All 74 AWS & Cloud quiz questions below come with a short explanation, visible right on the page — no sign-in needed. They're grouped by beginner and intermediate levels and 8 subtopics, so you can revise one part at a time. Choose Try AWS & Cloud quiz above to take a scored run and review the questions you got wrong.
What is the difference between a Region and an Availability Zone?
A.Regions are for storage services and AZs for compute
B.An AZ is a geographic area containing several Regions
C.They are two names for the same concept
D.A Region is a geographic area containing several isolated AZs
Answer: D
A Region is a geographic area (e.g. Singapore, Tokyo). Inside each Region there are multiple Availability Zones — each AZ is one or more data centers isolated for power, cooling, and networking, connected to each other by low-latency links.
Under the shared responsibility model, what is the customer responsible for?
A.The physical security of the data centre
B.Maintaining the server hardware and network equipment
C.Nothing — the provider handles all security
D.Security of what runs in the cloud
Answer: D
The provider handles security OF the cloud (physical infrastructure, hardware, virtualization). The customer handles security IN the cloud: IAM permissions, bucket and security group configuration, data encryption, patching the OS on VMs, and managing access keys.
It is object storage: each file is an object with a key, content, and metadata, accessed via HTTP API rather than mounted as a drive. Suited for images, video, backups, static files, and raw data.
It runs event-driven, scales automatically, and bills by number of invocations plus execution time — no events means no compute cost. In exchange there is a per-invocation time limit (max 15 minutes) and cold starts.
D.It applies to the whole VPC rather than per resource
Answer: B
It is stateful — allowing an inbound connection automatically allows the response outbound, with no separate rule needed. It only has allow rules, no deny rules. It attaches at the resource level (EC2, RDS, load balancer), not the subnet level.
An app on EC2 needs to read from S3. What is the correct way to grant access?
A.Write the access keys into a configuration file in the source
B.Make the bucket publicly accessible
C.Attach an IAM role to the EC2 instance
D.Put the access key and secret key in environment variables
Answer: C
Attach an IAM role to the EC2 instance. The application gets temporary credentials through the instance metadata, they rotate automatically, and no long-term keys sit in code or environment variables.
It is a content delivery network (CDN): it caches copies of content at edge locations near users, reducing latency and load on the origin infrastructure. Commonly placed in front of S3 or a load balancer.
A.Backing the data up periodically to another region
B.Failing over when the primary AZ has an incident
C.Increasing read capacity by spreading the queries
D.Reducing cost by splitting the database up
Answer: B
For high availability: a synchronous standby in another AZ that takes over automatically when the primary fails. With Multi-AZ DB instance, the main goal is failover, not read scaling — for read scaling use a read replica or a Multi-AZ DB cluster (if the engine supports it, with reader instances serving reads).
Which EC2 purchasing option is cheapest but can be reclaimed mid-run?
A.A Reserved Instance
B.On-Demand
C.A Spot Instance
D.A Dedicated Host
Answer: C
Spot Instance — it uses AWS spare capacity so it is far cheaper than On-Demand, but it can be reclaimed when AWS needs it back (with a few minutes' notice). Suited to interruption-tolerant work: batch processing, rendering, model training, test environments.
A.It uses public IP ranges rather than private ones
B.It was named public when the subnet was created
C.It lets any security group open outbound ports
D.It has a route to an internet gateway
Answer: D
The only difference is the route table: a public subnet has a route to an internet gateway, a private subnet does not. Resources in a private subnet that need outbound internet access must go through a NAT gateway placed in a public subnet.
How does an Elastic IP differ from an EC2 default public IP?
A.An Elastic IP stays the same across instance restarts
B.An Elastic IP gives more bandwidth than the default address
C.An Elastic IP can only be used in a private subnet
D.Elastic IPs are free and unlimited in number
Answer: A
An Elastic IP is a public address owned by the account, attachable and detachable between resources, and preserved across restarts. A default public IP is reassigned each time an instance stops and starts again.
Use EFS when you need a shared file system across multiple instances. EBS is a block device attached to one instance, suited to databases and operating systems. S3 is an object store for files written whole and read back.
A.Security groups are stateful while network ACLs are not
B.Security groups apply to subnets and network ACLs to instances
C.Security groups support deny rules while network ACLs do not
D.Security groups only filter traffic leaving the network
Answer: A
A security group is attached to an instance, is stateful (return traffic is allowed automatically), and only has allow rules. A network ACL is attached to a subnet, is stateless (both directions must be declared), and has both allow and deny rules.
A.It resolves domain names to IP addresses inside the VPC
B.It encrypts traffic between subnets within the VPC
C.It lets the internet connect into the private subnet
D.It lets a private subnet reach out to the internet
Answer: D
A NAT gateway lets resources in a private subnet initiate outbound connections to the Internet — to pull patches, call external APIs — while still not accepting inbound connections from the Internet. This is how you keep a server hidden yet still updatable.
How does a Route 53 alias record differ from a CNAME?
A.An alias only works for first-level subdomains
B.An alias works at the domain apex while a CNAME does not
C.An alias resolves faster thanks to its own cache
D.A CNAME can point at an IP address while an alias cannot
Answer: B
An alias record works at the zone apex (e.g. example.com) — which a CNAME cannot do per DNS standards — and incurs no query charge when pointing to AWS resources. CNAME is only for subdomains.
What is notable about TLS certificates issued through ACM?
A.The private key can be exported and installed on any server
B.It only works for domains registered through Route 53
C.Free and auto-renewing with AWS services
D.It never expires so it needs no monitoring
Answer: C
ACM public certificates are free and auto-renew when attached to supported services (ALB, CloudFront, API Gateway). In exchange, the private key cannot be exported, so they are not usable for self-managed servers.
A.So the resources run faster from being prioritized
B.So AWS backs up the important resources automatically
C.To allocate costs and know who owns each resource
D.To qualify for a discount under an AWS incentive programme
Answer: C
Tags enable cost allocation by team, environment, and service; identify ownership when cleanup is needed; and select resources by condition for automation and IAM policies. Without tags, the bill is just a list of services.
A.They increase automatically with the account's spending
B.They are hard technical limits that cannot be changed
C.They are per account and per region, and can be raised
D.They apply across an entire multi-account organization
Answer: C
Quotas are counted per account and per region, and most can be raised via a request but take time to process. This is why you should review quotas before peak events or before expanding to a new region, rather than discovering them mid-deployment.
What data does Compute Optimizer base its recommendations on?
A.The configuration declared in your infrastructure code
B.Comparison against other customers in the same industry
C.The resources' actual measured usage
D.The current prices of the instance types
Answer: C
It analyzes actual usage metrics (CPU, network, disk, and memory if an agent is present) over a sufficiently long period, then recommends a more suitable resource type. Applies to EC2, Auto Scaling Group, EBS volumes, and Lambda functions.
Why should the root account not be used for daily work?
A.It can only be used from one fixed IP address
B.It cannot perform administrative operations
C.It has full access and cannot be restricted by any policy
D.It is billed at a higher rate than ordinary IAM accounts
Answer: C
The root account has unrestricted full permissions — neither Service Control Policies nor permissions boundaries apply to it. So use it only for a few required tasks, enable MFA, delete all of its access keys, and create separate IAM users for daily work.
When should you choose a Network Load Balancer over an Application Load Balancer?
A.When you need to terminate HTTPS at the load balancer
B.When you need layer 4 or a static IP address
C.When you need to authenticate users at the load balancer
D.When you need routing by URL path
Answer: B
Choose NLB when working at layer 4 (TCP/UDP), needing very low latency, a static IP address, or a non-HTTP protocol. Choose ALB for web apps needing path-based or host-based routing, or using WebSocket and gRPC.
A.SQS works within one AZ while SNS is multi-region
B.SQS is for large data and SNS for small
C.SQS is a pull queue while SNS is a fan-out
D.SQS pushes messages while SNS has consumers pull them
Answer: C
SQS is a queue: messages wait, consumers pull them for processing and then delete them — typically one consumer handles each message. SNS is publish/subscribe: one message is pushed to every subscriber at once (multiple queues, functions, emails, HTTP endpoints).
What must a DynamoDB partition key design avoid most?
A.A key of string type rather than numeric
B.A key whose value has too many characters
C.A key with the same name as another attribute in the table
D.A key that concentrates traffic into one partition
Answer: D
Avoid hot partitioning: a key with few values or a heavily skewed distribution (e.g. using the current date, or order status) will funnel most reads and writes into one partition and throttle throughput even though the table has capacity to spare.
Logs must be kept five years and are almost never accessed. Which S3 storage class fits?
A.S3 One Zone-IA for a lower price
B.S3 Standard for frequent access
C.S3 Standard-IA for infrequent access
D.S3 Glacier Deep Archive
Answer: D
Use an archive class (Glacier Flexible Retrieval or Deep Archive, depending on how long you can wait for retrievals). The standard practice is to set a lifecycle policy that transitions objects to colder classes by age, rather than choosing manually per file.
Which line item most often surprises on the AWS bill of a small web system?
A.The cost of creating and deleting security groups
B.Data transfer out to the internet and through NAT
C.The cost of calling the management APIs
D.S3 storage cost for static files
Answer: B
Data transfer: data out to the internet, data through the NAT gateway, and inter-AZ traffic. These are billed per gigabyte, so they grow quietly with traffic while the design phase only looked at server prices.
How does Fargate differ from the ECS EC2 launch type?
A.It runs more containers per machine
B.You do not have to manage the underlying servers
C.It only supports Linux containers, not Windows
D.It is always cheaper than EC2 at any load
Answer: B
With Fargate, you don't manage the underlying servers — you just declare CPU and memory per task. With the EC2 launch type, you manage the cluster fleet yourself: patching, scaling, container density optimization, and you carry the spare capacity cost.
What is the most common cause of S3 data exposure incidents?
A.The data not being encrypted at rest
B.A security hole in the S3 service itself
C.The bucket being in an unsuitable geographic region
D.A configuration allowing public access
Answer: D
Publicly accessible configuration — an overly broad bucket policy, open ACLs, or presigned URLs with too long an expiry. This is a customer-side misconfiguration, exactly the part of the shared responsibility model the customer owns.
What is the most sensible scaling policy signal for a web API auto scaling group?
A.A fixed schedule following office hours each day
B.The number of open connections to the database
C.A metric reflecting the application's real load
D.The free disk space on each machine
Answer: C
Base it on a metric that reflects real load: requests per target or average CPU, typically with a target tracking policy. You can combine this with scheduled scaling for known load spikes like a sale start time.
What is the difference between CloudWatch and CloudTrail?
A.CloudWatch is for EC2 and CloudTrail for Lambda
B.CloudWatch logs API calls while CloudTrail measures performance
C.The two overlap in function and differ only in interface
D.CloudWatch measures operations while CloudTrail logs API calls
Answer: D
CloudWatch answers "how is the system running" — metrics, application logs, alarms. CloudTrail answers "who did what" — it logs every API call made in the account, used for auditing and security incident investigation.
How many pillars does the AWS Well-Architected Framework have?
A.Ten pillars
B.Six pillars
C.Three pillars
D.Four pillars
Answer: B
Six: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability (the sustainability pillar was added later, in 2021).
To send users to a standby region when the primary fails, which Route 53 routing policy fits?
A.Failover with health checks
B.Latency-based routing to the lowest latency
C.Geolocation by the user's country
D.Weighted with a 50-50 split
Answer: A
Use failover routing with a health check: Route 53 checks the health of the primary endpoint and returns the standby record when it fails. The other policies (weighted, latency, geolocation, multivalue) serve different purposes.
What problem does ElastiCache usually solve in an architecture?
A.Converting data formats between services
B.Reducing read load and latency for frequently accessed data
C.Long-term storage in place of the main database
D.Backing up data automatically on a schedule
Answer: B
Reduce latency and read load for frequently accessed data: heavy query results, login sessions, leaderboards, rate limiting. A cache is not a source of truth — the data in it can be lost at any time.
What is the safest way to store a database connection string for a cloud app?
A.An environment variable set when the container starts
B.A managed secrets service with encryption and rotation
C.A parameter passed on the startup command line
D.An encrypted configuration file inside the repository
Answer: B
Use a secrets management service (Secrets Manager or Parameter Store as SecureString): the secret is encrypted, read access is controlled by IAM, access is logged, and it can be rotated without redeploying the application.
What do RTO and RPO mean in a disaster recovery plan?
A.Both measure time, differing only in system level
B.RTO is the maximum outage duration while RPO is the maximum data loss
C.RTO is for hardware and RPO for software
D.RTO is the data loss and RPO is the recovery time
Answer: B
RTO (Recovery Time Objective): how long the system is allowed to be down. RPO (Recovery Point Objective): how much data you are allowed to lose, measured as the time since the most recent backup.
What is the main advantage of blue/green deployment over a rolling update?
A.Near-instant rollback by switching the routing
B.No testing is needed before switching traffic
C.It uses fewer resources during the deployment
D.It fixes problems automatically after release
Answer: A
Near-instant rollback: the old environment is still running intact, so you just point traffic back. In exchange, you have to run two environments in parallel during the switch, which costs more resources than a rolling update.
Infrastructure is defined as code but someone edits it by hand in the console. What is that called?
A.Drift — the real state diverges from the declared code
B.Rollback — the system returns to its previous state itself
C.Blue/green — two infrastructure versions existing in parallel
D.Idempotency — repeated runs give the same result
Answer: A
Drift: the real state of the infrastructure diverges from the declared code. The next IaC run may overwrite the manual change, or fail because the state isn't what it expects — and both tend to happen while you're dealing with an incident.
What is the main capability EventBridge has that SNS does not?
A.Guaranteeing absolute ordering of every event
B.Filtering and routing by the event's content
C.Storing events permanently for later replay
D.Sending messages to an email address
Answer: B
Content-based routing: EventBridge has rules that match on the event structure, so one bus can send the right event types to the right targets. SNS fans out to every subscriber of a topic (it can filter on attributes, but that's far simpler).
Which measure protects S3 data from accidental deletion or overwrite?
A.Enabling bucket access logging
B.Enabling encryption at rest
C.Moving the bucket to a colder storage class
D.Enabling versioning on the bucket
Answer: D
Enable versioning: every overwrite or delete keeps the previous version so it can be restored. Combine it with a lifecycle policy to clean up old versions by age, avoiding storage costs growing without bound.
A Lambda connecting directly to RDS exhausts connections under load. Why?
A.Each function instance opens its own connection so the count explodes
B.Lambda does not support the relational database protocol
C.RDS does not allow connections from a serverless environment
D.The network latency between Lambda and RDS is too high
Answer: A
Because Lambda scales out very fast: each function instance holds its own connection, so a thousand concurrent invocations create up to a thousand connections — exceeding the database limit. The standard fix is to put a connection pooler (RDS Proxy) in between.
An app in account A must read an S3 bucket in account B. What is the standard approach?
A.Create an IAM user in account B and send the keys to account A
B.Make the bucket public and filter by IP
C.Create a role in account B for account A to assume
D.Copy all the data into a bucket in account A
Answer: C
Create a role in account B with narrow permissions on that bucket, allowing a principal from account A to assume the role. The application calls AssumeRole to get temporary credentials — no long-term keys are shared between the two accounts.
When should Lambda be chosen over running containers on ECS or EKS?
A.Long-lived connections must be held open with clients
B.High, steady load throughout the day
C.Uneven load, short processing time and no state to keep
D.The application starts slowly and keeps state in memory
Answer: C
Lambda fits when the load is uneven, processing time is short, and no state needs to be kept: event handling, webhooks, scheduled tasks, post-upload file processing. With high, steady load, always-on containers are usually cheaper and give more control.
How do RDS Multi-AZ and read replicas differ in purpose?
A.Multi-AZ spreads read load while read replicas are for backups
B.Both spread read load and differ only in configuration
C.A read replica takes over as primary automatically on failure
D.Multi-AZ is for fault tolerance, read replicas for spreading read load
Answer: D
Multi-AZ keeps a synchronous standby in another zone, doesn't serve queries, and fails over automatically when the primary dies — it's the answer for availability. A read replica replicates asynchronously and can serve read queries — it's the answer for read scaling.
Which AWS cost is most often missed in initial estimates?
A.The storage cost of the EBS volumes
B.The cost of manually created snapshots
C.Data transfer out and across availability zones
D.The hourly cost of the EC2 instances
Answer: C
Data transfer charges: out to the Internet, between availability zones, and between regions. They don't show up when you estimate from server configuration but grow with real traffic, and in an architecture where many services call across zones they make up a significant part of the bill.
When should Kinesis Data Streams be chosen over SQS?
A.When each message must be processed exactly once
B.When several consumers must read the same stream, including re-reads
C.When you need more throughput than a queue can handle
D.When you need the lowest possible latency per message
Answer: B
Choose Kinesis when you need to retain the stream and let multiple independent consumers read from their own positions, with ordering guaranteed within each shard. SQS fits better when each message only needs one processor and then disappears.
What is the most relevant difference between API Gateway HTTP APIs and REST APIs?
A.HTTP APIs only support the GET and POST methods
B.HTTP APIs are cheaper and faster with fewer features
C.REST APIs cannot integrate with Lambda
D.HTTP APIs do not support caller authentication
Answer: B
HTTP APIs are significantly cheaper and lower latency, and support JWT and IAM. REST APIs add request validation, API keys with usage plans, WAF, and complex request transformations. If you don't need those features, HTTP API is the sensible default.
When an IAM policy has both Allow and Deny for the same action, what wins?
A.The policy attached directly to the user wins
B.The policy with the narrower resource scope wins
C.Deny always beats any granted permission
D.A policy created later overrides one created earlier
Answer: C
An explicit deny always wins. Evaluation order: the default is deny; a matching Allow grants access; but any matching Deny overrides everything. That's what lets you put deny rules at the organization level that nobody below can override.
What principle makes DynamoDB table design different from relational design?
A.Design around the access patterns rather than around normalization
B.Each entity must live in its own separate table
C.Normalize the data more thoroughly than in a relational database
D.The primary key must be a value that increases over time
Answer: A
DynamoDB is designed around query patterns: list the questions the application will ask first, then choose the partition key and sort key so each question can be answered with a single read. There are no joins, so related data is usually grouped in the same partition.
What is the key difference between gp3 and gp2 EBS volumes?
A.gp3 does not support periodic snapshots
B.gp3 uses mechanical disks so it is much cheaper
C.gp3 lets you set IOPS independently of capacity
D.gp3 can only be attached to the newest instance generation
Answer: C
With gp2, IOPS scale with capacity, so to go faster you must buy a larger disk. gp3 decouples the two: set capacity for storage needs and set IOPS and throughput independently, usually cheaper at the same performance level.
Beyond caching, what does putting CloudFront in front of an application provide?
A.TLS termination near the user and lower transfer costs
B.It fully removes the need for a load balancer
C.Automatic compression of the database behind it
D.It guarantees every user always sees the freshest data
Answer: A
Beyond caching, CloudFront terminates TLS close to the user (reducing handshake latency), reduces data transfer costs compared to serving directly from the origin, and provides a point to attach WAF plus protection against network-layer denial-of-service attacks.
How should very high-volume CloudWatch Logs be handled to control cost?
A.Raise the log verbosity so causes are easier to find
B.Turn logging off in production to reduce cost
C.Move all the logs onto each instance's own disk
D.Set a retention period, filter out noise and export to S3
Answer: D
Three directions at once: set retention per log group (the default is to keep forever); reduce ingest volume by adjusting log levels and dropping meaningless repeated lines; and move old logs to S3 with cheaper storage classes for compliance needs.
On AWS Kubernetes, what problem does IRSA (IAM roles for service accounts) solve?
A.Granting AWS permissions per pod rather than per node
B.Encrypting traffic between the pods in the cluster
C.Synchronizing user accounts between the cluster and IAM
D.Scaling the pod count automatically with the application's load
Answer: A
IRSA attaches an IAM role to a Kubernetes service account, so each pod receives only the permissions it needs. Without it, all pods on a node share the node's IAM role — violating least privilege and letting one compromised pod affect everything.
C.Periodically backing up the table's entire contents
D.Validating data before it is written
Answer: A
Streams emit every change to the table in order within each key partition, with before and after images. Used to trigger Lambda to update search indexes, sync to an analytics store, send notifications, or maintain aggregate tables.
How should container images in ECR be configured to reduce risk?
A.Use a single tag and overwrite it on every build
B.Store secrets in the image so the application always starts
C.Make the repository public so deployment is easier
D.Enable vulnerability scanning and use immutable tags
Answer: D
Enable vulnerability scanning on push, set tags to immutable so each tag points to fixed content, and use lifecycle policies to clean up old images. Never put secrets into an image.
Why does VPC peering become unmanageable as VPC count grows?
A.Peering only works within one region
B.Peering requires the VPCs to share an address range
C.Peering reduces the bandwidth between VPCs
D.The connection count grows fast and traffic does not transit
Answer: D
VPC peering is not transitive: A connected to B and B connected to C does not make A see C. Therefore connecting every required pair needs connections growing quadratically, along with the route tables to maintain. Transit Gateway solves this with a hub-and-spoke model.
What roles distinguish a Cognito user pool from an identity pool?
A.A user pool manages sign-in, an identity pool grants AWS permissions
B.They are equivalent concepts named differently by version
C.A user pool is for web apps and an identity pool for mobile apps
D.A user pool stores user data and an identity pool stores login sessions
Answer: A
A user pool is the user directory and authentication system: sign-up, sign-in, MFA, federation with external providers; the result is tokens. An identity pool exchanges those tokens for temporary AWS credentials so clients can call services directly.
What should replace cron on EC2 for scheduled tasks on AWS?
A.Cron on several instances so one is always available to run
B.Scheduled tasks should be triggered manually when needed
C.EventBridge Scheduler triggering Lambda or ECS
D.A loop inside the application checking the time and running it
Answer: C
Use EventBridge Scheduler: the schedule lives in the infrastructure tier, triggering Lambda, ECS tasks, or Step Functions. It does not depend on a specific server, does not run duplicates across multiple instances, and includes retry with a dead-letter target for failed runs.
B.Automatically transitioning storage class or deleting objects by age
C.Copying objects to a bucket in another region
D.Scanning uploaded user files for viruses
Answer: B
Lifecycle policies automatically move objects to cheaper storage classes by age, and delete them when retention expires. This is the most effective way to reduce storage costs without changing application code.
A Lambda has high cold start latency. What reduces it most effectively?
A.Move all the logic into one single function
B.Invoke the function periodically to keep it warm
C.Reduce the package size and the unnecessary initialization work
D.Increase the function's maximum timeout
Answer: C
Reduce deployment package size and initialization work: load only libraries actually used, initialize connections lazily, and avoid reading configuration from external services during init. When that is still not enough, use provisioned concurrency for latency-sensitive paths.
How should CloudFront serve private content from S3?
A.Make the bucket public but use hard-to-guess object names
B.Allow access based on the users' address ranges
C.Set a password on each object in the bucket
D.Origin Access Control, with the bucket closed to the internet
Answer: D
Use Origin Access Control: the bucket blocks all public access and only allows the CloudFront distribution to read. To restrict access per user, add signed URLs or signed cookies with a short expiry.
A.Performance figures for the instances in the VPC
B.The full contents of the packets crossing the network
C.A log of API calls to AWS services
D.Flow metadata, without the packets' contents
Answer: D
Flow Logs record metadata for each flow: source and destination addresses, ports, protocol, packet and byte counts, and whether the traffic was accepted or rejected. There is no packet content, so it is a tool for investigating traffic paths, not for reading data.
How does ElastiCache differ with cluster mode enabled versus disabled?
A.Enabled means several shards, disabled means one
B.Enabled persists the data durably to disk
C.Disabled cannot be used by an application with many instances
D.Enabled gives replicas while disabled has none
Answer: A
Disabled: a single shard with read replicas, simplest and supports all commands. Enabled: data is split across multiple shards, exceeding the memory and throughput limits of a single node, but multi-key commands are constrained to the same slot.
A.It moves the data into a relational database before querying
B.It loads the data into its own warehouse and queries it there
C.It copies the data into a compute cluster's memory
D.It reads the files in S3 directly against a declared schema
Answer: D
Athena runs SQL queries directly on files in S3 using a schema declared in the catalog. No data loading, no cluster to maintain, and you pay by amount of data scanned. Well suited to occasional analysis on data already in S3.
What does PrivateLink allow that VPC peering does not?
A.Joining two VPCs whose address ranges overlap completely
B.Exposing one service without joining the two networks
C.Allowing internet access into an internal service
D.Raising the bandwidth between two VPCs
Answer: B
PrivateLink exposes a specific service through an endpoint in the consumer's VPC instead of connecting two networks. Neither side sees the other's network, overlapping IP ranges are not a problem, and traffic does not go out to the Internet.
B.Load requiring absolutely stable latency at all times
C.Sharply fluctuating, hard-to-predict load
D.High, steady load all day long
Answer: C
Suitable when load fluctuates sharply or is hard to predict: development environments, applications with hourly peaks, or new systems with unknown scale. For high, steady load, fixed instances with long-term commitments are usually significantly cheaper.
What is needed for SES transactional email to avoid the spam folder?
A.Send the whole batch at once to reduce the connection count
B.Configure SPF, DKIM and DMARC, and watch the sender reputation
C.Send from many different addresses to spread the traffic
D.Gradually increase the message size so providers recognize it
Answer: B
Configure SPF, DKIM, and DMARC for the sending domain; use a separate subdomain for transactional email; monitor bounce and spam complaint rates; and handle undeliverable addresses promptly. Sender reputation is built gradually, not given upfront.
A.One source sending too many requests in a short period
B.Malicious content embedded in a request's parameters
C.Theft of users' login sessions
D.Very high volume attack traffic at the network layer
Answer: A
A rate-based rule counts requests from a single source IP address within a time window and blocks when the threshold is exceeded. Used to limit password brute-forcing, automated path scanning, and API abuse — it complements application-layer rate limiting rather than replacing it.
A.Blocking the creation of non-compliant resources
B.Optimizing resource configuration to reduce cost
C.Evaluating whether resources comply with the rules
D.Backing up configuration for recovery
Answer: C
A Config rule evaluates resources against policy and reports which resources are non-compliant — for example publicly open S3 buckets, unencrypted EBS volumes, or security groups opening management ports to the Internet. Automated remediation actions can be attached.
How should OS patching be handled across hundreds of EC2 instances?
A.Log into each machine and run the update by hand
B.Only patch when a critical vulnerability is announced
C.Replace the instances with a new, already-patched image
D.Enable automatic updates on each machine and let the OS handle it
Answer: C
The recommended approach is immutable infrastructure: build a new patched image, test it, then gradually replace instances. When in-place patching is unavoidable, use Patch Manager with maintenance windows and patch groups by environment.
Connecting on-premises to AWS: when is Direct Connect needed over VPN?
A.When you need high bandwidth and stable latency
B.When you only need a temporary connection for a few weeks
C.When there are fewer than ten servers on site
D.When you need the traffic between the two sides encrypted
Answer: A
Direct Connect when you need large bandwidth, consistent latency, and frequent high-volume egress traffic — it also has lower data transfer pricing. VPN when you need fast setup, low cost, or only a backup path.
What must an ECS service with a load balancer target group configure for zero-downtime deployment?
A.Double the task count during the deployment
B.Set the load balancer's timeout to its minimum
C.Stop all the old tasks before starting the new ones
D.Correct health checks and a long enough shutdown grace period
Answer: D
Two things are decisive: a health check that reflects the application's actual readiness (not just an open port), and a deregistration delay long enough for old tasks to finish in-flight requests after being removed from the target group.
What purpose does S3 replication between buckets serve?
A.Compressing the data before storing it in the destination bucket
B.Creating a backup that can be restored to any point in time
C.Automatically moving old objects to a cheaper storage class
D.Copying to another bucket for redundancy or lower latency
Answer: D
Replication copies objects to another bucket — same region or cross-region — serving disaster recovery, latency reduction for distant users, or permission separation by keeping a copy in another account.
How do Savings Plans differ from Reserved Instances?
A.Reserved Instances apply to every AWS service
B.Savings Plans require no term commitment
C.Savings Plans commit to spend and are more flexible
D.Savings Plans discount more deeply in every case
Answer: C
Savings Plans commit to an hourly spend level and apply flexibly across EC2, Fargate, and Lambda; changing instance type or region still gets the discount. Reserved Instance is tied to a more specific configuration but can be resold on the secondary market.
An application processes large user-uploaded files. What flow is most sensible?
A.The client sends the file to the application server which pushes it to S3
B.The client uploads straight to S3 and an event triggers the processing
C.The client splits the file and sends the parts into the database
D.The client sends the file in a request to an API that processes it immediately
Answer: B
The client uploads directly to S3 using a presigned URL, S3 emits an event, and a function or worker processes it asynchronously then updates status. The application server only issues the URL and receives the result, rather than relaying the data.
How should AWS development environments be managed to avoid waste?
A.Run the development environment in the cheapest region
B.Share one environment across the whole development team
C.Use the smallest possible configuration for every resource
D.Shut them down outside working hours and rebuild from infrastructure code
Answer: D
The two most important things: automatically shut down outside working hours (saving about two-thirds of the week), and fully rebuildable from infrastructure code so unused environments can be deleted entirely instead of left running.
