Answer : A, B
Explanation: AWS Certificate Manager (ACM) is the primary service for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services. Amazon Route 53 can also be used in conjunction with SSL certificates for domain validation. AWS Directory Service manages Active Directory, IAM manages user permissions, and AWS Data Pipeline is a data movement service — none are used to deploy SSL certificates.

Answer : B, C
Explanation: Amazon S3 automatically scales to handle any amount of data and any number of requests without any manual intervention. AWS Lambda automatically scales by running code in parallel in response to each trigger, handling any number of requests simultaneously. Amazon EC2 requires Auto Scaling to be configured, Amazon EMR requires manual cluster resizing, and Amazon EBS volumes must be manually resized — none scale automatically on their own.

Answer : B, D
Explanation: With AWS Lambda, AWS is responsible for capacity management (B) — automatically provisioning and scaling the underlying compute resources — and operating system maintenance (D) — patching and managing the underlying OS and runtime environment. Application management (A), access control (C), and data management (E) remain the customer’s responsibility regardless of whether they use EC2 or Lambda.

Answer : D
Explanation: Elastic Load Balancers (ELBs) continuously monitor the health of registered targets (such as EC2 instances) and automatically route traffic only to healthy targets. If a target becomes unhealthy, the ELB stops sending traffic to it, improving application reliability and availability. ELBs do not distribute traffic to S3 buckets, replicate data across AZs, or create database Read Replicas — those are functions of other AWS services.

Answer : C
Explanation: Dedicated instances run on hardware that is physically isolated at the host hardware level and is not shared with other AWS customers. This meets the company’s requirement for dedicated hardware. On-Demand, Spot, and Reserved Instances are all purchasing options that can run on shared hardware by default. Note that Dedicated Hosts provide even more control over the physical server, but Dedicated Instances satisfy the “not shared” requirement.

Answer : C
Explanation: AWS Snowmobile is an exabyte-scale data transfer service that uses a secure, ruggedized shipping container transported by a truck to move extremely large amounts of data — up to 100 Petabytes per Snowmobile — to AWS. For 60 Petabytes, Snowmobile is the most appropriate choice. AWS Snowball handles up to 80 TB per device (multiple would be needed), S3 Transfer Acceleration speeds up internet-based uploads but is impractical at this scale, and Amazon VPC is a networking service, not a data transfer tool.

Answer : A
Explanation: Amazon S3 Glacier is designed for long-term archival storage at very low cost, with retrieval options ranging from minutes to hours. The standard retrieval option provides access within 3-5 hours, which meets the 5-hour requirement. S3 Standard is much more expensive and designed for frequently accessed data. Amazon EFS is a file system service and Amazon EBS is block storage — both are far more expensive than Glacier for archival use cases.

Answer : C
Explanation: AWS Identity and Access Management (IAM) is the service used to manage user identities and their permissions to access AWS services and resources. You can create users, groups, and roles, and attach policies that define what actions are allowed or denied. Security Groups control network traffic at the instance level, Amazon ECS is a container orchestration service, and AWS Support provides technical assistance — none manage user permissions.

Answer : C
Explanation: The AWS Support Concierge Service is exclusively available to customers on the Enterprise Support plan. It provides a dedicated team to assist with billing and account inquiries, helping enterprise customers get personalized guidance. “Premium Support” and “Standard Support” are not actual AWS support plan names. Business Support does not include the Concierge Service.

Answer : C
Explanation: AWS CloudTrail records every API call made in your AWS account, including who made the call, what service was called, what action was performed, and when it happened. This makes it the ideal service for tracking resource changes through API call history. AWS Config tracks resource configuration states over time, CloudWatch monitors metrics and logs, and CloudFormation provisions infrastructure — none record API call history.

Answer : B, C
Explanation: AWS-managed services reduce operational complexity (C) by offloading routine infrastructure tasks such as patching, backups, and scaling to AWS, allowing teams to focus on building and delivering new solutions faster (B). Managed services do not provide complete control over the virtual infrastructure (A) — that is a characteristic of IaaS like EC2. Data encryption is still the customer’s responsibility (D), and managed services handle patching, removing it from developer control (E is incorrect).

Answer : A, D
Explanation: Amazon S3 can host static websites (A) by serving HTML, CSS, and JavaScript files directly from a bucket. It is also commonly used as an origin media store for Amazon CloudFront (D), which retrieves and caches content from S3 at Edge Locations globally. S3 cannot host dynamic websites requiring CPU processing (B) — that needs EC2 or Lambda. S3 is object storage, not a database (C). Processing data streams (E) is handled by Amazon Kinesis.

Answer : C
Explanation: AWS recommends rotating access keys regularly as a security best practice to reduce the risk of compromised credentials being used over a long period. Access keys should never be shared with others (B), embedded in application code (D) — use IAM roles instead — or deleted simply in favor of passwords (A), as access keys are required for programmatic access. Regular rotation limits the window of exposure if a key is ever compromised.

Answer : D
Explanation: Multi-Factor Authentication (MFA) adds an additional layer of security by requiring users to provide a second form of verification — such as a time-based one-time password from an authenticator app or hardware token — in addition to their username and password. Key Pairs are for SSH access to EC2 instances, Access Keys are for programmatic API access, and the SDK is a development tool — none provide an additional authentication layer on top of username and password.

Answer : D
Explanation: AWS APIs allow developers to programmatically interact with and manage AWS resources using code, scripts, or third-party tools — enabling automation, integration with applications, and infrastructure as code. APIs do not inherently improve resource performance (A), reduce provisioning time directly (B), or reduce the number of developers needed (C). The core benefit is enabling programmatic, automated management of AWS resources.

Answer : C
Explanation: Amazon EBS (Elastic Block Store) is the best storage option for databases with high read/write activity. It provides persistent, high-performance block storage with low latency, designed specifically for workloads requiring frequent read and write operations such as databases. Amazon S3 is object storage not suited for high-frequency random read/write, S3 Glacier is for archival with high retrieval latency, and AWS Storage Gateway is for hybrid cloud connectivity, not primary database storage.

Answer : C
Explanation: AWS Budgets allows customers to set custom utilization thresholds for Reserved Instances and receive alert notifications when utilization drops below those thresholds, helping avoid waste from underutilized reservations. Amazon Neptune is a graph database, not a usage analysis tool (B). CloudTrail logs API calls but does not provide reservation utilization recommendations (D). Turning off Reserved Instance sharing (A) would reduce the benefit of consolidated billing.

Answer : A
Explanation: Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud that delivers up to five times the throughput of standard MySQL and three times that of standard PostgreSQL. Amazon Redshift is a data warehouse for analytics, Amazon DynamoDB is a NoSQL database, and Amazon Neptune is a graph database — none are MySQL-compatible relational databases with this level of performance improvement.

Answer : C
Explanation: AWS Service Catalog allows organizations to create and manage catalogs of approved IT services — such as virtual machine images, servers, software, and databases — that are pre-approved for use within an organization. This helps with governance, compliance, and self-service provisioning. Option D describes AWS CDK (Cloud Development Kit). Options A and B describe general documentation or the AWS console, not a specific service.

Answer : C, D
Explanation: For fully managed services like Amazon DynamoDB, AWS is responsible for patching the database software (C) and maintaining the underlying operating system (D). Customers retain responsibility for protecting their credentials (A), configuring logging of access activity (B), and creating appropriate access policies (E) to control who can access the database and what actions they can perform.

Answer : B
Explanation: AWS Application Discovery Service helps enterprises plan migration projects by automatically collecting configuration and usage data about on-premises servers, which can be used to assess the scope and cost of migration. AWS DMS (Database Migration Service) performs the actual database migration. AWS Migration Hub tracks the progress of migrations. “AWS Snowball Migration Service” is not a real AWS service — Snowball is a physical data transfer device.

Answer : C
Explanation: AWS Cost & Usage Report (CUR) provides the most comprehensive and granular data available about AWS costs and usage, including hourly or daily line items for every AWS service, resource, and tag. AWS Cost Explorer offers visualizations and summaries but is less granular than CUR. Amazon Machine Image is an EC2 instance template, and CloudWatch monitors operational metrics — neither provides billing data.

Answer : C
Explanation: An AWS Region is a distinct geographical location that contains multiple, physically separated and isolated Availability Zones. Each Region is completely independent of others. Edge Locations are part of CloudFront’s CDN network, not part of a Region’s definition (A). A VPC is a virtual private network for a single customer (B). Regions can span multiple countries and are not limited to a single country (D).

Answer : D
Explanation: AWS CloudTrail logs all API calls made in your AWS account, including the identity of the caller, the time of the call, and the action performed. By reviewing CloudTrail logs, the company can identify exactly who deleted the S3 buckets and when. SNS and SQS do not maintain action logs. CloudWatch Logs collects application and system logs but does not record AWS API-level actions like bucket deletions.

Answer : C, D
Explanation: The number of reads and writes per second (C) determines whether you need a high-throughput database like DynamoDB or a traditional relational database. The nature of the queries (D) — whether they are transactional, analytical, graph-based, or key-value lookups — helps determine whether you need SQL, NoSQL, or a specialized database. Availability Zones, data sovereignty, and software bugs are infrastructure or compliance considerations, not database technology selection criteria.

Answer : A, E
Explanation: Tags are key-value pairs attached to AWS resources that help with organization and cost management. A tagging strategy allows you to quickly identify resources belonging to a specific project, team, or environment (A), and track and allocate AWS spending by filtering Cost & Usage Reports by tag (E). Tracking API calls is done by CloudTrail, not tags. Tags do not help identify software solutions or deleted resources.

Answer : D
Explanation: AWS shared controls are responsibilities that apply to both AWS and the customer, where each party manages their own portion. Examples include Patch Management (AWS patches infrastructure, customers patch their OS and apps) and Configuration Management (AWS configures its devices, customers configure their own). These are not solely customer responsibilities (A), not inherited entirely from AWS (B), and are more specifically defined than simply “both layers” (C).

Answer : A, D
Explanation: The AWS Well-Architected Framework’s Performance Efficiency pillar includes principles such as building multi-region architectures (A) to reduce latency for global users, and using serverless architectures (D) to avoid over-provisioning and ensure resources scale automatically with demand. Applying security at all layers (B), implementing strong IAM controls (C), and enabling audit logging (E) are all principles of the Security pillar, not Performance Efficiency.

Answer : A, E
Explanation: When using Amazon EC2, customers are responsible for protecting their sensitive data (A) — including encryption and access control — and for installing and configuring any third-party software (E) running on their instances. Patching the underlying infrastructure (B) and maintaining hardware components (D) are AWS responsibilities. Setup and operation of managed databases (C) is also an AWS responsibility when using services like RDS, though the schema and data remain the customer’s responsibility.

Answer : C, E
Explanation: AWS provides elastic resources (C) that can be scaled up or down on demand, eliminating the need to over-provision hardware for peak loads. AWS also offers significant cost savings (E) by replacing large upfront capital expenditures with lower variable operational costs. AWS does not provide free commercial software licenses (A) or free technical support (B) — both have associated costs. On-site auditing visits (D) are not a standard AWS offering.

Answer : A, E
Explanation: Amazon Inspector (A) performs automated security assessments of EC2 instances and applications, identifying vulnerabilities and deviations from security best practices to support compliance auditing. AWS Config (E) continuously monitors and records AWS resource configurations, enabling compliance auditing by evaluating configurations against desired rules. AWS Virtual Private Gateway is for VPN connectivity, AWS Batch is for batch computing, and Amazon ECS is for container orchestration — none perform security or compliance analysis.

Answer : A
Explanation: Amazon EC2 is NOT a serverless service — it is an Infrastructure as a Service (IaaS) offering where you provision and manage virtual servers. Serverless services like AWS Lambda abstract away server management entirely. EC2 does eliminate upfront hardware investment (B), allows flexible launch of any number of instances (C), and offers scalable computing capacity (D) — all of which are genuine EC2 characteristics.

Answer : A
Explanation: AWS Lambda is a serverless compute service that runs your code only in response to events — such as changes to S3 objects, DynamoDB updates, HTTP requests via API Gateway, or scheduled events — without requiring you to provision or manage servers. You are charged only for the compute time consumed. Amazon CloudWatch monitors metrics and logs, AWS Transit Gateway connects networks, and Amazon EC2 runs continuously as a virtual server — none execute code only on event triggers.

Answer : D
Explanation: Amazon EC2 Instances are the virtual servers provided by AWS, equivalent to physical servers in a traditional data center but available on demand in the cloud. Amazon EBS Snapshots are point-in-time backups of storage volumes. Amazon VPC is a virtual private network. “AWS Managed Servers” is not a real AWS service name — EC2 Instances are the correct term for AWS virtual servers.

Answer : C
Explanation: The AWS Cloud Adoption Framework (CAF) is a framework created by AWS Professional Services to help organizations develop an efficient and effective plan for cloud adoption. It provides guidance across six perspectives: Business, People, Governance, Platform, Security, and Operations. AWS Secrets Manager manages sensitive credentials, AWS WAF is a web application firewall, and Amazon EFS is a file storage service — none are cloud adoption frameworks.

Answer : B
Explanation: The AWS TCO (Total Cost of Ownership) Calculator helps organizations compare the cost of running their existing on-premises infrastructure versus running equivalent workloads on AWS, providing a detailed cost-benefit analysis to support migration decisions. AWS Cost Explorer analyzes existing AWS spending. AWS Budgets sets cost thresholds and alerts. AWS Pricing Calculator estimates the cost of specific AWS configurations — none are designed specifically for on-premises vs. AWS cost comparison.

Answer : C
Explanation: Managing infrastructure as code using AWS CloudFormation is a key practice of the Operational Excellence pillar, as it enables automated, repeatable, and auditable infrastructure deployments. Using Trusted Advisor to find underutilized resources (A) relates to Cost Optimization. Using CloudTrail to record user activities (B) relates to Security. Deploying across multiple Availability Zones (D) relates to Reliability — none of these are Operational Excellence practices.

Answer : C, E
Explanation: Startups prefer AWS because it allows them to focus on building their product and reducing time-to-market instead of managing data center infrastructure (C). AWS also replaces large upfront capital expenditures (buying servers, building data centers) with low, variable operational costs — pay only for what you use (E). AWS does not offer deferred payment (A), does not guarantee building faster than competitors (B), and cloud computing increases, not removes, operational expenditure (D is incorrect — CapEx is replaced by OpEx).

Answer : A, D
Explanation: Amazon DynamoDB automatically scales throughput capacity up or down based on demand (A), eliminating the need to manually provision capacity. It also delivers consistent, single-digit millisecond latency (D) at any scale, making it ideal for high-performance applications. DynamoDB does not use resizable instances (B) — it is serverless. It is a NoSQL-only database and does not support relational models (C). It is a proprietary AWS service, not CouchDB or MongoDB (E).

Answer : A, C
Explanation: S3 Versioning (A) protects data at rest by keeping multiple versions of an object, allowing recovery from accidental deletion or overwriting. S3 Permissions (C) — through bucket policies, ACLs, and IAM policies — protect data by controlling who can access or modify objects. Deduplication is not an S3 feature. Decryption is the opposite of protecting data. Conversion does not relate to data protection in S3.

Answer : A, C
Explanation: The AWS Migration Acceleration Program (MAP) helps enterprises migrate to AWS by providing AWS Partners (A) — a global network of consulting and technology partners — and AWS Professional Services (C) — an AWS team of experts who work alongside customers to accelerate cloud adoption. AWS Artifact is a compliance document portal, Amazon Athena is a query service, and Amazon Pinpoint is a customer engagement service — none are components of MAP.

Answer : B
Explanation: Auto Scaling launch configurations are free — they are just configuration templates and do not incur charges whether used or not. Deleting them does not reduce your AWS bill. In contrast, unused EBS volumes (A), idle Elastic Load Balancers (C), and unassociated Elastic IPs (D) all incur ongoing charges even when not actively being used, so deleting or releasing them is a recommended cost-saving practice.

Answer : A
Explanation: AWS Cost Explorer provides an interactive graphical interface to visualize, understand, and analyze your AWS costs and usage over time — including the past few months. It allows filtering by service, region, tag, and more. AWS Pricing Calculator estimates future costs. AWS Budgets tracks spending against defined thresholds. AWS Consolidated Billing aggregates billing across multiple accounts but does not provide visualization tools on its own.

Answer : C, E
Explanation: Data center operations (C) — including physical facility management, power, cooling, and hardware maintenance — are entirely AWS’s responsibility. Infrastructure security (E) — securing the underlying physical and network infrastructure — is also solely AWS’s responsibility. Customers are responsible for running their own penetration tests (A) on their resources, reserving capacity (B) through Reserved Instances if needed, and managing their own auditing and regulatory compliance (D) for their applications and data.

Answer : C
Explanation: Amazon Simple Notification Service (SNS) supports sending SMS text messages to recipients in more than 200 countries worldwide, making it ideal for promotional messaging and notifications. Amazon SES is for sending emails, not SMS. Amazon S3 is object storage. Amazon SQS is a message queuing service for application-to-application messaging, not for sending SMS to end users.

Answer : C, E
Explanation: AWS CloudFormation (C) allows you to define and provision RDS instances as part of infrastructure-as-code templates, automating their creation. The AWS Management Console (E) provides a web-based graphical interface where you can manually create and configure RDS instances. AWS CodeDeploy automates application deployments, AWS Quick Starts are pre-built reference architectures, and AWS DMS migrates databases — none directly create new RDS instances.

Answer : C
Explanation: AWS bills Linux-based EC2 instances per second (with a minimum of 60 seconds), meaning customers only pay for the exact compute time they use. This granular billing model significantly reduces costs for short-running workloads compared to hourly billing. There are no monthly maintenance fees (A), instance tagging has no direct cost reduction impact (B), and there are no instance start-up fees in AWS (D).

Answer : B
Explanation: AWS Professional Services is a global team of experts that works alongside customers and AWS Partners to help organizations achieve their desired business outcomes on AWS. They provide specialized knowledge, best practices, and hands-on assistance for cloud adoption, migration, and optimization projects. The AWS Security Team is an internal AWS team. AWS Trusted Advisor is an automated recommendation tool. The Concierge Support Team handles billing and account inquiries for Enterprise Support customers.

Answer : A
Explanation: AWS Key Management Service (KMS) is a managed service that allows customers to create, manage, and control the cryptographic keys used to encrypt their data across AWS services. AWS SCPs restrict actions in AWS Organizations accounts. MFA adds a second authentication factor for user logins. Amazon Macie uses machine learning to discover and protect sensitive data in S3 — none manage encryption keys.

Answer : B
Explanation: AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and security documents, including SOC (System and Organization Controls) reports, PCI DSS compliance reports, and other certifications. Customers can download these reports directly to support their own compliance and audit requirements. The AWS Well-Architected Tool reviews architecture best practices, AWS Glue is a data integration service, and Amazon Chime is a communications service — none provide compliance reports.