You save $69.98
A manager asks for a framework principle covering confidentiality and access control of AWS resources.
Which AWS concept, service, or approach best meets the need described?
The security pillar focuses on protecting systems and data using appropriate identity and detection controls. For the described requirement, apply the security pillar to prioritize identity, detection and protection of information.
Selecting fit-for-purpose resources meets performance needs without automatically overprovisioning.
Sustainability encourages efficient resource usage and avoiding unnecessary capacity and processing.
Operational excellence emphasizes runbooks, feedback, monitoring and continually refining operational processes.
A security officer asks how to reduce the risk that a stolen password alone grants account access.
Which observation would best confirm that the intended cloud outcome is being achieved?
MFA adds a second authentication factor to protect against password-only compromise.
Role separation prevents business users from inheriting broad resource modification permissions.
Sign-in success is not sufficient; identity and resource policies and explicit denies influence authorization.
AWS managed policies are maintained by AWS; customer managed policies are created and governed by the customer.
An engineering lead wants to stop placing long-lived IAM access keys on compute instances.
Which AWS concept, service, or approach best meets the need described?
IAM roles supply temporary credentials for authorized workloads and avoid hard-coded long-term keys. For the described requirement, attach a suitable IAM role to the workload for temporary credentials.
Unused permanent keys expand the credential attack surface without supporting an active business function.
IAM policies express permitted actions on supported resources; broad wildcard privileges are usually unnecessary.
IAM user groups let administrators attach permissions once for a collection of users.
An alerting app wants independent email and service consumers to receive a published event.
Which observation would best confirm that the intended cloud outcome is being achieved?
SNS can distribute published messages to configured endpoints and subscribers.
Amazon SES supports sending emails and is distinct from contact-center voice workflows.
IoT Core supports communication between approved devices and cloud services.
EventBridge routes matching events from supported sources to configured destinations.
A media startup plans to serve a new overseas audience within weeks and cannot obtain local server space.
Which observation would best confirm that the intended cloud outcome is being achieved?
AWS global infrastructure enables geographic reach and faster regional market entry while the business remains responsible for its application.
AWS supplies resilient infrastructure options but application architecture and chosen deployment patterns still affect availability.
Metered cloud consumption lowers initial capital outlay and supports experiments with uncertain future demand.
Elasticity aligns provisioned resources with current need instead of maintaining permanent peak-sized local capacity.
A local retailer wants its shopping application available to customers on several continents without building new data centers.
Which observation would best confirm that the intended cloud outcome is being achieved?
AWS global infrastructure enables geographic reach and faster regional market entry while the business remains responsible for its application.
Elasticity aligns provisioned resources with current need instead of maintaining permanent peak-sized local capacity.
Metered cloud consumption lowers initial capital outlay and supports experiments with uncertain future demand.
Regional AWS infrastructure lets customers choose appropriate geographic placement subject to service availability and compliance.
A small company needs virtual machines for a three-week experiment with uncertain future demand.
Which AWS pricing, billing, or support approach best matches the requirement?
On-Demand billing allows eligible EC2 capacity without an upfront duration commitment, though its unit price may be higher. For the described requirement, choose On-Demand EC2 pricing when flexibility matters more than a long-term commitment.
Lower storage rates can involve retrieval fees, time delays or duration requirements depending on class.
Capacity Reservations address eligible instance-capacity availability rather than inherently reducing the cost of the instances.
Data leaving AWS can incur transfer charges based on service and path, while ordinary ingress pricing often differs.
A legal department asks how a global provider can support a defined geographic deployment constraint.
Which observation would best confirm that the intended cloud outcome is being achieved?
Choosing Region determines the geographic location of many deployed resources and data residency choices.
Multiple instances sharing one AZ remain exposed to an AZ-wide event despite instance-level redundancy.
Using different AWS Regions can reduce dependence on one geographic Region when application design supports recovery.
Edge locations serve nearby delivery needs; Availability Zones host fault-isolated regional workloads.
A company uses DynamoDB and asks who classifies its application data before deciding access policies.
Which AWS concept, service, or approach best meets the need described?
Managed database services reduce infrastructure work but do not determine the business sensitivity of stored records. For the described requirement, keep data classification and access authorization decisions with the customer for managed databases.
AWS secures the service infrastructure while customers control authorization and exposure of their S3 objects.
Customer OS patching is greater for EC2 than Lambda, while code and data responsibilities remain with the customer.
RDS reduces customer responsibility for host and engine administration compared with hosting a database directly on EC2.
A compliance reviewer wants a list of affected compute resources and relevant package vulnerabilities.
Which observation would best confirm that the intended cloud outcome is being achieved?
Inspector analyzes supported workloads for exposure and software vulnerabilities, not user login events.
Protective filters block matching traffic; detection services report suspicious activity for investigation.
Firewall Manager supports organization-level security-policy management for selected AWS protection services.
Trusted Advisor evaluates selected account checks and is not the same as a complete security audit.
A business needs different permissions for analysts and account administrators.
Which AWS concept, service, or approach best meets the need described?
Role separation prevents business users from inheriting broad resource modification permissions. For the described requirement, use separate least-privilege IAM roles tailored to distinct job duties.
STS role assumption permits controlled cross-account access without sharing long-lived access keys.
IAM user groups let administrators attach permissions once for a collection of users.
MFA adds a second authentication factor to protect against password-only compromise.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
