Study. uk . com
  1. Home
  2. All questions

All 500 questions — AWS Certified Solutions Architect – Associate

Every question in the free AWS Certified Solutions Architect – Associate study material, one page each: the question, its options, the answer, the reasoning and a public source. Pick one of 7 topics or read them in order.

Challenge yourself → Study as cards

Topics

Every question

  1. 1. An architect attaches a permissions boundary to an IAM role that already has an administrator policy. What effect does the boundary have on the role?
  2. 2. A team must let an application in account A read an S3 bucket in account B. What is the minimum policy configuration required?
  3. 3. Within a single AWS account, a bucket policy grants s3:GetObject to a role that has no S3 permissions in its own identity-based policy. What happens when the role calls GetObject?
  4. 4. A request is allowed by an identity-based policy but explicitly denied by a service control policy. What is the outcome?
  5. 5. A VPC interface endpoint is created without an endpoint policy attached. What access does it permit?
  6. 6. Which statement describes the only resource-based policy that the IAM service itself supports?
  7. 7. An organization wants a single mechanism to share subnets and Transit Gateway attachments with several member accounts without writing a resource policy on each one. Which service does this?
  8. 8. An application running on an EC2 instance needs to read from S3. Which approach follows AWS security guidance?
  9. 9. A company runs servers in its own data centre that must call AWS APIs. It already operates an internal PKI. Which mechanism issues temporary AWS credentials to those servers?
  10. 10. Which AWS STS operation exchanges a SAML assertion from an external identity provider for temporary AWS credentials?
  11. 11. A security team wants to generate a least-privilege policy for a role from the activity that role has actually performed. Which service produces it?
  12. 12. An auditor asks which S3 buckets and IAM roles are reachable from outside the account. Which service reports that exposure?
  13. 13. What distinguishes an IAM role from an IAM user?
  14. 14. An administrator wants to change the permissions of a service-linked role that an AWS service created. What can they do?
  15. 15. Why does AWS refuse to delete a service-linked role while dependent resources still exist?
  16. 16. Which multi-factor authentication type does AWS describe as resistant to phishing, interception and replay?
  17. 17. An administrator enables MFA on the account root user. What is the effect on the IAM users in that account?
  18. 18. How long can temporary security credentials issued by AWS STS remain valid?
  19. 19. An organization has only the consolidated billing features enabled. What does this mean for service control policies?
  20. 20. An administrator attaches a restrictive SCP and is surprised that their own actions in the management account are unaffected. Why?
  21. 21. An administrator removes the FullAWSAccess policy from an organizational unit without attaching any other allow policy. What is the result for member accounts in that OU?
  22. 22. A member account reaches a resource that has no resource-based policy. Which policies must all allow the action?
  23. 23. Which capability lets one AWS managed application pass a signed-in user's identity to another so CloudTrail records the person who acted?
  24. 24. A team wants encryption at rest with no key to manage, no charge for the key, and easy sharing of encrypted data across accounts. Which KMS key type fits?
  25. 25. An auditor needs CloudTrail evidence of every use of the key protecting a data set. Which KMS key type makes that impossible?
  26. 26. An instance's security group allows outbound HTTPS but has no inbound rule for the returning traffic. Can the instance receive the response?
  27. 27. Which two statements correctly describe network ACLs in a VPC? Choose two.
  28. 28. What does the default S3 Object Ownership setting, bucket owner enforced, do?
  29. 29. With ACLs disabled on a bucket, a client uploads an object specifying a custom grant to another AWS account. What does S3 return?
  30. 30. An organization wants to guarantee that no S3 bucket in any member account can be made public. Which two actions achieve this? Choose two.
  31. 31. An organization enables Block Public Access at the organization level, but one bucket has it disabled at bucket level. What protection does that bucket have?
  32. 32. At which level do the four S3 Block Public Access settings have to be applied together as one policy?
  33. 33. A team wants to block public access to one particular object while leaving the rest of the bucket unchanged. What does S3 Block Public Access offer?
  34. 34. A developer generates a presigned URL for a private S3 object and sends it to an external partner. Whose permissions does the download use?
  35. 35. What is the longest a presigned URL created with the AWS CLI can remain valid?
  36. 36. A workload in a private subnet must call an AWS service without any traffic reaching an internet gateway. Which approach meets the requirement?
  37. 37. Which two responsibilities belong to AWS Secrets Manager rather than another AWS service? Choose two.
  38. 38. Where does AWS recommend storing SSH keys, rather than in Secrets Manager?
  39. 39. How many subdomains does a single ACM wildcard certificate protect?
  40. 40. A mobile app must let users sign in with Google and then read from a private S3 bucket. Which Cognito components does this need?
  41. 41. An API only needs to verify signed-in users and receives no AWS resource calls from them. Which Cognito component suffices?
  42. 42. Which two threats does Amazon GuardDuty look for? Choose two.
  43. 43. Which service discovers sensitive data in S3 and raises a finding when a bucket becomes publicly readable?
  44. 44. Which two resource types does Amazon Inspector scan for software vulnerabilities? Choose two.
  45. 45. A security team wants Inspector enabled once for every account in the organization, including accounts that join later. What should they configure?
  46. 46. A public web application behind an Application Load Balancer must block requests from specific IP ranges and inspect query strings. Which service does this?
  47. 47. Which DDoS protection does a workload on AWS receive without any additional charge?
  48. 48. Under the AWS shared responsibility model, which party is responsible for security of the cloud?
  49. 49. Which two capabilities does AWS Security Hub CSPM provide? Choose two.
  50. 50. Which open source intrusion prevention system provides stateful inspection in AWS Network Firewall?
  51. 51. A company wants a governed multi-account environment with a landing zone built in under an hour. Which service orchestrates Organizations, Service Catalog and IAM Identity Center to do this?
  52. 52. In AWS Control Tower, what is a guardrail?
  53. 53. Which Control Tower feature lets distributed teams open new accounts from configurable templates?
  54. 54. How many key policies can a single AWS KMS key have?
  55. 55. An IAM policy grants kms:Decrypt on a key, but the key policy does not enable IAM policies. What happens when the principal calls Decrypt?
  56. 56. How does the scope of a KMS key policy differ from that of an IAM policy?
  57. 57. After automatic rotation replaces a customer managed key's material, what happens to data encrypted before the rotation?
  58. 58. Which two key types can only be rotated manually, by creating a replacement key? Choose two.
  59. 59. A data key generated by a KMS key has leaked. What does rotating that KMS key achieve?
  60. 60. Why do AWS services that encrypt data at rest typically use a KMS grant rather than editing the key policy?
  61. 61. Which two statements about KMS grants are correct? Choose two.
  62. 62. An application creates a KMS grant and immediately needs its permissions. What makes them usable at once?
  63. 63. A workload running as GitHub Actions outside AWS needs to call AWS APIs without stored keys. Which federation approach fits?
  64. 64. Why does AWS warn against putting a password in EC2 instance user data?
  65. 65. What isolation does a single AWS Fargate task receive?
  66. 66. How is traffic protected on an inter-Region VPC peering connection?
  67. 67. Which protocol does AWS Site-to-Site VPN use to secure the connection between an on-premises network and a VPC?
  68. 68. Which two authentication options can Amazon RDS Proxy use when connecting to the database? Choose two.
  69. 69. A subnet must be reachable only from other resources in the same VPC, with no route anywhere else. What is this called?
  70. 70. A data lake team must grant access to particular columns and rows of S3 data queried through Athena and Redshift Spectrum. Which service enforces that?
  71. 71. How does the Lake Formation permissions model relate to IAM?
  72. 72. S3 replication is configured across accounts, and the destination account must control who can read the replicas. Which option achieves this?
  73. 73. An enterprise wants to lift Active Directory-aware applications into AWS and keep using an actual Windows Server Active Directory. Which option fits?
  74. 74. An IAM user switches to a role in the console. What happens to their original permissions?
  75. 75. How does an application stop using a role it assumed programmatically?
  76. 76. Which two policy types does an architect reach for most often when granting permissions in AWS?
  77. 77. What is the practical difference between an AWS managed policy and a customer managed policy?
  78. 78. What happens to an inline policy when the IAM user it is attached to is deleted?
  79. 79. Which characteristic sets access control lists apart from every other AWS policy type?
  80. 80. How many managed session policies can be passed when assuming a role?
  81. 81. Which service does AWS recommend for managing workforce sign-in and permissions across many AWS accounts from one place?
  82. 82. Which two practices does IAM security guidance recommend for reducing standing permissions? Choose two.
  83. 83. An administrator must let a team lead manage IAM permissions in an account without being able to widen their own access. Which mechanism does this?
  84. 84. A newly created AWS account is inspected and contains no IAM roles at all. Is this expected?
  85. 85. How many MFA devices may a single IAM user register?
  86. 86. Which advantage do temporary credentials have over long-term access keys when a task finishes?
  87. 87. An application in Sydney calls AWS STS and wants to reduce latency. What can it do, and what is the effect on the credentials?
  88. 88. Before tightening a service control policy, a team wants to know which services an account genuinely uses. Which two data sources reveal this?
  89. 89. An SCP is approaching its maximum size. What does AWS suggest to reclaim room?
  90. 90. Which step does AWS skip when handling a request to a service such as S3 that permits anonymous callers?
  91. 91. Which two capabilities does AWS Organizations provide beyond consolidated billing? Choose two.
  92. 92. Which mechanism seeds newly created member accounts with baseline resources and permissions?
  93. 93. An organization wants attribute-based access control to key off a consistent classification of resources. Which Organizations feature supports that?
  94. 94. Which KMS key type carries a monthly charge for merely existing, in addition to per-request charges?
  95. 95. A team wants to share EBS volumes encrypted under an AWS managed key with another AWS account. What blocks them?
  96. 96. How often does KMS rotate the material of an AWS managed key?
  97. 97. A security group is created in one VPC and must also protect resources in another VPC in the same Region. What makes that possible?
  98. 98. Which naming rule applies to a security group?
  99. 99. A bucket policy denies PutObject unless the request carries the server-side-encryption header. What unintended effect can this have?
  100. 100. What does S3 server-side encryption leave unprotected?
  101. 101. Which two policy types set a maximum on permissions without granting any themselves? Choose two.
  102. 102. An organization wants to cap what can be done to resources in member accounts without editing each resource policy. Which two statements about resource control policies are correct? Choose two.
  103. 103. Which two things must be true for a principal to use a KMS key? Choose two.
  104. 104. A KMS key has had its material rotated four times. How many keys does it count as against the account's key quota?
  105. 105. An administrator needs to withdraw everything a KMS grant allowed, without unpicking policy statements. What should they do?
  106. 106. Which two statements about on-demand rotation of a KMS key are correct? Choose two.
  107. 107. What does enabling automatic rotation on a customer managed key do by default?
  108. 108. Which two conditions must hold before disabling ACLs on an existing S3 bucket? Choose two.
  109. 109. Which Security Hub control is satisfied by enabling all four Block Public Access settings on a bucket?
  110. 110. A team must host a static website out of S3. How should Block Public Access be handled?
  111. 111. How quickly does an account-level Block Public Access setting take effect across AWS Regions?
  112. 112. Which two statements about Amazon Cognito identity pools are correct? Choose two.
  113. 113. Which access control models does a Cognito identity pool use to decide what a user may reach?
  114. 114. Which two things can AWS Certificate Manager do with certificates? Choose two.
  115. 115. A company needs an ACM-signed certificate for use on servers inside its own internal PKI. What makes that possible?
  116. 116. Which two kinds of traffic can AWS Network Firewall inspect? Choose two.
  117. 117. Which two controls can AWS Network Firewall apply to outbound VPC traffic? Choose two.
  118. 118. Which sharing target is available for some resource types in AWS RAM but not for all of them?
  119. 119. In AWS Control Tower, what is the landing zone?
  120. 120. Which two automation options does AWS Security Hub offer for handling findings? Choose two.
  121. 121. How can Macie findings be fed into an automated remediation workflow?
  122. 122. How does Amazon Inspector decide what to scan?
  123. 123. Which two resource types can AWS WAF protect? Choose two.
  124. 124. What does AWS Shield Advanced add beyond the protection every AWS workload already receives?
  125. 125. An account on the Basic Support plan relies on Trusted Advisor's Security checks. What must the team remember?
  126. 126. Which statement describes how an identity-based policy differs from a resource-based policy?
  127. 127. Which two statements about how a session policy affects an assumed role are correct? Choose two.
  128. 128. Why does AWS recommend federating human users rather than creating IAM users for them?
  129. 129. A single AWS account is not using IAM Identity Center but must federate with an external identity provider. Which two protocols can IAM use? Choose two.
  130. 130. Which sign-in scenario still justifies creating an IAM user rather than federating?
  131. 131. A role must be assumable by anyone on a team who needs it, rather than tied to one person. Which property of roles makes this possible?
  132. 132. Why is embedding AWS access keys in a mobile application discouraged?
  133. 133. Which two facts about MFA on AWS accounts are correct? Choose two.
  134. 134. Which three MFA types does AWS accept?
  135. 135. Why does AWS advise against attaching a new SCP directly to the organization root?
  136. 136. In what order does AWS process a request before deciding whether to allow it?
  137. 137. An administrator removes a permissions boundary from an IAM user. What is the possible effect?
  138. 138. Which two statements about AWS managed KMS keys are correct? Choose two.
  139. 139. Since when have AWS services stopped adopting AWS managed keys as the default for encryption at rest?
  140. 140. An architect must choose between a customer managed key and an AWS owned key. Which requirement points to the customer managed key?
  141. 141. What does an inbound security group rule specify?
  142. 142. What do security groups and network ACLs cost to use in a VPC?
  143. 143. With ACLs disabled on a bucket, which policy types decide access?
  144. 144. Which two signs indicate an S3 bucket policy may expose data publicly? Choose two.
  145. 145. Which two AWS Config managed rules give a standing detective control over publicly exposed S3 buckets? Choose two.
  146. 146. Why does AWS recommend keeping SSE-C disabled unless a workload specifically requires it?
  147. 147. A bucket has SSE-C blocked. What does S3 return for a PutObject request that asks for SSE-C?
  148. 148. Why does AWS advise emptying rather than deleting a general purpose bucket that is no longer used?
  149. 149. Which encryption does S3 apply to objects under SSE-S3?
  150. 150. How can an account force every upload to a bucket to use SSE-S3?
  151. 151. Why should a failover procedure depend only on data plane operations?
  152. 152. A well-architected, highly available workload must survive the loss of a single data centre. Which disaster recovery strategy is sufficient?
  153. 153. Which service continuously validates whether a workload is still likely to meet its RTO and RPO targets?
  154. 154. A team plans a backup-and-restore strategy into a second Region. Which two things must be restored besides the data? Choose two.
  155. 155. What determines the recovery point a backup-based strategy can actually achieve?
  156. 156. Which weakness does continuous replication have compared with point-in-time backups?
  157. 157. S3 replication is running to a recovery Region and someone deletes an object in the source bucket. What happens to the replica?
  158. 158. Which two capabilities does AWS Backup add over per-service backup tools? Choose two.
  159. 159. A team wants restores from AWS Backup to run automatically each night. What must they build?
  160. 160. Why is running a periodic restore in advance of any disaster considered good practice?
  161. 161. In a pilot light strategy, which components stay running in the recovery Region?
  162. 162. What is the essential difference between pilot light and warm standby?
  163. 163. Which two AWS features provide continuous cross-Region asynchronous data replication? Choose two.
  164. 164. A workload uses RDS read replicas across Regions. What must happen before the recovery Region can accept writes?
  165. 165. Which two advantages does an Aurora global database offer over cross-Region RDS read replicas? Choose two.
  166. 166. How can one CloudFormation template deploy full capacity to the primary Region and a scaled-down stack to the recovery Region?
  167. 167. Why do many teams keep failover initiation manual while automating every step behind it?
  168. 168. Which mechanism gives an operator a highly available data plane switch to shift traffic between Regions?
  169. 169. How does CloudFront origin failover differ from a Region-level failover?
  170. 170. Which two statements about AWS Elastic Disaster Recovery are correct? Choose two.
  171. 171. Before a recovery Region can be scaled to production capacity, what must be checked?
  172. 172. A team provisions the recovery Region at full production capacity rather than relying on Auto Scaling during failover. What is this arrangement called?
  173. 173. How does multi-site active/active differ from hot standby?
  174. 174. Which two behaviours does Amazon EC2 Auto Scaling provide without any manual intervention? Choose two.
  175. 175. An application process hangs but the EC2 instance still passes its system checks. What lets Auto Scaling replace it?
  176. 176. An SQS consumer receives a message and takes longer than expected to process it. What happens when the visibility timeout expires before the message is deleted?
  177. 177. Which SQS action extends the visibility timeout for a message that needs more processing time?
  178. 178. What is the default visibility timeout on a new SQS queue?
  179. 179. Which two constraints apply to an SQS dead-letter queue? Choose two.
  180. 180. What risk does attaching a dead-letter queue to a FIFO queue introduce?
  181. 181. Which setting names a source queue's dead-letter queue and the number of failed receives that send a message there?
  182. 182. After fixing the fault that sent messages to a dead-letter queue, how are those messages returned for processing?
  183. 183. Which two endpoint types can subscribe to an Amazon SNS topic? Choose two.
  184. 184. What role does an SNS topic play between publishers and subscribers?
  185. 185. Which EventBridge feature suits routing events from many sources to many targets?
  186. 186. A team needs events from one DynamoDB stream delivered to one target, with enrichment applied on the way. Which EventBridge feature fits?
  187. 187. Which EventBridge component runs recurring tasks defined by cron and rate expressions?
  188. 188. Which two characteristics describe a Step Functions Standard workflow? Choose two.
  189. 189. A workload ingests IoT telemetry at a very high event rate through Step Functions. Which workflow type suits it?
  190. 190. In Step Functions, what is a single running instance of a workflow called?
  191. 191. How can work in a Step Functions task be performed by a worker that does not run on AWS?
  192. 192. A Multi-AZ DB instance deployment is in place and the team wants the standby to serve read traffic. What must change?
  193. 193. Why can an RDS read replica return slightly stale data?
  194. 194. Which two benefits does Amazon RDS Proxy give an application? Choose two.
  195. 195. A traffic surge sends RDS Proxy more connection requests than its pool can serve. What happens first?
  196. 196. Across how many Availability Zones is an Aurora cluster volume spread?
  197. 197. What happens when an Aurora cluster's primary instance becomes unavailable?
  198. 198. Which two statements about DynamoDB global tables are correct? Choose two.
  199. 199. How does S3 versioning protect against an accidental delete?
  200. 200. Two clients write the same object key to a versioning-enabled bucket at the same moment. What does S3 do?
  201. 201. Which AWS Backup feature protects against an insider threat or a compromised account?
  202. 202. A backup strategy must reach every account in an organization without duplicating plans by hand. What does AWS Backup offer?
  203. 203. What is a prerequisite for AWS Backup cross-account management and cross-account backup?
  204. 204. Which two things does AWS Backup Audit Manager do? Choose two.
  205. 205. How does AWS Backup keep frequent backups affordable for supported resource types?
  206. 206. A compliance team asks whether AWS Backup governs the EBS snapshots a developer takes directly in the EC2 console. What is the answer?
  207. 207. How is one AWS Backup plan applied consistently to a whole group of resources across applications?
  208. 208. Which two statements about AWS X-Ray are correct? Choose two.
  209. 209. On which platforms is the X-Ray daemon already included?
  210. 210. An application must process long-running jobs pulled from an SQS queue on Elastic Beanstalk. Which environment type fits?
  211. 211. Which two things can a Route 53 health check monitor? Choose two.
  212. 212. Which Route 53 routing policy arranges active-passive failover between a primary resource and a standby?
  213. 213. How many healthy records does a Route 53 multivalue answer routing policy return?
  214. 214. How does an operator learn immediately that a Route 53 health check has changed status?
  215. 215. Which two endpoint types can sit behind a standard AWS Global Accelerator? Choose two.
  216. 216. A team disables a Global Accelerator to save cost and later deletes it. What happens to its static IP addresses?
  217. 217. Why does a VPC peering connection introduce no single point of failure?
  218. 218. How many tunnels does a single AWS Site-to-Site VPN connection provide?
  219. 219. Which two placement group strategies reduce the chance that one hardware failure takes several instances at once? Choose two.
  220. 220. Instances are launched without any placement group. How does EC2 place them?
  221. 221. Which signal warns that a Spot Instance faces a raised risk of interruption?
  222. 222. How does reserved concurrency protect the resources behind a Lambda function?
  223. 223. A team needs replicas that are byte-for-byte identical to the source objects, keeping creation times and version IDs. What does S3 replication offer?
  224. 224. What service level does S3 Replication Time Control commit to?
  225. 225. A team enables Replication Time Control and expects it to cover a Batch Replication job. What actually happens?
  226. 226. Which Elastic Load Balancing component decides how a request reaches the registered targets?
  227. 227. Which two statements about Application Load Balancer listener rules are correct? Choose two.
  228. 228. At what level are Elastic Load Balancing health checks configured?
  229. 229. A Network Load Balancer has two Availability Zones enabled but traffic is uneven because one zone holds fewer targets. What setting evens it out?
  230. 230. What does enabling an Availability Zone on a load balancer create?
  231. 231. A target must receive traffic from two different applications with different health requirements. What makes this possible?
  232. 232. Which generation of Elastic Load Balancing does AWS recommend migrating away from?
  233. 233. How does adding or removing targets behind a load balancer affect in-flight application traffic?
  234. 234. Which two statements about API Gateway API types are correct? Choose two.
  235. 235. Which API Gateway API type routes incoming messages according to their content?
  236. 236. A workload must survive an Availability Zone failure. Which design choice addresses this directly?
  237. 237. Besides lowering latency, what does caching objects at many CloudFront edge locations achieve?
  238. 238. How quickly does Global Accelerator react to an endpoint becoming unhealthy?
  239. 239. Which two workloads suit Amazon Kinesis Data Streams? Choose two.
  240. 240. How does pushing logs directly into a Kinesis stream improve durability compared with batching them on the server?
  241. 241. Which two destinations can Amazon Data Firehose deliver streaming data to? Choose two.
  242. 242. What must a team build to use Amazon Data Firehose?
  243. 243. Which of the six Well-Architected Framework pillars addresses recovering from failure?
  244. 244. What is the purpose of the AWS Well-Architected Framework?
  245. 245. What does Amazon OpenSearch Service do when a node in a managed domain fails?
  246. 246. Why is a daily automatic backup of an FSx for Windows file system file-system-consistent?
  247. 247. A multipart upload loses one part to a network error. What must be retransmitted?
  248. 248. Across what scope is EBS snapshot data replicated?
  249. 249. Who is responsible for backing up the data on an EBS volume?
  250. 250. How can a team follow the progress and status of EBS snapshots programmatically?
  251. 251. Which two statements distinguish an Aurora Replica from an RDS read replica? Choose two.
  252. 252. Which mechanism does RDS use to build a read replica?
  253. 253. What access do clients have to an RDS read replica?
  254. 254. How much application change does adopting Amazon RDS Proxy usually require?
  255. 255. Which two models does DynamoDB offer for global tables?
  256. 256. How many broad disaster recovery strategies does AWS describe?
  257. 257. In an active/passive disaster recovery design, when does the recovery site begin serving traffic?
  258. 258. Which two AWS resources offer point-in-time backup for a disaster recovery plan? Choose two.
  259. 259. What does versioning in the destination bucket add to an S3 Cross-Region Replication strategy?
  260. 260. An AMI is created from a running EC2 instance. What does it capture?
  261. 261. AWS Backup records extra EC2 metadata such as instance type, VPC and IAM role. When is that metadata used?
  262. 262. Which two practices does AWS recommend when adopting a pilot light strategy? Choose two.
  263. 263. Which Aurora capability confirms that a secondary cluster is staying inside the target recovery point window?
  264. 264. How does an Image Builder pipeline support a multi-Region recovery plan?
  265. 265. Why is changing Route 53 weighted routing weights a weaker failover mechanism than routing controls?
  266. 266. Adjusting Global Accelerator traffic dials to shift traffic during a failover has which characteristic?
  267. 267. A company runs applications and databases on EC2 and wants continuous block-level replication into a recovery Region. Which service fits?
  268. 268. Besides EC2 instances, which two resources can EC2 Auto Scaling adjust within a Region? Choose two.
  269. 269. Which change brings a recovery Region's Auto Scaling group up to full production capacity?
  270. 270. Multi-site active/active brings recovery time close to zero. Which failure still leaves a non-zero recovery point?
  271. 271. Which two values bound the size of an EC2 Auto Scaling group? Choose two.
  272. 272. Which Elastic Load Balancing behaviour keeps a failing target from receiving requests?
  273. 273. An SQS consumer needs one particular message hidden for longer than the queue's default, without changing the queue. What is possible?
  274. 274. How is a processed SQS message removed from the queue?
  275. 275. What is the purpose of collecting failed messages in a dead-letter queue?
  276. 276. Which characteristic of EventBridge makes an event-driven architecture loosely coupled?
  277. 277. A pipe reads from a DynamoDB stream and delivers to an event bus. What does this pattern achieve?
  278. 278. In Step Functions, what does a Task state represent?
  279. 279. How many primary instances does an Aurora DB cluster have?
  280. 280. Two buckets in the same AWS Region must be kept in sync automatically. Which feature does this?
  281. 281. An object is uploaded to S3 without naming a storage class. Where does it land?
  282. 282. What actually differs between the S3 storage classes?
  283. 283. Which two statements about S3 One Zone-IA are correct? Choose two.
  284. 284. Which storage class does AWS recommend for a primary copy of data that could not be recreated but is read rarely?
  285. 285. Into which S3 Intelligent-Tiering tier does a newly uploaded object go?
  286. 286. After how many consecutive days without access does Intelligent-Tiering move an object to Infrequent Access?
  287. 287. An object in S3 Intelligent-Tiering has gone 90 consecutive days without being read. Which tier does it move to?
  288. 288. Which two statements about the optional Intelligent-Tiering archive tiers are correct? Choose two.
  289. 289. What happens to an object smaller than 128 KB in S3 Intelligent-Tiering?
  290. 290. How does the Archive Instant Access tier differ from the Archive Access tier?
  291. 291. Which durability figure is S3 Intelligent-Tiering designed for?
  292. 292. Why does AWS advise against Reduced Redundancy Storage?
  293. 293. How is S3 Express One Zone's data stored?
  294. 294. Which two actions can an S3 Lifecycle configuration perform? Choose two.
  295. 295. A bucket policy denies every action to every principal. What happens to the bucket's lifecycle rules?
  296. 296. A lifecycle rule expiring objects after 30 days is added to a bucket that already holds older objects. What happens?
  297. 297. Which two EBS volume families are SSD-backed? Choose two.
  298. 298. For which kind of workload are SSD-backed EBS volumes designed?
  299. 299. Which EBS volume type is rated for five nines of durability?
  300. 300. What is the maximum size of a gp3 EBS volume?
  301. 301. A database volume must be attached to several EC2 instances at once. Which EBS family supports this?
  302. 302. Which two workloads does AWS name as a good fit for General Purpose SSD volumes? Choose two.
  303. 303. What does an EBS snapshot store after the first one is taken?
  304. 304. Where do EBS snapshots live, and how are they managed?
  305. 305. A team creates a new EBS volume from a snapshot. What state does the volume start in?
  306. 306. Which protocol do clients use to reach an Amazon FSx for Windows File Server file system?
  307. 307. Which two settings are chosen when creating an FSx for Windows file system, and can be changed later? Choose two.
  308. 308. What does AWS handle on a customer's behalf for FSx for Windows File Server?
  309. 309. An existing Linux application must run unchanged against a high-performance shared file system. Which property of FSx for Lustre makes that possible?
  310. 310. Which two gateway types does AWS Storage Gateway offer? Choose two.
  311. 311. An on-premises site needs access to Windows file shares that live in the cloud. Which gateway type fits?
  312. 312. What distinguishes the two Volume Gateway architectures?
  313. 313. Which two on-premises sources can AWS DataSync read from? Choose two.
  314. 314. Which two AWS storage services can DataSync move data into? Choose two.
  315. 315. At what object size does AWS treat multipart upload as best practice?
  316. 316. An application starts a multipart upload and then abandons it. What happens to the upload?
  317. 317. Which capability lets an application begin uploading an object before its final size is known?
  318. 318. What are the three steps of a multipart upload?
  319. 319. Which two S3 storage classes hold objects that cannot be read in real time? Choose two.
  320. 320. How is an object in S3 Glacier Deep Archive made readable?
  321. 321. A team restores an object from S3 Glacier Flexible Retrieval and wants a permanent copy in S3 Standard. What must they do?
  322. 322. How does restoring from an Intelligent-Tiering archive tier differ from restoring from S3 Glacier?
  323. 323. Which mechanism restores many archived S3 objects in one operation?
  324. 324. Which two statements about S3 live replication are correct? Choose two.
  325. 325. A bucket must have its pre-existing objects copied to a new destination bucket. Which feature does this?
  326. 326. Can S3 replication write objects into a different storage class at the destination?
  327. 327. What are the three possible versioning states of an S3 bucket?
  328. 328. What happens when an object is overwritten in a versioning-enabled bucket?
  329. 329. How large can a single record delivered to an Amazon Data Firehose stream be?
  330. 330. Which two services can query data catalogued by AWS Glue straight away? Choose two.
  331. 331. How many general purpose buckets may an AWS account create by default?
  332. 332. What is the account regional namespace for S3 buckets?
  333. 333. Since January 2023, what encryption is applied to new object uploads to S3?
  334. 334. What does S3 Versioning let an owner do with an object?
  335. 335. Which two arrangements does S3 replication support? Choose two.
  336. 336. What is a VPC?
  337. 337. Can a subnet span two Availability Zones?
  338. 338. Which two components does a default VPC provide that a newly created VPC does not? Choose two.
  339. 339. An EC2 instance is launched into a nondefault subnet with no public IPv4 address assigned. What connectivity does it have?
  340. 340. A subnet is created but never explicitly associated with a route table. Which table governs its traffic?
  341. 341. Which two elements make up a route in a VPC route table? Choose two.
  342. 342. A private NAT gateway's route is pointed at the VPC's internet gateway. What happens to that traffic?
  343. 343. Which two statements about a public NAT gateway are correct? Choose two.
  344. 344. Which device provides outbound-only internet access for instances using IPv6?
  345. 345. From where must a connection through a NAT gateway be initiated?
  346. 346. At which OSI layer does an Application Load Balancer operate?
  347. 347. Which two protocols can a Network Load Balancer target group use? Choose two.
  348. 348. Which Route 53 routing policy sends users to the AWS Region that answers them fastest?
  349. 349. How does geoproximity routing differ from geolocation routing in Route 53?
  350. 350. Which Route 53 routing policy uses the IP addresses that traffic originates from?
  351. 351. Which two attachments can be made to an AWS Transit Gateway? Choose two.
  352. 352. Two VPCs in different AWS Regions are peered. How do resources in them communicate?
  353. 353. Which Direct Connect virtual interface type reaches a customer's own VPC?
  354. 354. Which two requirements must a customer network meet to use Direct Connect? Choose two.
  355. 355. A single Direct Connect connection is established in a public Region. Which AWS services can it reach?
  356. 356. What must be true of a subnet for it to be called a public subnet?
  357. 357. Which two subnet types have no route to an internet gateway? Choose two.
  358. 358. A VPC has an IPv6 CIDR block and instances with IPv6 addresses, but IPv6 traffic is not leaving the VPC. What is the likely cause?
  359. 359. What addresses do resources in an IPv6-only subnet receive for reaching services available only inside the VPC?
  360. 360. What must a VPC carry before a dual-stack subnet can be created in it?
  361. 361. How many network ACLs can a subnet be associated with at one time?
  362. 362. Traffic goes from a private subnet through a NAT gateway to a public AWS service endpoint. Where does that traffic travel?
  363. 363. How does a NAT gateway handle the source address of an instance's outbound packet?
  364. 364. Which two things does a private NAT gateway differ on compared with a public one? Choose two.
  365. 365. What is a CloudFront distribution?
  366. 366. Which two can serve as a CloudFront origin? Choose two.
  367. 367. What are CloudFront edge locations?
  368. 368. Which two advantages does Global Accelerator hold over DNS-based failover? Choose two.
  369. 369. How many static IP addresses does Global Accelerator provide for a dual-stack accelerator?
  370. 370. Which Global Accelerator type maps particular users to one specific destination among many?
  371. 371. A company must keep its existing public IPv4 addresses when adopting Global Accelerator. Is this possible?
  372. 372. How does S3 Transfer Acceleration speed up a long-distance upload?
  373. 373. Which three functions can Route 53 perform, in any combination?
  374. 374. Which Route 53 routing policy suits one web server serving a single site?
  375. 375. Which frame sizes does AWS Direct Connect accept at the link layer?
  376. 376. Which transceiver does a 100 gigabit Direct Connect connection require?
  377. 377. How can public AWS service IPv6 addresses be reached over Direct Connect?
  378. 378. Which two routes to a Direct Connect connection does AWS describe? Choose two.
  379. 379. How do instances in an AWS Outposts subnet communicate with instances in the parent Region?
  380. 380. Which connection does AWS Outposts not allow within the same VPC?
  381. 381. A default VPC exists in the Region and an instance is launched without naming a subnet. What happens?
  382. 382. What term describes a subnet created inside a VPC that the customer built themselves?
  383. 383. Which component lets EC2 instances reach the internet through the Amazon EC2 network edge?
  384. 384. Which two things must be in place to give an instance in a nondefault subnet internet access? Choose two.
  385. 385. What does a NAT device do for instances in a private subnet?
  386. 386. What is the role of a VPC route table?
  387. 387. On what basis does a VPC route table choose a target for a packet?
  388. 388. What does an IPv4-only subnet mean for the resources inside it?
  389. 389. Which step is part of building a VPC?
  390. 390. Which AWS service acts as a transit hub joining many VPCs and on-premises networks from one place?
  391. 391. Which resources does EC2 dedicate to a particular instance rather than sharing with others on the host?
  392. 392. Two instances on the same host both want the shared disk subsystem at full rate. What happens?
  393. 393. What does an EC2 instance type name encode?
  394. 394. Which two hypervisors does Amazon EC2 use? Choose two.
  395. 395. Which instance families still run on the Xen hypervisor rather than Nitro?
  396. 396. Where does an Auto Scaling group get the configuration for the instances it launches?
  397. 397. What is a Spot capacity pool?
  398. 398. A persistent Spot Instance request has its instance interrupted. What does EC2 do?
  399. 399. Which two things does starting a hibernated EC2 instance restore? Choose two.
  400. 400. An application takes a long time to bootstrap and build up a useful memory footprint. How can hibernation help?
  401. 401. Which placement group strategy puts instances on hardware with direct access to high-precision time sources?
  402. 402. What is included in the dynamic data portion of EC2 instance metadata?
  403. 403. Several instances are launched by one RunInstances call. How can their code tell them apart?
  404. 404. How does one generic AMI serve many customers with different content?
  405. 405. What is required to make an ECS task definition run on AWS Fargate?
  406. 406. Which two operating systems does AWS Fargate publish platform versions for? Choose two.
  407. 407. What does running ECS tasks on Fargate remove the need to decide?
  408. 408. What is the default concurrency limit for Lambda across all functions in an AWS Region?
  409. 409. Which two phases does Lambda use to serve a request? Choose two.
  410. 410. Where does code written outside a Lambda function's main handler run?
  411. 411. Can one Lambda execution environment handle two requests at the same time?
  412. 412. A function averages 500 ms and receives 100 requests per second. What is its concurrency?
  413. 413. A Lambda function averages 200 ms and peaks at 5,000 requests per second. What concurrency does it need?
  414. 414. A critical function has no reserved concurrency and the account's pool is exhausted by other functions. What happens to it?
  415. 415. Which two effects does setting reserved concurrency on a Lambda function have? Choose two.
  416. 416. A function with 400 reserved concurrency hits that ceiling while the account has spare capacity elsewhere. What happens?
  417. 417. Why might an account be unable to use all the Lambda concurrency it is entitled to?
  418. 418. Which two ways can a Lambda function's code be packaged? Choose two.
  419. 419. Which three per-function capacity settings does a Lambda owner tune?
  420. 420. What are AWS Lambda MicroVMs designed for?
  421. 421. How does a Lambda function get invoked?
  422. 422. What does Lambda manage on the customer's behalf?
  423. 423. Which two statements about Amazon ECS are correct? Choose two.
  424. 424. Which three layers make up Amazon ECS?
  425. 425. Under EKS standard, which part does the customer remain responsible for?
  426. 426. Which two options let EKS clusters run outside the AWS cloud? Choose two.
  427. 427. On which services does AWS Batch run its work?
  428. 428. On which two kinds of compute can AWS Batch scale capacity? Choose two.
  429. 429. How does AWS Batch help machine learning teams running SageMaker Training jobs?
  430. 430. Which two things does Elastic Beanstalk provision for a deployed web application? Choose two.
  431. 431. Which two languages or runtimes does Elastic Beanstalk support directly? Choose two.
  432. 432. What is the deployment workflow for an application on Elastic Beanstalk?
  433. 433. What is an AWS Outpost?
  434. 434. What is an Outpost site?
  435. 435. Which resource types does AWS Compute Optimizer generate recommendations for?
  436. 436. What does an OpenSearch Service domain correspond to?
  437. 437. How is an OpenSearch Service cluster resized?
  438. 438. Which service runs Apache Hadoop and Apache Spark as a managed cluster platform?
  439. 439. What makes AWS Glue serverless in practice?
  440. 440. What is AWS Glue Studio?
  441. 441. What does Fargate require an application to declare when launching a task?
  442. 442. Which two tools does Amazon ECS integrate with? Choose two.
  443. 443. How does Lambda handle two simultaneous invocations of the same function?
  444. 444. What does an Auto Scaling scaling policy do?
  445. 445. What work can be offloaded from compute targets to a load balancer?
  446. 446. Which routing algorithm does an Application Load Balancer target group use by default?
  447. 447. Which two claims does AWS make for S3 Express One Zone against S3 Standard? Choose two.
  448. 448. An EBS volume is not delivering the IOPS it was provisioned for. What should be checked first?
  449. 449. What maximum IOPS does an io2 Block Express volume reach?
  450. 450. Which EBS volume family does AWS recommend for a workload that must sustain more than 16,000 IOPS?
  451. 451. Which two choices shape the performance of an Amazon EFS file system? Choose two.
  452. 452. Why does AWS recommend General Purpose over Max I/O performance mode for EFS?
  453. 453. Which EFS throughput mode reaches the highest IOPS on a Regional file system?
  454. 454. Which two workloads does AWS name as suiting FSx for Lustre? Choose two.
  455. 455. What performance does FSx for Lustre deliver?
  456. 456. How does S3 multipart upload raise throughput for a large object?
  457. 457. Which two situations make S3 Transfer Acceleration worth its cost? Choose two.
  458. 458. Why do instance types billed for high I/O performance show less variance in that performance?
  459. 459. Which placement group strategy serves a tightly coupled HPC application needing low-latency node-to-node networking?
  460. 460. Why do later invocations of a Lambda function often start faster than the first?
  461. 461. Which Lambda control is designed specifically to reduce cold start latency?
  462. 462. What benefit does self-managed S3 code storage give a Lambda function?
  463. 463. How does routing a request across the AWS backbone improve CloudFront performance?
  464. 464. A user requests an object that is not cached at the nearest CloudFront edge location. What happens?
  465. 465. Which two statements compare Step Functions workflow throughput? Choose two.
  466. 466. How does adding read replicas help a read-heavy database?
  467. 467. How does connection pooling in RDS Proxy help the database?
  468. 468. How many Aurora Replicas can one Aurora DB cluster carry?
  469. 469. Which consistency mode does a DynamoDB global table use if none is specified?
  470. 470. Which two statements about DynamoDB Accelerator are correct? Choose two.
  471. 471. Which two engines does Amazon ElastiCache support? Choose two.
  472. 472. What does ElastiCache Serverless remove compared with a node-based cluster?
  473. 473. What does Amazon Athena let a team do with data already in S3?
  474. 474. Besides SQL, what else can Amazon Athena run interactively?
  475. 475. How many data source types can AWS Glue connect to?
  476. 476. How is an On-Demand EC2 instance billed?
  477. 477. Which two commitments do Reserved Instances and Savings Plans differ on? Choose two.
  478. 478. Which purchasing option lets a customer bring existing per-socket or per-core software licences to AWS?
  479. 479. How is the hourly price of a Spot Instance determined?
  480. 480. Which two workloads suit Spot Instances? Choose two.
  481. 481. Which two savings can a single Auto Scaling group combine? Choose two.
  482. 482. What does S3 Intelligent-Tiering charge that the other storage classes do not?
  483. 483. Which two billing rules apply to the S3 infrequent-access storage classes? Choose two.
  484. 484. A team uploads data to S3 Standard and wants it to become cheaper as it ages. What is the usual approach?
  485. 485. Which two costs can an S3 Lifecycle configuration incur? Choose two.
  486. 486. Why does keeping three versions of an object in a versioned bucket cost as much as three objects?
  487. 487. Which two charges apply while an object restored from S3 Glacier sits in the bucket? Choose two.
  488. 488. An application restores an object that has already been restored. How is that request billed?
  489. 489. How is an interface VPC endpoint charged?
  490. 490. Which two things can AWS Budgets do beyond raising an alert? Choose two.
  491. 491. How often does AWS Budgets refresh its information?
  492. 492. Which two cost types can an AWS Budget track? Choose two.
  493. 493. A finance team needs a budget covering a three-month project rather than a calendar month. What can they use?
  494. 494. Which two facts about Cost Explorer are correct? Choose two.
  495. 495. How much can Savings Plans reduce the cost of compute workloads?
  496. 496. Which two kinds of usage does a Compute Savings Plan discount? Choose two.
  497. 497. Which payment options does a Savings Plan offer?
  498. 498. What does AWS Compute Optimizer analyse to make its recommendations?
  499. 499. Which support plans give access to the full set of Trusted Advisor checks?
  500. 500. Which two serverless services charge nothing while completely idle? Choose two.