A financial services firm must transfer large volumes of market data between its data center and AWS every trading day. The firm requires consistent, predictable network throughput and wants the traffic to avoid the public internet. Which connectivity option should be used?
Intermediate · Choose one
Explanation
Answer: A. AWS Direct Connect establishes a dedicated, private physical network connection between the customer's premises and AWS. Because the traffic does not traverse the public internet, it delivers more consistent network performance and reduced, predictable bandwidth costs, which is exactly what a daily large-volume, latency-sensitive transfer needs.
B. An internet gateway simply allows VPC resources to send and receive traffic over the public internet. It provides no dedicated bandwidth or private path.
C. Route 53 Resolver handles DNS resolution between on-premises networks and VPCs. It does not carry application data traffic.
D. A Site-to-Site VPN creates an encrypted tunnel over the public internet. It is quick and inexpensive to set up, but throughput and latency depend on internet conditions and are therefore not consistent.
12
A small business needs to connect its office network to a VPC within a few hours, with encrypted traffic, and with minimal upfront cost. Occasional variability in throughput is acceptable. Which option should the business choose?
Intermediate · Choose one
Explanation
Answer: A. AWS Site-to-Site VPN creates an IPsec encrypted tunnel between the customer gateway and the VPC over the existing internet connection. It can be provisioned in minutes to hours, has no dedicated circuit to order, and has a low hourly cost, which matches the requirement for speed, encryption, and low upfront investment.
B. Amazon CloudFront is a content delivery network for distributing content to end users. It does not connect a corporate office network to a VPC.
C. Direct Connect requires ordering a physical cross-connect at a Direct Connect location, which typically takes weeks to months and carries port and installation costs. That contradicts the few-hours requirement.
D. AWS Global Accelerator improves availability and performance for internet-facing applications using the AWS global network. It is not a site-to-site corporate connectivity solution.
13
An operations team must apply a security patch to a fleet that includes both Amazon EC2 instances and physical servers still running in the company data center. They want a single console and a single automation workflow for both. Which AWS service should they use?
Intermediate · Choose one
Explanation
Answer: A. AWS Systems Manager provides operational management across hybrid environments. With the SSM Agent installed, on-premises servers and virtual machines can be registered as managed nodes alongside EC2 instances, and capabilities such as Patch Manager and Run Command then apply uniformly to both.
B. AWS Config tracks resource configuration changes and compliance. It is a recording and evaluation service, not a patch deployment tool.
C. Amazon Inspector continually scans workloads for software vulnerabilities and unintended network exposure. It reports findings but does not perform the patching workflow.
D. AWS CloudFormation provisions AWS resources from templates. It does not patch operating systems, and it does not manage on-premises servers.
14
Which TWO statements describe genuine advantages of using infrastructure as code instead of manually creating resources in the AWS Management Console? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: A and D. Infrastructure as code turns environment definitions into machine-readable files. Because the same template produces the same resources every time, environments stay consistent and configuration drift is reduced. And because the definition is a text file, it can live in a Git repository where changes are reviewed, versioned, and reverted using the same practices the team already uses for application code.
B. Infrastructure as code does not by itself guarantee zero downtime. Achieving that depends on the deployment strategy chosen, such as blue/green or rolling deployments.
C. IAM permissions are still required. The principal running the deployment must be authorized to create each resource, and the resources themselves still need appropriate roles and policies.
E. Resources provisioned by a template are billed exactly the same as resources created by hand. IaC changes how resources are created, not what they cost.
15
A large enterprise wants its application teams to be able to self-service deploy only from a curated set of pre-approved, pre-configured architectures that meet corporate security and compliance standards. Which AWS service is designed for this?
Hard · Choose one
Explanation
Answer: A. AWS Service Catalog lets a central team create and manage portfolios of approved IT products (typically backed by CloudFormation templates), grant specific users access to those portfolios, and let them launch products themselves. This gives teams self-service speed while the organization keeps governance over what can be deployed.
B. AWS Organizations centrally manages multiple AWS accounts, consolidated billing, and service control policies. It restricts what accounts may do, but it does not publish launchable product templates.
C. AWS Trusted Advisor provides best-practice recommendations against existing resources. It does not provision anything.
D. AWS Marketplace is a digital catalog for discovering and purchasing third-party software from independent vendors. It is not a mechanism for publishing an organization's own internally approved architectures.
16
A company is expanding from one AWS account to dozens. It wants a repeatable way to provision new accounts with a pre-configured baseline of identity, logging, and preventive and detective controls already in place. Which service most directly addresses this?
Hard · Choose one
Explanation
Answer: C. AWS Control Tower automates the set-up of a well-architected multi-account environment known as a landing zone. It provisions accounts through Account Factory and applies guardrails, which are pre-packaged preventive and detective controls, along with centralized logging and identity configuration, so every new account starts from a governed baseline.
A. IAM Identity Center provides centralized workforce single sign-on and permission sets across accounts. It handles identity only, not the full account baseline.
B. AWS Organizations provides the account structure, organizational units, consolidated billing, and service control policies, but the administrator must design and apply the whole baseline manually. Control Tower is built on top of Organizations and automates that work.
D. AWS CloudTrail records API activity for auditing. It is one component of a governed baseline, not the mechanism that provisions and governs accounts.
17
A development team is writing a Python application that must create and query AWS resources at run time. They need language-native objects, automatic request signing, and built-in retry handling. Which access method is most appropriate?
Hard · Choose one
Explanation
Answer: A. AWS SDKs are language-specific libraries that expose AWS service APIs as native objects and methods. They handle credential resolution, request signing, retries with exponential backoff, and response parsing, which makes them the intended way to call AWS from inside application code.
B. Invoking the CLI as a subprocess means parsing text output, depending on the CLI being installed on every host, and losing type safety and structured error handling. The CLI is designed for interactive and scripting use, not as an in-application API layer.
C. The AWS Management Console is a human-facing web interface. An application cannot use it programmatically.
D. AWS CloudFormation provisions resources from a declarative template. It is well suited to standing up infrastructure, but it is not a library the running application calls to create and query resources dynamically.
18
Which statement best describes an AWS Availability Zone?
Easy · Choose one
Explanation
Answer: B. An Availability Zone (AZ) consists of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities within a Region. AZs in a Region are physically separated by a meaningful distance yet connected by high-bandwidth, low-latency, fully redundant private networking.
A. That describes AWS Outposts, which brings AWS infrastructure into a customer facility.
C. That describes an edge location, which is part of the Amazon CloudFront and AWS global edge network, not an Availability Zone.
D. This reverses the relationship. A Region contains multiple Availability Zones, not the other way around.
19
Which component of the AWS global infrastructure does Amazon CloudFront use to cache copies of content close to end users?
Easy · Choose one
Explanation
Answer: D. Amazon CloudFront delivers content through a worldwide network of edge locations. When a user requests content, the request is routed to the edge location that provides the lowest latency, and cached content is served from there instead of from the origin.
A. Availability Zones host the origin infrastructure such as EC2 instances and databases. They are not the caching tier for CloudFront.
B. AWS Outposts extends AWS infrastructure into a customer's data center. It is not part of the CloudFront caching network.
C. Regions are the geographic groupings that contain Availability Zones. There are far fewer Regions than edge locations, so serving from a Region alone would not minimize latency for global users.
20
Which statement correctly describes an AWS Region?
Easy · Choose one
Explanation
Answer: B. An AWS Region is a separate geographic area, such as eu-west-1 or ap-southeast-1. Each Region contains multiple Availability Zones that are physically isolated from one another but interconnected with fast, private networking. Regions are isolated from each other, and AWS does not replicate data between Regions unless the customer configures it.
A. That describes edge locations used for content delivery and DNS.
C. A logical grouping of accounts under one payer is an AWS Organization, which is an account management construct, not a physical location.
D. A single facility is smaller than an Availability Zone, and an AZ is in turn only one part of a Region.