Answer : C
Explanation: Fault Tolerance is the design principle that ensures a system continues operating without interruption even when one or more of its components fail. For an e-commerce site where every minute of downtime means significant financial loss, building a fault-tolerant architecture — using redundancy across multiple AZs, load balancing, and auto scaling — minimizes the risk of an outage. Least Privilege is a security concept, Pilot Light is a DR strategy, and Multi-threading is a software concept unrelated to AWS availability.

Answer : A
Explanation: Among the three Reserved Instance payment options, All Up-Front provides the largest total discount because you pay the entire reservation cost upfront, reducing AWS’s financial risk and allowing them to offer the highest savings. Partial Up-Front offers a mid-level discount, and No Up-Front offers the lowest discount. All three options provide savings over On-Demand pricing, but the discount level is not equal (B is incorrect).

Answer : A, C
Explanation: Access control (A) through IAM policies, bucket policies, and security groups ensures that only authorized users and services can access your data. Data encryption (C) — both at rest (using services like AWS KMS and SSE) and in transit (using TLS/SSL) — protects data from unauthorized access. Physical MFA devices are a security feature but not specifically a data protection feature. Unlimited storage and load balancing are not data protection mechanisms.

Answer : C
Explanation: Amazon Linux instances are billed per second with a minimum of 60 seconds, so the customer is billed for exactly 2 hours, 5 minutes and 9 seconds for the Linux instance. CentOS is not a Linux distribution billed per second by AWS — it falls under the “all other instance types” category and is billed per full hour. Since the CentOS instance ran for 4 hours and 23 minutes, it is rounded up to 5 full hours.

Answer : C
Explanation: The AWS Support API allows customers to programmatically create, manage, and retrieve AWS support cases, as well as access Trusted Advisor check results. This enables customers to integrate support case management into their own applications and workflows. AWS Trusted Advisor provides best practice recommendations, AWS Operations Support is not a standard AWS service name, and the Personal Health Dashboard provides alerts about AWS service health — none allow programmatic case management.

Answer : A, C
Explanation: AWS IAM can be managed using the AWS CLI (A), which allows scripting and automation of IAM operations from the command line, and the AWS SDKs (C), which allow programmatic interaction with IAM from within application code using supported programming languages. Security Groups and NACLs are network traffic controls, not IAM interaction methods. AWS CodeCommit is a source control service — none of these interact with IAM.

Answer : C, D
Explanation: IAM Roles (C) and IAM Users (D) are both IAM identity types — entities that can be authenticated and authorized to interact with AWS services. IAM Groups are also an identity type (a collection of users). IAM Policies are permission documents attached to identities, not identities themselves. AWS Resource Groups and AWS Organizations are separate AWS features unrelated to IAM identity types.

Answer : D
Explanation: Read Replicas are copies of the primary RDS database instance that serve read-only traffic, offloading read queries from the primary instance and improving overall performance. This is particularly useful for read-heavy workloads. Database Snapshots and Automated Backups are for data recovery, not performance. Multi-AZ Deployments provide high availability through automatic failover, not read offloading.

Answer : B
Explanation: AWS publishes Security Bulletins on the AWS Security Bulletins page to notify customers about security and privacy events that may affect AWS services. These bulletins include details about vulnerabilities, patches, and recommended actions. AWS ACM is for SSL/TLS certificate management, the Management Console is a general administration interface, and Compliance Resources provide regulatory documentation — none are the primary channel for AWS security event notifications.

Answer : C
Explanation: IAM Roles are the best way to grant temporary access to AWS resources. When a role is assumed, AWS provides temporary security credentials (Access Key ID, Secret Access Key, and Session Token) that expire automatically. Roles are commonly used to grant EC2 instances, Lambda functions, or external users temporary access without embedding long-term credentials. IAM Users have permanent credentials, Key Pairs are for SSH access, and IAM Groups are for organizing users — none provide temporary access.

Answer : B
Explanation: The AWS Application Load Balancer (ALB) is the ideal service for distributing HTTP/HTTPS traffic evenly across multiple EC2 instances. It operates at Layer 7 and supports content-based routing, health checks, and even distribution of requests across registered targets. AWS Global Accelerator improves global performance but does not balance traffic between EC2 instances. CloudFront is a CDN for content delivery. Transit VPC is a network connectivity pattern — none distribute application traffic across EC2 instances.

Answer : C
Explanation: Using code to provision and operate AWS infrastructure — known as Infrastructure as Code (IaC) — is the best practice for eliminating human error in environment management. Tools like AWS CloudFormation and AWS CDK allow you to define infrastructure in code, making deployments consistent, repeatable, and auditable. Software test automation tools are for application testing. AWS CodeDeploy automates application deployments, not infrastructure provisioning. Dedicated hosts address hardware isolation, not automation.

Answer : C
Explanation: Requiring MFA for all IAM users is one of the most effective ways to secure an AWS account. Even if a password is compromised, an attacker cannot log in without the second factor. Restricting all SDK/CLI API calls (A) would prevent legitimate programmatic access. Sharing IAM accounts across staff (B) violates the principle of least privilege and makes auditing impossible. Setting up two passwords (D) is not a feature AWS supports and does not improve security.

Answer : B
Explanation: Amazon S3 offers tiered volume pricing — the more data you store, the lower the per-GB price. For example, the first 50 TB/month is priced higher per GB than storage beyond 50 TB, providing automatic volume discounts as usage increases. Amazon VPC is a networking service with no volume discount model. Amazon Lightsail is a simplified compute service with flat pricing. AWS Cost Explorer is a cost analysis tool, not a service that offers discounts.

Answer : B, C
Explanation: Data sovereignty (B) is a critical factor — some regulations require data to remain within specific geographic boundaries or countries, dictating which AWS Region can be used. Cost (C) is also important, as AWS pricing varies by Region, and deploying in a lower-cost region can reduce expenses. All AWS Regions maintain the same high security standards (A is not a differentiating factor). The number of VPCs (D) does not determine region selection. Geographic proximity (E) affects latency but is a subset of cost and performance considerations — data sovereignty and cost are the primary factors for this question.

Answer : C
Explanation: Amazon ElastiCache is a fully managed in-memory caching service that supports Redis and Memcached. It sits in front of your MySQL database and serves frequently requested data from memory, dramatically reducing database load and response times. DAX (D) is an in-memory cache specifically for DynamoDB, not MySQL. Amazon EFS is a file storage service, and Amazon Neptune is a graph database — neither provide in-memory caching for MySQL applications.

Answer : B
Explanation: Auto Scaling Groups can be configured to launch EC2 instances across multiple Availability Zones, increasing both availability and fault tolerance. If one AZ becomes unavailable, the group maintains capacity in other AZs. Caching at edge locations (A) is a function of CloudFront. Scaling across multiple regions (C) is not a feature of Auto Scaling Groups. Distributing traffic (D) is the function of Elastic Load Balancers, not Auto Scaling Groups.

Answer : C
Explanation: AWS has a history of regularly reducing prices for its services as its infrastructure grows more efficient and economies of scale increase. These ongoing price reductions widen the TCO gap between AWS and traditional on-premises infrastructure over time. AWS does not increase CapEx for customers (A) — it reduces it. AWS does not automate all operations (B) — customers still manage their applications. While AWS includes security features, charging “no additional charge” for all security (D) is not the primary driver of the TCO gap.

Answer : A, E
Explanation: “Security IN the cloud” refers to the customer’s responsibilities within the AWS environment. Building a schema for an application (A) is a customer responsibility, as it relates to how the customer structures their data and application. File system encryption (E) is also a customer responsibility — customers choose whether and how to encrypt their data. Replacing physical hardware (B), creating hypervisors (C), and patching the underlying infrastructure (D) are all AWS responsibilities as part of “security OF the cloud.”

Answer : B
Explanation: A U2F (Universal 2nd Factor) Security Key is a hardware MFA device — such as a YubiKey — that can be plugged into a USB port and used as a second factor for AWS Console authentication. AWS supports three types of MFA devices: virtual MFA apps (like Google Authenticator), U2F security keys, and hardware TOTP tokens. AWS CloudHSM is a hardware security module for key management, not an MFA device. Access Keys and Key Pairs are authentication credentials, not MFA devices.

Answer : B
Explanation: AWS Elastic Beanstalk is a PaaS service that makes it easy to quickly deploy and manage applications without worrying about the underlying infrastructure. It natively supports .NET applications along with other platforms like Java, Python, Node.js, and PHP. Developers simply upload their code and Elastic Beanstalk handles provisioning, load balancing, scaling, and monitoring. Amazon SNS is a notification service, AWS Systems Manager is for operational management, and Trusted Advisor provides best practice recommendations — none deploy .NET applications.

Answer : B, D
Explanation: Security groups (B) are free to create and use — they do not factor into EC2 cost estimates. Hosted Zones (D) are a Route 53 pricing element, not an EC2 cost factor. The amount of time instances run (A), allocated Elastic IPs (C) — which incur charges when not associated with a running instance — and the number of instances (E) are all direct factors in EC2 cost estimation.

Answer : B
Explanation: AWS Storage Gateway is a hybrid cloud storage service that enables enterprises to seamlessly extend their on-premises storage to AWS. It provides on-premises applications with access to cloud storage using standard protocols, enabling cost-effective hybrid architectures where frequently accessed data stays on-premises and less-accessed data is tiered to AWS. AWS Data Pipeline moves data between services, Amazon Aurora is a relational database, and Amazon EFS is a cloud-based file system — none specifically extend on-premises storage to AWS.

Answer : A
Explanation: Amazon S3 is the ideal choice for a cloud storage platform. It scales automatically to store any amount of data without pre-provisioning capacity, and you only pay for what you store, making it highly cost-effective. Amazon EBS requires manual volume resizing and is tied to EC2 instances. Amazon ECS is a container orchestration service, not a storage service. AWS Storage Gateway is for hybrid cloud connectivity, not a scalable cloud storage platform.

Answer : D
Explanation: In AWS IAM, new users are created with no permissions by default — this is an implicit deny. Without explicit permissions being granted via an IAM policy, the new user cannot perform any actions, including creating EBS snapshots or S3 buckets. EBS and S3 are not restricted only to the root account (A). New IAM accounts do not need AWS Support activation (B). S3 provides virtually unlimited storage (C). The administrator simply needs to attach the appropriate IAM policies to the new user.

Answer : A
Explanation: AWS CloudTrail records all API calls and access events across your AWS account, including who accessed which resource, when, from where, and what action was taken. This provides the complete access log that an auditor would need. Amazon CloudFront is a CDN, AWS CloudFormation is an infrastructure provisioning service, and Amazon CloudWatch monitors metrics and logs — none provide a comprehensive log of all AWS resource accesses.

Answer : A
Explanation: Amazon Cloud Directory is a highly scalable directory store that enables you to create directory-based data stores and organize hierarchies of data across multiple dimensions — for example, an organizational chart that can be traversed by department, location, or role simultaneously. Option B describes Amazon Kinesis. Option C describes AWS Directory Service with AD Connector. Option D describes Amazon Route 53.

Answer : D
Explanation: For a “Production System Down” critical case, AWS Business Support provides a response time of less than one hour, and AWS Enterprise Support provides a response time of less than 15 minutes. Since the question asks for the expected response time for this case type in general, one hour (D) is the standard response time at the Business Support level, which is the minimum plan that offers this severity level. The 15-minute response (B) applies specifically to Enterprise Support’s critical business impact cases.

Answer : A
Explanation: Deploying an application across at least two Availability Zones ensures that if one AZ experiences an outage, the application continues to serve traffic from the other AZ, achieving high availability. ELB does not operate across multiple Regions (B) — it operates within a single region. Deploying two servers in the same AZ (C) does not protect against an AZ-level failure. Rewriting application code (D) does not improve infrastructure-level availability.

Answer : A, B
Explanation: A TCO analysis comparing on-premises to AWS should include labor and IT costs (A) — such as staff needed to manage physical servers, networking, and data center operations — which are significantly reduced with AWS. Cooling and power consumption (B) are major ongoing expenses for on-premises data centers that are eliminated when moving to AWS. Amazon EBS computing power (C) is an AWS service cost, not an on-premises cost factor. Software architecture (D) and compatibility (E) are migration concerns, not TCO cost components.

Answer : D
Explanation: AWS Enterprise Support is the only plan that guarantees a response time of less than 15 minutes for business-critical system outages (critical severity cases). AWS Business Support offers less than 1 hour for production system down cases. AWS Developer Support offers less than 12 hours for general guidance. AWS Basic Support offers no technical support SLAs. Only Enterprise Support meets the 15-minute requirement.

Answer : B, C
Explanation: AWS Lambda (B) is a serverless compute service where you run code without provisioning or managing servers. Amazon DynamoDB (C) is a serverless NoSQL database that automatically scales and requires no server management. Amazon EC2 requires you to provision and manage virtual servers. Amazon EMR requires cluster management. Amazon RDS requires instance provisioning and management — none of these are serverless.

Answer : B
Explanation: AWS Certificate Manager (ACM) allows you to easily provision, manage, and deploy SSL/TLS certificates for use with AWS services such as Elastic Load Balancers, CloudFront, and API Gateway. ACM provides free public certificates and handles automatic renewal. Amazon GuardDuty is a threat detection service, Amazon Detective helps investigate security findings, and AWS WAF is a web application firewall — none provision SSL/TLS certificates.

Answer : B
Explanation: AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet, enabling automated configuration, deployment, and management of EC2 instances and on-premises servers. AWS Config tracks resource configuration changes for compliance. AWS Auto Scaling adjusts compute capacity. AWS CloudFormation provisions infrastructure as code — none specifically integrate with Chef for configuration management.

Answer : C
Explanation: Amazon S3 is an object storage service that allows you to store any number of objects and make them publicly downloadable over the internet via URLs, or privately accessible through signed URLs and bucket policies. Amazon EBS is block storage attached to EC2 instances and not directly accessible over the internet. Amazon EFS is a network file system for EC2. Amazon Instance Store is temporary block storage — none support direct internet downloads of stored objects.

Answer : B
Explanation: Amazon CloudWatch collects and monitors metrics from Amazon CloudFront, including the number of HTTP/HTTPS requests, error rates, bytes transferred, and cache hit/miss ratios. This allows you to monitor the performance of your CloudFront distributions. AWS WAF can filter requests but is a security service, not a monitoring tool. AWS Cloud9 is a cloud IDE. AWS CloudTrail logs API management calls for CloudFront, not the HTTP/HTTPS content requests forwarded through it.

Answer : D
Explanation: For workloads with continuous, predictable compute needs throughout the year, Reserved Instances offer the most cost-effective solution — providing discounts of up to 72% compared to On-Demand pricing in exchange for a 1 or 3-year commitment. On-Demand Instances are the most expensive for always-on workloads. Spot Instances can be interrupted and are not suitable for continuously running applications. Dedicated Hosts are the most expensive option.

Answer : C
Explanation: For a new employee requiring long-term access, creating an IAM user (C) with a policy granting only the specific DynamoDB permissions needed follows the Principle of Least Privilege. IAM roles are better suited for temporary or cross-account access, not long-term individual user access. Granting Administrator access (B, D) violates least privilege by giving far more permissions than necessary. An IAM role without a specific user identity (A) is less appropriate for a named individual employee.

Answer : C
Explanation: The AWS best practice for granting permissions to EC2 applications is to attach an IAM role to the EC2 instance. The role provides temporary, automatically rotating security credentials that the application can use to access AWS services. This eliminates the need to store long-term access keys in code (B) — which is a serious security risk — or manage key rotation manually (A). Applications often do need permissions to interact with other AWS services (D is incorrect).

Answer : B
Explanation: Bringing your own existing third-party software licenses to AWS (BYOL — Bring Your Own License) allows customers to reuse licenses they have already paid for, avoiding the cost of purchasing new licenses in AWS. Using servers instead of managed services (A) increases operational burden and can cost more. Production workloads cannot run on edge locations (C). AWS Outposts extends AWS infrastructure on-premises and is not inherently cost-optimized for all workloads (D).

Answer : A
Explanation: Amazon SQS (Simple Queue Service) is the primary AWS service for decoupling application components. By placing a message queue between components, each component can operate independently — producers send messages to the queue and consumers process them at their own pace. This breaks the tight coupling of monolithic architectures. A Virtual Private Gateway is for VPN connectivity, AWS Artifact is a compliance portal, and CloudFront is a CDN — none decouple application components.

Answer : B, C
Explanation: Virtual MFA can be enabled through the AWS CLI (B) using the `aws iam enable-mfa-device` command, and through the AWS Management Console via IAM (C) where you can assign a virtual MFA device to an IAM user or root account. Amazon Connect is a contact center service, Amazon SNS is a notification service, and Amazon VPC is a networking service — none are used to enable MFA.

Answer : D
Explanation: Running EC2 instances in parallel (horizontal scaling) is the best practice for processing a large number of binary files. By distributing the workload across multiple instances simultaneously, processing time is reduced significantly. Vertical scaling (A) increases the size of a single instance but has limits and creates a single point of failure. RDS is a relational database service and is not appropriate for binary file processing (B, C). Parallelizing compute tasks across multiple EC2 instances is the AWS-recommended approach.

Answer : B
Explanation: The AWS Pricing Calculator allows you to build cost estimates for specific AWS services and configurations before you deploy them. For a company planning to use S3 and CloudFront, the Pricing Calculator can model the expected costs based on storage volume, data transfer, and request rates. AWS Cost Explorer analyzes past spending. AWS Budgets tracks spending against thresholds. AWS Cost & Usage Report provides detailed billing data for existing usage — none estimate future costs for planned architectures.

Answer : D, E
Explanation: If unauthorized resources are found, you should immediately change your root account password and all IAM user passwords (E) to lock out any unauthorized access, and open an investigation to identify and delete potentially compromised IAM users (D). Never share your root account password with anyone, including AWS Support (B). Deleting all IAM users indiscriminately (C) would disrupt legitimate access. Stopping all running services (A) may cause business disruption before an investigation is even complete.

Answer : B
Explanation: Loose coupling is the AWS design practice of minimizing dependencies between application components so that each component can function independently. If one component fails, it does not cascade failures to other components. This is achieved using services like Amazon SQS, SNS, and API Gateway. Tight coupling (D) is the opposite — components are highly dependent on each other, making failures propagate. Elastic and scalable coupling are not recognized AWS design principles.

Answer : A
Explanation: Amazon Elastic File System (EFS) is a fully managed NFS (Network File System) file system that can be mounted simultaneously on thousands of EC2 instances across multiple Availability Zones. This makes it ideal for shared file storage scenarios. Amazon S3 is object storage accessed via HTTP APIs, not NFS. Amazon EBS volumes can only be attached to one EC2 instance at a time (except with Multi-Attach for io1/io2 volumes). AWS Storage Gateway bridges on-premises storage to AWS.

Answer : D
Explanation: The low-latency, high-bandwidth connections between Availability Zones within a Region make it possible to perform synchronous data replication between AZs — for example, Amazon RDS Multi-AZ synchronously replicates data to a standby instance in another AZ. This ensures data consistency and enables automatic failover. Private connections to data centers (A) are provided by Direct Connect, not inter-AZ links. Global high availability (B) requires multiple Regions. Provisioning automation (C) is handled by Auto Scaling and CloudFormation.

Answer : B, E
Explanation: AWS Lambda natively supports multiple programming languages (B) including Node.js, Python, Java, Go, Ruby, .NET (C#), and PowerShell. Additionally, Lambda supports custom runtimes via the Runtime API (E), which allows you to run code in virtually any programming language by implementing a custom runtime. Lambda is not limited to Python and Node.js (A is incorrect). Lambda is not a proprietary language (C). Lambda absolutely supports programming languages (D is incorrect).

Answer : B, C
Explanation: AWS X-Ray is a distributed tracing service that helps developers track and analyze user requests as they travel through an application (B), making it easy to identify bottlenecks, errors, and performance issues. By providing end-to-end visibility into request flows, X-Ray helps improve application performance (C). X-Ray does not automatically decouple components (A) — that is done through architectural patterns and services like SQS. X-Ray does not deploy applications (D, E) — that is the function of AWS CodeDeploy or Elastic Beanstalk.