Which TWO statements describe genuine advantages of using infrastructure as code instead of manually creating resources in the AWS Management Console? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and D. Infrastructure as code turns environment definitions into machine-readable files. Because the same template produces the same resources every time, environments stay consistent and configuration drift is reduced. And because the definition is a text file, it can live in a Git repository where changes are reviewed, versioned, and reverted using the same practices the team already uses for application code.
B. Infrastructure as code does not by itself guarantee zero downtime. Achieving that depends on the deployment strategy chosen, such as blue/green or rolling deployments.
C. IAM permissions are still required. The principal running the deployment must be authorized to create each resource, and the resources themselves still need appropriate roles and policies.
E. Resources provisioned by a template are billed exactly the same as resources created by hand. IaC changes how resources are created, not what they cost.
62
A large enterprise wants its application teams to be able to self-service deploy only from a curated set of pre-approved, pre-configured architectures that meet corporate security and compliance standards. Which AWS service is designed for this?
Hard · Choose one
Explanation
Answer: A. AWS Service Catalog lets a central team create and manage portfolios of approved IT products (typically backed by CloudFormation templates), grant specific users access to those portfolios, and let them launch products themselves. This gives teams self-service speed while the organization keeps governance over what can be deployed.
B. AWS Organizations centrally manages multiple AWS accounts, consolidated billing, and service control policies. It restricts what accounts may do, but it does not publish launchable product templates.
C. AWS Trusted Advisor provides best-practice recommendations against existing resources. It does not provision anything.
D. AWS Marketplace is a digital catalog for discovering and purchasing third-party software from independent vendors. It is not a mechanism for publishing an organization's own internally approved architectures.
63
A company is expanding from one AWS account to dozens. It wants a repeatable way to provision new accounts with a pre-configured baseline of identity, logging, and preventive and detective controls already in place. Which service most directly addresses this?
Hard · Choose one
Explanation
Answer: C. AWS Control Tower automates the set-up of a well-architected multi-account environment known as a landing zone. It provisions accounts through Account Factory and applies guardrails, which are pre-packaged preventive and detective controls, along with centralized logging and identity configuration, so every new account starts from a governed baseline.
A. IAM Identity Center provides centralized workforce single sign-on and permission sets across accounts. It handles identity only, not the full account baseline.
B. AWS Organizations provides the account structure, organizational units, consolidated billing, and service control policies, but the administrator must design and apply the whole baseline manually. Control Tower is built on top of Organizations and automates that work.
D. AWS CloudTrail records API activity for auditing. It is one component of a governed baseline, not the mechanism that provisions and governs accounts.
64
A development team is writing a Python application that must create and query AWS resources at run time. They need language-native objects, automatic request signing, and built-in retry handling. Which access method is most appropriate?
Hard · Choose one
Explanation
Answer: A. AWS SDKs are language-specific libraries that expose AWS service APIs as native objects and methods. They handle credential resolution, request signing, retries with exponential backoff, and response parsing, which makes them the intended way to call AWS from inside application code.
B. Invoking the CLI as a subprocess means parsing text output, depending on the CLI being installed on every host, and losing type safety and structured error handling. The CLI is designed for interactive and scripting use, not as an in-application API layer.
C. The AWS Management Console is a human-facing web interface. An application cannot use it programmatically.
D. AWS CloudFormation provisions resources from a declarative template. It is well suited to standing up infrastructure, but it is not a library the running application calls to create and query resources dynamically.
65
A European company must guarantee that its customer records are never stored outside the European Union. Which action most directly enforces this requirement?
Hard · Choose one
Explanation
Answer: D. AWS Regions are isolated from one another, and customers choose the Region in which their data is stored. AWS does not replicate or move customer content out of the selected Region unless the customer explicitly configures a service to do so. Therefore, selecting EU Regions is the direct control for an EU data residency requirement.
A. Encryption protects data confidentiality. It has no effect on the geographic location where the data physically resides.
B. CloudFront caches content at edge locations worldwide, which could actually place copies of content outside the EU rather than restrict it.
C. Support plans provide technical guidance and faster response times. They do not change where data is stored, and no case is needed because Region selection is a customer setting.