Answer : A, C
Explanation: Amazon EFS (Elastic File System) is a scalable file storage service that can be mounted on multiple EC2 instances simultaneously. Amazon EBS (Elastic Block Store) provides block-level storage volumes that can be attached to EC2 instances to store files and data. Amazon SNS is a notification service, Amazon ECS is a container orchestration service, and Amazon EMR is a big data processing platform — none of these are file storage services.

Answer : A
Explanation: Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables decoupling and reliable delivery of messages between distributed application components. It ensures messages are not lost if a component fails. AWS Storage Gateway connects on-premises storage to AWS, Amazon SES is an email delivery service, and Amazon S3 is object storage — none are message queuing services.

Answer : D
Explanation: “Save when you reserve” describes the Reserved Instance pricing model where customers commit to using EC2 for a 1 or 3-year term in exchange for a significant discount (up to 72%) compared to On-Demand pricing. “Pay as you go” describes On-Demand pricing, “Pay less by using more” refers to volume-based discounts, and “Pay less as AWS grows” refers to the benefit customers receive as AWS passes on infrastructure savings.

Answer : A
Explanation: Right-sizing means selecting the most appropriate instance type and size for your workload — not too large (wasteful) and not too small (insufficient). Doing this both before and after migration ensures you are only paying for the capacity you actually need. Multi-Region architectures (B, D) increase costs significantly. Combining Capacity Reservations with Savings Plans (C) is a cost strategy but right-sizing is the most fundamental step to minimizing RDS costs.

Answer : B
Explanation: Amazon RDS uses Amazon EBS (Elastic Block Store) as its primary storage service for database instances. EBS provides persistent, high-performance block storage that is ideal for database workloads. Amazon Glacier is for archival storage, Amazon EFS is a file system service, and Amazon S3 is object storage — none serve as the primary storage layer for RDS instances.

Answer : B
Explanation: AWS X-Ray is a distributed tracing service that helps developers analyze and debug production and distributed applications, including those built using microservices. It provides an end-to-end view of requests as they travel through the application, making it easy to identify performance bottlenecks and latency issues. AWS CodePipeline is for CI/CD, Amazon Inspector is for security vulnerability assessments, and CloudTrail is for API activity logging.

Answer : C, E
Explanation: Amazon S3 automatically stores data redundantly across multiple Availability Zones within a region, providing native Multi-AZ fault tolerance without any additional configuration. Amazon DynamoDB also replicates data across multiple AZs by default, ensuring high availability and durability. Amazon Redshift and EBS require additional configuration for Multi-AZ redundancy. AWS Snowball is a physical data transfer device, not a storage service with AZ fault tolerance.

Answer : B, D
Explanation: Multi-AZ Deployment (B) automatically provisions a standby replica of your database in a different Availability Zone, providing automatic failover in the event of a primary database failure. Read Replicas (D) improve availability and performance by allowing read traffic to be distributed across multiple replicas. Automatic patching improves security but not availability. AWS Regions and Edge Locations are infrastructure concepts, not RDS-specific availability features.

Answer : D
Explanation: Amazon CloudFront is a CDN that caches content at Edge Locations around the world, including in Asia. This means Asian users retrieve content from a nearby Edge Location rather than the origin server in us-west-1, significantly reducing latency. Replicating across AZs in the same region (A) does not help international users. Migrating to a different hosting provider (B) is unnecessary and costly. Recreating website content (C) has no impact on latency.

Answer : A
Explanation: AWS Identity and Access Management (IAM) allows organizations to manage access to AWS services and resources securely. You can create users, groups, and roles, and assign fine-grained permissions to control exactly what each developer can and cannot do across all AWS products. Amazon RDS is a database service, NACLs control subnet-level network traffic, and Amazon EMR is a big data platform — none manage developer access permissions.

Answer : B
Explanation: Amazon EC2 is an Infrastructure as a Service (IaaS) offering. It provides virtualized computing resources — such as servers, networking, and storage — over the internet, giving customers full control over the operating system, middleware, and runtime. SaaS delivers fully managed software applications, and PaaS provides a managed platform for developers to deploy applications without managing the underlying infrastructure.

Answer : D
Explanation: Decoupling application components so they run independently is a key AWS best practice. It improves resilience and fault tolerance because a failure in one component does not bring down others. Services like Amazon SQS and SNS are commonly used to implement decoupling. Physical security (A) is AWS’s responsibility, not the customer’s. Hardware vendor selection (B) is abstracted away in AWS. IAM policies manage access permissions, not application performance (C).

Answer : D
Explanation: Amazon S3 is the ideal storage service for photos and videos. It offers virtually unlimited scalable object storage, high durability (99.999999999%), built-in security features, and the ability to serve media directly to users or applications via URLs. Amazon EBS is block storage tied to EC2, Amazon SQS is a message queue, and Instance Store is temporary storage lost when an instance stops — none are suitable for storing media files at scale.

Answer : A, C
Explanation: Amazon S3 Glacier is designed for long-term, low-cost archival storage. It is suitable for active archives (A) — data that is retained for compliance or historical purposes but rarely accessed — and long-term analytic data (C) that needs to be kept for extended periods. Dynamic website assets and cached data require fast access times incompatible with Glacier’s retrieval delays. Active databases require low-latency storage such as EBS or RDS.

Answer : A
Explanation: Amazon Elastic Beanstalk is a Platform as a Service (PaaS) that automates the deployment, scaling, and management of applications. Developers simply upload their code, and Elastic Beanstalk automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring. Option C describes Amazon EFS. Option D describes Amazon DynamoDB. Elastic Beanstalk is not a compute engine for ECS.

Answer : C
Explanation: Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It automatically assesses EC2 instances for exposure, vulnerabilities, and deviations from best practices, generating detailed findings. Amazon Kinesis is for real-time data streaming, Security Groups and NACLs are network traffic controls — none perform automated vulnerability assessments.

Answer : D, E
Explanation: Environmental controls (D) — such as temperature, humidity, and fire suppression in data centers — and physical controls (E) — such as physical access restrictions and surveillance — are entirely managed by AWS. Customers fully inherit these controls and bear no responsibility for them. Patch management, database controls, and awareness and training are shared or customer-specific responsibilities depending on the service used.

Answer : B
Explanation: For a known, long-term workload of three years, Reserved Instances with Partial Upfront payment offer the best balance of cost savings and cash flow management. Partial Upfront 3-year reservations provide a greater discount than No Upfront, while not requiring the full payment at once like All Upfront. On-Demand is the most expensive for long-running workloads. Spot Instances are not available for RDS — they apply only to EC2.

Answer : B
Explanation: AWS’s global reach — comprising multiple Regions, Availability Zones, and Edge Locations around the world — allows you to deploy your application closer to international users, reducing latency significantly. Elasticity refers to scaling resources with demand. Data durability refers to the reliability of stored data. High availability ensures uptime but does not inherently reduce geographic latency.

Answer : D, E
Explanation: AWS Savings Plans provide flexible pricing in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for 1 or 3 years. They are available for Amazon EC2 (D) and AWS Lambda (E), as well as AWS Fargate. AWS Batch uses EC2 or Fargate but Savings Plans are not applied directly to Batch. AWS Outposts and Amazon Lightsail are not covered by Savings Plans.

Answer : D
Explanation: For zero downtime tolerance against natural disasters, an Active-Active multi-Region disaster recovery strategy is the most robust approach. Traffic is served from multiple Regions simultaneously, so if one Region is affected by a natural disaster, the other Region continues serving traffic with no interruption. Deploying across multiple AZs (B) protects against zone-level failures but not a regional disaster. CloudFront Edge Locations (A) are for content delivery, not compute failover. Point-in-time backups (C) involve recovery time, which means downtime.

Answer : A, D
Explanation: AWS imposes default service limits (also called quotas) on resources to protect customers and AWS infrastructure. You can request increases to these limits by contacting AWS Support (A). AWS Trusted Advisor monitors your service limit usage and alerts you when you are approaching them (D). Service limits exist on AWS (C is incorrect), they apply at the account level not per IAM user (B is incorrect), and SES is not responsible for service limit notifications (E is incorrect).

Answer : D
Explanation: The AWS Command Line Interface (CLI) is a unified tool that allows you to control and automate all AWS services from the command line using scripts. It is ideal for automating repetitive tasks and integrating AWS into shell scripts or CI/CD pipelines. The AWS Console is a web-based GUI, AWS Service Catalog manages approved IT services, and AWS OpsWorks is a configuration management service using Chef and Puppet — none enable script-based management of all AWS services.

Answer : C, E
Explanation: AWS Direct Connect (C) establishes a dedicated private network connection between your on-premises data center and AWS, ideal for hybrid architectures requiring consistent, high-bandwidth connectivity. AWS VPN (E) creates an encrypted IPSec tunnel over the internet between your on-premises network and AWS, providing a cost-effective hybrid connectivity option. AWS Artifact is a compliance portal, AWS Cloud9 is a cloud IDE, and CloudTrail is an audit logging service — none establish hybrid network connectivity.

Answer : D
Explanation: The AWS Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and is designed to distribute incoming web traffic across multiple EC2 instances based on content-based routing rules. It is the best choice for HTTP/HTTPS traffic. The Network Load Balancer (NLB) operates at Layer 4 and is optimized for TCP/UDP traffic, not HTTP. EC2 Auto Recovery restores failed instances, and Auto Scaling adjusts instance counts — neither distributes HTTP traffic.

Answer : B
Explanation: Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud that automatically scales storage capacity in increments of 10GB up to 128TB as needed. It delivers up to five times the performance of standard MySQL. Amazon Neptune is a graph database, not MySQL-compatible. Amazon RDS for SQL Server and PostgreSQL do not auto-scale capacity in the same way Aurora does.

Answer : B, E
Explanation: Security Groups (B) act as instance-level firewalls and can restrict traffic to only allowed sources, helping mitigate DDoS by blocking unwanted requests. Network ACLs (E) operate at the subnet level and can block traffic from specific IP ranges, providing an additional layer of protection against DDoS attacks. AWS CloudHSM is for hardware security module key management, AWS Batch is for batch computing workloads, and AWS IAM manages access permissions — none directly protect against DDoS traffic.

Answer : A
Explanation: Amazon Redshift is a fully managed, petabyte-scale cloud data warehouse service that delivers fast query performance on large datasets using columnar storage and massively parallel processing (MPP). It is purpose-built for analytical workloads and business intelligence. Amazon Kinesis is for real-time data streaming, DynamoDB is a NoSQL database, and Amazon RDS is a transactional relational database — none are data warehouse solutions.

Answer : D
Explanation: A Total Cost of Ownership (TCO) analysis compares the full cost of running infrastructure on-premises versus on AWS. Physical hardware (D) is a major on-premises cost that includes servers, storage, networking equipment, and data center facilities — costs that are eliminated when moving to AWS. Application development, market research, and business analysis costs are generally the same regardless of where the infrastructure is hosted and are not relevant to a TCO comparison.

Answer : A
Explanation: Linux-based Amazon EC2 instances are billed per second, with a minimum charge of 60 seconds (one minute). This granular billing ensures customers only pay for the exact compute time they use, making it cost-effective for short-running workloads. Windows-based instances are billed per hour. Options B, C, and D all describe incorrect billing increments.

Answer : A, B
Explanation: The instance type (A) — which determines the CPU, memory, storage, and networking capacity — directly affects EC2 pricing, with larger instance types costing more. The Availability Zone (B) can also impact pricing, as Spot Instance prices vary by AZ, and some regions/AZs have slightly different On-Demand pricing. Load balancing, number of S3 buckets, and number of private IPs are not factors in EC2 instance pricing.

Answer : D
Explanation: An Amazon Machine Image (AMI) captures the complete configuration of an EC2 instance, including the OS, installed software, and settings. Creating an AMI from the configured instance allows the customer to launch any number of identical EC2 instances from it. AWS Config templates do not launch instances. EBS Snapshots back up data volumes but do not capture the full instance configuration. Aurora is a database service, not a tool for duplicating EC2 instances.

Answer : B
Explanation: AWS Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to set permission guardrails across all accounts in an organization. SCPs restrict what services and actions are available in each account, even overriding administrator-level IAM permissions within those accounts. IAM policies manage permissions within a single account. IAM Principals are entities that can make requests (users, roles, services). AWS Fargate is a serverless compute engine for containers — unrelated to access control.

Answer : C
Explanation: Agility in the AWS Cloud refers to the ability to rapidly provision and de-provision resources in minutes, enabling teams to experiment and innovate faster than with traditional on-premises infrastructure where procurement and setup can take weeks or months. Hosting in multiple regions (A) describes global reach. Customizable hardware (B) is not an AWS offering. Paying upfront (D) describes Reserved Instance pricing, not agility.

Answer : A, C
Explanation: Amazon RDS reduces the administrative burden (A) by handling routine database tasks such as patching, backups, and hardware provisioning. It also provides resizable compute capacity (C), allowing you to scale your database instance up or down as needed. RDS does not provide complete control over the underlying host (B) — that is a benefit of running a database on EC2. RDS does not auto-scale instance types automatically (D) — that requires manual intervention. Document and key-value data structures (E) are supported by DynamoDB, not RDS.

Answer : D
Explanation: AWS Site-to-Site VPN creates an encrypted IPSec tunnel between your on-premises network and your Amazon VPC over the public internet, providing secure hybrid connectivity. AWS Direct Connect (C) is a dedicated private connection but does not use IPSec encryption by default. An Internet Gateway provides internet access for resources in a VPC. AWS IQ is a marketplace for connecting customers with AWS certified experts.

Answer : D
Explanation: AWS Business Support is the minimum support plan that provides 24×7 access to Cloud Support Engineers via phone, chat, and email. Developer Support only provides email-based support during business hours. Basic Support offers no technical support access. Enterprise Support includes all Business Support features plus a dedicated Technical Account Manager (TAM) and other premium services.

Answer : A, E
Explanation: Network Access Control Lists (NACLs) (A) are stateless firewalls that control inbound and outbound traffic at the subnet level within a VPC. Security Groups (E) are stateful firewalls that control traffic at the EC2 instance level. Key Pairs are used for SSH authentication to EC2 instances, Access Keys are for programmatic API access, and IAM Policies control permissions to AWS services — none of these control network traffic directly.

Answer : B
Explanation: Spot Instances are the most cost-effective option (up to 90% discount over On-Demand) and are ideal for workloads that can tolerate interruptions, such as media transcoding jobs that are designed to recover quickly from failures. Since the application already handles recovery from hardware failures, Spot Instance interruptions are not a concern. Reserved Instances require a long-term commitment, On-Demand is more expensive, and Dedicated Instances are the costliest option.

Answer : A
Explanation: The AWS Service Health Dashboard (now part of AWS Health) provides a public, real-time view of the operational status of all AWS services across all regions. Anyone can view it without logging in. The AWS Personal Health Dashboard provides a personalized view of events affecting your specific AWS resources. Amazon CloudWatch monitors your own application and resource metrics. The AWS Management Console is the web-based interface for managing AWS services.

Answer : A
Explanation: The AWS Software Development Kit (SDK) provides language-specific APIs that allow developers to integrate and call AWS services directly from their application code in languages such as Python, Java, JavaScript, .NET, Go, Ruby, and more. The AWS CLI is for command-line scripting, not programming language integration. AWS CodeDeploy automates application deployments. The AWS Management Console is a web-based GUI — none of these allow programmatic calls from application code the way the SDK does.

Answer : B
Explanation: Amazon Route 53 is AWS’s scalable DNS web service that also provides domain name registration. You can search for and register new domain names directly through Route 53. Amazon Personalize is a machine learning service for recommendations, AWS KMS manages encryption keys, and AWS Config tracks resource configurations — none offer domain name registration.

Answer : A, D
Explanation: AWS CloudFormation (A) enables infrastructure as code, allowing developers to automate the provisioning of entire application stacks using templates, speeding up deployments significantly. AWS Elastic Beanstalk (D) automates application deployment by handling capacity provisioning, load balancing, scaling, and monitoring with minimal configuration. AWS Migration Hub tracks migrations, AWS IAM manages access permissions, and Amazon Macie is a data security service — none are application deployment automation tools.

Answer : A
Explanation: AWS Trusted Advisor analyzes your AWS environment and provides real-time recommendations across five categories, including Cost Optimization — such as identifying idle EC2 instances, underutilized EBS volumes, and unused Reserved Instances. AWS Pricing Calculator estimates future costs for planned architectures. Amazon QuickSight is a business intelligence visualization tool. AWS X-Ray is for application performance tracing — none provide cost-optimization recommendations for existing resources.

Answer : B
Explanation: AWS Transit Gateway acts as a cloud router that enables you to connect hundreds of VPCs and on-premises networks through a central hub, greatly simplifying network management at scale. VPC Peering (A) only connects two VPCs at a time and becomes unmanageable at scale with hundreds of VPCs. Amazon Connect is a cloud contact center service. Security Groups are instance-level traffic filters — neither simplifies large-scale VPC connectivity.

Answer : B, D
Explanation: The main benefit of Reserved Instances is the significant discount (up to 72%) compared to On-Demand pricing (D). The main drawback is the required pricing commitment of at least one year (B), which makes them unsuitable for short-term or variable workloads. Instances being shut down without notice (A) describes Spot Instances, not Reserved. Reserved Instances are best suited for steady, predictable workloads, not periodic ones (E is incorrect).

Answer : A
Explanation: Multiple Availability Zones within a Region allow customers to build resilient and highly available architectures by distributing resources across physically separate, isolated locations. If one AZ experiences an outage, applications can continue running from another AZ. Multiple AZs do not inherently reduce costs (B), they support regional not global reach (C), and they do not increase total storage capacity available (D).

Answer : A
Explanation: For a short-term workload of only two months that must always be available, On-Demand Instances are the most appropriate and cost-effective choice. Reserved Instances require a minimum 1-year commitment, making them unsuitable and more expensive for a two-month period. Spot Instances can be interrupted by AWS at any time, making them unsuitable for workloads that must always be available.

Answer : D
Explanation: Running an application across multiple Availability Zones increases its availability by ensuring that if one AZ experiences an outage, the application continues to operate from the other AZs without interruption. Running in multiple AZs does not allow you to exceed service limits (A), does not inherently reduce latency for global users (B — that requires CloudFront or multiple Regions), and does not automatically increase compute capacity (C — that requires Auto Scaling).

Answer : B
Explanation: AWS follows strict industry-standard practices for decommissioning storage devices. When a storage device reaches the end of its useful life, AWS uses techniques such as DoD 5220.22-M or NIST 800-88 to decommission and physically destroy the devices, ensuring that customer data cannot be recovered. AWS does not sell, remanufacture, or simply store old devices — destruction is the only method that guarantees data cannot be accessed.