Answer : D
Explanation: An AWS Availability Zone is an isolated data center (or group of data centers) within an AWS Region, providing fault isolation within that region. Edge Locations, on the other hand, are part of Amazon CloudFront’s global CDN infrastructure and are located in hundreds of cities worldwide — far more locations than Regions or AZs. Edge Locations and Availability Zones are separate concepts and not nested within each other.

Answer : A, C
Explanation: AWS Business Support includes 24×7 access to customer service via phone, chat, and email (A). Infrastructure Event Management (IEM) is available to Business Support customers for an additional fee (C). TAM (Technical Account Manager) is exclusively available on the Enterprise Support plan, not Business (D is incorrect). Business Support provides full access to all Trusted Advisor checks, not partial access (E is incorrect). Email-only support during business hours (B) describes Developer Support, not Business.

Answer : C
Explanation: Amazon Cognito provides user authentication and authorization for web and mobile applications. It supports federation with social identity providers such as Amazon, Apple, Facebook, and Google, allowing users to sign in using their existing accounts. Amazon GuardDuty is a threat detection service, Amazon Personalize is a machine learning recommendation service, and AWS IAM manages AWS service access — none support social identity federation for mobile apps.

Answer : A
Explanation: AWS CloudFormation allows customers to define their entire AWS infrastructure as code using JSON or YAML templates. These templates can provision and configure all AWS resources consistently and can be reused across multiple projects or environments. AWS Config tracks resource configuration compliance, CloudTrail logs API activity, and Auto Scaling manages compute capacity — none allow reusable infrastructure templates.

Answer : D, E
Explanation: AWS eliminates the need to guess infrastructure capacity (D) — you can scale up or down as needed, paying only for what you use. AWS also enables customers to trade large upfront capital expenses (buying hardware) for lower variable operational expenses (E). AWS does not eliminate the need to monitor your own applications (A) — that remains the customer’s responsibility. Compliance and auditing (B) are shared responsibilities. AWS uses standardized hardware, not custom hardware per customer (C).

Answer : B, C
Explanation: Microsoft SQL Server can run on Amazon EC2 (B) by installing SQL Server on a Windows EC2 instance, giving full control over the database engine. It can also run on Amazon RDS for SQL Server (C), which is a fully managed database service that supports SQL Server. AWS Fargate is for containers, AWS DMS migrates databases but does not host them, and AWS Lambda is serverless compute — none run SQL Server as a database host.

Answer : B
Explanation: Amazon Route 53 can perform health checks on Amazon EC2 instances and other endpoints, monitoring their availability and routing traffic away from unhealthy instances. CloudFormation provisions infrastructure, Amazon Chime is a communications service, and Amazon Aurora is a relational database — none perform health checks on EC2 instances.

Answer : D
Explanation: Amazon Rekognition is an AI-powered image and video analysis service that can detect and recognize faces, objects, scenes, and activities. It is ideal for automating photo tagging using facial recognition. Amazon Comprehend is a natural language processing (NLP) service. AWS IAM manages access permissions. Amazon Polly converts text to speech — none perform facial recognition.

Answer : A, E
Explanation: Amazon Neptune (A) is a fully managed graph database service where AWS handles provisioning, patching, backups, and scaling. Amazon RDS for MySQL (E) is a fully managed relational database service. Microsoft SQL Server on EC2 (C) and MySQL on EC2 (D) are self-managed databases — the customer is responsible for the OS, database software, patching, and backups. Amazon CloudSearch is a managed search service, not a database.

Answer : C
Explanation: EC2 Spot Instances offer discounts of up to 90% compared to On-Demand pricing, making them the most cost-effective option. Since the company is not concerned about processing time and the jobs can tolerate interruptions, Spot Instances are ideal for this batch processing workload. On-Demand is the most expensive for this use case. Reserved Instances require long-term commitments and are best for steady, predictable workloads — not periodic batch jobs.

Answer : A
Explanation: Only the AWS account owner (the root account holder or an IAM administrator with sufficient permissions) can grant full administrative access to IAM users or groups within their own account. The AWS Technical Account Manager, AWS security team, and AWS Cloud Support Engineers are AWS-side personnel who do not have the ability to modify permissions within a customer’s AWS account — that remains entirely under the customer’s control.

Answer : B
Explanation: AWS Server Migration Service (SMS) automates, schedules, and tracks incremental replications of live server volumes to AWS, making it the most appropriate service for migrating a large number of on-premises server workloads. AWS DMS is specifically for database migrations. AWS Application Discovery Service collects data to plan migrations but does not perform them. “AWS File Transfer Acceleration” is not a real AWS service.

Answer : C, D
Explanation: AWS CloudFormation automates the provisioning and updating of infrastructure in a safe, controlled, and predictable manner using change sets (C). It also allows you to define your entire infrastructure — servers, databases, networking, and more — in a single JSON or YAML text file (D), enabling version control and repeatability. CloudFormation does not automatically apply IAM security features (B), build application code (E), or abstract away infrastructure concerns the same way Elastic Beanstalk does (A).

Answer : C
Explanation: A Hybrid cloud deployment model connects cloud-based resources (such as AWS services) with existing on-premises infrastructure, allowing organizations to run workloads across both environments. This is common for organizations gradually migrating to the cloud or those with regulatory requirements to keep certain data on-premises. On-premises is fully local infrastructure, Cloud is fully cloud-based, and “Mixed” is not a recognized cloud deployment model.

Answer : A
Explanation: CloudEndure Disaster Recovery continuously replicates your machines into a low-cost staging area in your target AWS Region. In the event of a disaster, it can launch fully provisioned machines within minutes, meeting the requirement for rapid failover to another Region. CloudEndure Migration is for one-time server migrations, not ongoing DR. AWS Backup creates backups but recovery time may be longer. AWS Glue is a data integration service unrelated to disaster recovery.

Answer : D
Explanation: S3 Standard is the best choice for frequently accessed data with stable, predictable access patterns — such as static assets (images, CSS, JavaScript) for a popular e-commerce website. It provides low latency and high throughput. S3 Standard-IA is for infrequently accessed data and charges a retrieval fee. S3 Intelligent-Tiering is for unpredictable access patterns. S3 Glacier Deep Archive is for long-term archival with retrieval times of hours — unsuitable for a live website.

Answer : B
Explanation: To create a backup in a different geographical location, you should store it in another AWS Region. Regions are geographically distinct locations (e.g., US East, EU West, Asia Pacific), providing protection against region-wide disasters. Availability Zones are isolated within the same Region, not different geographical locations. VPCs are logical network boundaries within a Region. Edge Locations are CDN points of presence, not backup storage destinations.

Answer : B
Explanation: Regularly patching the operating system and applications on EC2 instances is a critical security best practice and a customer responsibility under the AWS Shared Responsibility Model. Instance store volumes are temporary and should never be used to store persistent or sensitive data like login credentials (A). All Availability Zones within a Region maintain the same high security standards — there is no “trusted” AZ (C). API calls are tracked using AWS CloudTrail, not Amazon Athena (D).

Answer : D
Explanation: AWS Cost Explorer includes a forecasting feature that uses your historical usage data to predict future costs with high accuracy for up to 12 months ahead, helping with budget planning. Cost comparisons with on-premises (A) are done using the AWS TCO Calculator. Estimating costs for planned architectures (B) is done with the AWS Pricing Calculator. Consolidated billing (C) is a feature of AWS Organizations — not Cost Explorer specifically.

Answer : D
Explanation: Amazon RDS Multi-AZ deployments automatically maintain a synchronous standby replica of your database in a different Availability Zone. If the primary database instance fails, RDS automatically fails over to the standby replica with minimal downtime, without requiring manual intervention. RDS Single-AZ has no standby replica. Read Replicas are for offloading read traffic, not failover. Snapshots are point-in-time backups used for recovery, not automatic failover.

Answer : D
Explanation: Stopping EC2 instances when not in use is the best way to reduce charges for a development environment, as you stop paying for compute time while the instances are stopped. EBS storage charges continue while stopped, but compute charges cease. Terminating instances (C) would delete the instances entirely, requiring you to reconfigure them — not ideal for a dev environment you plan to reuse. Deleting EBS volumes (A) would cause data loss. You can absolutely minimize charges (B is incorrect).

Answer : A
Explanation: AWS strongly recommends deleting root user access keys if they are not needed, since the root account has unrestricted access to all AWS resources. If access keys exist for the root account, they represent a significant security risk if compromised. While applying MFA to the root account is also a best practice, option B states to “use it for all of your work” — which is incorrect, as you should avoid using the root account for daily tasks. You should never share root credentials with anyone (D).

Answer : A, C
Explanation: Amazon EBS pricing is based on the size of the volumes you provision per month (A) — you are charged for the storage capacity allocated, not just what is used. You are also charged for the amount of data stored in EBS Snapshots (C), which are stored in Amazon S3. Compute capacity and compute time (B, D) relate to EC2 pricing, not EBS. Snowball devices (E) are a separate data transfer service unrelated to EBS pricing.

Answer : B
Explanation: The AWS-recommended best practice when granting permissions is the Principle of Least Privilege — granting each user only the minimum permissions necessary to perform their job functions. This limits the potential damage in case of a compromised account. Attaching a separate policy per account (A) is unnecessary overhead and doesn’t follow best practices. Granting no permissions (C) would prevent the team from working. Creating different passwords (D) is basic account hygiene, not a permission management strategy.

Answer : A, D
Explanation: Compute charges (A) — such as EC2 instance hours — are typically one of the largest cost components for most AWS workloads. Data Transfer Out charges (D) — the cost of transferring data from AWS to the internet — can also be significant, especially for data-intensive applications. Data Transfer In to AWS is free (C). The number of services used (B) and the number of IAM roles (E) do not directly drive costs — IAM is free, and costs depend on usage, not the count of services.

Answer : D
Explanation: The largest discount is obtained by combining the most favorable options: Reserved (vs On-Demand), Standard (vs Convertible, which offers flexibility at a lower discount), and All Upfront (vs Partial or No Upfront). Standard Reserved Instances with All Upfront payment offer the maximum possible discount — up to 72% compared to On-Demand. Convertible Reserved Instances offer slightly lower discounts than Standard ones because of their exchange flexibility.

Answer : D
Explanation: With Reserved Instances, customers can pay upfront (partially or fully) in exchange for lower effective hourly costs over the reservation term. This is a genuine EC2 purchasing option. Spot Instances no longer use a bidding model (A) — AWS sets Spot prices based on supply and demand. Volume discounts by registering instances (B) is not an EC2 feature. Dedicated Instances do not offer up to 90% discounts (C) — that level of discount applies to Spot Instances.

Answer : C
Explanation: Economies of Scale means that as AWS grows and serves more customers, its operational costs per unit decrease. AWS passes these savings on to customers through regular price reductions. This is a key advantage of cloud computing — individual customers benefit from the massive purchasing power and operational efficiency of a large cloud provider. Option A describes volume discounts. Option D describes the pay-as-you-go model. Option B is incorrect — costs decrease, not increase, over time.

Answer : A
Explanation: AWS Auto Scaling automatically adjusts the number of EC2 instances in response to changing traffic patterns, scaling out during traffic spikes (like flash sales) and scaling in when demand drops — ensuring performance while minimizing costs. Amazon EC2 provides the instances but does not auto-scale on its own. Amazon EFS is a file storage service. Amazon ElastiCache improves database performance through caching — none dynamically adjust compute capacity based on traffic.

Answer : B
Explanation: Amazon VPC gives customers complete control over their virtual networking environment, including selecting IP address ranges, creating subnets, configuring route tables, and setting up internet and NAT gateways. AWS manages the underlying physical network infrastructure, but the customer controls the VPC configuration entirely. Controlling user interactions (A) is the role of IAM. Reviewing architecture best practices (D) is done by AWS Trusted Advisor or the Well-Architected Tool.

Answer : D
Explanation: The AWS TCO (Total Cost of Ownership) Calculator is specifically designed to help non-AWS customers and those evaluating a move to AWS compare the full cost of running their on-premises infrastructure versus equivalent workloads on AWS. It is publicly accessible without an AWS account. AWS Cost Explorer, Budgets, and the Pricing Calculator require an AWS account or are designed for existing AWS customers managing their cloud spend.

Answer : A, D
Explanation: AWS Config (A) continuously monitors and records AWS resource configurations, evaluating them against compliance rules in real time. AWS Trusted Advisor (D) performs real-time checks against AWS best practices, including security and compliance checks such as identifying open security groups, unrestricted S3 buckets, and IAM vulnerabilities. Amazon Redshift is a data warehouse, Amazon MQ is a message broker, and Amazon Cognito is a user authentication service — none provide compliance auditing.

Answer : A
Explanation: AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet, enabling automated configuration, deployment, and management of EC2 instances. AWS CloudFormation provisions infrastructure as code but does not integrate with Puppet. AWS Quick Starts are pre-built reference architectures. AWS CloudTrail is an API audit logging service — none use Puppet for configuration management.

Answer : C
Explanation: AWS CodeDeploy is a fully managed deployment service that automates application deployments to Amazon EC2 instances, AWS Fargate, AWS Lambda, and on-premises servers — making it ideal for hybrid cloud architectures. Amazon Kinesis is for real-time data streaming, Amazon QuickSight is a business intelligence service, and Amazon Athena is a query service for S3 data — none support hybrid application deployments.

Answer : A, E
Explanation: Amazon RDS (A) is server-based — it runs on database instances (servers) that you provision and manage the size of. Amazon EMR (E) is also server-based, running on a cluster of EC2 instances that you configure and manage. Amazon DynamoDB is serverless — no server management required. AWS Lambda is serverless compute. AWS Fargate is a serverless container runtime — none of these require you to manage the underlying servers.

Answer : B
Explanation: Penetration testing (pen testing) is a simulated cyberattack against your systems to identify security vulnerabilities that a real attacker could exploit, before they do. It is a proactive security practice. Testing response time (A) describes performance testing. Checking for unhealthy instances (C) describes health monitoring. Testing for bugs (D) describes software testing — none of these are penetration testing.

Answer : C, D
Explanation: Amazon EMR (Elastic MapReduce) is a managed big data platform for processing and analyzing large datasets (C) using frameworks such as Apache Hadoop, Apache Spark, Hive, and others (D). Backing up large amounts of data at low cost (A) is done with S3 Glacier. Moving exabyte-scale data from on-premises (B) is done with AWS Snowmobile. Running and managing Docker containers (E) is done with Amazon ECS or EKS.

Answer : C
Explanation: Live chat support is available starting from the AWS Business Support plan. Basic Support and Developer Support plans do not include chat access to Cloud Support Engineers. Upgrading to at minimum Business Support (C) would unlock the chat feature along with 24×7 phone and chat access. Chat is not available on all plans for a fee (B is incorrect), and upgrading to Developer Support (D) would still not provide chat access.

Answer : D
Explanation: AWS Elastic Beanstalk is a PaaS service designed for developers who want to quickly deploy and manage applications without needing deep cloud expertise. Developers simply upload their code and Elastic Beanstalk automatically handles capacity provisioning, load balancing, auto-scaling, and health monitoring. AWS Fargate requires container knowledge, AWS Batch is for batch computing workloads, and Amazon Personalize is a machine learning recommendation service — none are designed for quick, beginner-friendly application deployment.

Answer : D
Explanation: The AWS Pay-As-You-Go model replaces large upfront capital expenditures (buying servers, building data centers) with low, variable operational payments based on actual usage. You pay only for what you consume, with no long-term commitments required. Options A and B incorrectly describe on-premises costs as “low upfront.” Option C incorrectly says “fixed payments” — AWS payments are variable based on usage, not fixed.

Answer : A, C
Explanation: For Amazon RDS, AWS handles database setup (A) — including installation, configuration, and initial provisioning of the database engine — and management of the underlying operating system (C) — including OS patching and maintenance. Network traffic protection (B) and firewall rule management (E) are customer responsibilities, configured via Security Groups and NACLs. Access management (D) — such as database user accounts and IAM policies — is also the customer’s responsibility.

Answer : A
Explanation: Using tags to group AWS resources (by project, department, environment, etc.) allows you to filter and analyze costs in AWS Cost and Usage Reports and Cost Explorer, providing granular visibility into spending by category. AWS CloudFormation automates deployments but does not analyze costs. Deploying to multiple regions adds costs, not helps analyze them. Amazon Inspector is a security assessment service, not a cost analysis tool.

Answer : A
Explanation: AWS Direct Connect provides a dedicated, private network connection between on-premises environments and AWS, offering consistent network performance, lower latency, and higher bandwidth than internet-based transfers. This makes it ideal for daily large-scale data transfers of business-critical data. AWS Snowmobile is for one-time large-scale physical data migrations, not daily transfers. AWS VPN uses the public internet, which can have variable performance. Amazon Comprehend is an NLP service unrelated to data transfer.

Answer : C
Explanation: The main benefit of AWS Storage Gateway is that it seamlessly integrates on-premises IT environments with AWS cloud storage, enabling hybrid storage architectures. It allows on-premises applications to use AWS cloud storage (S3, Glacier, EBS) using standard protocols like NFS, SMB, and iSCSI. Option A describes AWS Glue. Option B describes AWS Snowball. Option D describes AWS CloudHSM.

Answer : B
Explanation: Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the most cost-effective option that provides immediate (millisecond) retrieval of data. It is designed for data that is accessed less frequently but requires rapid access when needed — making it ideal for database backups. S3 Glacier and S3 Glacier Deep Archive both have retrieval times ranging from minutes to hours, making them unsuitable for immediate retrieval. Instance Store is temporary storage that is lost when the instance stops — not suitable for backups.

Answer : A
Explanation: AWS Global Accelerator is a networking service that routes user traffic through the AWS global network to the nearest healthy endpoint, optimizing performance by reducing latency for global users. It continuously monitors endpoint health and automatically reroutes traffic to the best-performing endpoint. AWS Data Pipeline automates data movement. AWS DAX is a DynamoDB accelerator. S3 Transfer Acceleration speeds up S3 uploads — none route global traffic to the best-performing application endpoint.

Answer : B
Explanation: Serverless architectures are more economical because you only pay for the exact compute time your code runs — you are not charged when your code is idle. With server-based architectures, instances run continuously and incur costs even when idle. This event-driven billing model makes serverless significantly cheaper for workloads with variable or infrequent traffic. Auto-scaling (D) is a benefit of serverless but not the primary reason for its cost economy.

Answer : C, D
Explanation: Amazon Route 53 is AWS’s scalable DNS service that handles DNS configuration and management (C) — translating domain names to IP addresses. It also manages global application traffic through routing policies such as latency-based, geolocation, weighted, and failover routing (D). Point-to-point connectivity (A) is provided by AWS Direct Connect. Configuration change detection (B) is done by AWS Config. Security optimization recommendations (E) are provided by AWS Trusted Advisor.

Answer : D
Explanation: AWS Snowball is a physical data transfer device that can hold up to 80 TB per device, making it cost-effective for transferring 200 TB of data (requiring approximately 3 devices). AWS Snowmobile is designed for exabyte-scale transfers (up to 100 PB per trip) and would be overkill and more expensive for 200 TB. AWS DMS is for database migrations, not bulk data transfer. AWS Import/Export is an older service that has been largely replaced by Snowball.

Answer : D
Explanation: Amazon ElastiCache for Redis is an in-memory data store that delivers sub-millisecond latency, making it ideal for real-time IoT applications that require extremely fast data access and processing. Amazon Redshift is a data warehouse optimized for analytical queries, not real-time low-latency access. Amazon Athena queries data in S3 with query times measured in seconds. AWS Cloud9 is a cloud-based IDE — none provide sub-millisecond latency for real-time applications.