Answer : D
Explanation: AWS Quick Start reference deployments are automated, gold-standard deployments of popular IT solutions built by AWS and AWS Partners. They use CloudFormation templates to quickly deploy complex environments following AWS best practices, allowing administrators to get up and running immediately. The Well-Architected Framework provides design guidance but not deployments. CloudFront is a CDN. CodeCommit is a source code repository — none rapidly deploy pre-built IT solutions.

Answer : A
Explanation: A key advantage of Amazon RDS is that it simplifies relational database administration tasks such as hardware provisioning, database setup, patching, and backups — freeing DBAs to focus on higher-value activities. The 99.999999999% durability figure (B) applies to Amazon S3, not RDS. RDS does not automatically scale instance size for load (C) — that requires manual intervention or Aurora Serverless. Dynamically adjusting CPU and RAM (D) is not a standard RDS feature.

Answer : A
Explanation: Amazon EC2 allows customers to install and self-manage any relational database software of their choice — including MySQL, PostgreSQL, Oracle, SQL Server, or any other engine. This gives full control over the database configuration. Amazon Route 53 is a DNS service. Amazon ElastiCache is an in-memory caching service. Amazon DynamoDB is a managed NoSQL database — none allow customers to run and fully manage their own relational database software.

Answer : A
Explanation: To increase availability, instances should be launched across multiple Availability Zones in a single AWS Region. If one AZ experiences an outage, instances in other AZs continue running, maintaining application availability. Launching all instances in the same AZ (B) provides no AZ-level redundancy. Availability Zones do not exist across Regions (C is not a valid configuration). Using Spot Instances (D) introduces the risk of interruption, which reduces availability.

Answer : C
Explanation: IAM policies can be attached to users, groups, or roles to grant or deny access to specific S3 buckets and objects. S3 bucket policies and IAM policies together define who can access S3 resources. Public/private key-pairs are used for SSH access to EC2 instances. Amazon Inspector performs security assessments. Security Groups control network traffic for EC2 instances — none restrict S3 bucket access to specific users.

Answer : A, D
Explanation: AWS VPN (A) creates an encrypted IPSec tunnel over the public internet between a VPC and an on-premises network, providing secure hybrid connectivity. AWS Direct Connect (D) establishes a dedicated private network connection between an on-premises data center and AWS, bypassing the public internet for consistent, high-bandwidth performance. Amazon Redshift is a data warehouse. API Gateway is for building and managing APIs — neither connects VPCs to on-premises networks.

Answer : C
Explanation: Amazon CloudWatch automatically collects CPU utilization metrics from EC2 instances and other AWS services. You can create dashboards and set alarms based on CPU usage thresholds. AWS CloudTrail logs API activity. VPC Flow Logs capture network traffic information. AWS Config tracks resource configuration changes — none monitor CPU performance metrics.

Answer : C
Explanation: AWS is responsible for updating the firmware of the underlying EC2 host hardware — this is part of AWS’s responsibility to manage “security of the cloud,” including the physical infrastructure, hardware, and hypervisor. Granting access to individuals and services (A) is the customer’s responsibility using IAM. Encrypting data in transit (B) is the customer’s responsibility. Updating operating systems on EC2 instances (D) is also the customer’s responsibility.

Answer : C
Explanation: AWS provides free access to a wide range of security resources including the AWS Security Blog, AWS forums, whitepapers, and documentation at no cost to anyone. Calling AWS Support (A) beyond Basic Support requires a paid plan. AWS Professional Services workshops (B) are paid engagements. University AWS courses (D) are typically paid educational programs — only publicly available online resources are free.

Answer : D
Explanation: Amazon S3 supports static website hosting directly from a bucket, serving HTML, CSS, JavaScript, and media files at very low cost. You only pay for the storage used and data transfer out. S3 Glacier is for long-term archival storage with retrieval delays — not suitable for hosting live websites. Amazon DynamoDB is a NoSQL database. Amazon EFS is a file system service — neither are designed for static website hosting.

Answer : B
Explanation: Managing Edge Locations — including the physical infrastructure, hardware, networking, and operations of CloudFront Edge Locations worldwide — is solely AWS’s responsibility. Application security (A) is a customer responsibility. Patch management (C) is a shared control — AWS patches its infrastructure while customers patch their OS and applications. Client-side data (D) is entirely the customer’s responsibility.

Answer : B, C
Explanation: The AWS Well-Architected Framework has six pillars: Operational Excellence, Security (C), Reliability, Performance Efficiency (B), Cost Optimization, and Sustainability. Multiple Availability Zones (A) is a design practice, not a pillar. Encryption usage (D) and high availability (E) are concepts within the pillars, not pillars themselves.

Answer : A
Explanation: AWS Trusted Advisor includes a Security check that identifies security groups with rules that allow unrestricted inbound access (0.0.0.0/0) to specific ports, flagging these as potential security risks. Amazon Inspector assesses EC2 instance vulnerabilities. Amazon CloudWatch monitors metrics. AWS CloudTrail logs API calls — none specifically identify overly permissive security group rules.

Answer : C, E
Explanation: When re-architecting a monolithic application for the cloud, implementing loose coupling (C) is essential — breaking the application into independent components that communicate through well-defined interfaces so failures don’t cascade. Designing for scalability (E) ensures each component can scale independently based on demand. Manual monitoring (A) and fixed servers (B) are anti-patterns in cloud design. Relying on individual components (D) implies tight coupling — also an anti-pattern.

Answer : D
Explanation: Implementing elasticity is a key cloud architecture design principle — designing systems to scale up or down automatically in response to demand, so you only use and pay for the capacity you need. Using the largest instance (A) wastes resources. Provisioning for peak load (B) is the traditional on-premises approach that cloud elasticity replaces. Scrum (C) is a software development methodology, not a cloud architecture principle.

Answer : D
Explanation: AWS Systems Manager Patch Manager automates the process of patching managed EC2 instances, including applying security patches on a defined schedule across multiple instances simultaneously. This is far more efficient than manually connecting to each instance (A). Amazon RDS automated patching (B) applies only to RDS managed instances, not databases on EC2. AWS Config (C) tracks compliance but does not apply patches.

Answer : A
Explanation: The AWS Software Development Kit (SDK) provides language-specific APIs that allow developers to integrate AWS services directly into their application code using languages such as Python, Java, JavaScript, .NET, Go, and more. The AWS Management Console is a web-based GUI for human users, not for application code. AWS CodePipeline automates CI/CD pipelines. AWS Config tracks resource configurations — none provide programmatic access to AWS services from application code.

Answer : C
Explanation: Elastic computing directly reduces TCO by allowing customers to scale resources up during peak demand and scale down during quiet periods — paying only for what they use. This eliminates the need to over-provision hardware for peak loads, a major cost driver in traditional data centers. The shared responsibility model is a security framework, not a cost-reduction feature. Single tenancy (Dedicated Hosts) typically costs more. Encryption is a security feature that does not reduce TCO.

Answer : B
Explanation: By offloading infrastructure management to AWS, companies can redirect their time and resources toward revenue-generating activities such as product development, customer acquisition, and innovation — rather than managing servers and data centers. Permissive security (A) would create vulnerabilities, not reduce burden. AWS customers do not control the underlying network hardware (C) or choose hardware vendors (D) — those decisions are made by AWS.

Answer : A, D
Explanation: AWS Trusted Advisor provides recommendations across five categories: Cost Optimization, Performance (D), Security, Fault Tolerance (A), and Service Limits. Instance Usage, Infrastructure, and Storage Capacity are not official Trusted Advisor category names — they may relate to checks within the categories, but are not the category names themselves.

Answer : B
Explanation: Amazon CloudWatch is a monitoring and observability service that collects metrics and logs from AWS resources and applications, stores them in a metrics repository, and allows you to set customizable alarms with notifications via SNS, email, or other channels. Option A describes AWS CodeCommit. Option C loosely describes AWS Security Hub or GuardDuty. Option D describes AWS WAF.

Answer : B, D
Explanation: Encrypting data on the client-side (B) is entirely the customer’s responsibility — AWS cannot encrypt data before it leaves the customer’s environment. Configuring Network ACLs (D) within the customer’s VPC is also the customer’s responsibility. Patching the OS for Amazon RDS (A) is AWS’s responsibility as it is a managed service. Training data center staff (C) and maintaining environmental controls (E) are AWS responsibilities related to physical data center management.

Answer : B
Explanation: Patch management is a shared control — AWS patches the underlying infrastructure (hypervisors, hardware, managed service software), while customers are responsible for patching the guest OS and applications running on EC2 or other customer-managed resources. Physical controls (A), zone security (C), and data center auditing (D) are all solely AWS’s responsibilities, as customers have no access to or control over AWS physical facilities.

Answer : A
Explanation: AWS Billing and Cost Management is the service that provides tools to pay AWS bills, monitor usage, set budgets, and analyze costs. It includes features like Cost Explorer, AWS Budgets, and the billing dashboard. Consolidated billing is a feature within AWS Organizations, not a standalone service. Amazon CloudWatch monitors application metrics. Amazon QuickSight is a business intelligence visualization tool — none serve as the primary billing and cost management service.

Answer : A
Explanation: As AWS grows and serves more customers, its operational efficiency improves and per-unit costs decrease. AWS passes these savings on to customers through periodic price reductions. This is the direct customer benefit of economies of scale. New instance types (B) reflect technological advances, not economies of scale. The ability to scale (C) is elasticity. Hardware reliability (D) is a general AWS infrastructure benefit — none are the definition of economies of scale benefits.

Answer : B
Explanation: Consolidated billing in AWS Organizations combines the usage from all member accounts into a single bill. This aggregated usage allows the organization to reach higher usage tiers faster, qualifying for volume pricing discounts that individual accounts might not achieve on their own. SCPs control permissions across accounts. All Upfront Reserved Instances is a purchasing option. AWS Cost Explorer is an analysis tool — none combine usage across accounts for volume pricing.

Answer : C, E
Explanation: AWS Storage Gateway (C) extends on-premises storage environments to AWS by providing seamless integration between on-premises IT environments and AWS cloud storage, enabling hybrid storage architectures. AWS Direct Connect (E) provides a dedicated private network connection between on-premises data centers and AWS, extending the on-premises network into the cloud. Amazon EBS is block storage for EC2. Amazon Connect is a contact center service. CloudFront is a CDN — none extend on-premises architectures to AWS.

Answer : B
Explanation: Elastic Load Balancing automatically scales its request-handling capacity in response to incoming web traffic without any intervention required. It seamlessly handles varying levels of traffic, distributing requests across registered targets. AWS CodePipeline is a CI/CD service. Amazon EBS volumes must be manually resized. AWS Direct Connect provides fixed-bandwidth network connectivity — none automatically scale with web traffic.

Answer : D
Explanation: Amazon S3 provides virtually unlimited object storage with 99.999999999% (11 nines) of durability by automatically replicating data across multiple Availability Zones. There is no limit on the total amount of data stored. Amazon Redshift is a data warehouse. Amazon EFS is a file system with capacity limits. Amazon ECS is a container orchestration service — none provide virtually unlimited, highly durable object storage.

Answer : B
Explanation: Deploying applications across multiple Availability Zones is the primary AWS feature for achieving high availability. AZs are physically isolated locations within a Region with independent power, cooling, and networking — if one fails, the others continue operating. AWS Direct Connect provides network connectivity. Data centers are AWS’s physical facilities. Amazon VPC is a logical network boundary — none provide high availability through geographic redundancy like multiple AZs.

Answer : A, E
Explanation: AWS WAF (A) is a web application firewall that can block requests from specific IP addresses, IP ranges, or geographic locations at the application layer (Layer 7). Network ACLs (E) operate at the subnet level (Layer 3/4) and can block inbound and outbound traffic from specific IP address ranges. AWS Trusted Advisor provides recommendations. AWS Direct Connect is a network connectivity service. AWS Organizations manages multiple accounts — none block network requests to web applications.

Answer : B
Explanation: Loosely coupling components is a core cloud architectural design principle — designing components to operate independently reduces dependencies, improves resilience, and makes each component easier to scale and update. Scaling out (horizontally) rather than up (vertically) is the cloud recommendation — so option A has it backwards. Building monolithic systems (C) is an anti-pattern for cloud. Using commercial database software (D) is a technology choice, not a design principle.

Answer : B
Explanation: AWS CloudTrail continuously monitors and logs all API calls and user actions across an AWS account — including actions taken via the Management Console, SDKs, CLI, and other AWS services. This provides a complete audit trail for security analysis and risk auditing. Amazon CloudWatch monitors metrics and performance. AWS Config tracks resource configuration changes. AWS Health provides information about AWS service events — none provide a full account activity audit log.

Answer : A
Explanation: AWS Artifact is a self-service portal where customers can download AWS compliance reports and certifications issued by third-party auditors, including SOC reports, PCI DSS reports, ISO certifications, and more. AWS Concierge is a support service for billing inquiries. AWS Certificate Manager provisions SSL/TLS certificates. AWS Trusted Advisor provides best practice recommendations — none allow downloading compliance and certification reports.

Answer : A, C
Explanation: AWS reduces TCO (A) by eliminating upfront hardware costs, reducing data center management expenses, and offering pay-as-you-go pricing. It also reduces operational expenditure (C) by offloading infrastructure management tasks such as hardware maintenance, patching, and power management to AWS. AWS increases, not decreases, CapEx — it replaces CapEx with OpEx (B is incorrect). AWS does not offer deferred payment plans (D) or business credit lines (E) as standard offerings.

Answer : A
Explanation: Amazon S3 has a built-in static website hosting feature that allows you to serve HTML, CSS, JavaScript, images, and other static content directly from an S3 bucket via a website endpoint URL. Amazon Route 53 handles DNS routing but does not host content. Amazon QuickSight is a business intelligence tool. AWS X-Ray is a distributed tracing service — none host static websites.

Answer : A, C
Explanation: Deploying applications in multiple AWS Regions (A) places compute resources closer to users in different countries, significantly reducing latency. Amazon CloudFront’s global network of Edge Locations (C) caches content near users worldwide, further reducing latency for content delivery. Amazon Translate translates text, not entire website interfaces automatically (B). Amazon Comprehend analyzes text but does not enable multilingual responses by itself (D). Elastic Load Balancing operates within a single Region, not across multiple Regions (E is incorrect).

Answer : B, D
Explanation: AWS Regions (D) are distinct geographic locations around the world where AWS clusters data centers. Availability Zones (B) are isolated locations within each Region, consisting of one or more data centers with independent power and networking. Together, Regions and Availability Zones form the core of the AWS global infrastructure. Resource groups, security groups, and AMIs are logical or configuration constructs within AWS, not physical infrastructure components.

Answer : B
Explanation: Data encryption is the customer’s responsibility — customers decide whether to encrypt their data at rest and in transit, and configure the appropriate encryption settings for their applications and storage. Physical access controls (A), secure disposal of storage devices (C), and environmental risk management (D) are all AWS responsibilities related to the physical security and management of data center facilities.

Answer : C
Explanation: To enable consolidated billing, the designated payer account must create an AWS Organization and invite the department accounts to join as member accounts. Once set up, all charges from member accounts are consolidated into a single monthly bill for the payer account. AWS Budgets (A) sets spending alerts but does not consolidate billing. AWS Support (B) does not manage billing consolidation. Manually aggregating invoices in S3 and Redshift (D) is a workaround, not the proper AWS consolidation mechanism.

Answer : C
Explanation: Data center security is a significant cost component in on-premises TCO that is eliminated when moving to AWS — AWS handles all physical data center security. This makes it a direct comparison point in a TCO analysis. Project management (A) and software development (D) costs are generally similar regardless of infrastructure model. Antivirus software licensing (B) may still be required in the cloud for customer-managed instances and is not a unique on-premises cost.

Answer : C
Explanation: A key benefit of AWS managed services like ElastiCache and RDS is that AWS handles patching and updating the underlying operating systems and database software on a timely and consistent basis, reducing the operational burden on customers. Customers still monitor their services (A is incorrect — AWS does not require customers to replace failing instances as that is also automated). Performance depends on configuration (B is not guaranteed). Customers still need to select appropriate instance types (D is incorrect).

Answer : A, B
Explanation: Amazon Route 53 (A) can route traffic between on-premises servers and AWS resources, making it useful in hybrid architectures for DNS-based traffic management. A Virtual Private Gateway (B) is the AWS side of a VPN connection or Direct Connect link, enabling secure connectivity between a VPC and on-premises networks — a core component of hybrid architectures. The Classic Load Balancer, Auto Scaling, and CloudWatch default metrics are AWS-only services that do not extend to on-premises environments.

Answer : B
Explanation: Elastic Load Balancing (ELB) distributes incoming application traffic across multiple registered targets such as EC2 instances, containers, or IP addresses, improving availability and fault tolerance. DNS resolution (A) is performed by Amazon Route 53. Collecting metrics (C) is done by Amazon CloudWatch. Automatically adjusting the number of EC2 instances (D) is the function of AWS Auto Scaling — not ELB.

Answer : C
Explanation: Amazon DynamoDB is a fully managed, fast, and reliable NoSQL database service that delivers consistent single-digit millisecond performance at any scale. It supports key-value and document data models. Amazon Redshift is a SQL-based data warehouse for analytical queries. Amazon RDS is a managed relational (SQL) database. Amazon S3 is object storage — none are NoSQL databases with DynamoDB’s performance characteristics.

Answer : A
Explanation: AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and security certifications from third-party auditors, including SOC reports, PCI DSS, ISO certifications, and more. AWS Lambda is a serverless compute service. Amazon Inspector performs security vulnerability assessments. AWS Certificate Manager manages SSL/TLS certificates — none provide downloadable compliance reports and certifications.

Answer : A, D
Explanation: Amazon Route 53 (A) is a global service — its DNS infrastructure spans the entire world and is not confined to a specific AWS Region. Amazon CloudFront (D) is also a global service, operating through a worldwide network of Edge Locations rather than within specific Regions. Amazon EC2, Amazon S3, and Amazon DynamoDB are regional services — resources are created within specific AWS Regions and do not automatically span all Regions.

Answer : A
Explanation: Applying an IAM policy to an IAM group is the most efficient way to manage access controls for a large set of users. All users added to the group automatically inherit the group’s permissions, making it easy to manage and update access for many users at once. Applying policies to individual users (C) is inefficient at scale. IAM roles are for temporary access or service permissions. Amazon Cognito manages end-user authentication for applications, not AWS service access.

Answer : A
Explanation: Using multiple Availability Zones is an important cloud architectural design principle for achieving high availability and fault tolerance. If one AZ fails, the application continues operating from other AZs. Tightly coupled components (B) is an anti-pattern — loose coupling is preferred. Open source software (C) is a technology choice, not an architectural principle. Provisioning extra capacity (D) is an on-premises approach — cloud elasticity eliminates the need for over-provisioning.

Answer : B
Explanation: AWS Organizations with consolidated billing combines the usage from all member accounts into a single aggregated usage calculation. This allows the company to reach higher volume tiers across services like S3, EC2, and data transfer, qualifying for volume pricing discounts that individual accounts might not achieve alone. AWS Server Migration Service migrates servers. AWS Budgets sets cost alerts. AWS Trusted Advisor provides best practice recommendations — none combine usage across accounts for volume discounts.