Free and Premium Amazon Web Services CLF-C02 Dumps Questions Answers

AWS Trusted Advisor is the service that can meet these requirements. AWS Trusted Advisor is a service that helps you optimize your AWS environment by providing recommendations based on AWS best practices. Trusted Advisor continuously evaluates your AWS resources and services across five categories: cost optimization, performance, service limits, fault tolerance, and security. You can view the recommendations on the Trusted Advisor console or access them programmatically using the Trusted Advisor API. You can also set up notifications and alerts for any changes in the status of your checks. Trusted Advisor can help you improve your AWS environment by reducing costs, enhancing performance, increasing security, and ensuring reliability12. The other services are not designed to provide best practice recommendations in five categories. AWS Shield is a service that protects your AWS resources from distributed denial-of-service (DDoS) attacks. AWS WAF is a service that helps you protect your web applications from common web exploits. AWS Service Catalog is a service that enables you to create and manage catalogs of IT services that are approved for use on AWS34 . References: AWS Trusted Advisor, Achieve operational excellence with AWS Trusted Advisor, AWS Shield, AWS WAF, [AWS Service Catalog]

Amazon CloudFrontis a content delivery network (CDN) that helps deliver your website content globally with low latency by caching copies of your website content at edge locations around the world. This helps ensure that users receive content from the edge location closest to them, thereby reducing latency and improving user experience.

A. Amazon Route 53: Incorrect, as it is a DNS web service that routes users to the appropriate endpoint, but it does not cache content or reduce latency.

C. Elastic Load Balancing: Incorrect, as it distributes incoming application or network traffic across multiple targets, but does not cache content globally.

D. AWS Lambda: Incorrect, as it is a serverless compute service, not intended for content delivery.

AWS Cloud References:

Amazon CloudFront

Understanding the Reliability Pillar: The Reliability pillar of the AWS Well-Architected Framework focuses on the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues.

Key Concepts of Reliability:

Foundations: Ensure a solid foundation on which to build, including AWS account management, limits, and networking.

Change Management: Manage changes in automation to ensure systems remain reliable during modifications.

Failure Management: Design systems to detect failures and automatically recover from them.

How to Align with Reliability Pillar:

Implement Multi-AZ Deployments: Deploy applications across multiple Availability Zones to ensure fault tolerance.

Use Auto Scaling: Automatically adjust resources to maintain system performance during demand fluctuations.

Monitor and Respond: Implement monitoring and alerting mechanisms using services like CloudWatch to detect and respond to issues proactively.

AWS Well-Architected Framework: Reliability Pillar

Understanding EC2 Image Builder: EC2 Image Builder is a fully managed service that simplifies the creation, maintenance, validation, and testing of Amazon Machine Images (AMIs).

Why Use EC2 Image Builder:

Automation: Automates the creation and management of AMIs, reducing manual efforts and the risk of errors.

Customization: Allows you to customize the images to include necessary software, configurations, and security settings.

Compliance: Ensures that the images comply with your security and operational standards through continuous monitoring and testing.

How to Implement EC2 Image Builder:

Create a Recipe: Define an image recipe specifying the base image and components to be included.

Build Pipeline: Set up an image pipeline that automates the building and testing of the AMI based on a schedule or trigger.

Distribute Images: Use the produced AMIs across multiple AWS regions and accounts as needed.

EC2 Image Builder

Amazon CloudFront and AWS Global Accelerator are two AWS services that make use of global edge locations. Edge locations are AWS sites that are deployed worldwide in major cities and places with a high population. Edge locations are used to cache data and reduce latency for end-user access1.

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. Amazon CloudFront uses a global network of over 200 edge locations and 13 regional edge caches to cache your content closer to your viewers, improving performance and reducing costs23.

AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint based on health, performance, and policies. AWS Global Accelerator uses over 100 edge locations to bring your application endpoints closer to your users, reducing networkhops and improving user experience45. References: 1: AWS for the Edge - Amazon Web Services (AWS), 2: Content Delivery Network (CDN) - Amazon CloudFront - AWS, 3: Amazon CloudFront Documentation, 4: AWS Global Accelerator - Amazon Web Services, 5: AWS Global Accelerator Documentation

Migration Evaluator is a cloud-based service that provides organizations with a comprehensive assessment of their current IT environment and estimates the cost savings and performance improvements that can be achieved by migrating to AWS. Migration Evaluator helps users build a data-driven business case for AWS by discovering over-provisioned on-premises instances,providing recommendations for cost-effective AWS alternatives, and analyzing existing licenses and cost comparisons of Bring Your Own License (BYOL) and License Included (LI) options

Amazon Simple Queue Service (Amazon SQS) is a fully managed message queuing service that lets you send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available1. Amazon SQS is designed to provide a simpleand reliable way for customers to decouple and connect components (microservices) together using queues2. Queues are an important mechanism for providing fault tolerance and scalability in distributed systems, and help decouple different parts of your application3. The other options are not AWS services that are used specifically for sending messages between applications

Understanding Amazon Snowball Edge: Amazon Snowball Edge is a data migration and edge computing device that helps in transferring large amounts of data to and from AWS.

No-Cost Activities:

Transfer into S3: AWS does not charge for transferring data from the Snowball Edge device into Amazon S3. This is part of the service to facilitate easy data migration into the AWS cloud.

Other Costs: The use of the Snowball Edge appliance for up to 10 days is included in the service fee. However, any usage beyond the 10-day period may incur additional costs.

How to Utilize Snowball Edge:

Order the Device: Use the AWS Management Console to order a Snowball Edge device.

Load Data: Transfer your data onto the Snowball Edge appliance.

Ship Back: Ship the device back to AWS, where the data will be uploaded to Amazon S3 at no additional cost.

Amazon Snowball Edge Pricing

Amazon Snowball Edge Documentation

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using AWS Direct Connect, you can establish private connectivity between AWS and your datacenter, office, or colocation environment, which in many cases can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections12. References: 1: Dedicated Network Connection - AWS Direct Connect - AWS, 2: What is AWS Direct Connect? - AWS Direct Connect

On-Demand Instances are the most flexible and cost-effective pricing model for short-term, experimental, or unpredictable workloads on AWS. On-Demand Instances let you pay only for the resources you use, without any long-term commitments or upfront fees. You can easily start and stop instances as needed, and scale up or down depending on your demand.

Savings Plans, Reserved Instances, and Dedicated Hosts are all pricing models that require a commitment for a certain amount of usage or capacity for a one- or three-year term. These pricing models offer lower prices than On-Demand Instances, but they are not suitable for workloads that only run for 3 to 6 months or have variable usage patterns. Savings Plans and Reserved Instances also offer flexibility to change instance types, sizes, or regions within the same family or pool, while Dedicated Hosts are physical servers that can only run specific instance types.

According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while customers are responsible for the security in the cloud. This means that AWS is responsible for the physical servers, networking, and operating system that run DynamoDB, while customers are responsible for the security of their data and access to the database. Customers need to manage database access permissions, such as creating and managing AWS Identity and Access Management (IAM) policies and roles, and using encryption and key management options to protect their data123. References: 1: Shared Responsibility Model - Amazon Web Services (AWS), 2: Security in Amazon DynamoDB - Amazon DynamoDB, 3: AWS Shared Responsibility Model - Introduction to DevOps …

Amazon Elastic Container Service (Amazon ECS) is a highly scalable, fast container management service that allows you to run, stop, and manage Docker containers on a cluster of Amazon EC2 instances or a serverless environment powered by AWS Fargate. It provides secure, reliable, and scalable operations for containers, allowing users to deploy containers in a highly secure and reliable manner. Amazon Aurora is a relational database service, Amazon Athena is an interactive query service, and Amazon Polly is a text-to-speech service. Therefore, the correct answer is Amazon ECS.

ASecurity Groupacts as a virtual firewall for your Amazon EC2 instances to control inbound and outbound traffic. It provides granular control over network connections to and from a specific EC2 instance or set of instances. Unlike Network ACLs, which operate at the subnet level, Security Groups operate at the instance level, allowing control over network traffic for individual instances.

A. Network ACL: Incorrect, as it controls traffic at the subnet level and not for individual instances.

B. AWS WAF: Incorrect, as AWS WAF is a web application firewall that helps protect web applications from common web exploits but is not designed for controlling instance-level traffic.

C. Route table: Incorrect, as route tables are used for network routing within a VPC and do not act as firewalls.

AWS Cloud References:

AWS Security Groups

On-Demand Instances are ideal for workloads that require flexibility, offering compute capacity with no upfront cost, allowing users to pay by the second for the instances they use. This makes it suitable for applications with short-term, spiky, or unpredictable workloads that cannot be interrupted. Reserved Instances require long-term commitments, Spot Instances can be interrupted, and Dedicated Instances are for specific hardware requirements, making On-Demand the correct choice for uninterruptible and flexible instance usage.

AWS Direct Connect is an AWS service that allows users to establish a dedicated network connection between their on-premises data center and the AWS Cloud. This connection bypasses the public internet and provides more predictable network performance, reduced bandwidth costs, and increased security. Users can choose from different port speeds and connection types, and use AWS Direct Connect to access AWS services in any AWS Region globally. Users can also use AWS Direct Connect in conjunction with AWS VPN to create a hybrid network architecture that combines the benefits of both private and public connectivity. References: AWS Direct Connect, [AWS Cloud Practitioner Essentials: Module 3 - Compute in the Cloud]

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. You can use VPC Flow Logs to diagnose network issues, monitor traffic patterns, detect security anomalies, and comply with auditing requirements34. References: Logging IP traffic using VPC Flow Logs - Amazon Virtual Private Cloud, New – VPC Traffic Mirroring – Capture & Inspect Network Traffic | AWS News Blog

According to theAWS Shared Responsibility Model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, including Amazon S3. This infrastructure includes hardware, software, networking, and facilities that run AWS services.

A. Configure an S3 Lifecycle policy: Incorrect, as configuring S3 Lifecycle policies to manage object lifecycle (e.g., transitioning objects to different storage classes or deleting them after a certain period) is the customer ' s responsibility.

B. Activate S3 Versioning: Incorrect, as enabling S3 Versioning is a customer responsibility for managing data protection.

C. Configure S3 bucket policies: Incorrect, as setting and managing S3 bucket policies to control access is the customer ' s responsibility.

AWS Cloud References:

AWS Shared Responsibility Model

Amazon S3

AWS Cloud Adoption Framework (AWS CAF) is a set of best practices, tools, and guidance that helps organizations get started with cloud technologies. AWS CAF helps organizations identify and prioritize transformation opportunities, evaluate and improve their cloud readiness, and iteratively evolve their transformation roadmap. AWS CAF groups its capabilities in six perspectives: Business, People, Governance, Platform, Security, and Operations. Each perspective comprises a set of capabilities that functionally related stakeholders own or manage in the cloud transformation journey1

AWS Managed Services (AMS) is a service that operates AWS infrastructure on behalf of customers, providing a secure AWS Landing Zone, features that help meet various compliance program requirements, a proven enterprise operating model, on-going cost optimization, and day-to-day infrastructure management. AMS does not help customers identify and prioritize business transformation opportunities or evaluate their cloud readiness2

AWS Well-Architected Framework is a set of six pillars and lenses that help cloud architects design and run workloads in the cloud. It provides a consistent approach for customers and AWS Partners to evaluate and implement designs that scale with their needs. AWS Well-Architected Framework helps customers understand the pros and cons of decisions they make while building systems on AWS, but it does not help them identify and prioritize business transformation opportunities3

AWS Migration Hub is a tool that lets customers discover, plan, and track their existing servers and applications for migration to AWS. It offers journey templates, cross-team collaboration, application and server discovery, strategy recommendations, orchestration and simple dashboard. AWS Migration Hub simplifies the migration and modernization process, but it does not help customers identify and prioritize business transformation opportunities or evaluate their cloud readiness4

 IAM roles are a secure way to grant permissions to applications running on an Amazon EC2 instance to make calls to other AWS services. IAM roles are entities that have specific permissions policies attached to them. You can create an IAM role and associate it with an EC2 instance when you launch it or later. The applications on the instance can then use the temporary credentials provided by the role to access AWS resources that the role allows. This way, you do not have tostore any long-term credentials or access keys on the instance, which reduces the risk of compromise or misuse12.

The other options are not correct, because:

Security groups are virtual firewalls that control the inbound and outbound traffic for your EC2 instances. Security groups do not grant permissions to access other AWS services, but rather filter the network traffic based on rules that you define3.

AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources. AWS Firewall Manager works with AWS WAF, AWS Shield Advanced, and Amazon VPC security groups. AWS Firewall Manager does not grant permissions to access other AWS services, but rather helps you enforce consistent security policies across your AWS infrastructure4.

IAM user SSH keys are credentials that allow you to connect to your EC2 instance using SSH. SSH keys do not grant permissions to access other AWS services, but rather authenticate your identity when you log in to your instance5.

Using an IAM role to grant permissions to applications running on Amazon EC2 instances - AWS Identity and Access Management

IAM roles for Amazon EC2 - Amazon Elastic Compute Cloud

Security groups for your VPC - Amazon Virtual Private Cloud

What is AWS Firewall Manager? - AWS Firewall Manager

Connecting to your Linux instance using SSH - Amazon Elastic Compute Cloud

The ability to scale resources up and down based on application load is tied to the advantage of " Stop guessing capacity. " This feature allows users to scale resources automatically to match the demand, thereby avoiding over-provisioning or under-provisioning of resources. " Go global in minutes, " " Benefit from massive economies of scale, " and " Trade fixed expense for variable expense " are other advantages of cloud computing, but they do not specifically address scaling resources up and down based on load.

AWS CloudFormation is a service that allows you to model and provision your AWS resources using templates. You can define your infrastructure as code and automate the creation and update of your resources. AWS CloudFormation also supports nested stacks, change sets, and rollback features to help you manage complex and dynamic environments34. References:

AWS CloudFormation

AWS Certified Cloud Practitioner Exam Guide

Understanding AWS Compute Optimizer: AWS Compute Optimizer is a service that analyzes the configuration and utilization metrics of your AWS resources. It provides recommendations to help you select the optimal configurations for your workloads.

Why AWS Compute Optimizer for Rightsizing:

Resource Recommendations: It provides specific recommendations to rightsize your EC2 instances by suggesting instance types that match your actual usage patterns.

Cost Efficiency: By optimizing instance sizes, you can reduce costs associated with over-provisioned resources.

Performance Improvement: Ensures that you are using instances that provide the required performance without over-allocating resources.

How to Implement AWS Compute Optimizer:

Enable AWS Compute Optimizer: In the AWS Management Console, navigate to AWS Compute Optimizer and enable it for your account.

Review Recommendations: After a period of monitoring, review the recommendations provided for your EC2 instances.

Implement Changes: Follow the suggestions to resize or change instance types based on the recommendations, ensuring you balance cost savings with performance needs.

AWS Compute Optimizer

Amazon Aurora Serverless is an on-demand, auto-scaling configuration for Amazon Aurora PostgreSQL-Compatible Edition. It is a fully managed service that automatically scales up and down based on the application’s actual needs. Amazon Aurora Serverless is suitable for applications that have infrequent, intermittent, or unpredictable database workloads, and that do not require the full power and range of options provided by provisioned Aurora clusters. Amazon Aurora Serverless eliminates the need to provision and manage database instances, and reduces the management overhead associated with database administration tasks such as scaling, patching, backup, and recovery. References: Amazon Aurora Serverless, Choosing between Aurora Serverless and provisioned Aurora DB clusters, [AWS Cloud Practitioner Essentials: Module 4 - Databases in the Cloud]

Amazon EC2 Auto Scaling is a service that helps you maintain application availability and allows you to automatically add or remove EC2 instances according to definable conditions. You can create collections of EC2 instances, called Auto Scaling groups, and specify the minimum and maximum number of instances in each group. You can also define scaling policies that adjust the number of instances based on the demand on your application. Amazon EC2 Auto Scaling helps you improve the performance, reliability, and cost-efficiency of your EC2workloads123. References: 1: VDI Desktops - Amazon WorkSpaces Family - AWS, 2: What is Amazon EC2 Auto Scaling? - Amazon EC2 Auto Scaling, 3: Discover Amazon EC2 Auto Scaling Unit | Salesforce Trailhead

AWS Artifact is a service provided by AWS that offers on-demand access to AWS compliance reports, including the Payment Card Industry (PCI) reports. It is the primary tool for retrieving compliance reports such as Service Organization Control (SOC) reports, ISO certifications, and Payment Card Industry Data Security Standard (PCI DSS) reports.

To obtain these reports:

The company should log into the AWS Management Console and navigate to AWS Artifact.

From there, they can select and download the necessary compliance reports.

Why other options are not suitable:

A. Contact AWS Support: AWS Support is not needed to obtain these reports; they are readily available through AWS Artifact.

C. Download reports from AWS Security Hub: AWS Security Hub is a service that provides a comprehensive view of security alerts and compliance status, but it does not host or provide compliance reports like PCI DSS.

D. Contact an AWS technical account manager (TAM): While a TAM may assist in various AWS-related queries, they are not required to obtain PCI reports. AWS Artifact is designed for this purpose.

According to the AWS shared responsibility model, customers are responsible for managing their data, applications, operating systems, security groups, and other aspects of their AWS environment. This includes installing updates and security patches of the guest operating system and any application software or utilities installed by the customer on the instances. AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, such as data centers, hardware, software, networking, and facilities. This includes the physical connectivity among Availability Zones, the network switch maintenance, and the hardware updates and firmware patches. Therefore, option D is the correct answer, and options A, B, and C are AWS responsibilities, not customer responsibilities. References: : AWS Well-Architected Framework - Elasticity; : Reactive Systems on AWS - Elastic

According to the AWS shared responsibility model, the customer is responsible for the security in the cloud, which includes configuring firewalls and networks. AWS provides security groups and network access control lists (NACLs) as firewall features that customers can use to control the traffic to andfrom their AWS resources. Customers are also responsible for managing their own virtual private clouds (VPCs), subnets, route tables, internet gateways, and other network components. AWS is responsible for the security of the cloud, which includes the physical security of the facilities, thehost operating system and virtualization layer, and the AWS global network infrastructure12. References:

Shared Responsibility Model - Amazon Web Services (AWS)

Shared responsibility model - Amazon Web Services: Risk and Compliance

Understanding High Availability: High availability (HA) refers to systems that are durable and likely to operate continuously without failure for a long time. HA ensures that an architecture can withstand failures with minimal downtime.

Importance of High Availability:

Redundancy: Systems are designed with redundancy to prevent single points of failure.

Fault Tolerance: Ensures that failures do not result in significant downtime, maintaining service continuity.

Automated Recovery: Utilizes automated recovery mechanisms to quickly restore services in the event of a failure.

AWS Services for High Availability:

Multi-AZ Deployments: Services like RDS, DynamoDB, and others support Multi-AZ deployments for fault tolerance.

Elastic Load Balancing: Distributes traffic across multiple instances or availability zones to ensure no single point of failure.

Auto Scaling: Automatically adjusts the number of instances based on demand, ensuring availability even during traffic spikes.

AWS Well-Architected Framework: Reliability

AWS Secrets Manageris the most secure way to store and manage sensitive information, such as passwords, database credentials, and API keys. Secrets Manager allows you to:

Securely store and rotate secrets.

Automatically manage secret rotation without disrupting applications.

Integrate with AWS services and third-party applications to retrieve secrets securely.

Why other options are not suitable:

A. Store passwords in an Amazon S3 bucket: Although S3 is secure, it is not designed for secret management. It lacks built-in secret rotation and fine-grained access control for sensitive data.

B. Store passwords as AWS CloudFormation parameters: CloudFormation is used for managing infrastructure as code, not for securely storing passwords.

C. Store passwords in AWS Storage Gateway: A service for hybrid storage integration, not suitable for storing secrets or passwords.

Amazon DynamoDBis a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. It is designed to handle unstructured data, offers high durability, and provides easy querying capabilities using key-value or document data models, making it suitable for applications that continuously produce unstructured data.

Why other options are not suitable:

A. Amazon RDS: A relational database service that is more suited for structured data and SQL queries.

B. Amazon Aurora: A MySQL- and PostgreSQL-compatible relational database, also more suited for structured data.

C. Amazon QuickSight: A business intelligence service for data visualization, not for storing data.

Amazon Elastic Transcoder is a media transcoding service that enables companies to convert video and audio files into formats optimized for playback on various devices, including smartphones. It automates the transcoding process and supports a wide array of video and audio formats, making it ideal for converting files into mobile-friendly formats. Services like Amazon Comprehend, Rekognition, and Polly do not perform media transcoding functions.

Understanding Operational Excellence: The Operational Excellence pillar of the AWS Well-Architected Framework focuses on running and monitoring systems to deliver business value and continuously improving supporting processes and procedures.

Key Concepts of Operational Excellence:

Small, Reversible Changes: Making changes in small, incremental steps allows for easier troubleshooting and rollback if issues arise.

Regular Updates: Regularly updating components ensures that systems stay up-to-date with the latest features, security patches, and performance improvements.

Automation: Implementing automation for deployments, updates, and monitoring to reduce human error and increase efficiency.

Continuous Improvement: Encouraging continuous learning and process improvement to enhance operational processes.

Implementing Operational Excellence:

Deployment Automation: Use CI/CD pipelines to automate deployments and ensure that changes can be rolled back if necessary.

Monitoring and Logging: Implement comprehensive monitoring and logging to track system health and performance.

Incident Response: Develop a robust incident response plan to handle issues quickly and efficiently.

Documentation and Training: Maintain thorough documentation and provide training to ensure teams can effectively manage and improve operations.

AWS Well-Architected Framework: Operational Excellence Pillar

Understanding IAM Roles: IAM (Identity and Access Management) roles in AWS are designed to delegate access permissions without sharing long-term security credentials. This means applications and services can use temporary security credentials, which enhances security.

Why IAM Roles are Best Practice:

Least Privilege Principle: By using IAM roles, you can ensure that applications only have the minimum permissions they need to function, reducing the risk of unauthorized access.

Temporary Credentials: Roles provide temporary security credentials, which reduce the risk if they are compromised compared to long-term access keys.

Automated Rotation: Temporary credentials automatically expire and are rotated, which means you don’t have to manage the rotation manually.

How to Implement IAM Roles:

Create an IAM Role: In the AWS Management Console, navigate to IAM, and create a new role. Choose the type of trusted entity (e.g., EC2, Lambda).

Attach Policies: Attach the necessary policies to the role that define the permissions for accessing the S3 bucket.

Assign Role to Service: Attach the IAM role to your EC2 instances, Lambda functions, or other AWS services that need to access the S3 bucket.

Use AWS SDKs: When accessing S3 from your application, use the AWS SDKs to automatically assume the IAM role and obtain temporary credentials.

AWS Identity and Access Management (IAM)

IAM Roles

AWS Organizations is the AWS service or feature that allows users to create new AWS accounts, group multiple accounts to organize workflows, and apply policies to groups of accounts. AWS Organizations enables users to centrally manage and govern their AWS environment across multiple accounts. Users can create organizational units (OUs) to group accounts based on their business needs, such as by function, project, or region. Users can also apply service control policies (SCPs) toOUs or individual accounts to define the permissions and restrictions for the AWS services and resources that they can access. AWS Organizations also offers features such as consolidated billing, account creation automation, and trusted access12. References:

AWS Organizations

What is AWS Organizations?

AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications without exposing traffic to the public internet. It enables private access to AWS services by creating private endpoints within a VPC, which enhances security and simplifies network architecture by keeping all communication on the AWS network. This service is ideal for scenarios where a company wants to connect AWS services and VPCs privately.

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. CloudFront enables companies to deploy an application close to end users by caching the application’s content at edge locations that are geographically closer to the users. This reduces the network latency and improves the user experience. CloudFront also integrates with other AWS services, such as Amazon S3, Amazon EC2, AWS Lambda, AWS Shield, and AWS WAF, to provide a secure and scalable solution for delivering applications12. References:

What Is Amazon CloudFront? - Amazon CloudFront

Amazon CloudFront Features - Amazon CloudFront

Amazon RDS for MySQL is a fully managed, open-source cloud database service that allows you to easily operate and scale your relational database of choice, including MySQL. With Amazon RDS for MySQL, you don’t have to worry about the hardware, resiliency, and replication of your database, as Amazon RDS handles these tasks for you. Amazon RDS for MySQL also provides features such as automated backups, multi-AZ deployments, read replicas, encryption, monitoring, and more. Amazon RDS for MySQL is compatible with the MySQL Community Edition versions 5.7 and 8.0, which means that you can use the same code, applications, andtools that you already use with MySQL4567. References: 4: Hosted MySQL - Amazon RDS for MySQL - AWS, 5: Amazon RDS for MySQL - Amazon Relational Database Service, 6: Amazon RDS for MySQL —亚马逊云科技, 7: Managed SQL Database - Amazon Relational Database Service (RDS) - AWS

TheBusiness perspectiveof the AWS Cloud Adoption Framework (AWS CAF) focuses on ensuring that cloud investments align with business strategies and that the organization achieves business value from cloud adoption. It provides real-time insights into the organization ' s strategic goals, financial objectives, and metrics.

This perspective helps answer questions about strategy, ensuring that cloud adoption aligns with the organization ' s long-term business goals.

Why other options are not suitable:

A. Operations: Focuses on operating cloud environments effectively.

B. People: Focuses on human resources and organizational structure.

D. Platform: Focuses on infrastructure and architecture.

Understanding S3 Intelligent-Tiering: S3 Intelligent-Tiering is designed to optimize costs by automatically moving data to the most cost-effective access tier based on changing access patterns. It is ideal for data with unknown or unpredictable access patterns.

Why S3 Intelligent-Tiering is Cost-Effective:

Automatic Tiering: Moves data between two access tiers (frequent and infrequent access) based on changing access patterns, optimizing storage costs without performance impact.

No Retrieval Fees: Unlike other storage classes, there are no retrieval fees in Intelligent-Tiering, making it cost-effective for data with unpredictable access patterns.

Monitoring and Automation: Automatically monitors access patterns and transitions data, reducing the need for manual intervention.

When to Use S3 Intelligent-Tiering:

Unpredictable Access Patterns: Ideal for datasets where the access frequency cannot be determined or changes frequently.

Cost Optimization: For organizations looking to minimize storage costs without sacrificing performance or requiring manual intervention to move data between tiers.

Amazon S3 Intelligent-Tiering

Amazon S3 Storage Classes

Spot Instances are a type of EC2 instance that let you bid on unused compute capacity, which AWS offers at a discount of up to 90% compared to On-Demand prices1. Spot Instances are suitable for fault-tolerant, stateless, or flexible applications that can handle interruptions2. Spot Instances can be interrupted with a two-minute warning when EC2 needs the capacity back3. The other options are not pricing models that will interrupt a running EC2 instance if capacity becomes temporarily unavailable

Best practices for using AWS Identity and Access Management (IAM) include:

B. Create individual IAM users: Each user should have their own IAM credentials to ensure accountability, control, and traceability. Sharing credentials can lead to security risks and difficulty in auditing.

E. Use groups to assign permissions to IAM users: Assigning permissions through IAM groups simplifies permission management. You can assign the necessary permissions to the group, and then add or remove users from the group as needed, rather than managing permissions for each user individually.

Why other options are not suitable:

A. Share access keys: Sharing access keys is a security risk and violates AWS security best practices. Each user should have their own credentials.

C. Use inline policies instead of customer-managed policies: Customer-managed policies are preferred over inline policies because they offer better control, reusability, and versioning.

D. Grant maximum privileges to IAM users: Granting the least privilege necessary is a best practice to reduce the risk of accidental or malicious actions.

AWS KMS is the service that is used to provide encryption for Amazon EBS. AWS KMS is a managed service that enables you to easily create and control the encryption keys used to encrypt your data.Amazon EBS uses AWS KMS to encrypt and decrypt your EBS volumes and snapshots. You can choose to use either the default AWS managed CMK or your own customer managed CMK for encryption. AWS KMS also provides features such as key rotation, audit logging, and access control policies to help you manage your encryption keys and protect your data12. The other services are not used to provide encryption for Amazon EBS. AWS Certificate Manager is a service that lets you provision, manage, and deploy public and private SSL/TLScertificates for use with AWS services and your internal connected resources3. AWS Systems Manager is a service that provides a unified user interface to view and manage your AWS resources, automate common operational tasks, and apply compliance policies4. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. References: Amazon EBS encryption, AWS Key Management Service, AWS Certificate Manager, AWS Systems Manager, [AWS Config]

Amazon FSx for Windows File Server is a fully managed file server that supports Microsoft workloads and file systems, including the SMB protocol. It provides features such as user quotas, end-user file restore, and Microsoft Active Directory integration. Amazon EFS is a fully managed file system that supports the NFS protocol, not SMB. Amazon FSx for Lustre is a fully managed file system that supports high-performance computing workloads, not Microsoft workloads. Amazon EBS is a block storage service that does not provide a file system or SMB support. References: Amazon FSx for Windows File Server, Amazon FSx for Lustre, Amazon EFS, Amazon EBS

AWS Organizationsis a service that helps users centrally manage and govern multiple AWS accounts. With AWS Organizations, a company can consolidate billing and receive a single bill for all AWS accounts under an organization, making it easier for the finance team to track costs.

Why other options are not suitable:

B. AWS Trusted Advisor: Provides real-time guidance to help optimize AWS resources, not for consolidated billing.

C. Cost Explorer: A tool for visualizing and managing AWS costs and usage, but it does not consolidate billing.

D. AWS Budgets: Allows setting custom budgets and alerts but does not consolidate billing across accounts.

Amazon Redshift is a fast, fully managed, petabyte-scale data warehouse service that makes it simple and cost-effective to analyze all your data using your existing business intelligence tools. You can start small with no commitments, and scale to petabytes for less than a tenth of the cost of traditional solutions. Amazon Redshift does not require manual hardware and software management, as AWS handles all the tasks such as provisioning, patching, backup, recovery, failure detection, and repair12. Amazon Redshift also offers serverless capabilities, which allow you to access and analyze data without any configurations or capacity planning. Amazon Redshift automatically scales the data warehouse capacity to deliver fast performance for even the most demanding and unpredictable workloads3. Therefore, Amazon Redshift meets the requirements of the company, compared to the other options.

The other options are not suitable for the company’s requirements, because:

Amazon DocumentDB (with MongoDB compatibility) is a fast, scalable, highly available, and fully managed document database service that supports MongoDB workloads. It is not designed for petabyte-scale data warehousing or analytics4.

Amazon Neptune is a fast, reliable, and fully managed graph database service that makes it easy to build and run applications that work with highly connected datasets. It is not designed for petabyte-scale data warehousing or analytics5.

Amazon ElastiCache is a fully managed in-memory data store and cache service that supports Redis and Memcached. It is not designed for petabyte-scale data warehousing or analytics.

What is Amazon Redshift? - Amazon Redshift

Amazon Redshift Features - Amazon Redshift

Amazon Redshift Serverless - Amazon Redshift

What Is Amazon DocumentDB (with MongoDB compatibility)? - Amazon DocumentDB (with MongoDB compatibility)

What Is Amazon Neptune? - Amazon Neptune

[What Is Amazon ElastiCache for Redis? - Amazon ElastiCache for Redis]

AWS Global Accelerator is a service that improves network performance by sending traffic through the AWS worldwide network infrastructure. It uses the AWS global network to direct TCP or UDP traffic to a healthy application endpoint in the closest AWS Region to the client. This provides improvements in terms of latency, throughput, and jitter. Global Accelerator also introduces features such as TCP termination at the edge, jumbo frame support, and large receive side window and TCP buffers to optimize data transfer12. Route table, AWS Transit Gateway, and Amazon VPC are not services or features that improve network performance by sending traffic through the AWS worldwide network infrastructure. Route table is a resource that defines how traffic is routed within a VPC3. AWS Transit Gateway is a service that enables you to connect your VPCs and on-premises networks to a single gateway4. Amazon VPC is a service that lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define5. References: Achieve up to 60% better performance for internet traffic with AWS Global Accelerator, Improving Performance on AWS and Hybrid Networks, Route tables, AWS Transit Gateway, Amazon Virtual Private Cloud (VPC)

The AWS Cloud Adoption Framework (AWS CAF) security perspective helps users achieve the confidentiality, integrity, and availability of their data and cloud workloads. It comprises nine capabilities that are grouped into three categories: preventive, detective, and responsive. Incident response and infrastructure protection are two of the capabilities in the responsive and preventive categories, respectively. Incident response helps users prepare for and respond to security incidents in a timely and effective manner, using tools and processes that leverage AWS features and services. Infrastructure protection helps users implement security controls and mechanisms to protect their cloud resources, such as network, compute, storage, and database, from unauthorized access or malicious attacks. References: Security perspective: compliance and assurance, AWS Cloud Adoption Framework

Elasticity is a characteristic of the AWS Cloud that helps users eliminate underutilized CPU capacity. Elasticity refers to the ability to dynamically provision and de-provision computing resources as per demand, ensuring that the application or service always has the required resources to operate efficiently. Elasticity helps users optimize performance and costs, as theyonly pay for the resources they use and avoid wasting resources when the demand is low345. References: 3: Which characteristic of the aws cloud helps users eliminate …, 4: AWS Elastic Load Balancing and Application Load Balancer, 5: Which characteristic of the AWS Cloud helps users eliminate …

Amazon Lexis a service for building conversational interfaces into any application using voice and text. It provides the tools necessary to create, test, and publish intelligent chatbots that can be integrated with web applications to provide a conversational experience.

A. Amazon Textract: Incorrect, as it is a service for extracting text and data from documents, not for creating chatbots.

C. AWS Glue: Incorrect, as it is a data integration service used for preparing and transforming data.

D. Amazon Rekognition: Incorrect, as it is an image and video analysis service.

AWS Cloud References:

Amazon Lex

Amazon EC2 (Elastic Compute Cloud)provides scalable computing capacity in the AWS Cloud, allowing customers to run virtual servers (instances) with different configurations of CPU, memory, storage, and networking capacity. This flexibility is ideal for applications that require specific infrastructure configurations, such as custom marketing and order-processing applications.

A. AWS Lambda: Incorrect, as it is a serverless compute service that automatically manages the computing resources needed to run code but does not offer the flexibility of choosing different instance types.

B. Amazon Cognito: Incorrect, as it is used for user authentication and authorization, not for deploying applications.

C. Amazon Athena: Incorrect, as it is an interactive query service for analyzing data in Amazon S3 using standard SQL.

AWS Cloud References:

Amazon EC2

Under theAWS Shared Responsibility Model, AWS manages securityofthe cloud (such as physical infrastructure and virtualization), while customers are responsible for securityinthe cloud. This means that customers are responsible for:

B. Encrypt data and maintain data integrity: Correct, as customers are responsible for securing their data, including encryption and maintaining its integrity.

D. Maintain identity and access management controls: Correct, as customers are responsible for managing access to their AWS resources, including creating and managing IAM users, roles, and permissions.

A. Secure the virtualization layer: Incorrect, as AWS is responsible for securing the underlying virtualization layer.

C. Patch the Amazon RDS operating system: Incorrect, as AWS handles patching and maintenance of the managed service’s underlying infrastructure.

E. Secure Availability Zones: Incorrect, as AWS is responsible for securing the physical infrastructure, including Availability Zones.

AWS Cloud References:

AWS Shared Responsibility Model

According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while customers are responsible for the security in the cloud. This means that AWS is responsible for the physical servers, networking, and operating system that run Lambdafunctions, while customers are responsible for the security of their code and AWS IAM to the Lambda service and within their function1. Customers need to manage the code within the Lambda function, such as writing, testing, debugging, deploying, and updating the code, as well as ensuring that the code does not contain any vulnerabilities or malicious code that could compromise the security or performance of the function23. References: 2: AWS Lambda - Amazon Web Services (AWS), 3: AWS Lambda Documentation, 1: Amazon CLF-C02: What is customer responsibility under AWS … - PUPUWEB

AWS Budgetsallows users to set custom cost and usage budgets and receive notifications when they exceed their thresholds. It provides detailed reports on cost and usage data for the past and current months, enabling the finance team to track and analyze spending.

AWS Budgets can automatically generate cost and usage reports, which can help the finance team plan ahead for each quarter based on historical data.

Why other options are not suitable:

A. Amazon Detective: A security service for analyzing and investigating AWS account activity for security purposes, not cost tracking.

B. AWS Pricing Calculator: A tool to estimate costs based on expected usage, not for tracking actual past usage.

D. AWS Savings Plans: An offering to save costs on AWS usage; it does not provide cost tracking or reporting features.

On-Demand Instances are the most cost-efficient pricing model for an uninterruptible workload that runs once a year for 24 hours. On-Demand Instances let you pay for compute capacity by the hour or second, depending on which instances you run. No long-term commitments or up-front payments are required. You can increase or decrease your compute capacity to meet the demands of your application and only pay the specified hourly rates for the instance you use1. This model is suitable for developing/testing applications with short-term or unpredictable workloads2. The other pricing models are not cost-efficient for this use case. Reserved Instances and Savings Plans require a commitment to a consistent amount of usage, in USD per hour, for a term of 1 or 3 years. They provide significant discounts compared to On-Demand Instances, but they are not flexible or scalable for workloads that run only once a year12. Spot Instances are the cheapest option, but they are not suitable for uninterruptible workloads, as they can be reclaimed by AWS at any time. They are recommended for applications that have flexible start and end times, or that are only feasible at very low compute prices12. Dedicated Instances are designed for compliance and licensing requirements, not for cost optimization. They are more expensive than the other options, as they run on single-tenant hardware12. References: Amazon EC2 – Secure and resizable compute capacity – AWS, Amazon EC2 - How AWS Pricing Works

AWS Transit Gateway is a network transit hub that you can use to interconnect your VPCs and on-premises networks through a central gateway. AWS Transit Gateway simplifies and scales the connectivity between your on-premises networks and AWS, as you only need to create and manage a single connection from the central gateway to each on-premises network, rather than individual connections to each VPC. You can also use AWS Transit Gateway to connect to other AWS services, such as Amazon S3, Amazon DynamoDB, and AWS PrivateLink12. AWS Transit Gateway supports thousands of VPCs per gateway, and enables you to peer Transit Gateways across AWS Regions3.

The other options are not AWS services or features that can simplify and scale the connectivity between on-premises networks and hundreds of VPCs using AWS Direct Connect. VPC endpoints enable private connectivity between your VPCs and supported AWS services, but do not support on-premises networks4. Amazon Route 53 is a DNS service that helps you route internet traffic to your resources, but does not provide network connectivity5. AWS Secrets Manager is a service that helps you securely store and manage secrets, such as database credentials and API keys, but does not relate to network connectivity

AWS IAM Access Analyzer is a service that helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, IAM Access Analyzer generates a finding. Findings include information about the access and the external principal granted to it345. References: 3: Using AWS Identity and Access Management Access Analyzer, 4: IAM Access Analyzer - Amazon Web Services (AWS), 5: Welcome - IAM Access Analyzer

AWS WAF is a web application firewall service that helps protect web applications from common web exploits that could affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over which traffic to allow or block to your web applications by definingcustomizable web security rules. You can use AWS WAF to create rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define1. AWS WAF also integrates with other AWS services, such as Amazon CloudFront, Amazon API Gateway, AWS AppSync, and AWS Load Balancer, to provide a comprehensive defense against web attacks2. Therefore, AWS WAF meets the requirements of the social media company, compared to the other options.

The other options are not suitable for the social media company’s requirements, because:

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. However, Amazon Inspector does not provide a web application firewall service that can block malicious web requests3.

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. Amazon GuardDuty analyzes and processes the following data sources: VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. However, Amazon GuardDuty does not provide a web application firewall service that can block malicious web requests4.

Amazon CloudWatch is a monitoring and observability service that provides data and actionable insights to monitor your applications, respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. Amazon CloudWatch collects monitoring and operational data in the form of logs, metrics, and events, and visualizes it using automated dashboards, alarms, and notifications. However, Amazon CloudWatch does not provide a web application firewall service that can block malicious web requests.

What Is AWS WAF? - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced

AWS WAF Features - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced

What Is Amazon Inspector? - Amazon Inspector

What Is Amazon GuardDuty? - Amazon GuardDuty

[What Is Amazon CloudWatch? - Amazon CloudWatch]

AWS provides an Attestation of Compliance (AOC) report for specific AWS services to assist companies in achieving Payment Card Industry Data Security Standard (PCI DSS) compliance in the cloud. This report demonstrates that AWS services meet the necessary PCI DSS requirements. AWS does not offer physical inspections of data centers by appointment, nor does it provide certifications for any application running on AWS. Additionally, AWS does not provide professional PCI compliance services; companies must manage their PCI compliance in their environment.

Under the AWS shared responsibility model, AWS is responsible for the security " of " the cloud, which includes the physical infrastructure, networking, and hypervisor layer. The customer, however, is responsible for security " in " the cloud, which includes managing the security of their data, patching and maintaining their guest operating system and applications, and managing identity and access. The responsibilities of shredding disk drives, preventing packet capture at the hypervisor level, and physical monitoring are handled by AWS as part of its responsibility for security " of " the cloud.

Understanding Availability Zones (AZs): An Availability Zone is a distinct location within an AWS region that is engineered to be isolated from failures in other AZs.

Characteristics of Availability Zones:

Data Centers: Each AZ consists of one or more discrete data centers with redundant power, networking, and connectivity.

High Availability: AZs are designed for high availability, providing low-latency network connections to other zones in the same region.

Fault Isolation: They provide fault isolation and are used to deploy applications and services to ensure high availability and reliability.

Use Cases for Availability Zones:

Multi-AZ Deployments: For services like RDS, deploying in multiple AZs ensures fault tolerance.

Disaster Recovery: Setting up resources in multiple AZs helps in quick recovery from failures.

Load Balancing: Distributing traffic across AZs using Elastic Load Balancing ensures optimal performance and availability.

AWS Global Infrastructure

Understanding AWS Regions and Availability Zones

" The Reliability pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it’s expected to. This includes the ability to operate and test the workload through its total lifecycle. "

Understanding Cost Optimization Recommendations: In AWS, cost optimization involves identifying ways to reduce costs while maintaining or improving performance and capacity.

Top-Level KPI - Estimated Monthly Saving:

Definition: This KPI provides an estimate of how much you can save per month by following the recommended actions.

Importance: It helps you quantify the potential cost savings from rightsizing, purchasing reserved instances, or optimizing resource usage.

Decision-Making: Provides a clear financial benefit to justify changes in your resource configurations.

How to Use Estimated Monthly Saving:

Access Recommendations: Navigate to the AWS Cost Management Console to view rightsizing recommendations.

Review Savings Estimates: Look at the estimated monthly savings for each recommendation to understand the potential financial impact.

Implement Recommendations: Prioritize actions based on the savings estimates to maximize cost reduction.

AWS Cost Management

AWS Rightsizing Recommendations

Amazon S3 is a service that provides durable storage for static content and infinitely scalable data storage infrastructure at the lowest cost. Amazon S3 is an object storage service that allows you to store and retrieve any amount of data from anywhere on the internet. Amazon S3 offers industry-leading scalability, availability, and performance, as well as 99.999999999% (11 9s) of durability and multi-AZ resilience. Amazon S3 also provides various storage classes that offer different levels of performance and cost optimization, such as S3 Standard, S3 Intelligent-Tiering, S3 Standard-Infrequent Access (S3 Standard-IA), S3 One Zone-Infrequent Access (S3One Zone-IA), and S3 Glacier456. Amazon S3 is ideal for storing static content, such as images, videos, documents, and web pages, as well as building data lakes, backup and archive solutions, big data analytics, and machine learning applications456. References: 4: Cloud Storage on AWS, 5: Object Storage - Amazon Simple Storage Service (S3) - AWS, 6: Amazon S3 Documentation

Amazon S3 (Simple Storage Service)is a scalable object storage service that allows users to store and retrieve any amount of data at any time from anywhere on the web. S3 provides the ability to make objects (files) publicly accessible via a public URL, which allows users to download files directly. S3 is highly durable, scalable, and secure, making it an ideal service for storing files that need to be accessed publicly.

Why other options are not suitable:

A. Amazon Redshift: A data warehouse service designed for complex queries and analytics, not for storing and publicly sharing files.

B. Amazon Elastic Block Store (Amazon EBS): Provides block storage for use with EC2 instances, but does not support public URLs or direct file access from the web.

C. Amazon Elastic File System (Amazon EFS): A managed file storage service for use with EC2 instances, not designed for public access via URLs.

One of the primary advantages of the AWS Cloud is the ability to provision resources on demand. Users no longer need to over-provision or guess the capacity needed for infrastructure, which helps optimizecosts and improve agility. AWS handles infrastructure scaling dynamically based on the actual usage. Options B, C, and D are incorrect as users do not maintain sole ownership of IT hardware or control of underlying infrastructure, and while they do maintain some control over the operating system in some cases, it is not an advantage specific to the cloud.

AWS Outposts is an AWS offering that brings AWS infrastructure and services to a customer ' s on-premises location. It allows companies to run AWS services locally while meeting any regulatory or compliance requirements to keep data or applications on-premises. Dedicated Instances are EC2 instances that run on hardware dedicated to a single customer but are still within AWS data centers. Amazon CloudFront is a CDN service, and AWS Fargate is a serverless compute engine for containers, neither of which meets the requirement for running an application on-premises.

AWS Technical Account Managers (TAMs) are available to customers who subscribe to either theAWS Enterprise On-RamporAWS Enterprise Supportplans. TAMs provide proactive guidance and ongoing support, assisting with architecture reviews, operational performance improvements, and business reviews. TheBasicandDeveloperSupport plans do not include access to TAMs, and whileBusiness Supportoffers enhanced technical support, it does not include TAMs either.

TheAWS Developer Supportplan is the lowest-cost AWS Support plan that provides basic guidance and technical support for running production workloads. It offers 24/7 access to AWS customer service, documentation, whitepapers, and access to a limited set of Trusted Advisor checks. This plan is ideal for non-critical workloads or early development phases but provides lower levels of support compared to the Business, Enterprise On-Ramp, and Enterprise plans.

B. Enterprise On-Ramp: Incorrect, as it is a higher-cost support plan designed for production workloads needing more guidance and technical support.

C. Enterprise: Incorrect, as it is the most expensive support plan, providing a Technical Account Manager and other premium support features.

D. Business: Incorrect, as it provides comprehensive support for production workloads but is more expensive than the Developer plan.

AWS Cloud References:

AWS Support Plans

Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. It supports both key-value and document data models, and allows you to create tables that can store and retrieve any amount of data, and serve any level of request traffic. You can also use DynamoDB Streams to capture data modification events in DynamoDB tables.

The correct answers to the questions are B and E because reliability and operational excellence are pillars of the AWS Well-Architected Framework. The AWS Well-Architected Framework is a set of best practices and guidelines for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud. The AWS Well-Architected Framework consists of five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization. Each pillar has a set of design principles that describe the characteristics of a well-architected system. Reliability is the pillar that focuses on the ability of a system to recover from failures and meet business and customer demand. Operational excellence is the pillar that focuses on the ability of a system to run and monitor processes that support business outcomes and continually improve. The other options are incorrect because they are not pillars of the AWS Well-Architected Framework. Availability, scalability, and responsive design are important aspects of cloud architecture, but they are not separate pillars in the framework. Availability and scalability are related to the reliability and performance efficiency pillars, while responsive design is related to the customer experience and user interface. Reference: AWS Well-Architected Framework

The company follows the AWS Cloud design principle of ensuring traceability by using AWS CloudTrail. AWS CloudTrail is a service that records the API calls and events made by or on behalf of the AWS account. The company can use AWS CloudTrail to monitor, audit, and analyze the activity and changes in their AWS resources and applications. AWS CloudTrail helps the company to achieve compliance, security, governance, and operational efficiency. Recovering automatically, performing operations as code, and measuring efficiency are other AWS Cloud design principles, but they are not directly related to using AWS CloudTrail. Recovering automatically means that the company can design their cloud workloads to handle failures gracefully and resume normal operations without manual intervention. Performing operations as code means that the company can automate the creation, configuration, and management of their cloud resources using scripts or templates. Measuring efficiency means that the company can monitor and optimize the performance and utilization of their cloud resources and applications34

 The AWS service that requires the customer to patch the guest operating system is Amazon EC2. Amazon EC2 is a service that provides scalable compute capacity in the cloud, and allows customers to launch and run virtual servers, called instances, with a variety of operating systems, configurations, and specifications. The customer is responsible for patching and updating the guest operating system and any applications that run on the EC2 instances, as part of the security in the cloud. AWS Lambda, Amazon OpenSearch Service, and Amazon ElastiCache are not services that require the customer to patch the guest operating system. AWS Lambda is a serverless compute service that allows customers to run code without provisioning or managing servers. Amazon OpenSearch Service is a fully managed service that makes it easy to deploy, operate, and scale OpenSearch clusters in the AWS Cloud. Amazon ElastiCache is a fully managed service that provides in-memory data store and cache solutions, such as Redis and Memcached. These services are managed by AWS, and AWS is responsible for patching and updating the underlying infrastructure and software.

Amazon EC2 Auto Scaling is the AWS service or tool that can help the company launch the number of EC2 instances that will be needed to handle the workload. Amazon EC2 Auto Scaling automatically adjusts the capacity of the EC2 instances based on the demand and the predefined scaling policies. Amazon EC2 Auto Scaling also helps to improve availability and reduce costs by scaling in and out as needed. For more information, see What is Amazon EC2 Auto Scaling? and [Getting Started with Amazon EC2 Auto Scaling] .

 Using EC2 instances across multiple Availability Zones in the same AWS Region is a solution that meets the requirements of sharing the same geographic area but using redundant underlying power sources. Availability Zones are isolated locations within an AWS Region that have independent power, cooling, and physical security. They are connected through low-latency, high-throughput, and highly redundant networking. By launching EC2 instances in different Availability Zones, users can increase the fault tolerance and availability of their applications. Amazon CloudFront is a contentdelivery network (CDN) service that speeds up the delivery of web content and media to end users by caching it at the edge locations closer to them. It is not a database service and cannot be used to store operational data for EC2 instances. Edge locations are sites that are part of the Amazon CloudFront network and are located in many cities around the world. They are not the same as Availability Zones and do not provide redundancy for EC2 instances. AWS OpsWorks is a configuration management service that allows users to automate the deployment and management of applications using Chef or Puppet. It can be used to create stacks that span multiple AWS Regions, but this would not meet the requirement of sharing the same geographic area.

 Access to all AWS resources will be denied if a newly created IAM user has no IAM policy attached and logs in and attempts to view the AWS resources in the account. IAM policies are the way to grant permissions to IAM users, groups, and roles to access and manage AWS resources. By default, IAM users have no permissions, unless they are explicitly granted by an IAM policy. Therefore, a newly created IAM user without any IAM policy attached will not be able to view or perform anyactions on the AWS resources in the account. Access to the AWS billing services and AWS CLI will also be denied, unless the user has the necessary permissions.

A benefit of decoupling an AWS Cloud architecture is the ability to upgrade components independently. Decoupling is a way of designing systems to reduce interdependencies and minimize the impact of changes. Decoupling allows components to interact with each other through well-defined interfaces, rather than direct references. This reduces the risk of failures and errors propagating across the system, and enables greater scalability, availability, and maintainability. By decoupling an AWS Cloud architecture, the user can upgrade or modify one component without affecting the other components5.

AWS Service Catalog is a service that allows you to create and manage catalogs of IT services that are approved for use on AWS. You can use AWS Service Catalog to centrally manage commonly deployed IT services and help your organization achieve consistent governance and meet your compliance requirements, while enabling users to quickly deploy only the approved IT services they need1. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS software development kits (SDKs) are tools that enable you to easily integrate your applications with AWS services using your preferred programming language. AWS AppSync is a service that simplifies application development by letting you create a flexible API to securely access, manipulate, and combine data from one or more data sources. None of these services can help you limit your employees’ AWS access to a portfolio of predefined AWS resources.

 The correct answer is D because AWS Security Hub is a service that aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Firewall Manager, and AWS IAM Access Analyzer. The other options are incorrect because they are not services that aggregate security alerts and findings from multiple AWS services. Amazon Detective is a service that helps users analyze and visualize security data to investigate and remediate potential issues. Amazon Inspector is a service that helps users find security vulnerabilities and deviations from best practices in their Amazon EC2 instances. Amazon Macie is a service that helps users discover, classify, and protect sensitive data stored in Amazon S3. Reference: AWS Security Hub FAQs

 Amazon EventBridge is the service that meets the requirements of building a serverless architecture that connects application data from multiple data sources without requiring additional code. Amazon EventBridge is a serverless event bus service that allows you to easily connect your applications with data from AWS services, SaaS applications, and your own applications. You can use Amazon EventBridge to create rules that match events and route them to targets such as AWS Lambda functions, Amazon SNS topics, Amazon SQS queues, or other AWS services. Amazon EventBridge handles the event ingestion, delivery, security, authorization, and error handling for you34

The correct answers are A and B because Amazon Aurora and Amazon RDS are AWS services that the company could use for the relational databases. Amazon Aurora is a relational database that is compatible with MySQL and PostgreSQL. Amazon Aurora is a fully managed, scalable, and high-performance service that offers up to five times the throughput of standard MySQL and up to three times the throughput of standard PostgreSQL. Amazon RDS is a service that enables users to set up, operate, and scale relational databases in the cloud. Amazon RDS supports six popular database engines: MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, and Amazon Aurora. The other options are incorrect because they are not AWS services that the company could use for the relational databases. Amazon DocumentDB (with MongoDB compatibility) is a document database that is compatible with MongoDB. Amazon Neptune is a graph database that supports property graph and RDF models. Amazon DynamoDB is a key-value and document database. Reference: Amazon Aurora, Amazon RDS

The correct answer is C because Dedicated Hosts are Amazon EC2 instances that are required when a user wants to utilize their existing per-socket, per-core, or per-virtual machine software licenses for a Microsoft Windows server running on AWS. Dedicated Hosts are physical servers that are dedicated to a single customer. Dedicated Hosts allow customers to use their existing server-bound software licenses, such as Windows Server, SQL Server, and SUSE Linux Enterprise Server, subject to their license terms. The other options are incorrect because they are not Amazon EC2 instances that are required when a user wants to utilize their existing per-socket, per-core, or per-virtual machine software licenses for a Microsoft Windows server running on AWS. Spot Instances are spare Amazon EC2 instances that are available at up to 90% discount compared to On-Demand prices. Spot Instances are suitable for stateless, fault-tolerant, and flexible workloads that can recover from interruptions easily. Dedicated Instances are Amazon EC2 instances that run on hardware that is dedicated to a single customer, but not to a specific physical server. Dedicated Instances do not allow customers to use their existing server-bound software licenses. Reserved Instances are Amazon EC2 instances that are reserved for a specific period of time (one or three years) in exchange for a lower hourly rate. Reserved Instances are suitable for steady-state or predictable workloads that run for a long duration. Reserved Instances do not allow customers to use their existing server-bound software licenses. Reference: Dedicated Hosts, Amazon EC2 Instance Purchasing Options

Reliability is the cloud concept that this architecture represents. Reliability is the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. Deploying an application to multiple AWS Regions and configuring automatic failoverbetween those Regions enhances the reliability of the application by reducing the impact of regional failures and increasing the availability of the application4

 The AWS tool that will meet the requirements of the company that is planning a migration to the AWS Cloud and wants to examine the costs that are associated with different workloads is AWS Pricing Calculator. AWS Pricing Calculator is a tool that helps customers estimate the cost of using AWS services based on their requirements and preferences. The company can use AWS Pricing Calculator to compare the costs of different AWS services and configurations, such as Amazon EC2, Amazon S3, Amazon RDS, and more. AWS Pricing Calculator also provides detailed breakdowns of the cost components, such as compute, storage, network, and data transfer. AWS Pricing Calculator helps customers plan and optimize their cloud budget and migration strategy. AWS Budgets, AWS Cost Explorer, and AWS Cost and Usage Report are not the best tools to use for this purpose. AWSBudgets is a tool that helps customers monitor and manage their AWS spending and usage against predefined budget limits and thresholds. AWS Cost Explorer is a tool that helps customers analyze and visualize their AWS spending and usage trends over time. AWS Cost and Usage Report is a tool that helps customers access comprehensive and granular information about their AWS costs and usage in a CSV or Parquet file. These tools are more useful for tracking and optimizing the existing AWS costs and usage, rather than estimating the costs of different workloads34

 AWS Trusted Advisor is the AWS service or tool that the company should use to identify areas for optimization. According to the AWS Trusted Advisor User Guide, “AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices. AWS Trusted Advisor checks help optimize your AWS infrastructure, increase security and performance, reduce your overall costs, and monitor service limits.” Amazon QuickSight, AWS Organizations, and AWS Budgets are not designed to provide optimization recommendations for the current AWS environment.

 AWS Abuse team is the AWS group or team that the company should notify if it suspects that its AWS resources are being used for illegal activities. AWS Abuse team is a dedicated team that handles reports of abuse, such as spam, phishing, malware, denial-of-service attacks, and unauthorized access, involving AWS resources. The company can contact the AWS Abuse team byfilling out the [Report Abuse of AWS Resources form] or sending an email to abuse@amazonaws.com. The company should provide as much information as possible, such as the source and destination IP addresses, timestamps, log files, and screenshots, to help the AWS Abuse team investigate and take appropriate actions. For more information, see [Reporting Abuse] and [AWS Acceptable Use Policy].

Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for the AWS environment. It analyzes network and account activity using machine learning and threat intelligence to identify potential security threats, such as unauthorized access, compromised credentials, malicious hosts, and reconnaissance activities. It also generates detailed and actionable findings that can be viewed on the AWS Management Console or sent to other AWS services, such as Amazon CloudWatch Events and AWS Lambda, for further analysis or remediation. Amazon GuardDuty OverviewAWS Certified Cloud Practitioner - aws.amazon.com

The AWS service or feature that the company can use to group users together and apply permissions to the group is AWS Identity and Access Management (IAM). AWS IAM is a service that enables users to create and manage users, groups, roles, and permissions for AWS services and resources. Users can use IAM groups to organize multiple users that have similar access requirements, and attach policies to the groups that define the permissions for the users in the group. This simplifies the management and administration of user access

 Amazon CloudFront is the AWS service that offers a global content delivery network (CDN) that helps companies securely deliver websites, videos, applications, and APIs at high speeds with low latency. Amazon CloudFront is a web service that speeds up distribution of static and dynamic web content, such as HTML, CSS, JavaScript, and image files, to users. Amazon CloudFront uses a global network of edge locations, located near users’ geographic locations, to cache and serve content with high availability and performance. Amazon CloudFront also provides features such as AWS Shield for DDoS protection, AWS Certificate Manager for SSL/TLS encryption, AWS WAF for web application firewall, and AWS Lambda@Edge for customizing content delivery with serverless code. Amazon EC2, Amazon CloudWatch, and AWS CloudFormation are not services that offer a global CDN. Amazon EC2 is a service that provides scalable compute capacity in the cloud. Amazon CloudWatch is a service that provides monitoring and observability for AWS resources andapplications. AWS CloudFormation is a service that provides a common language to model and provision AWS resources and their dependencies.

Compute Savings Plans are a flexible and cost-effective way to optimize long-term compute costs of AWS Lambda functions and Amazon EC2 instances. With Compute Savings Plans, customers can commit to a consistent amount of compute usage (measured in $/hour) for a 1-year or 3-year termand receive a discount of up to 66% compared to On-Demand prices3. Dedicated Hosts are physical servers with EC2 instance capacity fully dedicated to the customer’s use. They are suitable for customers who have specific server-bound software licenses or compliance requirements4. Reserved Instances are a pricing model that provides a significant discount (up to 75%) compared to On-Demand pricing and a capacity reservation for EC2 instances. They are available in 1-year or 3-year terms and different payment options5. Spot Instances are spare EC2 instances that are available at up to 90% discount compared to On-Demand prices. They are suitable for customers who have flexible start and end times, can withstand interruptions, and can handle excess capacity.

 Create annotated documentation is the design principle that is included in the operational excellence pillar of the AWS Well-Architected Framework. According to the AWS Well-Architected Framework whitepaper, creating annotated documentation means " documenting your workload so that the team understands the architecture, how to operate the workload, and how the workload delivers value to customers. " 3 Anticipate failure, ensure performance efficiency, and optimize costs are design principles that belong to other pillars of the AWS Well-Architected Framework, such as reliability, performance efficiency, and cost optimization.

 The correct answers are B and E because AWS Online Tech Talks and AWS Classroom Training are options that AWS makes available for customers who want to learn about security in the cloud in an instructor-led setting. AWS Online Tech Talks are live, online presentations that cover a broad range of topics at varying technical levels. AWS Online Tech Talks are delivered by AWS experts and feature live Q & A sessions with the audience. AWS Classroom Training are in-person or virtual courses that are led by accredited AWS instructors. AWS Classroom Training offer hands-on labs, exercises, and best practices to help customers gain confidence and skills on AWS. The other options are incorrect because they are not options that AWS makes available for customers who want to learn about security in the cloud in an instructor-led setting. AWS Trusted Advisor is an AWS service that provides real-time guidance to help customers follow AWS best practices for security, performance, cost optimization, and fault tolerance. AWS Blog is an AWS resource that provides news, announcements, and insights from AWS experts and customers. AWS Forums are AWS resources that enable customers to interact with other AWS users and get feedback and support. Reference: AWS Online Tech Talks, AWS Classroom Training

 The correct answer is B because security groups are AWS features that act as instance-level firewalls to control inbound and outbound access. Security groups are virtual firewalls that can be attached to one or more Amazon EC2 instances. Users can configure rules for security groups to allow or deny traffic based on protocols, ports, and source or destination IP addresses. The other options are incorrect because they are not AWS features that act as instance-level firewalls to control inbound and outbound access. Network access control list is an AWS feature that acts as a subnet-level firewall to control inbound and outbound access. AWS Trusted Advisor is an AWS service that provides real-time guidance to help users follow AWS best practices for security, performance, cost optimization, and fault tolerance. Virtual private gateways are AWS features that enable users to create a secure and encrypted connection between their VPC and their on-premises network. Reference: Security Groups for Your VPC

 The operational excellence pillar of the AWS Well-Architected Framework includes a design principle about measuring the overall efficiency of workloads in terms of business value. This principle states that you should monitor and measure key performance indicators (KPIs) and set targets and thresholds that align with your business goals. You should also use feedback loops to continuously improve your processes and procedures1.

 AWS Organizations helps to centrally manage billing and allow controlled access to resources across AWS accounts. AWS Organizations is a service that enables the user to consolidate multiple AWS accounts into an organization that can be managed as a single unit. AWS Organizations allows the user to create groups of accounts and apply policies to them, such as service control policies (SCPs) that specify the services and actions that users and roles can access in the accounts. AWS Organizations also enables the user to use consolidated billing, which combines the usage and charges from all the accounts in the organization into a single bill.

 Amazon Relational Database Service (Amazon RDS) is a service that provides fully managed relational database engines. Amazon RDS supports several database engines, including Oracle, MySQL, PostgreSQL, MariaDB, SQL Server, and Amazon Aurora. Amazon RDS can be used to migrate an application that includes an Oracle database to AWS without rewriting the application, as long as the application is compatible with the Oracle version and edition supported by Amazon RDS. Amazon RDS can also provide benefits such as high availability, scalability, security, backup and restore, and performance optimization. [Amazon RDS Overview] AWS Certified Cloud Practitioner - aws.amazon.com

AWS Pricing Calculator is the AWS service or tool that the company should use to estimate its future AWS service costs before the migration. AWS Pricing Calculator is a web-based tool that allows the company to create cost estimates for various AWS services and scenarios. AWS Pricing Calculator helps the company to compare the costs of running the workload on premises versus on AWS, and to optimize the costs by choosing the best options for the workload. AWS Pricing Calculator also provides a detailed breakdown of the cost components and a downloadable report. For more information, see [AWS Pricing Calculator] and [Getting Started with AWS Pricing Calculator] .

Amazon RDS is the AWS service that will meet the requirements of using a managed service to simplify the setup, operation, and scaling of a MySQL database in the AWS Cloud. Amazon RDS is a relational database service that supports MySQL and other popular database engines. Amazon RDS handles routine database tasks such as provisioning, patching, backup, recovery, and scaling. Amazon RDS also offers high availability, security, and compatibility features3

AWS Enterprise Support is the AWS Support plan that assigns an AWS concierge agent to a company’s account. AWS Enterprise Support is the highest level of support that AWS offers, and it provides the most comprehensive and personalized assistance. An AWS concierge agent is a dedicated technical account manager who acts as a single point of contact for the company and helps to optimize the AWS environment, resolve issues, and access AWS experts. For more information, see [AWS Support Plans] and [AWS Concierge Support] .

Creating an IAM role with the required permissions and attaching the role to the EC2 instance is the most operationally efficient solution to delegate permissions. An IAM role is an entity that defines a set of permissions for making AWS service requests. An IAM role can be assumed by an EC2 instance to access other AWS resources, such as Amazon S3 and Amazon DynamoDB, without having to store any credentials on the instance. This solution is more secure and scalable than using IAM users and their access keys. For more information, see [IAM Roles for Amazon EC2] and [Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances] .

Amazon Workspaces is the AWS service that provides the functionality of remotely accessing virtual desktop computers from the internet. Amazon Workspaces is a fully managed, secure desktop-as-a-service (DaaS) solution that allows users to provision cloud-based virtual desktops and access them from anywhere, using any supported device. Amazon Workspaces helps users reduce the complexity and cost of managing and maintaining physical desktops, and provides a consistent and secure user experience

AWS Storage Gateway file gateway allows companies to use protocols such as NFS and SMB to store and retrieve objects in Amazon S3. File gateway provides a seamless integration between on-premises applications and Amazon S3, and enables low-latency access to data through local caching. File gateway also supports encryption, compression, and lifecycle management of the objects in Amazon S3. For more information, see What is AWS Storage Gateway? and File Gateway.

 Security groups are the service or feature that meets the requirement of establishing a security layer in a VPC that will act as a firewall to control subnet traffic. Security groups are stateful firewalls that control the inbound and outbound traffic at the instance level. You can assign one or more security groups to each instance in a VPC, and specify the rules that allow or deny traffic based on the protocol, port, and source or destination. Security groups are associated with network interfaces, and therefore apply to all the instances in the subnets that use those network interfaces. Routing tables are used to direct traffic between subnets and gateways, not to filter traffic. Network ACLs are stateless firewalls that control the inbound and outbound traffic at the subnet level, but they are less granular and more cumbersome to manage than security groups. Amazon GuardDuty is a threat detection service that monitors your AWS account and workloads for malicious or unauthorized activity, not a firewall service.

 AWS Health API is available to a company that has an AWS Business Support plan. The AWS Health API provides programmatic access to the AWS Health information that is presented in the AWS Personal Health Dashboard. The AWS Health API can help users get timely and personalized information about events that can affect the availability and performance of their AWS resources, such as scheduled maintenance, network issues, or service disruptions. The AWS Health API can also integrate with other AWS services, such as Amazon CloudWatch Events and AWS Lambda, to enable automated actions and notifications. AWS Health API OverviewAWS Support Plans

The correct answers are A and C because patching AWS network devices and providing physical security for compute resources are tasks that are the responsibility of AWS, according to the AWS shared responsibility model. The AWS shared responsibility model is a framework that defines the division of responsibilities between AWS and the customer for security and compliance. AWS is responsible for the security of the cloud, which includes the global infrastructure, such as the regions, availability zones, and edge locations; the hardware, software, networking, and facilities that run the AWS services; and the virtualization layer that separates the customer instances and storage. The customer is responsible for the security in the cloud, which includes the customer data, the guest operating systems, the applications, the identity and access management, the firewall configuration, and the encryption. The other options are incorrect because they are tasks that are the responsibility of the customer, according to the AWS shared responsibility model. Setting user password rules, configuring security groups, and patching the operating system of an Amazon EC2 instance are all tasks that the customer has to perform to secure their AWS environment. Reference: AWS Shared Responsibility Model

The user authentication services managed by AWS are: Amazon Cognito and AWS Identity and Access Management (IAM). These services help users securely manage and control access to their AWS resources and applications. Amazon Cognito is a service that provides user sign-up, sign-in, and access control for web and mobile applications. Amazon Cognito supports various identity providers, such as Facebook, Google, and Amazon, as well as custom user pools. AWS IAM is a service that enables users to create and manage users, groups, roles, and permissions for AWS services and resources. AWS IAM supports various authentication methods, such as passwords, access keys, and multi-factorauthentication (MFA)

 Amazon Personalize is a fully managed machine learning service that customers can use to generate personalized recommendations for their users. It can also generate user segments based on the users’ affinity for certain items or item metadata. Amazon Personalize uses the customers’ data to train and deploy custom recommendation models that can be integrated into their applications. Therefore, the correct answer is B. You can learn more about Amazon Personalize and its use case.

 AWS Direct Connect gives users the ability to provision a dedicated and private network connection from their internal network to AWS. AWS Direct Connect links the user’s internal network to an AWSDirect Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to the user’s router, the other to an AWS Direct Connect router. With this connection in place, the user can create virtual interfaces directly to the AWS cloud and Amazon Virtual Private Cloud (Amazon VPC), bypassing internet service providers in the network path2.

 AWS Config is a service that enables users to assess, audit, and evaluate the configurations of AWS resources. It continuously monitors and records the configuration changes of the resources and evaluates them against desired configurations and best practices. It also provides a detailed view of the resource configuration history and relationships, as well as compliance reports and notifications. AWS Config can help users maintain consistent and secure configurations, troubleshoot issues, and simplify compliance auditing. AWS Config OverviewAWS Certified Cloud Practitioner - aws.amazon.com

Architecture optimization is the best practice for cost governance that this example shows. Architecture optimization is the process of designing and implementing AWS solutions that are efficient, scalable, and cost-effective. By using specific AWS services to improve efficiency and reduce cost, the company is following the architecture optimization best practice. Some of the techniques for architecture optimization include using the right size and type of resources, leveraging elasticity and scalability, choosing the most suitable storage class, and using serverless and managed services2.

 Amazon Rekognition is a service that provides deep learning-based image and video analysis. One of the benefits of Amazon Rekognition is the ability to detect objects that appear in pictures, such as faces, landmarks, animals, text, and scenes. This can enable applications to perform tasks such as face recognition, face verification, face comparison, face search, celebrity recognition, emotion detection, age range estimation, gender identification, facial analysis, facial expression recognition, and more. Amazon Rekognition OverviewAWS Certified Cloud Practitioner - aws.amazon.com

 According to the AWS shared responsibility model, the customer is responsible for configuring logical access controls for resources, and protecting account credentials. This includes managing IAM user permissions, security group rules, network ACLs, encryption keys, and other aspects of access management1. AWS is responsible for protecting the global infrastructure that runs all of the services offered in the AWS Cloud, such as the hardware, software, networking, and facilities. AWS isalso responsible for configuring the security used by managed services, such as Amazon RDS, Amazon DynamoDB, and Amazon Aurora2.

Security of the cloud refers to the security of the cloud infrastructure that runs all the AWS services. This includes the hardware, software, networking, and facilities that AWS operates and manages. AWS is responsible for protecting the security of the cloud as part of the AWS shared responsibility model. Availability of AWS services such as Amazon EC2 refers to the ability of the services to be up and running and to meet the expected performance. Availability is part of the reliability pillar of the AWS Well-Architected Framework and is a shared responsibility between AWS and the customer . Implementation of password policies for IAM users refers to the security of the customer data and applications in the cloud. This includes the configuration and management of IAM user permissions, encryption keys, security group rules, network ACLs, and other aspects of access management. The customer is responsible for protecting the security in the cloud as part of the AWS shared responsibility model. Security of customer environments by using AWS Network Firewall partners refers to the security of the customer data and applications in the cloud. AWS Network Firewall is a managed service that provides network protection for Amazon VPCs. It allows customers to use AWS Marketplace partners to implement firewall rules and policies. The customer is responsible for protecting the security in the cloud as part of the AWS shared responsibility model .

Amazon Athena is the AWS service that the developer should use to write a simple query that can read all of the .csv files stored in an Amazon S3 bucket and generate a summary report. Amazon Athena is an interactive query service that allows users to analyze data in Amazon S3 using standard SQL. Amazon Athena does not require any server setup or management, and users only pay for the queries they run. Amazon Athena can handle various data formats, including .csv, and can integrate with other AWS services such as Amazon QuickSight for data visualization

To maximize sustainability and minimize environmental impact, a company should apply the following design principles to AWS Cloud workloads: maximize utilization of Amazon EC2 instances and reduce the need for users to reinstall applications. Maximizing utilization of Amazon EC2 instances means that the company can optimize the performance and efficiency of their compute resources, and avoid wasting energy and money on idle or underutilized instances. The company can use features such as Amazon EC2 Auto Scaling, Amazon EC2 Spot Instances, and AWS Compute Optimizer to automatically adjust the number and type of instances based on demand, cost, and performance. Reducing the need for users to reinstall applications means that the company can minimize the amount of data and bandwidth required to deliver their applications to users, and avoid unnecessary downloads and updates that consume energy and resources. The company can use services such as Amazon CloudFront, AWS AppStream 2.0, and AWS Amplify to deliver their applications faster, more securely, and more efficiently to users across the globe. Minimizing utilization of Amazon EC2 instances, minimizing usage of managed services, and forcing frequent application reinstallations by users are not design principles that would maximize sustainability and minimize environmental impact. Minimizing utilization of Amazon EC2 instances would reduce the performance and efficiency of the compute resources, and potentially increase the costs and complexity of the cloud workloads. Minimizing usage of managed services would increase the operational overhead and responsibility of the company, and potentially expose them to more security and reliability risks. Forcing frequent application reinstallations by users would increase the amount of data and bandwidth required to deliver the applications to users, and potentially degrade the user experience and satisfaction.

AWS WAF is the AWS service that the company should use to configure rules to identify threats and protect applications from malicious network access. AWS WAF is a web application firewall that helps to filter, monitor, and block malicious web requests based on customizable rules. AWS WAF can be integrated with other AWS services, such as Amazon CloudFront, Amazon API Gateway, and Application Load Balancer. For more information, see What is AWS WAF? and How AWS WAF Works.

The company should deploy the EC2 instances across multiple Availability Zones to design a highly available application. Availability Zones are isolated locations within an AWS Region that are engineered to be fault-tolerant and operate independently of each other. By deploying the EC2 instances across multiple Availability Zones, the company can ensure that their application can withstand the failure of an entire Availability Zone and continue to operate with minimal disruption. Deploying the EC2 instances across multiple edge locations, VPCs, or AWS accounts will not provide the same level of availability and fault tolerance as Availability Zones. Edge locations are part of the Amazon CloudFront service, which is a content delivery network (CDN) that caches and serves webcontent to users. VPCs are virtual networks that isolate the AWS resources within an AWS Region. AWS accounts are the primary units of ownership and access control for AWS resources12

 Pay-as-you-go pricing is the feature of the AWS Cloud that gives users the ability to pay based on current needs rather than forecasted needs. Pay-as-you-go pricing means that users only pay for theAWS services and resources they use, without any upfront or long-term commitments. This allows users to scale up or down their usage depending on their changing business requirements, and avoid paying for idle or unused capacity. Pay-as-you-go pricing also enables users to benefit from the economies of scale and lower costs of AWS as they grow their business5

 AWS Regions are geographic areas around the world where AWS has clusters of data centers. Each AWS Region consists of multiple, isolated, and physically separate AZ’s within a geographic area. By hosting the customer’s data in a specific AWS Region, the company can meet the requirement of hosting the data in the customer’s country. AWS Shield is a service that provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. Amazon S3 Object Lock is afeature that allows you to store objects using a write-once-read-many (WORM) model. You can use it to prevent an object from being deleted or overwritten for a fixed amount of time or indefinitely. Placement groups are logical grouping of instances within a single Availability Zone. Placement groups enable applications to participate in a low-latency, 10 Gbps network. None of these services or infrastructure components can help the company host the customer’s data in a different country.

 Access keys are long-term credentials that consist of an access key ID and a secret access key. You use access keys to sign programmatic requests that you make to AWS using the AWS CLI or AWS API1. User name and password are credentials that you use to sign in to the AWS Management Console or the AWS Management Console mobile app2. SSH public keys are credentials that you use to authenticate with EC2 instances that are launched from certain Linux AMIs3. AWS Key Management Service (AWS KMS) keys are customer master keys (CMKs) that you use to encrypt and decrypt your data and to control access to your data across AWS services and in your applications4.

 The correct answer is C because learning to improve from operational failures is a recommended design principle of the AWS Well-Architected Framework. The AWS Well-Architected Framework is a set of best practices and guidelines for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud. The AWS Well-Architected Framework consists of five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization. Each pillar has a set of design principles that describe the characteristics of a well-architected system. Learning to improve from operational failures is a design principle of the operational excellence pillar, which focuses on running and monitoring systems to deliver business value and continually improve supporting processes and procedures. The other options are incorrect because they are not recommended design principles of the AWS Well-Architected Framework. Reducing downtime by making infrastructure changes infrequently and in large increments is not a design principle of the AWS Well-Architected Framework, but rather a source of risk and inefficiency. A well-architected system should implement changes frequently and in small increments to minimize the impact and scope of failures. Investing the time to configure infrastructure manually is not a design principle of the AWS Well-Architected Framework, but rather a source of human error and inconsistency. A well-architected system should automate manual tasks to improve the speed and accuracy of operations. Using monolithic application design for centralization is not a design principle of the AWS Well-Architected Framework, but rather a source of complexity and rigidity. A well-architected system should use loosely coupled and distributed components to enable scalability and resilience. Reference: [AWS Well-Architected Framework]

The correct answer is C because Amazon QuickSight is an AWS service that will provide the dashboards and charts for the insights from business data. Amazon QuickSight is a fully managed, scalable, and serverless business intelligence service that enables users to create and share interactive dashboards and charts. Amazon QuickSight can connect to various data sources, such as Amazon S3, Amazon RDS, Amazon Redshift, and more. Amazon QuickSight also provides users with machine learning insights, such as anomaly detection, forecasting, and natural languagenarratives. The other options are incorrect because they are not AWS services that will provide the dashboards and charts for the insights from business data. Amazon Macie is an AWS service that helps users discover, classify, and protect sensitive data stored in Amazon S3. Amazon Aurora is an AWS service that provides a relational database that is compatible with MySQL and PostgreSQL. AWS CloudTrail is an AWS service that enables users to track user activity and API usage across their AWS account. Reference: Amazon QuickSight FAQs

The correct answer is B because Amazon ElastiCache is a service that provides in-memory data storage. Amazon ElastiCache is a fully managed, scalable, and high-performance service that supports two popular open-source in-memory engines: Redis and Memcached. Amazon ElastiCache allows users to store and retrieve data from fast, low-latency, and high-throughput in-memory systems. Users can use Amazon ElastiCache to improve the performance of their applications by caching frequently accessed data, reducing database load, and enabling real-time data processing. The other options are incorrect because they are not services that provide in-memory data storage. Amazon DynamoDB is a service that provides key-value and document data storage. Amazon RDS is a service that provides relational data storage. Amazon Timestream is a service that provides time series data storage. Reference: Amazon ElastiCache FAQs

 The ability to deploy to AWS on a global scale is a cloud benefit that AWS offers to its users. AWS has a global infrastructure that consists of AWS Regions, Availability Zones, and edge locations. Users can choose from multiple AWS Regions around the world to deploy their applications and data closer to their end users, while also meeting their compliance and regulatory requirements. Users can also leverage AWS services, such as Amazon CloudFront, Amazon Route 53, and AWS Global Accelerator, to improve the performance and availability of their global applications. AWS also provides tools and guidance to help users optimize their global deployments, such as AWS Well-Architected Framework, AWS CloudFormation, and AWS Migration Hub. AWS Global Infrastructure [AWS Cloud Value Framework] AWS Certified Cloud Practitioner - aws.amazon.com

 AWS Artifact is the AWS service that can provide security and compliance documents for an upcoming audit. AWS Artifact is a self-service portal that allows users to access and download AWS compliance reports and agreements. These documents provide evidence of AWS’s compliance with global, regional, and industry-specific security standards and regulations

Deploying the application by using multiple Availability Zones is the best way to increase resilience for the application. According to the Amazon RDS User Guide, " Amazon RDS provides high availability and failover support for DB instances using Multi-AZ deployments. In a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. The primary DB instance is synchronously replicated across Availability Zones to a standby replica to provide data redundancy, eliminate I/O freezes, and minimize latency spikes during system backups. " 4 Deploying a copy of the application in another AWS account, using multiple VPCs, or using multiple subnets do not provide the same level of resilience as using multiple Availability Zones.

 Operations is an option that is a perspective that includes foundational capabilities of the AWS Cloud Adoption Framework (AWS CAF). Operations is one of the six perspectives of the AWS CAF, along with business, people, governance, platform, and security. Operations focuses on the processes and procedures to support the ongoing management and maintenance of the cloud-based IT assets. It covers topics such as monitoring, backup and recovery, change management, incident management, and automation5. Sustainability is not a perspective of the AWS CAF, but a concept that refers to the ability of a system to operate in an environmentally friendly and socially responsible manner. Performance efficiency is not a perspective of the AWS CAF, but a pillar of the AWS Well-Architected Framework. It focuses on using the right resources and services for the workload, monitoring performance, and continuously improving the efficiency of the solution. Reliability is not a perspective of the AWS CAF, but a pillar of the AWS Well-Architected Framework. It focuses on the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues.

AWS Pricing Calculator is a web-based planning tool that customers can use to create estimates for their AWS use cases. They can use it to model their solutions before building them, explore the AWS service price points, and review the calculations behind their estimates. Therefore, the correct answer is A. You can learn more about AWS Pricing Calculator and how it works.

AWS CloudTrail is an AWS service that enables users to accomplish the task of recording API calls made to AWS services. AWS CloudTrail is a service that tracks user activity and API usage across the AWS account. AWS CloudTrail records the details of every API call made to AWS services, such as the identity of the caller, the time of the call, the source IP address of the caller, the parameters and responses of the call, and more. Users can use AWS CloudTrail to audit, monitor, and troubleshoot their AWS resources and actions. The other options are incorrect because they are not tasks that users can accomplish using AWS CloudTrail. Generating an IAM user credentials report is a task that users can accomplish using IAM, which is an AWS service that enables users to manage access and permissions to AWS resources and services. Assessing the compliance of AWS resource configurations with policies and guidelines is a task that users can accomplish using AWS Config, which is an AWS service that enables users to assess, audit, and evaluate the configurations of their AWS resources. Ensuring that Amazon EC2 instances are patched with the latest security updates is a task that users can accomplish using AWS Systems Manager, which is an AWS service that enables users to automate operational tasks, manage configuration and compliance, and monitor system health and performance. Reference: AWS CloudTrail FAQs

 Patch management and configuration management are controls that are the responsibility of both AWS and AWS customers, according to the AWS shared responsibility model. Patch management is the process of applying updates to software and applications to fix vulnerabilities, bugs, or performance issues. Configuration management is the process of defining and maintaining the settings and parameters of systems and applications to ensure their consistency and reliability. AWS is responsible for patching and configuring the software and services that it manages, such as the AWS global infrastructure, the hypervisor, and the AWS managed services. The customer is responsible for patching and configuring the software and services that they manage, such as the guest operating system, the applications, and the AWS customer-managed services. Physical and environmental controls are the responsibility of AWS, according to the AWS shared responsibility model. Physical and environmental controls are the measures that protect the physical security and availability of the AWS global infrastructure, such as power, cooling, fire suppression, and access control. AWS is responsible for maintaining these controls and ensuring the resilience and reliability of the AWS Cloud. Account structures are the responsibility of the customer, according to the AWS shared responsibility model. Account structures are the ways that customers organize and manage their AWS accounts and resources, such as using AWS Organizations, IAM users and roles, resource tagging, and billing preferences. The customer is responsible for creating and configuring these structures and ensuring the security and governance of their AWS environment. Choice of the AWS Region where data is stored is the responsibility of the customer, according to the AWS sharedresponsibility model. AWS Regions are geographic areas that consist of multiple isolated Availability Zones. Customers can choose which AWS Region to store their data and run their applications, depending on their latency, compliance, and cost requirements. The customer is responsible for selecting the appropriate AWS Region and ensuring the data sovereignty and regulatory compliance of their data.

AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle1. Amazon S3 is a storage service that does not offer automatic rotation of credentials. AWS Systems Manager Parameter Store is a service that provides secure, hierarchical storage for configuration data management and secrets management2, but it does not offer automatic rotation of credentials. AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account3, but it does not store or rotate credentials.

Amazon RDS is the AWS service that will meet the requirements of migrating a relational database server to the AWS Cloud and minimizing administrative overhead of database maintenance tasks. Amazon RDS is a fully managed relational database service that handles routine database tasks, such as provisioning, patching, backup, recovery, failure detection, and repair. Amazon RDS supports several database engines, such as MySQL, PostgreSQL, Oracle, SQL Server, and Amazon Aurora5.

The correct answers are A and B because Service Quotas console and AWS Trusted Advisor are AWS services or tools that can report on the quotas so that the company can improve the reliability of the application. Service Quotas console is an AWS tool that enables users to view and manage their quotas for AWS services from a central location. Users can use Service Quotas console to request quota increases, track quota usage, and set up alarms for approaching quota limits. AWS Trusted Advisor is an AWS service that provides real-time guidance to help users follow AWS best practices for security, performance, cost optimization, and fault tolerance. One of the categories of checks that AWS Trusted Advisor performs is service limits, which monitors the usage of each AWS service and alerts users when they are close to reaching the default limit. The other options are incorrect because they are not AWS services or tools that can report on the quotas so that the company can improve the reliability of the application. AWS Systems Manager is an AWS service that enables users to automate operational tasks, manage configuration and compliance, and monitor system health and performance. AWS Shield is an AWS service that protects users from distributed denial of service (DDoS) attacks. AWS Cost Explorer is an AWS tool that enables users to visualize, understand, and manage their AWS costs and usage. Reference: Service Quotas, AWS Trusted Advisor FAQs

 AWS Organizations is an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage. AWS Organizationsincludes consolidated billing and account management capabilities that enable you to better meet the budgetary, security, and compliance needs of your business1.

 The correct answers are C and D because S3 bucket policies and IAM user policies are AWS features that will meet the requirements. S3 bucket policies are access policies that can be attached to Amazon S3 buckets to grant or deny permissions to the bucket and the objects it contains. S3 bucket policies can be used to control who has permission to read, write, or delete objects that the company stores in the S3 bucket. IAM user policies are access policies that can be attached to IAM users to grant or deny permissions to AWS resources and actions. IAM user policies can be used to control who has permission to read, write, or delete objects that the company stores in the S3 bucket. The other options are incorrect because they are not AWS features that will meet the requirements. Security groups and network ACLs are AWS features that act as firewalls to control inbound and outbound traffic to and from Amazon EC2 instances and subnets. Security groups andnetwork ACLs do not control who has permission to read, write, or delete objects that the company stores in the S3 bucket. S3 bucket versioning is an AWS feature that enables users to keep multiple versions of the same object in the same bucket. S3 bucket versioning can be used to recover from accidental overwrites or deletions of objects, but it does not control who has permission to read, write, or delete objects that the company stores in the S3 bucket. Reference: Using Bucket Policies and User Policies, Security Groups for Your VPC, Network ACLs, [Using Versioning]

 Server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and server-side encryption with AWS KMS managed keys (SSE-KMS) are the encryption types that can be used to protect objects at rest in Amazon S3. Server-side encryption means that Amazon S3 encrypts the objects before saving them on disks and decrypts them when they are downloaded. SSE-S3 uses one master key per bucket that is managed by Amazon S3. SSE-KMS uses a customer master key (CMK) that is stored in AWS Key Management Service (AWS KMS) and provides additional benefits, such as audit trails and key rotation. For more information, see Protecting Data Using Server-Side Encryption and Protecting Data Using Encryption.

 The correct answer is C because AWS CloudHSM is an AWS service that enables the security engineer to meet the requirements. AWS CloudHSM is a service that provides customers with dedicated hardware security modules (HSMs) to create, control, and manage their own cryptographic keys in the AWS Cloud. AWS CloudHSM allows customers to meet strict regulatory compliance requirements for data security, such as FIPS 140-2 Level 3, PCI-DSS, and HIPAA. The other options are incorrect because they are not AWS services that enable the security engineer to meet the requirements. AWS Key Management Service (AWS KMS) is a service that provides customers with a fully managed, scalable, and integrated key management system to create and control encryption keys for AWS services and applications. AWS KMS does not provide customers with single-tenant or dedicated HSMs. AWS Certificate Manager (ACM) is a service that provides customers with a simple and secure way to provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and internal connected resources. ACM does not provide customers with HSMs or cryptographic keys. AWS Systems Manager is a service that provides customers with a unified user interface to view operational data from multiple AWS services and automate operational tasks across their AWS resources. AWS Systems Manager does not provide customers with HSMs or cryptographic keys. Reference: AWS CloudHSM FAQs

The architecture concept of the AWS Cloud that meets the requirements of the company that wants to migrate to the AWS Cloud and needs the ability to acquire and release resources as needed is elasticity. Elasticity means that AWS customers can quickly and easily provision and scale up or down AWS resources as their demand changes, without any upfront costs or long-term commitments. AWS provides various tools and services that enable customers to achieve elasticity, such as Amazon EC2 Auto Scaling, Amazon CloudWatch, and AWS CloudFormation. Elasticity helps customers optimize their performance, availability, and cost efficiency. Availability, reliability, and durability are other architecture concepts of the AWS Cloud, but they are not directly related to the ability to acquire and release resources as needed. Availability means that AWS customers can access their AWS resources and applications whenever and wherever they need them. Reliability means that AWS customers can depend on their AWS resources and applications to functioncorrectly and consistently. Durability means that AWS customers can preserve their data and objects for long periods of time without loss or corruption12

Scaling horizontally across multiple Availability Zones is a way to adopt a highly available architecture, as it increases the fault tolerance and resilience of the application. Scaling vertically to a larger EC2 instance size is a way to improve the performance of the application, but it does not improve the availability. Purchasing an EC2 Dedicated Instance is a way to isolate the instance from other AWS customers, but it does not improve the availability. Changing the EC2 instance family to a compute optimized instance is a way to optimize the instance type for the workload, but it does not improve the availability. These concepts are explained in the AWS Well-Architected Framework2.

Amazon EC2 is a service that provides resizable compute capacity in the cloud. Users can launch and manage virtual servers, known as instances, that run on the AWS infrastructure. Users are responsible for maintaining the underlying operating system of the instances, as well as any applications or software that run on them. Amazon DynamoDB is a service that provides a fully managed NoSQL database that delivers fast and consistent performance at any scale. Users do not need to manage the underlying operating system or the database software. Amazon S3 is a service that provides scalable and durable object storage in the cloud. Users do not need to manage the underlying operating system or the storage infrastructure. AWS Lambda is a service that allows users to run code without provisioning or managing servers. Users only need to upload their code and configure the triggers and parameters. AWS Lambda takes care of the underlying operating system and the execution environment.

 AWS Budgets allows you to set custom budgets that alert you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount. You can also use AWS Budgets to set reservation utilization or coverage targets and receive alerts when your utilization drops below the threshold you define. AWS Budgets provides you with a comprehensive view of your cost and usage, as well as your reservation utilization and coverage1.

The security best practices that should be followed are A and E.

A. Grant the developer access to only the AWS resources needed to perform the job. This is an example of the principle of least privilege, which means giving the minimum permissions necessary to achieve a task. This reduces the risk of unauthorized access, data leakage, or accidental damage to AWS resources.You canuse AWS Identity and Access Management (IAM) to create users, groups, roles, and policies that grant fine-grained access to AWS resources12.

E. Ensure the account password policy requires a minimum length. This is a basic security measure that helps prevent brute-force attacks or guessing of passwords. A longer password is harder to crack than a shorter one.You can use IAM to configure apassword policy that enforces a minimum password length, as well as other requirements such as complexity, expiration, and history34.

B. Share the AWS account root user credentials with the developer. This is a bad practice that should be avoided. The root user has full access to all AWS resources and services, and can perform sensitive actions such as changing billing information, closing the account, or deleting all resources. Sharing the root user credentials exposes your account to potential compromise or misuse.You should never share your root user credentials with anyone, and use them only for account administration tasks5.

C. Add the developer to the administrator’s group in IAM. This is also a bad practice that should be avoided. The administrator’s group has full access to all AWS resources and services, which is more than what a developer needs to perform their job. Adding the developer to the administrator’s group violates the principle of least privilege and increases the risk of unauthorized access, data leakage, or accidental damage to AWS resources.You should create a custom group for the developer that grants only the necessary permissions for their role12.

D. Configure a password policy that ensures the developer’s password cannot be changed. This is another bad practice that should be avoided. Preventing the developer from changing their password reduces their ability to protect their credentials and comply with security policies. For example, if the developer’s password is compromised, they cannot change it to prevent further unauthorized access. Or if the company requires periodic password rotation, they cannot update their password to meet this requirement.You should allow the developer to change their password as needed, and enforce a password policy that sets reasonable rules for password management34.

AWS Elastic Beanstalk is the AWS service that allows customers to deploy applications in the AWS Cloud as quickly as possible. AWS Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, and auto-scaling to application health monitoring. Customers can upload their code and Elastic Beanstalk will take care of the rest1. AWS Elastic Beanstalk also minimizes the complexity that is related to the management of AWS resources. Customers can retain full control of the underlying AWS resources powering their applications and adjust the settings to suittheir needs1. Customers can also use the AWS Management Console, the AWS Command Line Interface (AWS CLI), or APIs to manage their applications1.

AWS Config is the AWS service that enables customers to assess, audit, and evaluate the configurations of their AWS resources. AWS Config continuously monitors and records the configuration changes of the resources and evaluates them against desired configurations or best practices2. AWS Config does not help customers deploy applications in the AWS Cloud as quickly as possible or minimize the complexity that is related to the management of AWS resources.

Amazon EC2 is the AWS service that provides secure, resizable compute capacity in the cloud. Customers can launch virtual servers called instances and choose from various configurations of CPU, memory, storage, and networking resources3. Amazon EC2 does not automatically handle the deployment or management of AWS resources for customers. Customers have to manually provision, configure, monitor, and scale their instances and other related resources.

Amazon Personalize is the AWS service that enables customers to create personalized recommendations for their users based on their behavior and preferences. Amazon Personalize uses machine learning to analyze data and deliver real-time recommendations4. Amazon Personalize does not help customers deploy applications in the AWS Cloud as quickly as possible or minimize the complexity that is related to the management of AWS resources.

AWS Managed Services is a service that provides operational management for AWS infrastructure and applications. It helps users migrate their workloads to AWS and provides ongoing support, security, compliance, and automation. AWS Trusted Advisor is a service that provides best practices and recommendations for cost optimization, performance, security, and fault tolerance. AWS Consulting Partners are professional services firms that help customers design, architect, build, migrate, and manage their workloads and applications on AWS. AWS Artifacts is a service that provides on-demand access to AWS compliance reports and select online agreements.

S3 Versioning is a feature that allows you to keep multiple versions of an object in the same bucket. You can use S3 Versioning to protect your data from accidental deletion or overwriting by enabling it on a bucket or a specific object. S3 Versioning also allows you to restore previous versions of an object if needed. S3 Lifecycle rules are used to automate the transition of objects between storage classes or to expire objects after a certain period of time. S3 bucket policies are used to control access to the objects in a bucket. S3 server-side encryption is used toencrypt the data at rest in S3. References: S3 Versioning, S3 Lifecycle rules, S3 bucket policies, S3 server-side encryption

 AWS Outposts is a fully managed service that extends AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hybrid experience. AWS Outposts enables you to run AWS services in your on-premises data center1.

Savings Plans are an AWS pricing model or offering that can meet the requirements of seeking cost savings in exchange for a commitment to use a specific amount of an AWS service or category of AWS services for 1 year or 3 years. Savings Plans are flexible plans that offer significant discounts on AWS compute usage, such as EC2, Lambda, and Fargate. The company can choose from two types of Savings Plans: Compute Savings Plans and EC2 Instance Savings Plans. Compute Savings Plans provide the most flexibility and apply to any eligible compute usage, regardless of instance family, size, region, operating system, or tenancy. EC2 Instance Savings Plans provide more savings and apply to a specific instance family within a region. The company can select the amount of compute usage per hour (e.g., $10/hour) that they want to commit to for the duration of the plan (1 year or 3 years). The company will pay the discounted Savings Plan rate for the amount of usage that matches their commitment, and the regular on-demand rate for any usage beyond that

 AWS Personal Health Dashboard and AWS Service Health Dashboard are two AWS services that can help the company to verify that underlying AWS services and general AWS infrastructure are operating normally. AWS Personal Health Dashboard provides a personalized view into the performance and availability of the AWS services you are using, as well as alerts that are automatically triggered by changes in the health of those services. In addition to event-based alerts, Personal Health Dashboard provides proactive notifications of scheduled activities, such as any changes to the infrastructure powering your resources, enabling you to better plan for events that may affect you. These notifications can be delivered to you via email or mobile for quick visibility, and can always be viewed from within the AWS Management Console. When you get an alert, it includes detailed information and guidance, enabling you to take immediate action to address AWS events impacting your resources3. AWS Service Health Dashboard provides a general status of AWS services, and the Service health view displays the current and historical status of all AWS services. This page shows reported service events for services across AWS Regions. You don’t need to sign in or have an AWS account to access the AWS Service Health Dashboard – Service health page. You can also subscribe to RSS feeds for specific services or regions to receive notifications about service events4. References: Gettingstarted with your AWS Health Dashboard – Your account health, Introducing AWS Personal Health Dashboard

Convertible Reserved Instances (RIs) are a type of Reserved Instance that allow you to change the attributes of the RI as long as the exchange results in the creation of Reserved Instances of equal or greater value. You can exchange Convertible RIs for other Convertible RIs from a different instance family, size, platform, tenancy, or scope (Region or Availability Zone)3.

AWS Artifact is a service that provides on-demand access to AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI) reports, and Service Organization Control (SOC) reports. You can download these documents and submit them as evidence to your auditors or regulators to demonstrate the security and compliance of the AWS infrastructure and services that you use. AWS Artifact also allows you to review, accept, and manage AWS agreements, such as the Business Associate Addendum (BAA) for customers who are subject to the Health Insurance Portability and Accountability Act (HIPAA). References: AWS Artifact, What is AWS Artifact?

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. It works seamlessly with services including AWS Shield for DDoS mitigation, Amazon S3, Elastic Load Balancing or Amazon EC2 as origins for your applications, and Lambda@Edge to run custom code closer to customers’ users and to customize the user experience. By using CloudFront, you can cache your content at the edge locations that are closest to your end users, reducing the network latency and improving theperformance of your application. CloudFront also offers a pay-as-you-go pricing model, so you only pay for the data transfer and requests that you use.

The AWS service that the company should use to meet these requirements is A. AWS Snowmobile.

AWS Snowmobile is a service that allows you to migrate large amounts of data to AWS using a 45-foot long ruggedized shipping container that can store up to 100 petabytes of data. AWS Snowmobile is designed for situations where you need to move massive amounts of data to the cloud in a fast, secure, and cost-effective way.AWS Snowmobile has the least possible operational overhead because it eliminates the need to buy, configure, or manage hundreds or thousands of storage devices12.

AWS Snowball Edge is a service that allows you to migrate data to AWS using a physical device that can store up to 80 terabytes of data and has compute and storage capabilities to run applications on the device. AWS Snowball Edge is suitable for situations where you have limited or intermittent network connectivity, or where bandwidth costs are high.However, AWS Snowball Edge has more operational overhead than AWS Snowmobile because you need to request multiple devices and transfer your data onto them using the client3.

AWS Data Exchange is a service that allows you to find, subscribe to, and use third-party data in the cloud.AWS Data Exchange is not a data migration service, but rather a data marketplace that enables data providers and data consumers to exchange data sets securely and efficiently4.

AWS Database Migration Service (AWS DMS) is a service that helps migrate databases to AWS.AWS DMS does not migrate file storage data, but rather supports various database platforms and engines as sources and targets5.

 Amazon S3 and Amazon EBS are two AWS services that can be used to store files . Amazon S3 is an object storage service that offers high scalability, durability, availability, and performance. Amazon EBS is a block storage service that provides persistent and low-latency storage volumes for Amazon EC2 instances. AWS Lambda, Amazon SageMaker, and AWS Storage Gateway are other AWS services that have different purposes, such as serverless computing, machine learning, and hybrid cloud storage .

 Amazon Elastic File System (Amazon EFS) is a service that provides a scalable and elastic file system for Linux-based workloads. It can be mounted on multiple Amazon EC2 instances across different Availability Zones within a region, allowing applications to access a common set of files1. AWS Backup is a service that provides a centralized and automated way to back up data across AWS services. Amazon Elastic Block Store (Amazon EBS) is a service that provides persistent block storage volumes for Amazon EC2 instances. AWS Snowball Edge Storage Optimized is a device that provides a petabyte-scale data transport and edge computing solution.

This is the pillar of the AWS Well-Architected Framework that represents the philosophy of testing failure scenarios regularly and validating the understanding of the impact of potential failures. The operational excellence pillar covers the best practices for designing, running, monitoring, and improving systems in the AWS Cloud. Testing failure scenarios is one of the ways to improve the system’s resilience, reliability, and recovery. You can learn more about the operational excellence pillar from this whitepaper or this digital course.

AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for all of your Amazon Virtual Private Clouds (VPCs). The service can be set up with just a few clicks from the AWS console or using APIs. AWS Network Firewall automatically scales with your network traffic, so you don’t have to worry about deploying and managing any infrastructure. AWS Network Firewall provides protection from common network threats such as SQL injection, cross-site scripting, and DDoS attacks1.

The architecture deployment model that the company should use to meet this requirement is A. Multi-Region.

A multi-region deployment model is a cloud computing architecture that distributes an application and its data across multiple geographic regions. A multi-region deployment model enables a company to achieve global reach, high availability, disaster recovery, and performance optimization.By deploying an application inmultiple regions, a company can serve customers from the nearest region, reduce latency, increase redundancy, and comply with data sovereignty regulations12.

A single-region deployment model is a cloud computing architecture that runs an application and its data within a single geographic region. A single-region deployment model is simpler and cheaper than a multi-region deployment model, but it has limited scalability, availability, and performance.A single-region deployment model may notbe suitable for a company that wants to deploy an application globally, as it may face challenges such as network latency, regional outages, or regulatory compliance12.

A multi-AZ (Availability Zone) deployment model is a cloud computing architecture that distributes an application and its data across multiple isolated locations within a single region. An Availability Zone is a physically separate location within an AWS Region that has independent power, cooling, and networking.A multi-AZ deployment model enhances the availability and durability of an application by providing redundancy and fault tolerance within a region34.

A single-AZ deployment model is a cloud computing architecture that runs an application and its data within a single Availability Zone. A single-AZ deployment model is the simplest and most cost-effective option, but it has no redundancy or fault tolerance.A single-AZ deployment model may not be suitable for a company that wants to deploy an application globally, as it may face challenges such as network latency, regional outages, or regulatory compliance34.

C is correct because turning on multi-factor authentication (MFA) for added security during the login process is one of the IAM security best practices recommended by AWS. MFA adds an extra layer of protection on top of the user name and password, making it harder for attackers to access the AWS account. A is incorrect because using the account root user access keys for administrative tasks is not a good practice, as the root user has full access to all the resources in the AWS account and can cause irreparable damage if compromised. AWS recommends creating individual IAM users with the least privilege principle and using roles for applications that run on Amazon EC2 instances. B is incorrect because granting broad permissions so that all company employees can access the resources they need is not a good practice, as it increases the risk of unauthorized or accidental actions on the AWS resources. AWS recommends granting only the permissions that are required to perform a task and using groups to assign permissions to IAM users. D is incorrect because avoiding rotating credentials to prevent issues in production applications is not a good practice, as it increases the risk of credential leakage or compromise. AWS recommends rotating credentials regularly and using temporary security credentials from AWS STS when possible.

Amazon EC2 M1 Mac instances are the AWS service or resource that the company should use for its iOS application development and build activities, as they enable users to run macOS on AWS and access a broad and growing set of AWS services. AWS CodeCommit is a service that provides a fully managed source control service that hosts secure Git-based repositories. AWS Amplify is a set of tools and services that enable developers to build full-stack web and mobile applications using AWS. AWS App Runner is a service that makes it easy for developers to quickly deploy containerized web applications and APIs. These concepts are explained in the AWS Developer Tools page4.

 Amazon Cognito is a service that provides identity management for mobile and web applications, allowing users to sign up, sign in, and access AWS resources with different identity providers. AWS Security Hub is a service that provides a comprehensive view of the security posture of AWS accounts and resources. AWS Shield is a service that provides protection against distributed denial of service (DDoS) attacks. AWS WAF is a web application firewall that helps protect web applications from common web exploits.

The scenario represents the operational excellence pillar of the AWS Well-Architected Framework, which focuses on running and monitoring systems to deliver business value and continually improve supporting processes and procedures1. Security, performance efficiency, cost optimization, and reliability are the other four pillars of the framework1.

AWS Outposts is an AWS service that extends AWS infrastructure, services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility. AWS Outposts enables you to run Amazon EC2 instances and other AWS services locally, while maintaining a consistent and seamless connection to the AWS Cloud. AWS Outposts is ideal for workloads that require low latency, local data processing, or data residency. By using AWS Outposts, the company can process personallyidentifiable information (PII) and keep data in the country where it was generated, while leveraging the benefits of AWS

 The AWS Cloud offers many benefits, such as:

Trade variable expenses for capital expenses: You can pay only for the resources you use, instead of investing in fixed costs upfront. This reduces the risk and complexity of planning and managing your IT infrastructure4

Deploy globally in minutes: You can leverage the global infrastructure of AWS to deploy your applications and data in multiple regions and availability zones. This enables you to reach your customers faster, improve performance, and increase reliability5

Pay-as-you-go pricing is one of the main benefits of AWS. With pay-as-you-go pricing, you pay only for what you use, when you use it. There are no long-term contracts, termination fees, or complex licensing. You replace upfront expenses with lower variable costs and pay only for the resources you consume.

 The AWS Well-Architected Framework helps you understand the pros and cons of decisions you make while building systems on AWS. By using the Framework, you will learn architectural best practices for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud. The Framework consists of five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization2.

Amazon EC2 On-Demand Instances are instances that let you pay for compute capacity by the hour or second (minimum of 60 seconds) with no long-term commitments. This frees you from the costs and complexities of planning, purchasing, and maintaining hardware and transforms what are commonly large fixed costs into much smaller variable costs. On-Demand Instances are suitable for applications with short-term, irregular, or unpredictable workloads that cannot be interrupted, such as periodic applications that run for a few hours most days, but run for 8 hours a day for a week at the end of each month2. Amazon EC2 Standard Reserved Instances are instances that provide you with a significant discount (up to 75%) compared to On-Demand Instance pricing. In exchange, you select a term and make an upfront payment to reserve a certain amount of compute capacity for that term. Reserved Instances are suitable for applications with steady state or predictable usage that require reserved capacity3. AWS Wavelength is a service that enables developers to build applications that deliver ultra-low latency to mobile devices and users by deploying AWS compute and storage at the edge of the 5G network. Wavelength is suitable for applications that requiresingle-digit millisecond latencies, such as game and live video streaming, machine learning inference at the edge, and augmented and virtual reality (AR/VR). Application Load Balancer is a service that operates at the request level (layer 7) and distributes incoming application traffic across multiple targets, such as EC2 instances, containers, Lambda functions, and IP addresses. Application Load Balancer is suitable for applications that need advanced routing capabilities, such as microservices or container-based architectures.

 Security groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. You can use security groups to set rules that allow or deny traffic to or from your instances. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances that are associated with the security group.

AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA). You can use AWS Artifact to download the applicable report for AWS security controls and provide it to the auditor.

 These are two scenarios that represent the concept of elasticity on AWS. Elasticity means the ability to adjust the resources and capacity of the system in response to changes in demand or environment. Scaling the number of Amazon EC2 instances based on traffic means using services such as AWS Auto Scaling or Elastic Load Balancing to add or remove instances as the traffic increases or decreases. Resizing Amazon RDS instances as business needs change means using the Amazon RDS console or API to modify the instance type, storage type, or storage size of the database as the workload grows or shrinks. You can learn more about the concept of elasticity on AWS from [this webpage] or [this digital course] .

The Operations perspective helps you monitor and manage your cloud workloads to ensure that they are delivered at a level that meets your business needs. Common stakeholders include chief operations officer (COO), cloud director, cloud operations manager, and cloud operations engineers1. The Operations perspective covers capabilities such as workload health monitoring, incident management, change management, release management, configuration management, and disaster recovery2.

The Business perspective helps ensure that your cloud investments accelerate your digital transformation ambitions and business outcomes. Common stakeholders include chief executive officer (CEO), chief financial officer (CFO), chief information officer (CIO), and chief technology officer (CTO). The Business perspective covers capabilities such as business case development, value realization, portfolio management, and stakeholder management3.

The Governance perspective helps you orchestrate your cloud initiatives while maximizing organizational benefits and minimizing transformation-related risks. Common stakeholders include chief transformation officer, CIO, CTO, CFO, chief data officer (CDO), and chief risk officer (CRO). The Governance perspective covers capabilities such as governance framework, budget and cost management, compliance management, and data governance4.

The Platform perspective helps you build an enterprise-grade, scalable, hybrid cloud platform, modernize existing workloads, and implement new cloud-native solutions. Common stakeholders include CTO, technology leaders, architects, and engineers. The Platform perspective covers capabilities such as platform design and implementation, workload migration and modernization, cloud-native development, and DevOps5.

The AWS best practice that ensures the most cost-effective architecture for the workload is rightsizing. Rightsizing means selecting the most appropriate instance type or resourceconfiguration that matches the needs of the workload. Rightsizing can help optimize performance and reduce costs by avoiding over-provisioning or under-provisioning of resources1. Loose coupling, caching, and redundancy are other AWS best practices that can improve the scalability, availability, and performance of the workload, but they do not necessarily ensure the most cost-effective architecture.

Amazon EC2 is a web service that provides secure, resizable compute capacity in the cloud. It allows you to launch virtual servers, called instances, with different configurations of CPU, memory, storage, and networking resources. AWS Compute Optimizer analyzes the specifications and utilization metrics of your Amazon EC2 instances and generates recommendations for optimal instance types that can reduce costs and improve performance. You can view the recommendations on the AWS Compute Optimizer console or the Amazon EC2 console12.

Amazon RDS, Amazon Lightsail, and AWS Step Functions are not supported by AWS Compute Optimizer. Amazon RDS is a managed relational database service that lets you set up, operate, and scale a relational database in the cloud. Amazon Lightsail is an easy-to-use cloud platform that offers everything you need to build an application or website, plus a cost-effective, monthly plan. AWS Step Functions lets you coordinate multiple AWS services into serverless workflows so you can build and update apps quickly3 .

 AWS Shield is an AWS service that provides protection against distributed denial of service (DDoS) attacks for applications that run in the AWS Cloud. DDoS attacks are attempts to make an online service unavailable by overwhelming it with traffic from multiple sources. AWS Shield provides two tiers of protection: AWS Shield Standard and AWS Shield Advanced. AWS Shield Standard is automatically enabled for all AWS customers at no additional charge. It provides protection against common and frequently occurring network and transport layer DDoS attacks. AWS Shield Advanced is an optional paid service that provides additional protection against larger and more sophisticated DDoS attacks. AWS Shield Advanced also provides access to 24/7 DDoS response team, cost protection, and enhanced detection and mitigation capabilities

 AWS Identity and Access Management (IAM) is a service that enables you to manage access to AWS services and resources securely. You can use IAM to perform the following actions:

Control access to AWS service APIs and to other specific resources: You can create users, groups, roles, and policies that define who can access which AWS resources and how. You can also use IAM to grant temporary access to users or applications that need to perform certain tasks on your behalf3

Protect the AWS environment using multi-factor authentication (MFA): You can enable MFA for your IAM users and root user to add an extra layer of security to your AWS account. MFA requires users to provide a unique authentication code from an approved device or SMS text message, in addition to their user name and password, when they sign in to AWS4

The AWS Well-Architected Framework is a set of best practices and guidelines for designing and operating workloads on AWS. It helps customers achieve operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. The framework is based on six pillars, each with its own design principles, best practices, and questions. Customers can use the framework to assess their current state, identify gaps, and implement improvements12.

AWS Support is a service that provides technical assistance, guidance, and resources for AWS customers. It offers different plans with varying levels of access to AWS experts, response times, and features3. AWS Support does not provide a comprehensive framework for operational support.

AWS Cloud Adoption Framework (AWS CAF) is a guidance tool that helps customers plan and execute their cloud migration journey. It provides a set of perspectives, capabilities, and best practices to align the business and technical aspects of cloud adoption4. AWS CAF does not focus on operational support for existing workloads on AWS.

AWS Managed Services (AMS) is a service that operates AWS infrastructure on behalf of customers. It provides a secure and compliant environment, automates commonactivities, and applies best practices for provisioning, patching, backup, recovery, and monitoring5. AMS does not provide a framework for customers to operate their own workloads on AWS.

 Amazon Relational Database Service (Amazon RDS) is a web service that makes it easier to set up, operate, and scale a relational database in the cloud. It provides cost-efficient and resizable capacity, while automating time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups. Amazon RDS supports six popular database engines: Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle Database, and SQL Server. Amazon RDS can support running a copy of a MySQL database in the AWS Cloud, as it offers compatibility, scalability, and availability features.

Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. It’s a fully managed, multi-region, multi-active, durable database with built-in security, backup and restore, and in-memory caching for internet-scale applications. DynamoDB can handle more than 10 trillion requests per day and can support peaks of more than 20 million requests per second. DynamoDB provides the least operational overhead for storing data from a recommendation engine, as it does not require any server provisioning, patching, or maintenance3

AWS Glue is a fully managed extract, transform, and load (ETL) service that makes it easy to prepare and load data for analytics. AWS Glue can discover data sources, transform data, and make it available for analysis by using data catalogs and workflows. Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud that enables customers to analyze data using standard SQL and existing business intelligence tools. Amazon Redshift can also integrate with other AWS services to visualize and transform data. Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully managed elastic NFS file system for use with AWS Cloud services and on-premises resources. Amazon QuickSight is a fast, cloud-powered business intelligence service that makes it easy to deliver insights to everyone in an organization. Amazon Quantum Ledger Database (Amazon QLDB) is a fully managed ledger database that provides a transparent, immutable, and cryptographically verifiable transaction log owned by a central trusted authority.

Amazon Kendra is a highly accurate and easy to use intelligent search service powered by machine learning. It enables users to easily find the content they are looking for, even when it is scattered across multiple locations and content repositories within their organization. Amazon Kendra supports natural language queries, and can search fortext in documents stored in Amazon S3, as well as other sources such as SharePoint, OneDrive, Salesforce, ServiceNow, and more1.

Amazon Rekognition is a computer vision service that makes it easy to add image and video analysis to applications. It can detect objects, faces, text, scenes, activities, and emotions in images and videos. However, it is not designed for searching for text in documents stored in Amazon S32.

Amazon Polly is a text-to-speech service that turns text into lifelike speech. It can create audio versions of books, articles, podcasts, and more. However, it is not designed for searching for text in documents stored in Amazon S33.

Amazon Lex is a service for building conversational interfaces using voice and text. It can create chatbots that can interact with users using natural language. However, it is not designed for searching for text in documents stored in Amazon S34.

AWS customer carbon footprint tool is a tool that helps customers measure and manage their carbon emissions from their AWS usage. It provides data on the carbon intensity, energy consumption, and estimated emissions of AWS services across regions and time periods. It alsoenables customers to review and forecast their emissions, and compare them with industry benchmarks. AWS Health Dashboard is a service that provides personalized information about the health and performance of AWS services and resources. AWS Support Center is a service that provides access to AWS support resources, such as cases, forums, and documentation. Amazon QuickSight is a service that provides business intelligence and analytics for AWS data sources.

AWS Elastic Beanstalk is a service that enables you to quickly deploy and manage applications in the AWS Cloud without worrying about the infrastructure that runs those applications. You simply upload your application, and Elastic Beanstalk automatically handles the details of capacity provisioning, load balancing, scaling, and application health monitoring. Elastic Beanstalk supports several platform configurations for Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker web applications that can run on familiar servers such as Apache, Nginx, Passenger, and IIS. You can also use Elastic Beanstalk to launch a virtual machine (VM) and MySQL database on AWS with theleast operational effort. Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that enables you to easily run, scale, and secure Docker containerized applications on AWS. However, it requires more operational effort than Elastic Beanstalk, as you need to define your application architecture and the specifications of the containers that run it. Amazon Lightsail is an easy-to-use cloud platform that offers everything you need to build an application or website, plus a cost-effective, monthly plan. It is designed for developers who have little or no prior cloud experience and want to launch and manage applications on AWS with minimal complexity. However, it does not support MySQL databases, and it requires more operational effort than Elastic Beanstalk, as you need to configure your VM and database settings. Amazon EC2 is a web service that provides secure, resizable compute capacity in the cloud. It allows you to launch a virtual machine (VM) and MySQL database on AWS, but it requires the most operational effort, as you need to provision, monitor, and manage your EC2 instances and database.

AWS Organizations is a service that helps you centrally manage and govern your AWS environment. You can use AWS Organizations to create multiple accounts for different business units, and group them into organizational units (OUs) that reflect your organizational structure1. By doing so, you can separate and track costs for each business unit using the account ID as a cost allocation tag2. You can also use AWSOrganizations to apply policies and controls to your accounts, such as service control policies (SCPs) and tag policies1.

The other options are not suitable for meeting the requirements with the least operational overhead. Using a spreadsheet or a DynamoDB table to control and record costs for each business unit would require manual data entry and maintenance, which is prone to errors and inconsistencies. Using the AWS Billing console to assign owners to resources and track costs would also require manual tagging of each resource, which is time-consuming and inefficient.

1: What Is AWS Organizations? - AWS Organizations

2: Cost Tagging and Reporting with AWS Organizations | AWS Cloud Financial Management

Amazon S3 is an AWS service that provides scalable, durable, and cost-effective object storage in the cloud. Amazon S3 can store any amount and type of data, such as server logs, and offers various storage classes with different performance and pricing characteristics. Amazon S3 is the most cost-effective option for storing server logs, as it offers low-cost storage classes, such as S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Intelligent-Tiering, that are suitable for infrequently accessed or changing access patterns data. Amazon S3 also integrates with other AWS services, such as Amazon Athena and Amazon OpenSearch Service, that can query the server logs directly from S3 without requiring any additional data loading or transformation. References: Amazon S3, Amazon S3 Storage Classes, Querying Data in Amazon S3

AWS Business Support is the most cost-effective AWS Support plan that provides chat access to a cloud support engineer 24/7. AWS Business Support also offers phone and email support, as well as a response time of less than one hour for urgent issues. AWS Business Support does not include access to infrastructure event management, which is a feature of AWS Enterprise Support. AWS Enterprise Support is more expensive and provides additional benefits, such as a technical account manager, a support concierge, and a response time of less than 15 minutes for critical issues. AWS Developer Support and AWS Basic Support do not provide chat access to a cloud support engineer. AWS Developer Support provides email support and a response time of less than 12 hours for general guidance issues. AWS Basic Support provides customer service and account support, as well as access to forums and documentation1

 To make a subnet public, the company should use an Amazon VPC internet gateway and an Amazon VPC route table. An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed. To enable internet access for a subnet, you need to attach an internet gateway to your VPC and add a route to the internet gateway in the route table associated with the subnet.

The AWS service that will meet this requirement is C. AWS Backup.

AWS Backup is a service that allows you to define a central data protection policy that works across AWS services for compute, storage, and database resources. You can use AWS Backup to create backup plans that specify the frequency, retention, and lifecycle of your backups, and apply them to your AWS resources using tags or resource IDs.AWS Backup supports various AWS services, such as Amazon EC2,Amazon EBS, Amazon RDS, Amazon DynamoDB, Amazon EFS, Amazon FSx, and AWS Storage Gateway12.

AWS Batch is a service that allows you to run batch computing workloads on AWS.AWS Batch does not provide a central data protection policy, but rather enables you to optimize the allocation and utilization of your compute resources3.

AWS Elastic Disaster Recovery is a service that allows you to prepare for and recover from disasters using AWS.AWS Elastic Disaster Recovery does not provide a central data protection policy, but rather helps you minimize downtime and data loss by replicating your applications and data to AWS4.

Amazon FSx is a service that provides fully managed file storage for Windows and Linux applications.Amazon FSx does not provide a central data protection policy, but rather offers features such as encryption, snapshots, backups, and replication to protect your file systems5.

 Amazon Route 53 and AWS WAF are AWS services that can be configured at the Region level. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service that lets you register domain names, route traffic to resources, and check the health of your resources. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. Amazon EC2, Amazon CloudFront, and Amazon DynamoDB are AWS services that can be configured at the global level or the Availability Zone level .

 Realigning teams to focus on products and value streams, and using agile methods to rapidly iterate and evolve are tasks that the company should perform to meet the requirements of becoming more responsive to customer inquiries and feedback, according to the AWS Cloud Adoption Framework (AWS CAF). AWS CAF organizes guidance into six areas of focus, called perspectives: business, people, governance, platform, security, and operations. Each perspective is divided into capabilities, which describe the skills and processes to execute the transition effectively. The people perspective helps you prepare your organization for cloud adoption, and includes capabilities such as organizational change management, staff skills and readiness, and organizational alignment. The business perspective helps you align IT strategy with business strategy, and includes capabilities such as business case development, value proposition, and product ownership. Creating new value propositions with new products and services is a task that belongs to the business perspective, but it is not directly related to the requirement of becoming more responsive to customer inquiries and feedback. Using a new data and analytics platform to create actionable insights is a task that belongs to the platform perspective, which helps you design, implement, and optimize the architecture of the AWS environment. However, it is also not directly related to the requirement of becoming more responsive to customer inquiries and feedback. Migrating and modernizing legacy infrastructure is a task that belongs to the operations perspective, which helps you enable, run, use, operate, and recover IT workloads to the level agreed upon with your business stakeholders.However, it is also not directly related to the requirement of becoming more responsive to customer inquiries and feedback.

 Amazon CloudWatch and AWS CloudTrail are the AWS services that allow users to monitor and retain records of account activities that include governance, compliance, and auditing. Amazon CloudWatch is a service that collects and tracks metrics, collects and monitors log files, and sets alarms. AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. Amazon GuardDuty, AWS Shield, and AWS WAF are AWS services that provide security and protection for AWS resources, but they do not monitor and retain records of account activities. These concepts are explained in the AWS Cloud Practitioner Essentials course3.

IAM credential report is a feature that allows you to generate and download a report that lists all IAM users in your AWS account and the status of their various credentials, including access keys and MFA devices. You can use this report to audit the security status of your IAM users and ensure that they follow the best practices for using AWS1.

AWS Key Management Service (AWS KMS) is a service that allows you to create and manage encryption keys to protect your data. It does not provide information about IAM users or their credentials2.

IAM Access Analyzer is a feature that helps you identify the resources in your AWS account, such as S3 buckets or IAM roles, that are shared with an external entity. It does not provide information about IAM users or their credentials3.

Amazon CloudWatch is a service that monitors and collects metrics, logs, and events from your AWS resources and applications. It does not provide information about IAM users or their credentials4.

Reserved Instances (RIs) are a pricing model that allows you to reserve EC2 instances for a specified period of time (one or three years) and receive a significant discount compared to On-Demand pricing. RIs are suitable for workloads that have predictable usage patterns and require a long-term commitment. You can choose between three payment options: All Upfront, Partial Upfront, or No Upfront. The more you pay upfront, the greater the discount1.

Savings Plans are a flexible pricing model that can help you reduce your EC2 costs by up to 72% compared to On-Demand pricing, in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a one or three year term. Savings Plans apply to usage across EC2, AWS Lambda, and AWS Fargate. You can choose between two types of Savings Plans: Compute Savings Plans and EC2 Instance Savings Plans. Compute Savings Plans offer the most flexibility and apply to any instance family, size, OS, tenancy, or region. EC2 Instance Savings Plans offer the highest discount and apply to a specific instance family within a region2.

Spot Instances are a pricing model that allows you to bid for unused EC2 capacity in the AWS cloud and are available at a discount of up to 90% compared to On-Demand pricing. Spot Instances are suitable for fault-tolerant or stateless workloads that can run on heterogeneous hardware and have flexible start and end times. However, SpotInstances are not guaranteed and can be interrupted by AWS at any time if the demand for capacity increases or your bid price is lower than the current Spot price3.

On-Demand Instances are a pricing model that allows you to pay for compute capacity by the hour or second with no long-term commitments. On-Demand Instances aresuitable for short-term, spiky, or unpredictable workloads that cannot be interrupted, or for applications that are being developed or tested on EC2 for the first time. However, On-Demand Instances are the most expensive option among the four pricing models4.

Dedicated Hosts are physical EC2 servers fully dedicated for your use. Dedicated Hosts can help you reduce costs by allowing you to use your existing server-bound software licenses, such as Windows Server, SQL Server, and SUSE Linux Enterprise Server. Dedicated Hosts can be purchased On-Demand or as part of Savings Plans. Dedicated Hosts are suitable for workloads that need to run on dedicated physical servers or have strict licensing requirements. However, Dedicated Hosts are not the lowest cost option among the four pricing models.

AWS Elastic Beanstalk is a service that allows you to deploy and manage applications on AWS without manually creating and configuring the required resources, such as EC2 instances, load balancers, security groups, databases, and more. AWS Elastic Beanstalk automatically handles the provisioning, scaling, load balancing, health monitoring, and updating of your application, while giving you full control over the underlying AWS resources if needed. AWS Elastic Beanstalk supports a variety of platforms and languages, such as Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker. You can use the AWS Management Console, the AWS CLI, the AWS SDKs, or the AWS Elastic Beanstalk API to create and manage your applications. You can also use AWS CodeStar, AWS CodeCommit, AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline to integrate AWS Elastic Beanstalk with your development and deployment workflows12

 Deploying the application in multiple Availability Zones is the best way to ensure high availability for the application. Availability Zones are isolated locations within an AWS Region that are engineered to be fault-tolerant from failures in other Availability Zones. By deploying the application in multiple Availability Zones, the company can reduce the impact of outages and increase the resilience of the application. Deploying the application in a single Availability Zone, on AWS Direct Connect, or on Reserved Instances does not provide the same level of high availability as deploying the application in multiple Availability Zones. Source: Availability Zones

Reserved Instances are a pricing model that offers significant discounts on Amazon EC2 usage compared to On-Demand Instances. Reserved Instances are suitable for stateful workloads that have predictable and consistent usage patterns for a long-term period. By committing to a one-year or three-year term, customers can reduce their total cost of ownership and optimize their cloud spend. Reserved Instances also provide capacity reservation, ensuring that customers have access to the EC2 instances they need when they need them. References: AWS Pricing Calculator, Amazon EC2 Pricing, [AWS Cloud Practitioner Essentials: Module 3 - Compute in the Cloud]

Spot Instances are Amazon EC2 instances that are available at a discounted price compared to On-Demand pricing. Spot Instances use spare EC2 capacity that is not being used by other customers, and the price fluctuates based on supply and demand. Customers can request Spot Instances for their applications and specify the maximum price they are willing to pay per hour. If the Spot price is lower than the customer’s bid, the Spot Instance is launched and the customer pays the current Spot price. However, if the Spot price rises above the customer’s bid, the Spot Instance is terminated by AWS and the customer is charged for the partial hour of usage. Therefore, Spot Instances can provide discounts of up to 90% or more, but they are not suitable for applications that require continuous or predictable availability. Spot Instances arerecommended for applications that are flexible, fault-tolerant, or have low priority, such as batch processing, data analysis, or testing and development. 

Amazon S3 Glacier Deep Archive is the lowest-cost storage class in the cloud. It is designed for long-term data archiving that is rarely accessed. It offers a retrieval time of 12 hours and a durability of 99.999999999% (11 9’s). It is ideal for data that must be retained for 7 years or longer to meet regulatory compliance requirements.

Rightsizing is the cloud concept that is demonstrated by using AWS Compute Optimizer. Rightsizing is the process of adjusting the type and size of your cloud resources to match the optimal performance and cost for your workloads. AWS Compute Optimizer is a service that analyzes the configuration and utilization metrics of your AWS resources, such as Amazon EC2 instances, Amazon EBS volumes, AWS Lambda functions, and Amazon ECS services on AWS Fargate. It reports whether your resources are optimal, and generates optimization recommendations to reduce the cost and improve the performance of your workloads. AWS Compute Optimizer uses machine learning to analyze your historical utilization data and compare it with the most cost-effective AWS alternatives. You can use the recommendations toevaluate the trade-offs between cost and performance, and decide when to move or resize your resources to achieve the best results. References: Workload Rightsizing - AWS Compute Optimizer - AWS, What is AWS Compute Optimizer? - AWS Compute Optimizer

This is a benefit of using an AWS managed service, such as Amazon S3, Amazon DynamoDB, or AWS Lambda. AWS managed services are fully managed by AWS, which means that AWS handles the provisioning, scaling, patching, backup, and recovery of the underlying infrastructure and software. This reduces the operational overhead for the company’s IT staff, who can focus on their core business logic and innovation. You can learn more about the AWS managed services from this webpage or this digital course.

AWS Outposts is a fully managed service that extends AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hybrid experience1. AWS Outposts enables customers to run workloads on premises using the same AWS APIs, tools, and services that they use in the cloud2. Dedicated Hosts are physical servers with EC2 instance capacity fully dedicated to a customer’s use3. Availability Zones are one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities within an AWS Region4. AWS Wavelength is an AWS Infrastructure offering optimized for mobile edge computing applications.

AWS VPN and AWS Direct Connect are two services that enable customers to connect their on-premises data center network to the AWS Cloud. AWS VPN establishes a secure and encrypted connection over the public internet, while AWS Direct Connect establishes a dedicated and private connection through a partner network. You can learn more about AWS VPN from [this webpage] or [this digital course] . You can learn more about AWS Direct Connect from [this webpage] or [this digital course] .

According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of configuring the AWS provided security group firewall and classifying company assets in the AWS Cloud. A security group is a virtual firewall that controls the inbound and outbound traffic for one or more EC2 instances. The customer must configure the security group rules to allow or deny traffic based on protocol, port, or source and destination IP address2 Classifying company assets in the AWS Cloud means identifying the types, categories, and sensitivity levels of the data and resources that the customer stores and processes on AWS. The customer must also determine the applicable compliance requirements and regulations that apply to their assets, and implement the appropriate security controls and measures to protect them

A is correct because Amazon Lex is the AWS service that helps users build conversational interfaces into applications using voice and text. B is incorrect because Amazon Transcribe is the AWS service that helps users convert speech to text. C is incorrect because Amazon Comprehend is the AWS service that helps users analyze text using natural language processing. D is incorrect because Amazon Timestream is the AWS service that helps users collect, store, and process time series data.

 Using AWS Artifact to access AWS documents about the compliance of the services, and getting the compliance of the application certified by a company assessor are actions that the company should take to meet the requirements of complying with credit card regulatory requirements. AWS Artifact is a service that provides on-demand access to AWS security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. AWS Artifact can help you demonstrate compliance with credit card regulatory requirements by providing you with proof that the AWS services and deployment are in compliance. Getting the compliance of the application certified by a company assessor is an action that the company should take to ensure that the application meets the specific requirements of the credit card industry. A company assessor is an independent third-party entity that is qualified to assess the compliance of the application with the relevant standards and regulations. Using Amazon Inspector to submit the application for certification is not an action that the company should take, because Amazon Inspector is a service that helps you improve the security and compliance of your applications deployed on AWS by automatically assessing them for vulnerabilities and deviations from best practices, but it does not provide certification for the applications. Ensuring that the application’s underlying hardware components comply with requirements is not an action that the company should take, because the application is deployed on AWS, and AWS is responsible for the security and compliance of the underlying hardware components. This is part of the shared responsibility model, where AWS is responsible for security of the cloud, and customers are responsible for security in the cloud. Using AWS Security Hub to certify the compliance of the application is not an action that the company should take, because AWS Security Hub is a service that gives you a comprehensive view of your security posture acrossyour AWS accounts and helps you check your environment against security industry standards and best practices, but it does not provide certification for the applications.

 AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. You can use AWS Secrets Manager to store, rotate, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. AWS Secrets Manager eliminates the need to hardcode sensitive information in plain text, and reduces the risk of unauthorized access or leakage. AWS Secrets Manager also integrates with other AWS services, such as AWS Lambda, Amazon RDS, and AWS CloudFormation, to simplify the management of secrets across your environment5

Server-side encryption is an encryption option that Amazon S3 provides to encrypt data at rest in Amazon S3. With server-side encryption, Amazon S3 encrypts an object before saving it to disk in its data centers and decrypts it when you download the objects. You have three server-side encryption options to choose from: SSE-S3, SSE-C, and SSE-KMS. SSE-S3 uses keys that are managed by Amazon S3. SSE-C allows you to manage your own encryption keys. SSE-KMS uses keys that are managed by AWS Key Management Service (AWS KMS)5.

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With AWS Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This can help you simplify compliance auditing, security analysis, change management, and operational troubleshooting1.

 Amazon ElastiCache is a fully managed in-memory data store and cache service that delivers sub-millisecond response times to applications. You can use ElastiCache as a primary data store for your applications, or as a cache to improve the performance of your existing databases. ElastiCache supports two popular open-source in-memory engines: Redis and Memcached5.

AWS WAF Overview:

AWS Web Application Firewall (WAF) allows users to create rules to block or allow traffic based on IP addresses, request patterns, and other conditions.

It is ideal for blocking traffic from a specific IP address.

Why AWS WAF Meets the Requirement:

The company can create a WAF rule to block traffic from the malicious IP address.

WAF integrates with services like Amazon CloudFront, Application Load Balancer, and API Gateway.

Why Other Options Are Incorrect:

A. AWS Shield:Protects against DDoS attacks but does not allow custom IP blocking.

B. AWS Config:Monitors resource configurations but does not block IPs.

C. Amazon GuardDuty:Detects threats but does not block traffic directly.

AWS Transit Gateway serves as a central hub that enables connectivity between multiple VPCs and on-premises networks. It simplifies network architecture and management by acting as a centralized gateway for traffic flowing between all connected networks. Other options, such as Gateway VPC Endpoints and AWS PrivateLink, do not provide the centralized, scalable connectivity that Transit Gateway offers across multiple VPCs and on-premises environments.

AWS Config enables users to assess, audit, and evaluate the configurations of AWS resources. It provides information that can be used by external auditors to ensure compliance with various regulatory requirements by tracking changes and maintaining configuration history. Amazon Cognito, FSx, and Inspector do not provide detailed configuration tracking for audit purposes.

The AWS Trusted Advisor check that evaluates whether AWS CloudTrail logging is enabled belongs to the Security category. CloudTrail records account activity and API actions as events, providing evidence that can support security analysis, governance, compliance, and auditing. Because the absence of appropriate logging can reduce visibility into actions performed in an AWS account, Trusted Advisor treats the relevant CloudTrail logging check as a security best-practice assessment. Therefore, option C is correct. The Performance category focuses on checks that identify opportunities to improve service performance or resource utilization. The Fault Tolerance category, called Resilience in newer Trusted Advisor materials, focuses on availability, redundancy, and recovery-related conditions. The Service Limits category, associated with service quotas, identifies usage that approaches or exceeds applicable AWS quotas. None of those categories primarily addresses whether account activity is being recorded for security investigation and auditing. For exam purposes, associate CloudTrail with API activity history, governance, compliance, and security auditing, and associate the Trusted Advisor CloudTrail logging check with the Security category.

The customer is responsible for configuring the logical networking resources inside its Amazon VPC. This includes creating and associating route tables and defining routes that determine where subnet traffic is directed. A subnet is considered public when its associated route table contains a route to an internet gateway and the relevant resources have suitable public addressing and security configuration. Therefore, configuring a route table to direct internet-bound traffic to an internet gateway is the company’s responsibility, making option C correct. AWS is responsible for the physical routers, backbone networks, data centers, and networking infrastructure that provide communication within and between AWS Regions. Customers do not maintain or physically secure that equipment. AWS also provides infrastructure-level protection for traffic across its global network, while customers remain responsible for application-level encryption where required by their security policies. The shared responsibility model distinguishes between AWS securing the physical infrastructureofthe cloud and customers securely configuring their networksinthe cloud. Route tables, subnet associations, gateways, network ACLs, and security groups are customer-controlled VPC configurations, even though AWS operates the underlying network infrastructure.

AWS Secrets Manager is a service designed to securely store and manage access to sensitive information such as API keys, passwords, and database credentials. It allows automatic rotation, secure storage, and fine-grained access control for these credentials, ensuring they are securely managed. The other options do not provide encrypted storage for credentials specifically.

Enforcing multi-factor authentication (MFA) for privileged users enhances account security by requiring a second form of authentication. It reduces the risk of unauthorized access, even if credentials are compromised. Removing the root account is not possible, and creating access keys for the root account or privileged users can increase security risks rather than reduce them.

An IAM credential report is designed for account-level auditing of IAM user credentials. AWS states that the report lists all IAM users in an AWS account and shows the status of their credentials, including passwords, access keys, and multi-factor authentication devices. It can also contain information such as whether a password is enabled, when credentials were created or last used, whether access keys are active, and whether an MFA device is enabled. This directly satisfies both requirements in the question: listing users and reporting specific credential details. AWS Shield protects applications against distributed denial-of-service attacks and does not produce user credential inventories. AWS Trusted Advisor evaluates an AWS environment against best-practice checks, but it is not the tool for downloading a complete per-user credential-status report. Amazon Inspector scans workloads such as Amazon EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. Therefore, the IAM credential report is the precise IAM auditing tool required. It can be generated and downloaded through the IAM console, AWS CLI, AWS SDKs, or IAM API.

AWS CloudTrail is the service that provides the account activity records needed for governance, compliance, operational auditing, and risk auditing. CloudTrail records actions taken by users, IAM roles, AWS services, and other identities as events. These actions can originate from the AWS Management Console, AWS CLI, AWS SDKs, and AWS APIs. Administrators can review event history and configure trails or event data stores for longer-term collection, analysis, and retention. This directly matches the wording of the question, so option A is correct. VPC Flow Logs capture information about IP traffic to and from network interfaces in a VPC; they are valuable for network troubleshooting and security analysis but do not provide the broad AWS account API audit history described. Amazon CloudWatch monitors resources and applications through metrics, logs, alarms, and events, but it is not the primary account governance and risk-auditing record. AWS Trusted Advisor evaluates an AWS environment against best-practice checks and provides recommendations. It does not replace CloudTrail’s record of account activity. The key distinction is recommendations versus an auditable history of actions.

The AWS Architecture Center provides examples, best practices, and architectural blueprints for various AWS Cloud solutions. It includes whitepapers, reference architectures, and detailed diagrams to help users design secure, scalable, and reliable applications on AWS. Other services like AWS Marketplace, Service Catalog, and Trusted Advisor do not offer solution design examples.

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

For an Amazon RDS Multi-AZ DB instance deployment, Amazon RDS provides the managed high-availability and failover mechanism. If a qualifying planned or unplanned outage affects the primary DB instance, RDS automatically switches to the standby replica in another Availability Zone. This automatic promotion or failover is performed by AWS as part of the managed RDS service, so option B is correct. The customer must first choose and enable a Multi-AZ deployment; AWS does not decide to enable that architecture on the customer’s behalf, which eliminates option C. The application must also be designed to recover connections after failover, normally by reconnecting through the unchanged DB endpoint after DNS updates propagate, which eliminates option A. Monitoring application behavior, business transactions, latency, and post-failover performance also remains part of the customer’s operational responsibility, even though AWS monitors the RDS service and underlying infrastructure. The exam distinction is that AWS automates the database infrastructure failover, while the customer configures the deployment and makes the application resilient to the connection interruption.

The AWS Cloud is cost-effective for dynamic workloads because of its elasticity, allowing resources to scale up or down based on demand, and its pay-as-you-go pricing, which enables companies to pay only for what they use. Reliability, security, and high availability are also benefits of AWS, but they do not specifically relate to cost-effectiveness in the context of dynamic workloads.

AWS is responsible for the physical security of the facilities and infrastructure that make up AWS Regions and Availability Zones. AWS also operates the infrastructure, operating system, and service platform for abstracted managed services such as Amazon S3. Consequently, AWS is responsible for patching the underlying operating system and platform that run S3. Options D and E are therefore correct. Customers are responsible for managing and protecting their data, including deciding whether client-side encryption is needed and implementing appropriate encryption and integrity controls. Customers also use AWS Identity and Access Management tools to define their users, roles, policies, and permissions. Although AWS operates the IAM service itself, the customer is responsible for configuring identities and access to the customer’s resources. The phrase “manage customer data” is also a customer responsibility because AWS does not determine the customer’s data classification, retention, permissions, or business use. Responsibility changes according to the selected service, but physical infrastructure always remains an AWS responsibility in standard AWS Regions, while S3’s abstracted platform and operating-system layer are also managed by AWS.

Elastic Load Balancing (ELB) distributes incoming traffic across multiple targets, such as EC2 instances, containers, and IP addresses, ensuring better application availability and fault tolerance. While ELB scales to meet traffic demands, it does not inherently scale compute resources themselves, span multiple regions, or balance traffic between internet gateways.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards AWS applications against network and transport layer attacks. AWS Shield Standard is automatically included with all AWS services and offers protection against common DDoS attacks. For more advanced protection, AWS Shield Advanced provides additional DDoS mitigation measures. Although AWS WAF, Firewall Manager, and GuardDuty contribute to security, they do not specialize in DDoS mitigation at the network layer like AWS Shield does.

Among the supplied options, A follows the strongest combination of AWS security practices. Each developer should use an individually attributable identity rather than a shared account, MFA should protect applicable human identities, the root user should be protected with MFA, and long-term access keys should be reviewed, updated, and removed when no longer required. Therefore, option A is the best available answer. A shared IAM user prevents reliable attribution of actions and violates AWS guidance that credentials must not be shared. The root user should not be used for routine or programmatic access because it has unrestricted account permissions. Permissions boundaries define the maximum permissions an IAM identity can receive, but they do not grant permissions or independently provide programmatic credentials, so option D is incomplete. Current AWS best practice goes further than option A: wherever possible, developers should use federation, IAM Identity Center, or IAM roles that issue temporary credentials instead of long-term IAM access keys. However, because temporary credentials are not offered as a choice, individually managed IAM users with MFA and rotated access keys represent the intended exam answer.

AWS provides the flexibility to scale resources up or down on demand, enabling companies to test new applications without making long-term commitments. This principle allows for cost efficiency and agility during testing and development. The other options do not specifically highlight the benefits of flexible, on-demand resource scaling.

AWS Application Discovery Service helps companies gather information about on-premises data centers to support migration planning. It collects data on system configuration, resource utilization, and network dependencies, providing essential insights for migration. AWS DataSync and Storage Gateway are used for data transfer, while AWS DMS is for database migration specifically.

AWS IAM Identity Center (formerly AWS Single Sign-On) provides centralized management of user access to multiple AWS accounts within an organization in AWS Organizations. It allows users to log in once and gain access to all assigned accounts without managing separate logins for each account. Amazon Cognito is generally used for application-level user management and authentication, not for managing access across AWS accounts.

On-Demand Instances are recommended for short-term, irregular workloads that cannot be interrupted. The company needs capacity for only 24 hours once per year, so it would not be economical to make a one-year or three-year Reserved Instance commitment for such limited usage. With On-Demand pricing, the company pays only while the instances are running, without a long-term commitment. Therefore, option A is correct. Spot Instances can provide significant discounts but use spare EC2 capacity that AWS can interrupt. Because the workload explicitly cannot be interrupted, Spot Instances do not meet the requirement. Reserved Instances can reduce costs for steady, predictable, long-running usage, but paying for a commitment to cover an annual 24-hour workload would generally be less economical than paying the On-Demand rate for that brief period. Dedicated Instances run on hardware dedicated to one customer and normally cost more; the question includes no compliance, tenancy, or licensing requirement that would justify dedicated hardware. The decisive combination is “cannot be interrupted” plus “short-term and infrequent,” which maps directly to the documented On-Demand use case.

SSH keys provide secure login for Linux-based Amazon EC2 instances by establishing a secure connection over SSH (Secure Shell), protecting login credentials from interception. VPNs and encryption enhance security in other contexts, but SSH keys are the standard approach for accessing Linux EC2 instances. Amazon Route 53 is unrelated to EC2 instance access.

According to AWS official documentation, theAWS Pricing Calculatoris designed to estimate and compare the cost of running workloads on AWS versus on-premises environments. This service allows customers to model their existing infrastructure, including compute, storage, and data transfer requirements, and then estimate AWS costs before migrating. AWS Pricing Calculator supports detailed cost breakdowns for individual services and helps organizations make informed financial decisions during cloud adoption planning.

AWS Cost Explorer and AWS Budgets are used onlyafter workloads are already running on AWSto analyze and manage existing AWS costs. AWS Trusted Advisor provides best-practice recommendations related to cost optimization, security, fault tolerance, and performance, but it does not perform cost comparisons with on-premises environments.

AWS documentation explicitly states that the AWS Pricing Calculator is intended forpre-migration cost estimation and comparison, making it the correct service for evaluating on-premises versus AWS cost scenarios.

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

Amazon AppStream 2.0, now documented under the name Amazon WorkSpaces Applications, is the fully managed application-streaming service that provides users with on-demand access to desktop applications from supported devices and locations. Applications run on AWS-managed streaming resources, while the visual output is streamed to the user through a client or an HTML5-capable web browser. This lets an organization centrally manage application versions and provide access without installing the full application locally on every endpoint. Therefore, option A is correct. Amazon Lightsail is a simplified cloud platform for deploying virtual servers, containers, databases, and web applications; it is not an end-user desktop application streaming service. AWS Resource Access Manager shares supported AWS resources across accounts or within AWS Organizations, rather than streaming applications to users. AWS Client VPN provides a managed VPN connection into AWS or connected networks, but it does not host and stream desktop applications. For exam preparation, recognize both names: older questions commonly use “Amazon AppStream 2.0,” while current AWS documentation presents the service as Amazon WorkSpaces Applications.

Spot Instances offer the lowest cost for Amazon EC2 and are suitable for non-production workloads like development and testing where occasional unavailability is acceptable. Spot Instances take advantage of unused EC2 capacity at a reduced cost, making them ideal for environments that can tolerate interruptions. Reserved or On-Demand Instances would be more expensive for this scenario, and Dedicated Hosts are not cost-effective for non-production environments.

IAM Users and Billing Permissions:

IAM users with appropriate permissions can access and view the AWS Billing console.

The root user is required only for certain account-level tasks, such as changing support plans or closing accounts.

Why Other Options Are Incorrect:

A. Change to a different AWS Support plan:Requires root user credentials.

B. Close an AWS account:Requires root user credentials.

D. Activate access to the AWS Billing console:Requires root user credentials.

Amazon EventBridge Overview:

EventBridge is a serverless event bus that enables applications to react to changes in AWS resources.

It supports routing events such as EC2 state changes to various targets, including AWS Step Functions.

How EventBridge Meets the Requirement:

EventBridge can capture the EC2 instance state change event and trigger the execution of a Step Functions workflow.

The integration is seamless and supports workflows triggered by multiple event sources.

Why Other Options Are Incorrect:

A. Amazon SageMaker:Used for building, training, and deploying machine learning models; not related to event triggers.

B. Amazon Connect:A cloud-based contact center service; unrelated to event triggers.

D. AWS Fargate:A compute engine for containers; does not manage events or invoke workflows.

AWS Migration Hub assists users in planning and tracking the progress of their server and application migrations. It centralizes migration tracking across various AWS services, providing visibility into application inventory and migration status. While AWS Application Migration Service also assists with migrations, Migration Hub is specifically designed for tracking migration data comprehensively.

The AWS Management Console provides a web-based graphical user interface (GUI) that allows users to manage AWS services. It is user-friendly and accessible, enabling users to control and configure resources without needing to interact with AWS through code or command-line interfaces. AWS CLI and SDKs are command-line and programming tools, respectively, and do not offer a graphical interface.

Based on AWS IAM documentation,inline policiesare policies that aredirectly embedded into a single IAM user, group, or role. When a company wants to create and apply a policy specifically for one user and does not intend to reuse it, inline policies are the most appropriate option.

AWS managed policies are created and maintained by AWS and are intended for general use cases. Customer managed policies are reusable policies created by customers and can be attached to multiple users, groups, or roles. Amazon S3 bucket policies are resource-based policies and apply only to S3 buckets, not directly to IAM users.

AWS documentation explains that inline policies maintain astrict one-to-one relationshipwith the entity to which they are attached. If the user is deleted, the inline policy is also deleted automatically. This makes inline policies ideal foruser-specific, tightly scoped permissions, which matches the requirement in the question exactly.

AWS Storage Gateway Volume Gateway, specifically its cached-volume configuration, meets the stated hybrid-storage requirements. With cached volumes, the primary data is stored in Amazon S3 while frequently accessed data is retained locally in the gateway’s cache. On-premises application servers access the volumes through the iSCSI protocol, and the local cache provides low-latency access to the active working set. This design allows the company to move or extend storage into AWS without requiring every frequently used block to be retrieved across the network for each access. Therefore, option C is correct. AWS Database Migration Service migrates and replicates database data, but the question describes application storage data and persistent low-latency access rather than a database-engine migration. AWS Application Migration Service moves servers and applications to AWS and is not a hybrid block-storage caching service. AWS Direct Connect provides a dedicated network connection between an on-premises environment and AWS, but connectivity alone does not create local caching for frequently used data. The decisive phrases are “application data” and “low-latency access to frequently used data,” which align directly with Volume Gateway cached volumes.

AWS Artifact Overview:

AWS Artifact is a service that provides on-demand access to AWS compliance documentation and agreements.

It includes reports such as PCI DSS, SOC, and ISO certifications.

How AWS Artifact Meets the Requirement:

The PCI DSS compliance documentation can be downloaded directly from the Artifact console.

Artifact helps customers demonstrate compliance to auditors by providing official certifications and attestations.

Why Other Options Are Incorrect:

B. AWS Organizations:Used for managing accounts, not compliance reports.

C. AWS Trusted Advisor:Offers best practice checks but does not provide compliance documentation.

D. AWS Support Center:Provides customer support and ticket management but not compliance documentation.

Amazon RDS provides a managed database service that supports MariaDB with minimal operational overhead. It handles routine database tasks such as backups, patching, and scaling, reducing the burden on users. Amazon Neptune and DynamoDB are not compatible with MariaDB, and Amazon S3 is not a relational database service.

DynamoDB global tables provide a fully managed, multi-Region, multi-active database capability. Global tables automatically replicate DynamoDB table data across the AWS Regions selected by the customer. Applications can perform local reads and writes against replica tables, and DynamoDB propagates changes to the other replicas without requiring the customer to build a separate cross-Region replication system. Therefore, option A is correct. DynamoDB Accelerator is an in-memory cache designed to reduce DynamoDB response times for read-intensive workloads. It does not synchronize complete tables across Regions. A global secondary index provides an alternative partition key and optional sort key for querying data within a DynamoDB table; despite the word “global,” it is not a cross-Region replication feature. A service-linked IAM role allows DynamoDB to perform specified actions on behalf of a customer but does not independently replicate table data. Global tables are designed for globally distributed applications, business continuity, high availability, and low-latency access by users in different geographic locations. The direct exam association is DynamoDB global tables for automatic multi-Region table synchronization and replication.

AWS Budgets allows organizations to set custom cost and usage budgets and receive notifications when they exceed predefined thresholds. This feature helps the finance department monitor spending and manage budget forecasts effectively. AWS Cost and Usage Reports and Cost Explorer provide detailed billing data but do not include budget notifications. Consolidated billing in AWS Organizations is useful for aggregating billing across accounts but does not provide budget alerts.

Amazon EC2 Reserved Instances provide a billing discount in exchange for a one-year or three-year commitment to specified EC2 usage attributes and payment terms. Because the company can commit for one year and expects specific usage, Reserved Instances are the most cost-effective choice among the listed options. A Reserved Instance is not a separate physical instance; its billing benefit is applied to qualifying running EC2 instances that match the reservation’s attributes. Dedicated Hosts provide an entire physical host for one customer and are appropriate for host-level compliance or licensing requirements, but those requirements are not stated here. Spot Instances can provide larger discounts by using spare EC2 capacity, but AWS can interrupt them, and the question describes a predictable committed workload rather than an interruption-tolerant workload. On-Demand Instances require no long-term commitment and are appropriate for short-term, irregular, or unpredictable workloads, but their normal usage price is higher than a matching Reserved Instance commitment. Although AWS also offers Savings Plans, they are not included in the options. Therefore, Reserved Instances are the intended answer for a one-year EC2 usage commitment.

Identity and access management is a capability of the Security perspective of the AWS Cloud Adoption Framework. AWS describes this capability as securely managing human and machine identities and their permissions to cloud services and resources. It focuses on ensuring that the correct users, systems, and services receive access to the correct resources under appropriate conditions. This includes creating identities in AWS, connecting external identity sources, granting permissions, applying least privilege, and managing access at organizational scale. Therefore, option D is correct. The Operations perspective focuses on delivering cloud services, monitoring workloads, managing events, and maintaining reliable operations. The Platform perspective addresses cloud architecture, platform engineering, provisioning, and the design of scalable cloud environments. The Governance perspective focuses on areas such as program management, risk, data governance, portfolio management, and cloud financial management. Although governance establishes organizational policies, the specific capability described as managing identities and permissions at scale belongs to the Security perspective. For exam purposes, associate IAM, identity federation, authorization, security monitoring, infrastructure protection, and data protection primarily with the AWS CAF Security perspective.

According to theAWS Shared Responsibility Model, AWS is responsible for thesecurity of the cloud, while customers are responsible for thesecurity in the cloud. AWS responsibilities include protecting the physical infrastructure that supports AWS services, such as data centers, hardware, networking, and global infrastructure.

Specifically, AWS is responsible forthe compute infrastructure, which includes servers, storage devices, networking equipment, and virtualization layers. AWS is also responsible forAvailability Zones, ensuring they are physically separate, fault-isolated, and highly available.

Client-side data encryption, Amazon EC2 guest operating systems, and customer data are explicitly defined ascustomer responsibilities. Customers must manage operating system patching, encryption methods, access controls, and data protection within their AWS environments.

AWS documentation consistently emphasizes that customers retain ownership and control of their data, while AWS ensures the resilience, availability, and security of the underlying cloud infrastructure. Therefore, the correct answers areC and D.

AWS Artifact provides on-demand access to AWS compliance reports and security documentation. It is a self-service portal where customers can download documents like SOC reports, ISO certifications, and other compliance-related materials necessary for meeting regulatory requirements. AWS Config and Trusted Advisor offer security assessments and compliance monitoring, but they do not provide direct access to compliance reports.

Customers are responsible for configuring access to their Amazon S3 buckets and objects. An S3 bucket policy is a resource-based policy that defines which principals can perform specified actions on the bucket and its objects, subject to the complete AWS authorization process. Because the customer determines who should access its data, configuring bucket policies is a customer responsibility, making option C correct. AWS is responsible for operating and protecting the physical storage equipment, data center facilities, underlying networking infrastructure, operating systems, and service platform that run Amazon S3. AWS also patches and maintains the managed S3 platform. Those tasks are part of securityofthe cloud and are not performed by individual customers. Customers retain responsibility for their content, including data classification, access permissions, encryption choices, public-access settings, versioning, lifecycle policies, and other service configurations. AWS provides secure S3 capabilities, but customers must configure those capabilities according to their business and compliance requirements. The fundamental exam distinction is that AWS secures the infrastructure that provides S3, while customers secure their S3 data and control how that data can be accessed.