A company needs to let another AWS account in the same AWS Organizations organization use a subnet in a VPC that the company owns, without recreating the network in the other account. Which service enables this?
Intermediate · Choose one
Explanation
Answer: C. AWS RAM lets a resource owner share supported resources with other accounts, organizational units, or an entire organization. VPC subnets are shareable only with accounts in the same organization, while resources such as AWS Transit Gateway and AWS License Manager configurations can also be shared with accounts outside it. Sharing avoids duplicating infrastructure while the owner keeps control of the resource.
A. AWS Certificate Manager issues and manages TLS certificates, which is unrelated to cross-account resource sharing.
B. AWS Directory Service provides managed Active Directory capabilities and has no role in sharing network resources.
D. Consolidated billing combines the charges of member accounts onto one invoice. It does not share technical resources between them.
12
Which statement about a VPC network ACL is correct?
Intermediate · Choose one
Explanation
Answer: D. Network ACLs are the subnet-level layer of VPC network security and behave very differently from security groups. Being stateless, they need matching rules in both directions, including the ephemeral port range for responses, and their numbered rules are evaluated lowest number first with the first match deciding the outcome.
A. Instance-level filtering is what a security group does. A network ACL is associated with subnets.
B. Allow-only rules evaluated as a whole describe a security group. The ability to write explicit deny rules is a key reason to use a network ACL, for example to block a specific address range.
C. Statefulness is the defining property of a security group, not of a network ACL.
13
A company wants to block requests originating from specific countries and to rate-limit requests to a public API so that a single client cannot overwhelm it. Which service provides these controls?
Intermediate · Choose one
Explanation
Answer: B. AWS WAF evaluates each HTTP or HTTPS request against the rules in a web ACL and can allow, block, count, or challenge it. Geographic match rules and rate-based rules are both native rule types, alongside managed rule groups that cover common exploits such as SQL injection and cross-site scripting.
A. A security group attaches to an elastic network interface and cannot be associated with an Amazon API Gateway API at all. Even where it does apply, it filters on IP address, protocol, and port and cannot count requests over time or evaluate the country a request came from.
C. Amazon GuardDuty is a detection service. It generates findings about suspicious activity and does not block or filter traffic.
D. AWS Shield Standard mitigates common network and transport layer DDoS attacks automatically, but it offers no configurable application-layer rules.
14
What does the DDoS cost protection feature of AWS Shield Advanced provide?
Intermediate · Choose one
Explanation
Answer: A. An attack drives up usage even when it is successfully mitigated, because the application scales out and transfers more data. DDoS cost protection requests service credits for those charges on protected resources such as Amazon EC2, Elastic Load Balancing, Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53, so a customer is not billed for absorbing an attack.
B. The subscription fee is not refunded. The protection concerns usage charges caused by the attack.
C. There is no charge cap. Shield Advanced does include AWS WAF usage on protected resources at no extra cost, which is a separate benefit from cost protection.
D. Access to the Shield Response Team is a Shield Advanced benefit but depends on the account's AWS Support plan, and it is not what cost protection means.
15
Which statement correctly contrasts Amazon GuardDuty with Amazon Inspector?
Intermediate · Choose one
Explanation
Answer: B. The two answer different questions. GuardDuty continuously analyzes activity such as CloudTrail management events, VPC Flow Logs, and DNS logs to find behavior that suggests compromise, while Inspector examines the software present in EC2 instances, container images, and Lambda functions to find known vulnerabilities before they are exploited.
A. GuardDuty performs no vulnerability scanning at all, and Inspector's coverage extends well beyond container images.
C. Aggregating findings from multiple security services into one view is the role of AWS Security Hub, not Inspector.
D. This reverses the two services. Vulnerability scanning is Inspector's function and log-based threat detection is GuardDuty's.
16
A manufacturing company keeps its ERP system in its own data center because of contractual data residency terms, while running its new customer-facing web application on AWS. The two environments are connected with AWS Direct Connect. Which cloud deployment model does this describe?
Intermediate · Choose one
Explanation
Answer: D. A hybrid deployment connects resources that run in an on-premises data center with resources that run in the AWS Cloud, so the two act as a single extended environment. Direct Connect or AWS Site-to-Site VPN is the usual connectivity layer. This is the standard pattern when some workloads must stay on-premises for latency, licensing, or data residency reasons.
A. An on-premises or private cloud deployment uses virtualization and resource management within the company's own data center only. This scenario clearly includes AWS.
B. Multi-cloud means using two or more public cloud providers. Only one public cloud provider, AWS, is described here.
C. An all-in cloud deployment means every part of the application is provisioned in the cloud. Here the ERP system deliberately remains in the company's data center.
17
A startup wants to deploy a Java web application to AWS. The team does not want to manually configure EC2 instances, load balancers, or Auto Scaling groups, but they do want the ability to inspect and adjust the underlying resources later if needed. Which service best fits?
Intermediate · Choose one
Explanation
Answer: C. AWS Elastic Beanstalk lets you upload application code and automatically handles capacity provisioning, load balancing, Auto Scaling, and application health monitoring. Crucially, it provisions standard AWS resources (EC2, ELB, Auto Scaling groups) in your account, so you retain full visibility and control over them if you need to tune the environment.
A. AWS Lambda is event-driven and function-based. Running a traditional Java web application on it would require re-architecting, and there are no underlying EC2 instances or load balancers for the team to inspect.
B. AWS CloudFormation would provision the resources, but the team would have to author the templates themselves. It does not remove the need to define the load balancer and Auto Scaling configuration.
D. Amazon Lightsail bundles compute, storage, and networking into simplified plans and intentionally abstracts the underlying resources, which conflicts with the requirement to inspect and adjust them.
18
A financial services firm must transfer large volumes of market data between its data center and AWS every trading day. The firm requires consistent, predictable network throughput and wants the traffic to avoid the public internet. Which connectivity option should be used?
Intermediate · Choose one
Explanation
Answer: A. AWS Direct Connect establishes a dedicated, private physical network connection between the customer's premises and AWS. Because the traffic does not traverse the public internet, it delivers more consistent network performance and reduced, predictable bandwidth costs, which is exactly what a daily large-volume, latency-sensitive transfer needs.
B. An internet gateway simply allows VPC resources to send and receive traffic over the public internet. It provides no dedicated bandwidth or private path.
C. Route 53 Resolver handles DNS resolution between on-premises networks and VPCs. It does not carry application data traffic.
D. A Site-to-Site VPN creates an encrypted tunnel over the public internet. It is quick and inexpensive to set up, but throughput and latency depend on internet conditions and are therefore not consistent.
19
A small business needs to connect its office network to a VPC within a few hours, with encrypted traffic, and with minimal upfront cost. Occasional variability in throughput is acceptable. Which option should the business choose?
Intermediate · Choose one
Explanation
Answer: A. AWS Site-to-Site VPN creates an IPsec encrypted tunnel between the customer gateway and the VPC over the existing internet connection. It can be provisioned in minutes to hours, has no dedicated circuit to order, and has a low hourly cost, which matches the requirement for speed, encryption, and low upfront investment.
B. Amazon CloudFront is a content delivery network for distributing content to end users. It does not connect a corporate office network to a VPC.
C. Direct Connect requires ordering a physical cross-connect at a Direct Connect location, which typically takes weeks to months and carries port and installation costs. That contradicts the few-hours requirement.
D. AWS Global Accelerator improves availability and performance for internet-facing applications using the AWS global network. It is not a site-to-site corporate connectivity solution.
20
An operations team must apply a security patch to a fleet that includes both Amazon EC2 instances and physical servers still running in the company data center. They want a single console and a single automation workflow for both. Which AWS service should they use?
Intermediate · Choose one
Explanation
Answer: A. AWS Systems Manager provides operational management across hybrid environments. With the SSM Agent installed, on-premises servers and virtual machines can be registered as managed nodes alongside EC2 instances, and capabilities such as Patch Manager and Run Command then apply uniformly to both.
B. AWS Config tracks resource configuration changes and compliance. It is a recording and evaluation service, not a patch deployment tool.
C. Amazon Inspector continually scans workloads for software vulnerabilities and unintended network exposure. It reports findings but does not perform the patching workflow.
D. AWS CloudFormation provisions AWS resources from templates. It does not patch operating systems, and it does not manage on-premises servers.