A research organization submits thousands of independent computational jobs that each run for several hours. It wants AWS to queue the jobs, dynamically provision the right amount and type of compute, and shut the compute down when the queue is empty. Which service is purpose-built for this?
Intermediate · Choose one
Explanation
Answer: C. AWS Batch is a fully managed batch computing service. It plans, schedules, and runs batch jobs, and it dynamically provisions the optimal quantity and type of compute resources (including EC2 and Fargate, with Spot support) based on the volume and requirements of the submitted jobs, then scales back down when work is finished.
A. Step Functions orchestrates the sequence and state of a workflow. It coordinates steps but does not itself provision batch compute capacity.
B. EC2 Auto Scaling scales an instance group against metrics. It has no concept of a job queue, job definitions, or job dependencies.
D. Lambda functions are capped at a 15-minute execution time, so jobs running for several hours cannot use it.
32
Which TWO outcomes does Amazon EC2 Auto Scaling directly help a company achieve? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: C and D. Amazon EC2 Auto Scaling performs health checks on the instances in a group and replaces any that become unhealthy, which improves fault tolerance and availability. It also scales in when demand drops, so the company stops paying for capacity it no longer needs, which supports cost optimization.
A. Capacity reservations and discounts come from On-Demand Capacity Reservations, Reserved Instances, or Savings Plans. Auto Scaling is a capacity management mechanism, not a pricing model.
B. EBS encryption is configured on the volume or as an account-level default setting. Auto Scaling does not enable it.
E. Patching the guest operating system remains the customer's responsibility under the shared responsibility model. AWS Systems Manager Patch Manager is the tool for that, not Auto Scaling.
33
An e-commerce application on Amazon RDS is slowing down because a nightly reporting job runs heavy SELECT queries against the production database. The company wants to move that read traffic off the primary instance. What should it implement?
Intermediate · Choose one
Explanation
Answer: A. Read replicas are asynchronous copies of the source database that serve read-only traffic. Directing the reporting workload to a replica removes that load from the primary instance, which continues serving transactional traffic. Read replicas are the standard mechanism for scaling reads in Amazon RDS.
B. In a Multi-AZ DB instance deployment the single standby exists purely for failover and does not serve read traffic, so it cannot run the reporting queries. (The separate Multi-AZ DB cluster deployment does provide two readable standbys, but that is not what this option describes.)
C. Migrating to DynamoDB would require a full re-architecture and would not naturally support the ad hoc analytical SQL that a reporting job uses.
D. Backup retention controls how far back point-in-time recovery can go. It has no effect on query performance.
34
Which AWS database service is MySQL-compatible and PostgreSQL-compatible, delivers significantly higher throughput than the standard community engines, and automatically maintains six copies of the data across three Availability Zones?
Intermediate · Choose one
Explanation
Answer: C. Amazon Aurora is a MySQL-compatible and PostgreSQL-compatible relational database built for the cloud. AWS states it delivers up to six times the throughput of stock MySQL and up to six times the throughput of stock PostgreSQL on similar hardware, and its distributed, fault-tolerant storage layer replicates each 10 GB chunk of the volume six ways across three Availability Zones, with continuous backup to Amazon S3.
A. RDS for MariaDB runs the community engine on a conventional storage volume. It does not use the Aurora distributed storage architecture or its six-way replication.
B. Amazon Redshift is a columnar data warehouse for analytics workloads, not a transactional relational engine.
D. Amazon DocumentDB is a document database with MongoDB compatibility. It is not MySQL or PostgreSQL compatible.
35
A web application repeatedly issues the same expensive database query, and the database instance is under pressure. The company wants to add a managed in-memory caching layer that is compatible with open source engines such as Valkey, Memcached, or Redis OSS. Which service should it use?
Intermediate · Choose one
Explanation
Answer: B. Amazon ElastiCache is a fully managed in-memory caching service. It provides Valkey-, Memcached-, and Redis OSS-compatible engines and is commonly placed in front of a database so that repeated read queries are served from memory in microseconds to milliseconds, which reduces load on the database and improves application response times.
A. A faster EBS volume improves disk throughput for the database, but it still means the query runs against the database engine each time rather than being cached.
C. CloudFront caches HTTP responses at edge locations for end users. It does not cache internal database query results.
D. Amazon S3 is durable object storage. It is not an in-memory cache and would not deliver sub-millisecond query results.
36
An application built on Amazon DynamoDB experiences a read-heavy workload and needs response times measured in microseconds rather than milliseconds. Which fully managed option should be added?
Intermediate · Choose one
Explanation
Answer: C. Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available in-memory cache purpose-built for DynamoDB. It sits in front of the table and delivers microsecond read latency for cached items, with an API-compatible client so application code changes are minimal.
A. Global Tables replicate a table across Regions for multi-Region access and resilience. Within a Region, read latency remains in the single-digit millisecond range.
B. An RDS read replica belongs to Amazon RDS and has no relationship to a DynamoDB table.
D. DynamoDB Streams captures an ordered record of item-level changes for downstream processing. It does not accelerate reads.
37
A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL and needs to both translate the database schema and stored procedures and move the data while the source database keeps serving users. Which TWO services should be used? (Choose TWO.)
Intermediate · Select 2 answers
Explanation
Answer: A and C. This is a heterogeneous migration because the source and target engines differ. The AWS Schema Conversion Tool converts the source schema, views, stored procedures, and functions to the target engine's format and reports the parts that need manual work. AWS DMS then migrates the data and supports ongoing replication, so the source database remains fully operational during the migration and cutover downtime is minimized.
B. AWS Glue DataBrew is a visual data preparation tool for cleaning and normalizing data for analytics. It is not a database migration tool.
D. AWS Application Discovery Service collects usage and configuration data from on-premises servers to help plan a migration. It informs planning; it neither converts a schema nor moves data.
E. Redshift Spectrum queries data in Amazon S3 from Amazon Redshift. It has no role in migrating an Oracle database.
38
Which statement accurately describes an Amazon VPC security group?
Intermediate · Choose one
Explanation
Answer: B. A security group acts as a virtual firewall attached to an elastic network interface, so it protects individual resources such as EC2 instances. It is stateful, which means that if inbound traffic is allowed, the corresponding response traffic is automatically permitted regardless of outbound rules. Security groups contain only allow rules; anything not explicitly allowed is implicitly denied.
A. Security groups are stateful, so return traffic is allowed automatically and no explicit return rule is needed.
C. Security groups do not operate at the subnet level, and all rules are evaluated together rather than in numbered order. Rule numbering is a network ACL characteristic.
D. That describes a network ACL, which is the stateless, subnet-level control that supports both allow and deny rules.
39
A security team must explicitly block traffic from a specific range of malicious IP addresses at the subnet boundary of a VPC. Which VPC feature should they use?
Intermediate · Choose one
Explanation
Answer: D. Network ACLs operate at the subnet level and are the only VPC firewall construct that supports explicit deny rules. Rules are numbered and evaluated in order from the lowest number, so a low-numbered deny rule for the malicious CIDR range blocks that traffic before any later allow rule is considered.
A. Route tables control where traffic is sent, not whether it is permitted. Using routes as a security control is unreliable and does not filter inbound traffic at the subnet boundary.
B. IAM policies authorize API calls to AWS services. They do not filter network packets flowing to EC2 instances.
C. Security groups support allow rules only. There is no way to express a deny rule in a security group.
40
Amazon EC2 instances in a private subnet must download operating system patches from the internet, but nothing on the internet should be able to initiate a connection to them. Which VPC component should be used?
Intermediate · Choose one
Explanation
Answer: C. A NAT gateway placed in a public subnet performs network address translation for instances in private subnets. It allows those instances to initiate outbound connections to the internet, for example to fetch patches, while preventing any unsolicited inbound connections from reaching them.
A. Internet gateways are attached to the VPC, not to a subnet, and routing a private subnet directly to one would make those instances reachable from the internet if they had public addresses, which violates the requirement.
B. A virtual private gateway terminates a Site-to-Site VPN connection to an on-premises network. It does not provide internet access.
D. Assigning Elastic IP addresses would make the instances publicly addressable and therefore reachable from the internet, which is exactly what must be prevented.