Download Amazon AWS-Certified-Cloud-Practitioner Practice Exam Online

NEW QUESTION 1

What can a user accomplish using AWS CloudTrail?

• A. Generate an IAM user credentials report.
• B. Record API calls made to AWS services.
• C. Assess the compliance of AWS resource configurations with policies and guidelines.
• D. Ensure that Amazon EC2 instances are patched with the latest security update
• E. A company uses Amazon Workspaces.

Answer: B

Explanation:
AWS CloudTrail is an AWS service that enables users to accomplish the task of recording API calls made to AWS services. AWS CloudTrail is a service that tracks user activity and API usage across the AWS account. AWS CloudTrail records the details of every API call made to AWS services, such as the identity of the caller, the time of the call, the source IP address of the caller, the parameters and responses of the call, and more. Users can use AWS CloudTrail to audit, monitor, and troubleshoot their AWS resources and actions. The other options are incorrect because they are not tasks that users can accomplish using AWS CloudTrail. Generating an IAM user credentials report is a task that users can accomplish using IAM, which is an AWS service that enables users to manage access and permissions to AWS resources and services. Assessing the compliance of AWS resource configurations with policies and guidelines is a task that users can accomplish using AWS Config, which is an AWS service that enables users to assess, audit, and evaluate the configurations of their AWS resources. Ensuring that Amazon EC2 instances are patched with the latest security updates is a task that users can accomplish using AWS Systems Manager, which is an AWS service that enables users to automate operational tasks, manage configuration and compliance, and monitor system health and performance. Reference: AWS CloudTrail FAQs

NEW QUESTION 2

Which options does AWS make available for customers who want to learn about security in the cloud in an instructor-led setting? (Select TWO.)

• A. AWS Trusted Advisor
• B. AWS Online Tech Talks
• C. AWS Blog
• D. AWS Forums
• E. AWS Classroom Training

Answer: BE

Explanation:
The correct answers are B and E because AWS Online Tech Talks and AWS Classroom Training are options that AWS makes available for customers who want to learn about security in the cloud in an instructor-led setting. AWS Online Tech Talks are live, online presentations that cover a broad range of topics at varying technical levels. AWS Online Tech Talks are delivered by AWS experts and feature live Q&A sessions with the audience. AWS Classroom Training are in-person or virtual courses that are led by accredited AWS instructors. AWS Classroom Training offer hands-on labs, exercises, and best practices to help customers gain confidence and skills on AWS. The other options are incorrect because they are not options that AWS makes available for customers who want to learn about security in the cloud in an instructor-led setting. AWS Trusted Advisor is an AWS service that provides real-time guidance to help customers follow AWS best practices for security, performance, cost optimization, and fault tolerance. AWS Blog is an AWS resource that provides news, announcements, and insights from AWS experts and customers. AWS Forums are AWS resources that enable customers to interact with other AWS users and get feedback and support. Reference: AWS Online Tech Talks, AWS Classroom Training

NEW QUESTION 3

A company is migrating to the AWS Cloud to meet storage needs. The company wants to optimize costs based on the amount of storage that the company uses.
Which AWS offering or benefit will meet these requirements MOST cost-effectively?

• A. Pay-as-you-go pricing
• B. Savings Plans
• C. AWS Free Tier
• D. Volume-based discounts

Answer: D

Explanation:
Volume-based discounts are an AWS offering or benefit that can help the company optimize costs based on the amount of storage that the company uses. Volume- based discounts are discounts that AWS provides for some storage services, such as Amazon S3 and Amazon EBS, when the company stores a large amount of data. The more data the company stores, the lower the price per GB. For example, Amazon S3 offers six storage classes, each with a different price per GB. The price per GB decreases as the amount of data stored in each storage class increases

NEW QUESTION 4

A company needs to run code in response to an event notification that occurs when objects are uploaded to an Amazon S3 bucket.
Which AWS service will integrate directly with the event notification?

• A. AWS Lambda
• B. Amazon EC2
• C. Amazon Elastic Container Registry (Amazon ECR)
• D. AWS Elastic Beanstalk

Answer: A

Explanation:
AWS Lambda is a service that lets you run code without provisioning or managing servers. You can use Lambda to process event notifications from Amazon S3 when objects are uploaded or deleted. Lambda integrates directly with the event notification and invokes your code automatically. Therefore, the correct answer is A.

NEW QUESTION 5

A company needs to control inbound and outbound traffic for an Amazon EC2 instance.
Which AWS service or feature can the company associate with the EC2 instance to meet this requirement?

• A. Network ACL
• B. Security group
• C. AWS WAF
• D. VPC route tables

Answer: B

Explanation:
A security group is a virtual firewall that can be associated with an Amazon EC2 instance to control the inbound and outbound traffic for the instance. You can specify which protocols, ports, and source or destination IP ranges are allowed or denied by the security group. A network ACL is a stateless filter that can be associated with a subnet to control the traffic to and from the subnet, but it is not associated with an EC2 instance4. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. VPC route tables are used to determine where network traffic is directed within a VPC or to an internet gateway, virtual private gateway, NAT device, VPC peering connection, or VPC endpoint.

NEW QUESTION 6

A company has deployed an Amazon EC2 instance.
Which option is an AWS responsibility under the AWS shared responsibility model?

• A. Managing and encrypting application data
• B. Installing updates and security patches of guest operating system
• C. Configuration of infrastructure devices
• D. Configuration of security groups on each instance

Answer: C

Explanation:
According to the AWS shared responsibility model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, such as data centers, hardware, software, networking, and facilities1. This includes the configuration of infrastructure devices, such as routers, switches, firewalls, and load balancers2. Customers are responsible for managing their data, applications, operating systems, security groups, and other aspects of their AWS environment1. Therefore, options A, B, and D are customer responsibilities, not AWS responsibilities. References: 1: AWS Well-Architected Framework - Elasticity; 2: Reactive Systems on AWS - Elastic

NEW QUESTION 7

Which AWS feature or resource is a deployable Amazon EC2 instance template that is prepackaged with
software and security requirements?

• A. Amazon Elastic Block Store (Amazon EBS) volume
• B. AWS CloudFormation template
• C. Amazon Elastic Block Store (Amazon EBS) snapshot
• D. Amazon Machine Image (AMI)

Answer: D

Explanation:
An Amazon Machine Image (AMI) is a deployable Amazon EC2 instance template that is prepackaged with software and security requirements. It provides the information required to launch an instance, which is a virtual server in the cloud. You can use an AMI to launch as many instances as you need. You can also create your own custom AMIs or use AMIs shared by other AWS users1.

NEW QUESTION 8

Which Amazon S3 storage class is the MOST cost-effective for long-term storage?

• A. S3 Glacier Deep Archive
• B. S3 Standard
• C. S3 Standard-Infrequent Access (S3 Standard-IA)
• D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

Answer: A

Explanation:
Amazon S3 Glacier Deep Archive is the lowest-cost storage class in the cloud. It is designed for long-term data archiving that is rarely accessed. It offers a retrieval time of 12 hours and a durability of 99.999999999% (11 9’s). It is ideal for data that must be retained for 7 years or longer to meet regulatory compliance requirements.

NEW QUESTION 9

What is a characteristic of Convertible Reserved Instances (RIs)?

• A. Users can exchange Convertible RIs for other Convertible RIs from a different instance family.
• B. Users can exchange Convertible RIs for other Convertible RIs in different AWS Regions.
• C. Users can sell and buy Convertible RIs on the AWS Marketplace.
• D. Users can shorten the term of their Convertible RIs by merging them with other Convertible RIs.

Answer: A

Explanation:
Convertible Reserved Instances (RIs) are a type of Reserved Instance that allow you to change the attributes of the RI as long as the exchange results in the creation of Reserved Instances of equal or greater value. You can exchange Convertible RIs for other Convertible RIs from a different instance family, size, platform, tenancy, or scope (Region or Availability Zone)3.

NEW QUESTION 10

Which AWS services make use of global edge locations'? (Select TWO.)

• A. AWS Fargate
• B. Amazon CloudFront
• C. AWS Global Accelerator
• D. AWS Wavelength
• E. Amazon VPC

Answer: BC

Explanation:
Amazon CloudFront and AWS Global Accelerator are two AWS services that make use of global edge locations. Edge locations are AWS sites that are deployed worldwide in major cities and places with a high population. Edge locations are used to cache data and reduce latency for end-user access1.
Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high
transfer speeds. Amazon CloudFront uses a global network of over 200 edge locations and 13 regional edge caches to cache your content closer to your viewers, improving performance and reducing costs23.
AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint based on health, performance, and policies. AWS Global Accelerator uses over 100 edge locations to bring your application endpoints closer to your users, reducing network hops and improving user experience45. References: 1: AWS for the Edge - Amazon Web Services
(AWS), 2: Content Delivery Network (CDN) - Amazon CloudFront - AWS, 3: Amazon CloudFront Documentation, 4: AWS Global Accelerator - Amazon Web Services, 5: AWS Global Accelerator Documentation

NEW QUESTION 11

Which of the following are advantages of the AWS Cloud? (Select TWO.)

• A. Trade variable expenses for capital expenses
• B. High economies of scale
• C. Launch globally in minutes
• D. Focus on managing hardware infrastructure
• E. Overprovision to ensure capacity

Answer: BC

Explanation:
The correct answers are B and C because they are advantages of the AWS Cloud. High economies of scale means that AWS can achieve lower variable costs than customers can get on their own. Launch globally in minutes means that AWS has a global infrastructure that allows customers to deploy their applications and data across multiple regions and availability zones. The other options are incorrect because they are not advantages of the AWS Cloud. Trade variable expenses for capital expenses means that customers have to invest heavily in data centers and servers before they know how they will use them. Focus on managing hardware infrastructure means that customers have to spend time and money on maintaining and upgrading their physical resources. Overprovision to ensure capacity means that customers have to pay for more resources than they actually need to avoid performance issues. Reference: What is Cloud Computing?

NEW QUESTION 12

Which of the following is a benefit of operating in the AWS Cloud?

• A. The ability to migrate on-premises network devices to the AWS Cloud
• B. The ability to expand compute, storage, and memory when needed
• C. The ability to host custom hardware in the AWS Cloud
• D. The ability to customize the underlying hypervisor layer for Amazon EC2

Answer: B

Explanation:
One of the benefits of operating in the AWS Cloud is the ability to expand compute, storage, and memory when needed, which enables users to scale their applications and resources up or down based on demand. This also helps users optimize their costs and performance. The ability to migrate on-premises network devices to the AWS Cloud, the ability to host custom hardware in the AWS Cloud, and the ability to customize the underlying hypervisor layer for Amazon EC2 are not benefits of operating in the AWS Cloud, as they are either not possible or not recommended by AWS .

NEW QUESTION 13

Which AWS service can defend against DDoS attacks?

• A. AWS Firewall Manager
• B. AWS Shield Standard
• C. AWS WAF
• D. Amazon Inspector

Answer: B

Explanation:
AWS Shield Standard is a service that provides protection against Distributed Denial of Service (DDoS) attacks for all AWS customers at no additional charge. It automatically detects and mitigates the most common and frequently occurring network and transport layer DDoS attacks that target AWS resources, such as Amazon EC2 instances, Elastic Load Balancers, Amazon CloudFront distributions, and Amazon Route 53 hosted zones. AWS Firewall Manager is a service that allows users to centrally configure and manage firewall rules across their AWS accounts and resources, such as AWS WAF web ACLs, AWS Shield Advanced protections, and Amazon VPC security groups. AWS WAF is a web application firewall that helps protect web applications from common web exploits, such as SQL injection, cross-site scripting, and bot attacks. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It analyzes the behavior of the applications and checks for vulnerabilities, exposures, and deviations from best practices.

NEW QUESTION 14

When designing AWS workloads to be operational even when there are component failures, what is an AWS best practice?

• A. Perform quarterly disaster recovery tests.
• B. Place the main component on the us-east-1 Region.
• C. Design for automatic failover to healthy resources.
• D. Design workloads to fit on a single Amazon EC2 instance.

Answer: C

Explanation:
Designing for automatic failover to healthy resources is an AWS best practice when designing AWS workloads to be operational even when there are component failures. This means that you should architect your system to handle the loss of one or more components without impacting the availability or performance of your application. You can use various AWS services and features to achieve this, such as Auto Scaling, Elastic Load Balancing, Amazon Route 53, Amazon CloudFormation, and AWS CloudFormation4.

NEW QUESTION 15

A company wants to set up a high-speed connection between its data center and its applications that run on AWS. The company must not transfer data over the internet.
Which action should the company take to meet these requirements?

• A. Transfer data to AWS by using AWS Snowball.
• B. Transfer data to AWS by using AWS Storage Gateway.
• C. Set up a VPN connection between the data center and an AWS Region.
• D. Set up an AWS Direct Connect connection between the company network and AWS.

Answer: D

Explanation:
AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from a customer’s premises to AWS. AWS Direct Connect does not involve the public internet, and therefore can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections. AWS Snowball is a petabyte-scale data transport service that uses secure devices to transfer large amounts of data into and out of the AWS Cloud. AWS Storage Gateway is a hybrid cloud storage service that gives customers on-premises access to virtually unlimited cloud storage. A VPN connection enables customers to establish a secure and private connection between their network and AWS.

NEW QUESTION 16

Which AWS services allow users to monitor and retain records of account activities that include governance, compliance, and auditing?
(Select TWO.)

• A. Amazon CloudWatch
• B. AWS CloudTrail
• C. Amazon GuardDuty
• D. AWS Shield
• E. AWS WAF

Answer: AB

Explanation:
Amazon CloudWatch and AWS CloudTrail are the AWS services that allow users to monitor and retain records of account activities that include governance, compliance, and auditing. Amazon CloudWatch is a service that collects and tracks metrics, collects and monitors log files, and sets alarms. AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. Amazon GuardDuty, AWS Shield, and AWS WAF are AWS services that provide security and protection for AWS resources, but they do not monitor and retain records of
account activities. These concepts are explained in the AWS Cloud Practitioner Essentials course3.

NEW QUESTION 17

A company needs a content delivery network that provides secure delivery of data, videos, applications, and APIs to users globally with low latency and high transfer speeds.
Which AWS service meets these requirements?

• A. Amazon CloudFront
• B. Elastic Load Balancing
• C. Amazon S3
• D. Amazon Elastic Transcoder

Answer: A

Explanation:
The correct answer is A because Amazon CloudFront is an AWS service that provides secure delivery of data, videos, applications, and APIs to users globally with low latency and high transfer speeds. Amazon CloudFront is a fast content delivery network (CDN) that integrates with other AWS services, such as Amazon S3, Amazon EC2, AWS Lambda, and AWS Shield. Amazon CloudFront delivers content through a worldwide network of edge locations that are located close to the end users. The other options are incorrect because they are not AWS services that provide secure delivery of data, videos, applications, and APIs to users globally with low latency and high transfer speeds. Elastic Load Balancing is an AWS service that distributes incoming traffic across multiple targets, such as Amazon EC2 instances, containers, and IP addresses. Amazon S3 is an AWS service that provides object storage for data of any size and type. Amazon Elastic Transcoder is an AWS service that converts media files from their original source format into different formats that will play on various devices. Reference: Amazon CloudFront FAQs

NEW QUESTION 18
......