Answer : C, D
Explanation: Enabling S3 Encryption (C) — either server-side encryption using AWS-managed keys (SSE-S3), KMS keys (SSE-KMS), or customer-provided keys (SSE-C) — protects data at rest in S3. Encrypting data before uploading (D), known as client-side encryption, ensures data is protected before it even reaches AWS. Deleting encryption keys (A) would make encrypted data permanently inaccessible. AWS encryption is a shared responsibility (B is incorrect). Deleting all IAM users with S3 access (E) would disrupt legitimate operations.

Answer : D
Explanation: AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs unit tests, and produces software packages ready for deployment. AWS CodeDeploy automates application deployments to EC2, Lambda, or on-premises servers. AWS CodeCommit is a source code repository service. CloudEndure is a migration and disaster recovery service — none compile and test code.

Answer : C, E
Explanation: The S3 storage class (C) directly affects pricing — S3 Standard costs more per GB than S3 Standard-IA or S3 Glacier. The total size of all objects stored in gigabytes (E) is the primary billing dimension for S3 storage. Enabling default encryption (A) does not add a cost for the encryption itself. EBS volumes (B) are billed separately from S3. Creating and deleting S3 buckets (D) is free — you are charged for the objects stored within them, not the buckets themselves.

Answer : B, E
Explanation: Amazon CloudFront is a CDN service that caches content at Edge Locations close to users, increasing application availability and reducing load on origin servers (B). It delivers content — including web pages, videos, and APIs — to end users with low latency by serving from the nearest Edge Location (E). Tracking API usage (A) is done by AWS CloudTrail. Archival storage (D) is provided by S3 Glacier. CloudFront does not directly enable disaster recovery (C).

Answer : B
Explanation: Amazon Connect is a cloud-based contact center service that makes it easy to set up and manage a customer contact center, providing seamless customer engagement at any scale. Amazon Lightsail is a simplified compute service, AWS Direct Connect is a private network connectivity service, and AWS Elastic Beanstalk is an application deployment platform — none provide contact center capabilities.

Answer : A
Explanation: The AWS Cost and Usage Report provides the most comprehensive and detailed data available about your AWS costs and usage, including line-item details for every service and resource used in your account. There is no “AWS TCO dashboard” (B). CloudWatch Logs (C) is for application and system log monitoring. The Amazon VPC dashboard (D) is for network configuration — none display account-level AWS billing costs.

Answer : A, E
Explanation: Amazon EC2 Reserved Instances come in two types: Standard (E), which offers the highest discount (up to 72%) but cannot be exchanged for a different instance type, and Convertible (A), which offers a slightly lower discount but allows you to exchange the reservation for a different instance family, OS, or tenancy. Expedited and Bulk are S3 Glacier retrieval options, not EC2 Reserved Instance types. Spot is a separate EC2 purchasing model, not a Reserved Instance type.

Answer : A
Explanation: AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and certifications issued by third-party auditors, including SOC reports, PCI DSS, ISO certifications, and more. AWS Config tracks resource configuration compliance, Amazon CloudWatch monitors metrics and logs, and AWS CloudTrail records API activity — none provide access to auditor-issued compliance reports and certifications.

Answer : A
Explanation: AWS Resource Groups allows you to create logical groupings of AWS resources based on tags or CloudFormation stacks. You can create separate resource groups for each environment (development, testing, production) and build a custom console view for each, making it easy to manage and view resources by environment. AWS Placement Groups control physical placement of EC2 instances. The AWS Management Console is the general web interface. AWS Tag Editor helps manage tags across resources but does not create custom consoles.

Answer : B
Explanation: Amazon CloudWatch automatically collects and monitors metrics from running EC2 instances, including CPU utilization, network traffic, disk I/O, and more. You can set alarms and create dashboards based on these metrics. Amazon Inspector performs security vulnerability assessments. AWS CloudFormation provisions infrastructure. AWS CloudTrail logs API calls — none collect performance metrics from EC2 instances.

Answer : B
Explanation: AWS X-Ray is a distributed tracing service that helps developers analyze and debug performance issues in applications, including identifying bottlenecks causing long load times. It provides a visual map of application components and shows where latency is being introduced. Amazon Detective is for security investigations. AWS Security Hub aggregates security findings. AWS Shield provides DDoS protection — none diagnose and help resolve application performance issues.

Answer : B, C
Explanation: AWS Lambda (C) is a serverless compute service that runs code in response to events without requiring server provisioning. AWS Fargate (B) is a serverless compute engine for containers — you run containers without managing the underlying EC2 instances. Amazon EC2 requires you to provision and manage virtual servers. Amazon ECS can run on EC2 (server-based) or Fargate (serverless), but ECS itself is not inherently serverless. Amazon EMR runs on EC2 clusters — not serverless.

Answer : A
Explanation: EC2 Dedicated Hosts provide physical servers that are fully dedicated to a single customer, ensuring that no other AWS customers share the underlying hardware. This meets strict compliance and regulatory requirements for hardware dedication. EC2 Reserved Instances, Spot Instances, and On-Demand Instances can all run on shared physical hardware by default and do not guarantee hardware exclusivity.

Answer : B
Explanation: Architecture Optimization is the cost governance best practice that involves continuously reviewing and refining workloads — such as right-sizing instances, using the most appropriate storage classes, and adopting managed services — to maximize the value of existing AWS resources and reduce costs. Tagging Enforcement ensures resources are tagged for cost allocation. Budgeting Processes set spending limits. Resource Controls restrict what resources can be provisioned — none focus specifically on refining workloads to optimize costs.

Answer : B
Explanation: Amazon RDS (Relational Database Service) supports ACID (Atomicity, Consistency, Isolation, Durability) transactions, which are essential for financial applications where data integrity is critical. RDS supports MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB — all of which are ACID-compliant relational databases. Amazon Redshift is an analytical data warehouse optimized for queries, not transactional workloads. AWS CloudHSM is a hardware security module for key management. AWS DMS is a database migration service.

Answer : D
Explanation: IAM Policies are JSON documents that define permissions and can be attached directly to IAM users, groups, or roles to grant or deny access to AWS services and resources. An IAM Group is a collection of users that can have policies attached, but you can also attach policies directly to individual users. IAM Roles provide temporary credentials, not direct user permissions. IAM Identity is not a standalone AWS concept used for assigning permissions.

Answer : C
Explanation: The ability to launch and terminate EC2 instances based on actual demand is what makes AWS more economical than traditional data centers for variable workloads. In a traditional data center, you must provision for peak capacity — paying for hardware even during low-demand periods. With AWS, you only pay for what you use, scaling up during peaks and scaling down when demand drops. This elasticity eliminates the waste of over-provisioning.

Answer : D
Explanation: Teradata is not a supported database engine in Amazon RDS. Amazon RDS supports six database engines: MySQL, PostgreSQL, MariaDB, Oracle, Microsoft SQL Server, and Amazon Aurora. Teradata is a separate enterprise data warehouse platform not available as an RDS engine. If you need to run Teradata on AWS, you would need to install it manually on an EC2 instance.

Answer : A
Explanation: AWS Database Migration Service (DMS) helps migrate databases to AWS quickly and securely while keeping the source database fully operational during migration, minimizing downtime. It supports migrations between the same database engine (homogeneous) and between different engines (heterogeneous). S3 Transfer Acceleration speeds up file uploads to S3. AWS Directory Service manages Active Directory. AWS Transit Gateway connects VPCs and networks — none migrate databases.

Answer : A
Explanation: Amazon Lightsail is designed for simplicity and is the easiest way for new AWS customers to launch a WordPress website. It provides pre-configured WordPress blueprints with a fixed monthly price, simple management console, and everything you need (compute, storage, networking) in one place — no deep cloud expertise required. Installing WordPress on EC2 (B) requires manual configuration. S3 only hosts static websites (C). AWS CDK is an infrastructure-as-code framework, not a website hosting service (D).

Answer : A, E
Explanation: AWS Key Management Service (KMS) (A) is a managed service that makes it easy to create, manage, and control encryption keys used to encrypt your data across AWS services. AWS CloudHSM (E) provides hardware-based key management using dedicated Hardware Security Modules (HSMs), giving customers full control over their keys for strict compliance requirements. AWS Certificate Manager manages SSL/TLS certificates, not encryption keys. AWS CodeDeploy and CodeCommit are developer tools unrelated to encryption key management.

Answer : A
Explanation: Amazon EC2 gives you full control over the virtual server, allowing you to install and run any custom relational database software of your choice — including databases not supported by RDS such as Teradata, IBM Db2, or any other engine. Amazon RDS is a managed service that supports a fixed set of database engines and does not allow custom software installation at the OS level. Amazon Cognito is for user authentication. Amazon Inspector is a security assessment service.

Answer : A
Explanation: AWS Auto Scaling automatically adjusts the number of EC2 instances (and therefore the total available CPU and RAM) based on real-time load, ensuring performance during peaks and cost efficiency during low-demand periods. ELB distributes traffic but does not add or remove compute resources. Amazon Route 53 is a DNS service. Amazon ECS is a container orchestration service — none dynamically adjust compute resources based on changing CPU and RAM demands.

Answer : A
Explanation: AWS Identity and Access Management (IAM) is the AWS service that handles identity management — creating and managing users, groups, roles, and permissions to control who can access AWS services and resources. This is the direct equivalent of an on-premises identity management team’s function in the cloud. AWS Outposts extends AWS infrastructure on-premises. AWS Federation enables SSO with existing identity providers. Amazon Redshift is a data warehouse — none perform identity management.

Answer : B, D
Explanation: Loose coupling (B) is a key cloud design principle where components are designed to be independent so failures don’t cascade across the system. Disposable resources (D) means treating servers as temporary and replaceable rather than fixed assets — you can terminate and replace them quickly using automation and AMIs. On-demand is preferred over reserved for flexibility (A is backwards). Managed services are preferred over servers for reduced operational burden (C is backwards). Multi-region is preferred over multi-AZ alone for maximum resilience (E is backwards).

Answer : B
Explanation: The IAM Credential Report is a downloadable report that lists all IAM users in your AWS account along with the status of their credentials — including passwords, access keys, MFA devices, and when they were last used or rotated. This is essential for security auditing. AWS CloudTrail records API activity. AWS Artifact provides compliance reports. AWS Cost and Usage Report provides billing data — none list IAM user credential statuses.

Answer : C
Explanation: AWS CloudHSM provides dedicated Hardware Security Modules in the AWS Cloud that allow you to generate and manage your own encryption keys with full control — the keys never leave the HSM unencrypted. This is ideal for organizations with strict regulatory requirements for key management. AWS Shield is for DDoS protection. AWS Certificate Manager manages SSL/TLS certificates. AWS WAF is a web application firewall — none allow you to generate and control your own encryption keys using dedicated hardware.

Answer : D
Explanation: Deploying across multiple Availability Zones in multiple AWS Regions provides the highest level of redundancy and fault tolerance. Multi-AZ protects against zone-level failures, and multi-region protects against region-wide outages such as natural disasters. For a global audience, multi-region deployment also reduces latency. AWS infrastructure is not automatically redundant for customer applications (A) — customers must architect for redundancy. Single AZ (B) and single region multi-AZ (C) both leave the application vulnerable to region-level failures.

Answer : B, C
Explanation: Amazon S3 (B) automatically stores data redundantly across multiple Availability Zones within a Region by default, providing 99.999999999% durability. Amazon DynamoDB (C) also automatically replicates data across multiple AZs within a Region, ensuring high availability and fault tolerance. Instance Store is temporary storage tied to a single physical host — data is lost if the instance stops. Amazon Route 53 is a DNS service. AWS VPN is a network connectivity service — none provide automatic multi-AZ data replication.

Answer : A, B
Explanation: Amazon CloudFront pricing is based on the number of HTTP/HTTPS requests served (A) and traffic distribution — meaning the geographic region (Edge Location) from which content is served, as data transfer prices vary by region (B). Number of volumes (C) is an EBS concept. Instance type (D) is an EC2 concept. Storage class (E) is an S3 concept — none of these are CloudFront pricing factors.

Answer : D
Explanation: The AWS Acceptable Use Policy (AUP) describes prohibited uses of AWS services — including activities like distributing malware, conducting unauthorized network scans, or violating intellectual property rights. It is a publicly available document that all AWS customers must agree to. AWS SCPs restrict actions within AWS Organizations. AWS Artifact provides compliance reports. AWS Budgets manages spending — none describe prohibited uses of AWS services.

Answer : A, D
Explanation: AWS Security Bulletins (A) are publicly available notifications about security vulnerabilities and issues affecting AWS services — accessible for free by anyone. The AWS Security Blog (D) is a publicly available resource with security best practices, guidance, and news — also free for all users. The AWS TAM (Technical Account Manager) is only available with Enterprise Support. The AWS Support API requires at least a Business Support plan. AWS Classroom Training is a paid service.

Answer : A
Explanation: Enabling S3 Versioning protects data from accidental deletion by preserving every version of every object. When versioning is enabled, a delete operation does not permanently remove the object — instead, it adds a delete marker, and previous versions can be restored. S3 Bucket Policies control access permissions but do not prevent accidental deletion by authorized users. S3 Lifecycle Policies automate transitions between storage classes or deletions. Disabling CRR does not protect against accidental deletion.

Answer : A
Explanation: AWS is responsible for securing its global infrastructure — including Regions, Availability Zones, and Edge Locations — which encompasses physical security of data centers, network infrastructure, and hardware. Auditing tasks (B) are a shared or customer responsibility. Monitoring resource usage (C) is primarily the customer’s responsibility using tools like CloudWatch. Securing access to AWS resources (D) — such as configuring IAM policies and security groups — is the customer’s responsibility.

Answer : B
Explanation: Both the AWS Basic Support and Developer Support plans provide access to only the seven core Trusted Advisor checks, which cover basic security and service limits. The Business and Enterprise Support plans provide access to the full suite of Trusted Advisor checks across all five categories: Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits.

Answer : D
Explanation: AWS Lambda cannot be called directly from any mobile app — it must be invoked through a trigger such as API Gateway, an AWS service event, or the AWS SDK. Mobile apps typically call Lambda indirectly via an API Gateway endpoint. Lambda does run code without managing servers (A), you only pay when code is executing (C), and Lambda does provide scalable compute capacity that adjusts automatically (B is technically true but framed as a characteristic of EC2 — either way D is the clearly incorrect statement).

Answer : C
Explanation: AWS holds a wide range of compliance certifications and assurance programs — including ISO 9001, ISO 27001, SOC 1/2/3, PCI DSS, HIPAA, and many others — which help customers meet their own compliance requirements. It is absolutely possible to achieve compliance in the cloud (A is incorrect). AWS is responsible for compliance of its own infrastructure, not customers’ specific laws and regulations (B is incorrect). Option D is partially true but less precise than C.

Answer : C
Explanation: Amazon DynamoDB is a fully managed NoSQL database service — AWS is responsible for scaling the underlying infrastructure, including storage and throughput capacity (especially with DynamoDB’s on-demand capacity mode). Customers can configure capacity settings, but the actual physical scaling of the database infrastructure is managed entirely by AWS. No customer team is responsible for the physical scaling of DynamoDB.

Answer : A
Explanation: Amazon Elastic Transcoder is a cloud-based media transcoding service that converts media files from their source format into versions that will play on a wide variety of devices including smartphones, tablets, and PCs. Amazon Pinpoint is a customer engagement and messaging service. Amazon S3 is object storage. Amazon Rekognition is an image and video analysis service — none convert media formats.

Answer : A, E
Explanation: AWS Organizations allows you to control access to AWS services across all accounts using Service Control Policies (SCPs) (A), which set permission guardrails at the organizational level. It also enables consolidated billing (E), combining all accounts’ usage into a single bill and enabling volume discounts. Helping with cloud adoption (B) and achieving business outcomes (D) are roles of AWS Professional Services or the Cloud Adoption Framework. Managing payment methods (C) is done in the billing console, not Organizations specifically.

Answer : B
Explanation: Amazon Redshift is a fully managed, petabyte-scale cloud data warehouse service that allows organizations to run complex analytical queries on large datasets using SQL. It is optimized for OLAP (Online Analytical Processing) workloads and business intelligence. AWS Shield is a DDoS protection service. Amazon RDS is a transactional relational database (OLTP). Amazon Comprehend is a natural language processing service — none build data warehouses.

Answer : C
Explanation: AWS Marketplace is a digital catalog with thousands of third-party software solutions, SaaS offerings, and professional services that can be purchased and deployed on AWS resources. It simplifies procurement, licensing, and deployment of third-party software. AWS Application Discovery Service collects data for migration planning. Amazon DevPay was a legacy billing service that has been discontinued. AWS Resource Groups organizes AWS resources — none provide a marketplace for third-party software.

Answer : B
Explanation: AWS CodeCommit is a fully managed source control service that hosts secure, private Git repositories, allowing teams to store, version, and manage application code. It integrates with other AWS developer tools and supports standard Git commands. AWS CodePipeline automates CI/CD pipelines. AWS X-Ray is a distributed tracing service. Amazon Inspector is a security assessment service — none provide source code repository management.

Answer : D
Explanation: Amazon Route 53 supports latency-based routing, which routes end users to the AWS Region that provides the lowest latency for their location. It measures latency between users and AWS Regions and directs traffic accordingly. Amazon Cognito is a user authentication service. AWS Systems Manager is for operational management. AWS Cloud9 is a cloud IDE — none route end users based on geographic latency.

Answer : A
Explanation: Federation allows users to authenticate to AWS using their existing corporate identity provider (such as Microsoft Active Directory or Okta) through standards like SAML 2.0 or OpenID Connect. This means employees can use their existing username and password to access AWS without needing separate IAM credentials. Access keys are for programmatic API access. IAM Permissions control what users can do. WAF rules control web traffic — none enable corporate credential sign-in.

Answer : C, D
Explanation: Customers fully inherit data center security controls (C) — physical access controls, surveillance, and perimeter security of AWS data centers — and environmental controls (D) — temperature, humidity, fire suppression, and power management — from AWS. Customers bear no responsibility for these. Awareness and training (A), communications controls (B), and resource configuration management (E) are shared or customer responsibilities, not fully inherited from AWS.

Answer : C
Explanation: The URL http://status.aws.amazon.com is the AWS Service Health Dashboard — a publicly accessible page that shows the real-time operational status of all AWS services across all regions. It does not require an AWS account to access. The AWS Billing and Cost Dashboards are available within the AWS Management Console for account holders. There is no standalone “AWS Security Dashboard” at that URL.

Answer : A, E
Explanation: Storing media assets in the AWS Region closest to your end users (A) reduces the geographic distance data must travel, lowering latency. Using Amazon S3 with CloudFront (E) caches content at Edge Locations worldwide, serving users from the nearest location for minimum latency. Adding EBS volumes (B) improves storage capacity but not end-user latency. Replicating to multiple AZs (C) improves availability, not latency. Reducing file size (D) may help download times but is not a standard latency-reduction strategy.

Answer : B, D
Explanation: Using IAM roles to grant temporary access instead of long-term credentials (B) is a core security design principle — it reduces the risk of credential exposure. Enabling real-time traceability (D) — through logging, monitoring, and alerting on actions and changes — is another key security principle from the AWS Well-Architected Framework Security pillar. Manual monitoring (A) is an anti-pattern — automation is preferred. Scaling horizontally (C) is a Reliability pillar principle. Sensitive data can and should be stored securely in the cloud using encryption (E is incorrect).

Answer : C
Explanation: Cost allocation tags allow companies to label AWS resources with key-value pairs (such as Department=Finance or Project=Alpha) and then filter the AWS Cost and Usage Report or Cost Explorer by these tags to track and allocate spending by department or project. AWS Pricing Calculator estimates future costs for planned architectures, not current departmental spending. Amazon Aurora is a database, not a cost forecasting tool. The AWS Price List API provides pricing data, not billing tracking by department.