AWS CCP (CLF-C02) Practice Test.

Answer: A
Trading capital expense (CapEx) for variable/operational expense is a core cloud value proposition: instead of buying hardware up front, you pay only for consumption. B is wrong because cloud reduces fixed costs rather than increasing them. C is wrong because you still pay operating costs for what you use. D describes a traditional on-premises commitment, the opposite of the pay-as-you-go model.

Answer: A
Because AWS aggregates demand from hundreds of thousands of customers, it achieves higher purchasing power and lower per-unit costs, which it can pass on as lower prices. B is wrong because customers benefit from AWS's aggregate scale, not individual negotiation. C is wrong because economies of scale apply broadly across services. D is wrong because a single organization rarely matches hyperscaler purchasing power.

Answer: A
Operational Excellence is one of the pillars of the AWS Well-Architected Framework (alongside Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability). B, C, and D are not pillars; vendor lock-in and capital expenditure are concerns the cloud helps reduce, and physical security is part of AWS's responsibility rather than a design pillar.

Answer: A
The AWS Cloud Adoption Framework organizes migration guidance into perspectives spanning business, people, governance, platform, security, and operations. B is a service that inspects deployed resources for best practices, not a migration-readiness framework. C analyzes historical spend, and D monitors resource metrics; neither structures organizational cloud adoption.

Answer: A
Elasticity is the ability to scale resources up and down automatically to match demand, avoiding over-provisioning. B (colocation) refers to housing hardware in a shared facility, an on-premises concept. C (depreciation) is an accounting treatment of owned assets. D (data residency) concerns where data is physically stored, not scaling.

Answer: A
Rightsizing means matching instance type and size to actual utilization, often downsizing over-provisioned resources to cut cost without hurting performance. B increases waste rather than reducing it. C removes visibility you need to rightsize. D is unrelated to optimizing existing cloud resources.

Answer: A
AWS is responsible for security 'of' the cloud, which includes physical data center security, hardware, and the global infrastructure. B, C, and D are all 'in the cloud' responsibilities that belong to the customer: configuring firewalls, managing identities, and protecting their own data.

Answer: A
IAM lets you create users, groups, and roles and attach policies that grant only the permissions needed, supporting least privilege. B is a DNS service, C is a data-transfer appliance, and D is a streaming-data service; none manage access permissions.

Answer: A
MFA adds a second factor so a stolen password alone is not enough to sign in, which is strongly recommended for the highly privileged root user. B increases exposure, C violates the guidance to avoid daily root use, and D removes an audit trail rather than improving authentication security.

Answer: A
CloudTrail records account activity and API calls, providing an audit trail of user and service actions. B is a content delivery network, C is a serverless compute service, and D is block storage; none provide the account-wide API auditing that CloudTrail does.

Answer: A
AWS Artifact is the self-service portal for on-demand access to AWS compliance reports and agreements such as SOC and ISO. B tracks resource configuration changes, C assesses workloads for vulnerabilities, and D provides DDoS protection; none deliver downloadable compliance documentation.

Answer: A
AWS Shield provides managed protection against DDoS attacks. B stores and rotates secrets, C discovers and protects sensitive data in S3, and D manages encryption keys; none are purpose-built DDoS mitigation services.

Answer: A
Amazon Macie uses machine learning to discover, classify, and protect sensitive data like PII in S3. B manages user sign-up and sign-in for apps, C provides a dedicated network connection, and D is a business-intelligence dashboard service; none perform sensitive-data discovery.

Answer: A
AWS Secrets Manager securely stores secrets such as database credentials and can rotate them automatically, removing the need to hardcode them. B collects log data, C is a data-integration/ETL service, and D queries data in S3 with SQL; none manage secret rotation.

Answer: A
Data protection is a customer responsibility; customers decide encryption settings and can use AWS KMS to manage keys. B is false and dangerous, C is false because S3 supports server-side encryption, and D is false because customer-managed keys are supported in KMS.

Answer: A
AWS Organizations lets you group accounts and apply service control policies (SCPs) as guardrails across the organization, plus consolidate billing. B routes events, C orchestrates workflows, and D is a natural-language-processing service; none provide multi-account governance.

Answer: A
Amazon EC2 provides resizable virtual servers where you control the OS and installed software, ideal for long-running, customizable workloads. B is serverless and abstracts the OS with short execution limits, C is object storage, and D is DNS; none provide managed virtual machines.

Answer: A
AWS Lambda is a serverless compute service that runs code in response to events and bills only for execution time, with no servers to manage. B requires managing EC2 instances, C is a managed relational database, and D is a networking connection; none are event-driven serverless compute.

Answer: A
Amazon S3 is object storage built for scalable storage and retrieval of objects over the web. B is block storage attached to a single EC2 instance, C is compute, and D is a virtual network; none are internet-scale object stores.

Answer: A
Amazon RDS is a managed relational database service that handles patching, backups, and OS maintenance for engines like MySQL and PostgreSQL. B is a NoSQL key-value database, C is a data warehouse for analytics, and D is archival storage; none are managed relational transactional databases in this scenario.

Answer: A
Amazon DynamoDB is a fully managed, serverless NoSQL database offering consistent low-latency performance at scale. B (Aurora) is a relational database, C (EMR) is a big-data processing platform, and D (Fargate) is a serverless container compute engine; none are NoSQL key-value databases.

Answer: A
Amazon CloudFront is a CDN that caches content at global edge locations to lower latency for end users. B is a message queue, C provisions infrastructure as code, and D deploys and manages applications; none are content delivery networks.

Answer: A
Availability Zones are isolated locations within a Region; spreading resources across multiple AZs protects against the failure of any one AZ. B creates a single point of failure, C confuses AZs with Regions, and D confuses edge locations (used by CDNs) with compute high availability.

Answer: A
Amazon VPC provides a logically isolated virtual network where you control IP ranges, subnets, route tables, and gateways. B monitors metrics and logs, C gives best-practice recommendations, and D publishes notifications; none define an isolated network.

Answer: A
Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, handling provisioning, load balancing, scaling, and monitoring while you retain control of the underlying resources. B is a graph database, C is an ETL service, and D delivers streaming data; none are application deployment platforms.

Answer: A
AWS Fargate is a serverless compute engine for containers that removes the need to provision and manage servers. B offers simplified virtual private servers, C is a discounted way to buy EC2 capacity you still manage, and D brings AWS infrastructure on-premises; none are serverless container runtimes.

Answer: A
AWS Trusted Advisor inspects your account and gives recommendations across categories such as cost optimization, security, performance, fault tolerance, and service limits. B is a threat-detection service, C automates data transfer, and D is a managed message broker; none deliver broad best-practice advisory checks.

Answer: A
Consolidated billing combines usage from all member accounts into one bill and can unlock volume pricing tiers because usage is aggregated. B is false, C is false because compute is never unlimited or free, and D is false because each account still requires its own security configuration.

Answer: A
AWS Cost Explorer provides an interface to visualize, understand, and forecast AWS costs and usage over time. B logs API activity, C assesses security vulnerabilities, and D tracks configuration changes; none are cost-analysis tools.

Answer: A
AWS Budgets lets you set custom cost or usage thresholds and receive alerts when actual or forecasted spend exceeds them. B estimates costs for planning before deployment, C is a managed search service, and D improves network performance; none send spend-threshold alerts.

Answer: A
For steady, predictable, long-running workloads, committing to Reserved Instances or Savings Plans yields significant discounts versus On-Demand. B is flexible but the most expensive per hour for steady use, C risks interruption and is unsuitable for always-on databases, and D without commitment does not maximize savings for this pattern.

Answer: A
A designated Technical Account Manager is a feature of Enterprise Support, not Business Support, which is a key differentiator. B is false because Business Support includes 24x7 technical support, C is false because paid plans allow technical cases, and D is false because Business Support is intended for production workloads.

Answer: C
Rehosting, commonly called lift and shift, moves servers to AWS essentially as they are, which is why it is the fastest strategy and the one that fits a hard data center exit date. Refactor is the tempting alternative because it produces the most cloud-native result, but re-architecting an application to use managed and serverless components is the slowest of the strategies and cannot realistically be completed in four months alongside a physical exit. Retire applies only to workloads being switched off entirely, which is not the case for an inventory system still in use.

Answer: B
Repurchase means abandoning the current product and buying a different one, typically a subscription offering, instead of migrating the existing installation. Replatform is the distractor most candidates pick, but replatforming keeps the same application and merely swaps components underneath it, such as moving its database to a managed service; here the application itself is replaced by a different vendor product. Retain describes deliberately leaving a workload where it is, which contradicts the decision to shut the servers down.

Answer: B
Replatform, sometimes described as lift and reshape, keeps the application substantially intact while swapping one or more underlying components for a cloud-managed equivalent. Rehost is the strongest distractor because no application code changed, but rehosting implies the stack moves as-is, including the self-managed database engine; substituting a managed database service is precisely the targeted optimization that separates replatform from rehost. Refactor is wrong because refactoring means the application itself is redesigned, which did not happen here.

Answer: B
Horizontal scaling adds more instances of the same component and spreads load across them, which raises capacity and removes the single point of failure at the same time. Vertical scaling is the tempting choice because it also increases capacity, but it does so by making one machine bigger, which leaves that machine as a single point of failure and eventually hits a hardware ceiling. Rightsizing is a separate cost practice concerned with matching resource size to actual utilization, not with adding redundancy.

Answer: C
High availability means a system continues operating with minimal downtime and recovers quickly from component failure, which matches a short error spike followed by normal service. Fault tolerance is the distractor worth understanding: a fault-tolerant design absorbs the failure with no interruption visible to users at all, and the observed error spike proves that bar was not met. Durability concerns whether stored data survives, which the scenario never tests, and elasticity concerns matching capacity to demand rather than surviving a zone outage.

Answer: A
Performance Efficiency is the pillar concerned with using computing resources efficiently and continuing to do so as demand changes and new technologies become available, which is exactly what stale instance selection violates. Cost Optimization is the strongest distractor because outdated instances usually cost more than necessary, and the two pillars genuinely overlap here; the deciding factor is that the question asks about efficient use of resources and adoption of newer technology, which is the defining concern of Performance Efficiency, while Cost Optimization focuses on eliminating unneeded spend and selecting the right pricing model.

Answer: A
Sustainability is the pillar that addresses the environmental impact of running cloud workloads, including maximizing utilization so that fewer resources are provisioned for the same result. Cost Optimization is the natural distractor because raising utilization also lowers the bill, and the practices frequently coincide; the distinction is the stated goal, since Cost Optimization exists to reduce spend while Sustainability exists to reduce environmental impact, and a change can advance one without advancing the other.

Answer: D
Operational Excellence covers running and monitoring systems to deliver business value and continually improving processes and procedures, which is precisely what runbooks, deployment standards, and post-incident refinement describe. Reliability is the distractor to rule out carefully: it also touches on recovery and change management, but its subject is whether the workload performs its intended function correctly and recovers from failure, not whether the team's operating procedures mature over time.

Answer: A
Reliability is the pillar concerned with a workload performing its intended function correctly and consistently, including recovering automatically from failure, testing recovery procedures, and managing quotas so that scaling is not blocked. Operational Excellence is the hardest distractor because it also deals with procedures and testing, but its focus is the effectiveness of the team's operating practices and continuous improvement, whereas Reliability asks whether the workload itself withstands and recovers from disruption.

Answer: A
Running and maintaining physical data center facilities, including power, cooling, and floor space, is absorbed by AWS and stops being a line item for the customer. Third-party software licensing is the most tempting wrong answer because migration feels like it should simplify licensing, but commercial software still has to be licensed whether it runs in a data center or on an EC2 instance, either by bringing existing licenses or by paying a license-included rate. Guest operating system administration also remains a customer responsibility on services such as EC2.

Answer: B
Bring Your Own License lets a customer apply licenses it already owns to workloads running on AWS, avoiding a second payment for software rights it has already purchased. License-included pricing is the direct opposite and the obvious trap: with license-included the vendor license is bundled into the hourly rate, which is exactly the arrangement the company is trying to avoid. Dedicated Instance pricing concerns tenancy of the underlying hardware rather than how software rights are acquired, although dedicated tenancy is sometimes required to satisfy license terms.

Answer: D
Agility is the advantage that describes how quickly an organization can obtain resources and how cheap it becomes to try something and discard it, which is exactly the behavior described. Economies of scale is the most frequently chosen wrong answer because it is also a headline cloud benefit, but it explains why the unit price of cloud resources is low across a large provider's customer base, not why a team can stand up and tear down an environment within a single day. Durability and fault tolerance describe data and failure behavior, neither of which the scenario touches.

Answer: C
Not having to guess capacity is the benefit that directly answers over-provisioning for a forecast peak: resources are provisioned against current demand and changed as demand changes, so idle hardware is not paid for all year. Option D is the trap, because it states the correct concept backwards; the cloud replaces capital expense with variable expense, not the other way around, and candidates who recognize the phrase without reading the direction often select it. Global reach is a real benefit but addresses geographic expansion rather than sizing against a demand forecast.

Answer: B
Deploying into additional Regions in minutes is the benefit that removes the need to lease facilities or ship hardware in order to serve a new geography. Load balancing across Availability Zones is the strongest distractor because it also sounds like a way to reach more users, but Availability Zones sit inside a single Region and therefore do nothing to place capacity on another continent. Consolidated billing and the shared responsibility model are real AWS concepts but neither addresses geographic expansion.

Answer: C
AWS operates the hardware, facilities, and virtualization layer, so work that produces no competitive differentiation for the customer is absorbed by the provider and the engineering team is freed for product work. Option B is the distractor a partially informed candidate picks because customers really do patch something, but what they patch is the guest operating system on services such as EC2; the hypervisor and everything below it belong to AWS. Option D is simply untrue, since usage-based pricing means the bill varies with consumption.

Answer: D
The Governance perspective is concerned with orchestrating cloud initiatives while managing risk, controlling spend, and maintaining compliance oversight, which is what unassigned budget ownership and unclear risk approval represent. The People perspective is the most attractive alternative because the problem manifests as confusion among staff, but People addresses culture, skills, and organizational change rather than the decision rights and financial controls being described. Platform concerns building the technical environment and Operations concerns running it once built.

Answer: A
The People perspective bridges technology and business by addressing culture, organizational structure, leadership, and workforce skills, which is exactly where a missing reskilling plan belongs. Business is the tempting alternative because training budgets are a business decision, but the Business perspective is about ensuring cloud investment accelerates business outcomes and aligns strategy, not about developing staff capability. Platform is concerned with building and modernizing the technical environment itself.

Answer: B
A hybrid deployment connects resources that remain in an organization's own facility with resources running in the cloud, which is exactly the arrangement described. A fully cloud-based deployment is the distractor to reject because it requires that all parts of the application run in the cloud, and here the records system deliberately stays on local servers. Multi-tenant describes how a provider shares underlying infrastructure among customers and is not one of the deployment models this question is asking about.

Answer: C
Platform as a service supplies the runtime environment and the operational plumbing beneath an application so the customer supplies only code and configuration. Infrastructure as a service is the classic wrong answer here because compute, storage, and networking are clearly involved, but with infrastructure as a service the customer chooses the instance, selects and patches the operating system, and configures the load balancer itself, none of which this team does. Software as a service would mean consuming a finished application, whereas this team is still writing and deploying its own.

Answer: D
Availability improves when the workload keeps serving traffic after a component or facility fails, and running instances in a second Availability Zone removes the dependency on any one facility. More frequent backups is the tempting answer because it feels like a resilience measure, but backups only shorten how much data is lost and how long recovery takes after an outage has already interrupted service; they do not keep the application serving requests. A larger server adds capacity while leaving the same single point of failure in place.

Answer: C
Designing for failure means assuming individual components will fail and building the system so that those failures are contained rather than cascading into a full outage. Option A is the most plausible wrong answer, because buying more reliable parts is the traditional way to raise availability; the maxim's whole point is that at cloud scale no component is reliable enough to depend on individually, so resilience must come from redundancy and isolation rather than from component quality. Option D fails for the same underlying reason, since the customer does not own the hardware and cannot rely on a vendor repair timeline.

Answer: B
A total cost of ownership comparison has to include everything required to keep on-premises servers running, which means the facility, its power and cooling, the refresh cycle when the hardware ages out, and the staff hours spent operating it. Option A is the most seductive because data transfer is a real and often surprising cloud cost, but treating it as the dominant component of cloud spend overstates it for most workloads and, more importantly, it does not fix the flaw described, which is on the on-premises side of the model.

Answer: D
The framework is organized around business outcomes such as reducing business risk, improving environmental, social, and governance performance, increasing revenue, and increasing operational efficiency. Option B is the trap for candidates who associate the framework's Governance and Security perspectives with compliance: the framework helps an organization build the capability to meet its obligations, but no framework and no provider makes a customer automatically compliant with regulations, because compliance depends on how the customer configures and operates its own workloads.

Answer: C
AWS WAF is a web application firewall that inspects incoming HTTP and HTTPS requests and blocks those matching rules for common exploits such as SQL injection and cross-site scripting. AWS Shield Standard is the tempting alternative because it is also a protective service sitting in front of the application, but Shield defends against volumetric denial-of-service attacks that try to exhaust capacity, not against malicious content inside individual well-formed requests. GuardDuty detects suspicious activity after the fact rather than blocking requests inline.

Answer: B
Security groups are stateful: when a request is allowed inbound, the corresponding response is allowed out regardless of the outbound rules. Option A describes network ACLs, which is the classic confusion on this topic, because ACLs are stateless, are evaluated as an ordered list of numbered rules, apply at the subnet boundary, and do require an explicit rule for return traffic. Option D is likewise a network ACL property rather than a security group property, since security groups attach to instances and network interfaces.

Answer: D
An IAM role attached to an instance supplies temporary, automatically rotated credentials that never have to be written to disk, which removes the long-lived secret from the picture entirely. Option C is the most defensible-sounding wrong answer because manual rotation is genuinely better than never rotating, but the key still exists in a readable location between rotations, so anyone who obtains the instance image, a backup, or the configuration file gets working credentials. Option A merely changes where the same durable secret is stored.

Answer: B
AWS IAM Identity Center provides centralized workforce single sign-on across multiple AWS accounts and business applications, and it can connect to an existing corporate identity source. Amazon Cognito is the distractor that catches candidates who know it handles sign-in, but Cognito is built for the end users of a customer-facing application rather than for employees who need access to AWS accounts. AWS Resource Access Manager shares resources between accounts and does not authenticate people at all.

Answer: C
Amazon Cognito manages sign-up, sign-in, and access control for the users of web and mobile applications, including federation with social identity providers. AWS Identity and Access Management is the answer most candidates reach for first, but IAM governs who may call AWS APIs and administer AWS resources; it is not intended to hold the account records of an application's consumer user base, which can number in the millions. AWS Directory Service provides managed enterprise directories for corporate users rather than application consumers.

Answer: A
AWS Key Management Service creates and manages cryptographic keys, controls their use through key policies and IAM, and integrates with a wide range of AWS services that encrypt data at rest. AWS Secrets Manager is the frequent mix-up because both services protect sensitive material, but Secrets Manager stores and rotates credentials such as database passwords and API keys, whereas KMS manages the encryption keys themselves. AWS Certificate Manager handles TLS certificates for securing traffic rather than keys for encrypting stored data.

Answer: D
AWS CloudHSM provides hardware security modules dedicated to a single customer, giving that customer exclusive control of the modules and the key material inside them. Option A is the hardest distractor because a customer managed key in KMS is genuinely created and controlled by the customer, and for most workloads it is the right answer; what it does not provide is a single-tenant appliance, since KMS is a shared managed service. When a regulator specifically demands dedicated single-tenant hardware, CloudHSM is the offering that meets the wording.

Answer: B
Amazon GuardDuty is a continuous threat detection service that analyzes account and network activity data to identify likely malicious or unauthorized behavior. AWS Config is the strongest distractor because it also runs continuously and reports problems, but Config evaluates whether resource configurations comply with rules, which is a very different question from whether an attacker is currently active. Trusted Advisor performs periodic best-practice checks, and Audit Manager gathers evidence for audits rather than detecting live threats.

Answer: D
Amazon Inspector performs automated vulnerability management, continually scanning workloads such as EC2 instances, container images, and functions for known software vulnerabilities and unintended network exposure. AWS Security Hub is the tempting answer because vulnerability findings do appear in its console, but Security Hub aggregates and prioritizes findings that other services produce rather than performing the scan itself. Amazon Macie is scoped to discovering sensitive data in storage, not to software vulnerabilities.

Answer: D
AWS Config records the configuration of resources over time and evaluates them against rules, so it can show both the current compliance state and the historical timeline of when a resource drifted and when it was remediated. Amazon CloudWatch is the common wrong choice because it also collects data continuously, but CloudWatch records operational metrics and logs describing how resources are performing, not the configuration settings of the resources themselves. AWS Artifact supplies AWS compliance reports, not a customer's own resource history.

Answer: B
AWS Security Hub aggregates, normalizes, and prioritizes security findings from AWS services and partner products across accounts, and runs automated checks against security standards. Amazon GuardDuty is the distractor for candidates who remember it as the security service that produces findings, and it does, but it is one of the sources that feeds Security Hub rather than the aggregation layer. AWS Firewall Manager centrally administers firewall policies and does not consolidate findings.

Answer: D
AWS Certificate Manager provisions, stores, and renews SSL/TLS certificates and deploys them on integrated services such as load balancers and content delivery distributions, which is what removes the expiry risk. AWS Key Management Service is the usual wrong pick because both services involve cryptography, but KMS manages keys used to encrypt data at rest and does not issue or renew the certificates that identify a website to browsers. Secrets Manager stores credentials rather than certificates.

Answer: A
On EC2 the customer controls the guest operating system, which makes patching, configuration, and updates a customer responsibility. Option B is the most-selected wrong answer because the phrase security of the cloud is genuinely an AWS responsibility, but that phrase covers the facilities, hardware, network, and virtualization layer beneath the instance, whereas anything the customer installs and runs inside the instance is security in the cloud and belongs to the customer. Option C confuses ownership of hardware with responsibility for software running on it.

Answer: C
Responsibility shifts with the service model: a database the customer installs on EC2 leaves operating system and engine patching with the customer, while a managed relational database service takes over patching of the underlying operating system and database engine. Option A is the trap, because owning the data is true in both cases and candidates over-extend that to patching; data ownership and software maintenance are separate responsibilities. Option D simply reverses the correct allocation.

Answer: B
Encryption at rest protects data written to disk or object storage, and encryption in transit, normally implemented with TLS, protects data moving across a network. Option D is the most credible distractor because versioning and security groups are both real protective controls, but versioning guards against accidental overwrite and deletion rather than unauthorized reading of stored data, and a security group restricts which sources may connect without encrypting the traffic that is allowed through.

Answer: D
A small set of tasks is reserved for the account root user regardless of how broad an IAM identity's permissions are, and closing the AWS account is one of them. Option A is the plausible-sounding trap for candidates who know service control policies can restrict what member accounts do; a service control policy can only limit permissions, never grant a capability that is reserved to the root user in the first place. Option B inverts good practice, since disabling multi-factor authentication would weaken the account rather than unlock an action.

Answer: A
IAM evaluates all applicable policies together, and an explicit deny in any of them overrides an allow anywhere else, so the delete is refused. Option B is the most common misconception, since candidates assume a precedence order between group-attached and user-attached policies; in fact there is no such hierarchy, because all policies that apply to the identity are combined before evaluation. Option D is wrong because conflicting statements are a normal, well-defined situation in IAM rather than an error condition.

Answer: C
Attaching policies to groups that correspond to job functions means a permission change is made once and inherited by every member, which is the standard remedy for per-identity policy sprawl. Option B is the tempting shortcut because it genuinely would reduce editing work, but granting everyone broad permissions abandons least privilege and creates a far larger problem than the one being solved. Option D is the subtlest wrong answer because roles are a legitimate and often preferable construct, but giving every person a role of their own reproduces exactly the per-identity sprawl described, since there are still forty separate permission sets to edit whenever a job function changes. Option A destroys individual accountability, because actions recorded in audit logs could no longer be traced to a specific person.

Answer: D
AWS Shield Advanced builds on the protection every customer receives by adding enhanced detection, access to a specialized response team during an event, and protection against charges arising from scaling under attack. Option A is the closest alternative and genuinely helps absorb application-layer floods, but rate-based rules provide no expert engagement during an incident and no relief from the resulting bill. Adding an Availability Zone improves resilience to facility failure, which is a different problem from a deliberate attack.

Answer: B
AWS Firewall Manager centrally defines firewall policies and applies them across accounts and resources in an organization, including newly created resources, which is precisely the enforcement gap described. AWS Config is the strongest distractor because it can detect a resource that lacks the required protection and even trigger remediation, but its native role is to evaluate and report compliance rather than to own and push the firewall policy itself. Security Hub reports findings and applies no protection.

Answer: D
AWS Audit Manager continually collects evidence from a customer's AWS usage and organizes it against the controls of common frameworks, which replaces the manual evidence-gathering described. AWS Artifact is the near-miss that trips up many candidates, because it also relates to audits, but Artifact delivers AWS's own compliance reports and agreements covering AWS infrastructure, not evidence about how the customer configured and operated its own workloads. CloudTrail supplies raw API history without mapping it to any framework.

Answer: B
Block Public Access settings act as an override at the account and bucket level, so a policy or access control list that would otherwise grant public access has no effect. Option A is the most frequently chosen wrong answer because encryption feels like the general-purpose data protection control, but server-side encryption protects data at rest against access to the underlying storage; it does not stop an authorized-looking public request from retrieving and automatically decrypting the object. Versioning likewise protects against deletion, not exposure.

Answer: D
AWS CloudTrail records the API activity in an account, capturing which identity made a call, when, and from where, which is exactly what an attribution question requires. Amazon CloudWatch is the colleague's suggestion and the main distractor: CloudWatch collects metrics and logs describing how resources behave, so it can show that the load balancer stopped reporting, but it does not record who issued the delete call. AWS Config would show that the resource disappeared without serving as the authoritative record of the API call itself.

Answer: B
Amazon Detective analyzes and visualizes security data so responders can investigate the context around a finding and determine root cause. Amazon Macie is the plausible alternative for candidates who associate it with security analysis, but Macie is scoped to discovering and classifying sensitive data in storage and produces no investigative graph of activity. Firewall Manager administers protective policies and plays no part in analyzing an incident that has already occurred.

Answer: A
AWS Marketplace is the curated store where customers find, subscribe to, and deploy third-party software, with charges consolidated onto the AWS bill. AWS Service Catalog is the closest distractor because it also presents a catalog of products for users to launch, but the products in it are templates an organization has created and approved for its own internal use, not commercial offerings from outside vendors. AWS Artifact distributes compliance documentation and sells nothing.

Answer: D
Least privilege means granting exactly the permissions required for the task at hand and adding more only when a genuine need is demonstrated. Option C is the most sophisticated distractor because reviewing actual usage to refine permissions is a real and recommended technique; the flaw is the sequencing, since starting broad means excess access exists during the entire review window. Option B fails because full control includes writing and deleting, neither of which the stated task requires.

Answer: C
Session Manager, a capability of AWS Systems Manager, provides managed shell access to instances without inbound ports, key pairs, or jump servers, and it records session activity centrally. Option A is the traditional answer and is what many organizations actually run, which makes it the strongest distractor, but a jump server is exactly the maintained infrastructure the requirement rules out and it still needs an open inbound port. Option B provides private network connectivity but does nothing about ports, keys, or session auditing.

Answer: B
Instance store provides temporary block storage on disks physically attached to the host, and its contents are lost when the instance is stopped or terminated, which makes it suitable only for caches, buffers, and scratch data. The reason this catches people is the contrast with Elastic Block Store, whose volumes live independently of any one host and retain data across stop and start cycles; a team that assumes all attached block storage behaves the same way will lose data exactly as described. Option D is wrong because instance store cannot be moved between instances.

Answer: D
Amazon Elastic File System provides a managed shared file system that many Linux instances can mount concurrently, with capacity that grows and shrinks automatically as files are added and removed. Amazon Elastic Block Store is the answer candidates most often give because it is the default storage for instances, but an EBS volume is block storage attached to a single instance at a time and does not give a whole fleet simultaneous read-write access through a file system interface. Glacier is archival object storage and offers no file system at all.

Answer: A
S3 Glacier Deep Archive is designed for long-lived data that is accessed very rarely and where a retrieval time measured in hours is acceptable, which is exactly the profile of a seven-year retention archive. S3 Standard-Infrequent Access is the closest competitor and is genuinely cheaper to store than S3 Standard, but it is built for data that must come back within milliseconds, so it carries a higher storage price than the deep archive tier and gives up savings the firm does not need to give up.

Answer: C
S3 Intelligent-Tiering exists for precisely this case: it monitors access patterns and shifts each object between tiers automatically, so unpredictable data gets appropriate pricing without manual analysis. Option B is the most tempting because it does cut cost right away, but One Zone-Infrequent Access assumes the data really is infrequently accessed and stores only one copy in a single Availability Zone, so datasets that turn out to be queried daily would incur retrieval charges and carry lower resilience than the group expects.

Answer: B
A lifecycle configuration defines rules that transition objects to another storage class or expire them once they reach a specified age, and Amazon S3 applies those rules without any external automation. Option D is the trap for candidates who know bucket policies control what happens to objects, but a bucket policy is an access control document that decides who may perform which actions; it has no ability to move or delete objects on a schedule. Versioning retains previous copies and increases storage rather than reducing it.

Answer: D
Amazon FSx for Windows File Server provides fully managed shared file storage built on Windows Server, exposed over SMB and integrated with Active Directory, which is what a lifted-and-shifted Windows application expects. Amazon Elastic File System is the strongest distractor because it is also managed shared file storage, but EFS presents an NFS file system aimed at Linux workloads and does not offer the SMB and Active Directory integration this application depends on.

Answer: B
Amazon Aurora is a relational database engine compatible with MySQL and PostgreSQL that was built for the cloud to improve on the performance and availability of the standard community editions. Amazon Redshift is the distractor that catches candidates who remember it is relational and uses SQL, but Redshift is a data warehouse optimized for analytical queries across very large datasets, not a transactional database that an existing MySQL or PostgreSQL application can point at. DocumentDB and Neptune are non-relational, serving document and graph workloads respectively.

Answer: A
Amazon Redshift is a data warehouse built to run complex analytical queries across very large volumes of structured data, which separates reporting work from the transactional system entirely. Amazon Aurora is the tempting alternative because it is a high-performance relational database and could technically execute the queries, but it is optimized for transactional processing of many small operations rather than for scanning billions of rows per report, so the underlying contention problem would follow the workload. DynamoDB is a key-value store and is not intended for ad hoc analytical aggregation.

Answer: B
Amazon ElastiCache provides a managed in-memory data store, so results of repeated expensive queries can be served from memory instead of hitting the database on every request. Amazon Redshift is the plausible wrong answer for candidates who think of it as the service that makes queries fast, but Redshift accelerates large analytical scans by using a different storage and execution model; it does not sit in front of a transactional database absorbing repeated identical reads, and pointing a catalog page at it would not solve the bottleneck.

Answer: D
AWS Schema Conversion Tool translates schema objects and procedural code between different database engines, and AWS Database Migration Service copies the data while the source database remains operational, which together handle a change of engine. Option B is the most credible distractor because AWS Glue really does maintain a data catalog and transform data; its role is analytics-oriented extract, transform, and load work rather than converting a commercial engine's stored procedures for a new target engine.

Answer: A
Amazon Route 53 is the managed Domain Name System service, and it also registers domains, performs health checks, and applies routing policies that steer requests based on criteria such as latency or geography. Amazon CloudFront is the frequent mix-up because it also improves the experience for globally distributed users, but CloudFront is a content delivery network that caches and serves content at edge locations; it does not resolve domain names or manage DNS records, and a CloudFront distribution still needs a DNS entry pointing to it.

Answer: C
Elastic Load Balancing distributes incoming traffic across multiple targets in one or more Availability Zones and stops routing to targets that fail health checks. AWS Auto Scaling is the closest distractor because the two are almost always deployed together and Auto Scaling can also replace an unhealthy instance, but Auto Scaling decides how many instances exist, whereas the load balancer decides which existing instance receives each request. A design with Auto Scaling and no load balancer would have no mechanism to spread inbound requests.

Answer: B
EC2 Auto Scaling adds instances when demand rises and removes them when it falls, which resolves the surge failure and the overnight waste with a single mechanism. Option A is the trap for candidates who conflate purchasing options with capacity management: buying reserved capacity for the peak fleet size changes what the peak costs but leaves the same fixed number of servers idle at night, so it fixes neither problem. Option C raises the ceiling of one server but still requires guessing a fixed size in advance.

Answer: D
Amazon Simple Queue Service holds messages durably until a consumer retrieves and processes them, which decouples a fast producer from a slower consumer and means work survives a restart of the downstream service. Amazon Simple Notification Service is the classic confusion because both are messaging services, but SNS pushes each message to its subscribers at the moment of publication; if the fulfillment service is down there is no queue holding the backlog, so the buffering the scenario requires would not happen.

Answer: B
Amazon Simple Notification Service uses a publish and subscribe model in which one published message is delivered to every subscriber of a topic, which is the fan-out behavior this scenario needs. Amazon Simple Queue Service is the tempting alternative because it is the other core messaging service, but a standard queue message is consumed by one receiver and then removed, so reaching three independent consumers would require the publisher to write to three separate queues and therefore know about all of them.

Answer: C
AWS Direct Connect establishes a dedicated private network connection between a customer facility and AWS, delivering consistent bandwidth and avoiding the public internet entirely. AWS Site-to-Site VPN is the strongest distractor and is genuinely private in the sense that traffic is encrypted, but the encrypted tunnel still rides over the public internet, so it inherits exactly the throughput variability the bank is trying to eliminate. Client VPN connects individual users rather than linking a data center to AWS.

Answer: A
The AWS Snow Family provides ruggedized physical devices that are shipped to a site, loaded locally, and returned to AWS, which bypasses the network entirely when bandwidth is the limiting factor. AWS Direct Connect is the most reasonable-looking alternative and would deliver far more throughput, but installing a dedicated circuit to a remote site means physical construction and a lead time of its own, which does not help a location served only by satellite. Multipart upload improves reliability of a transfer without adding any bandwidth.

Answer: B
AWS Storage Gateway connects on-premises applications to AWS storage while keeping a local cache of frequently accessed data, which preserves local access performance and moves the bulk of the data to the cloud. AWS Backup is the distractor for candidates focused on the phrase backed by cloud storage, but AWS Backup centralizes and schedules backup jobs for AWS resources; it does not present a local file share to on-premises applications or manage a working cache for them.

Answer: B
AWS Outposts places AWS-managed infrastructure inside the customer's own facility so workloads run locally with the same services and interfaces used in a Region, which is what a few-millisecond processing budget requires. Option A is the natural instinct and does reduce latency, but even the closest Region still involves a network round trip out of the plant, which cannot meet a hard millisecond-scale deadline for a local control loop. CloudFront caches content and does not run the processing workload.

Answer: A
Amazon Elastic Kubernetes Service runs a managed Kubernetes control plane, so existing manifests and Kubernetes-native tooling keep working while AWS operates the control plane. Amazon Elastic Container Service is the closest distractor and is also a fully managed container orchestrator, but it uses its own task and service model rather than the Kubernetes API, so the team's manifests and ecosystem tooling would have to be rewritten. Elastic Container Registry stores container images and orchestrates nothing.

Answer: C
Amazon Lightsail packages compute, storage, and data transfer into simple plans with a predictable monthly price, aimed at straightforward workloads where the user does not want to configure the underlying networking. Amazon EC2 is the answer many candidates default to because it is the general-purpose compute service and can certainly host the site, but it requires selecting instance types, configuring networking, and reasoning about usage-based charges, which is exactly the complexity the proprietor is trying to avoid.

Answer: B
Amazon Athena is a serverless query service that runs standard SQL directly against data in Amazon S3, with nothing to provision and charges tied to the queries that are run, which suits occasional ad hoc analysis. Amazon Redshift is the strongest distractor because it is the analytics database and would certainly answer the questions, but the classic Redshift pattern involves provisioning a cluster and loading data into it, which is precisely the work the analyst wants to avoid for infrequent queries.

Answer: D
Amazon Kinesis collects, processes, and analyzes streaming data continuously, so records become available to consumers within seconds of being produced. AWS Glue is the tempting alternative because it also moves and transforms data, but Glue is oriented toward extract, transform, and load jobs that run over batches of data on a schedule or on demand, which does not satisfy a requirement measured in seconds from arrival. Athena queries data already at rest rather than data in motion.

Answer: C
Amazon QuickSight is the business intelligence service for building and sharing interactive dashboards and visualizations that non-technical users consume in a browser. Amazon Athena is the distractor for candidates who reason that the managers ultimately need query results, and Athena can indeed produce them, but Athena returns query output to an analyst rather than presenting a maintained visual dashboard, so the weekly manual step would simply move rather than disappear.

Answer: C
Amazon Transcribe converts recorded speech into text, and Amazon Comprehend then applies natural language processing to that text to extract sentiment and other insights, so the order matters. Option D names the right two services in the wrong sequence, which is the most common error here, since Comprehend analyzes text and has nothing to work with until the audio has already been transcribed. Amazon Polly performs the reverse of Transcribe by generating speech from text, and Textract extracts text from scanned documents rather than audio.

Answer: B
AWS CloudFormation provisions and manages collections of resources from declarative templates, so the same template can be reviewed, versioned, and used to recreate an identical environment elsewhere. AWS Config is the distractor that trips up candidates who recall it deals with resource configuration, but Config observes and evaluates the configuration of resources that already exist; it does not create them from a definition. AWS Control Tower sets up and governs a multi-account environment rather than defining an individual workload's resources.

Answer: C
Amazon CloudWatch collects operational metrics, retains them for historical review, and triggers alarms and notifications when a metric breaches a defined threshold. AWS CloudTrail is the perennial confusion because both services record information continuously, but CloudTrail records API calls made against the account for audit and attribution purposes and does not track how busy a processor is or evaluate threshold conditions.

Answer: A
The AWS CLI and the SDKs provide programmatic access to the same service APIs the console calls, which is what makes a build repeatable and automatable from a pipeline. Option D is the most tempting alternative because a replayed recording really is automation of a sort, but it is bound to the exact page layout and element positions captured at the time and breaks whenever the console interface changes, whereas the CLI and SDKs call the stable service APIs directly. Option B feels practical to teams accustomed to manual work, and a checklist does improve consistency, but a human still executes every step, so a pipeline cannot trigger it.

Answer: C
A Region is a geographic area containing multiple Availability Zones, each isolated so a failure in one does not take down the others, while edge locations are a distinct and far more numerous set of sites used to serve content and terminate connections near users. Option D is the most common misconception, because candidates map Region onto the familiar idea of a single data center; in fact an Availability Zone itself consists of one or more data centers, so a Region spans many facilities. Option A simply inverts the containment relationship.

Answer: B
AWS Global Accelerator provides static entry addresses, pulls traffic onto the AWS backbone at a nearby edge, and routes each connection to the healthiest available endpoint, which suits non-cacheable session traffic including UDP. Amazon CloudFront is the reflexive answer whenever a question mentions global users and edge locations, but CloudFront exists to cache and deliver content, and a game session with no cacheable payload gains nothing from a longer cache duration. Route 53 influences DNS resolution but does not carry the session traffic itself.

Answer: C
The customer chooses which Region stores the data, and content stays in that Region unless the customer explicitly configures a transfer such as replication to another Region, which is what makes Region selection the primary control for data residency obligations. Option A is the dangerous misconception, because candidates conflate the multiple Availability Zones used inside a Region for durability with a global spread of copies; replication for durability happens within the selected Region, not across all of them.

Answer: D
Spot Instances draw on spare capacity at a steep discount in exchange for the possibility that AWS reclaims them with short notice, which is an excellent trade for a workload that can simply re-queue interrupted units of work. Standard Reserved Instances are the tempting alternative because they also reduce cost substantially, but they require committing to a defined amount of capacity for a one or three year term, which does not match a rendering pipeline whose volume rises and falls with production schedules and which does not need any particular instance to survive.

Answer: A
A Compute Savings Plan commits to a consistent hourly spend rather than to a specific resource, and the discount applies automatically across instance families, sizes, and Regions as well as to serverless container and function compute. Standard Reserved Instances are the natural instinct because they offer the deepest headline discount, but that discount is tied to a specific instance family in a Region and does not extend to container or function compute, so an organization that keeps changing shape would repeatedly strand its commitment.

Answer: B
Dedicated Hosts give the customer a physical server of its own, with visibility into the sockets and cores it contains, which is what per-socket and per-core license terms require in order to be reported and audited. Option D is the strongest distractor because dedicated tenancy does guarantee the customer is not sharing hardware with other AWS accounts, but it does not expose or let the customer target the specific physical host, so the socket and core reporting needed for license compliance is unavailable. Reserved Instances are a billing construct and change nothing about tenancy.

Answer: C
AWS Pricing Calculator produces cost estimates for architectures that have not been deployed, letting a team model configurations and compare alternatives before spending anything. AWS Cost Explorer is the answer most candidates give because it is the well-known cost tool, but Cost Explorer visualizes and forecasts based on the account's actual historical usage, and an architecture that has never run generates no history for it to work from. Budgets likewise monitors real spending against thresholds.

Answer: C
Cost allocation tags label resources with values such as a department name, and once activated in the billing console those tags become dimensions that split costs in billing reports and cost analysis. Option D is the most attractive wrong answer because budgets are undeniably a finance tool, but a budget monitors spending against a threshold and alerts when it is approached; it does not attribute existing charges to an owner, and in fact a per-department budget needs the tags to know which spending it is watching.

Answer: B
AWS Cost and Usage Reports deliver the most detailed available billing dataset, with line-item granularity, into a storage bucket where it can be loaded into external tooling. AWS Cost Explorer is the strongest distractor because it also examines cost and usage and is where most people look first, but it is an interactive visualization and forecasting interface rather than a delivered dataset, so it does not provide the raw line-item feed an analyst needs to reconcile individual charges in their own system.

Answer: D
Developer Support is the entry paid tier and is the first that permits opening technical support cases, providing email access to AWS technical staff during business hours for guidance of this kind. Business Support is the most tempting answer because it clearly satisfies the requirement too, but it adds around-the-clock access by phone and chat along with other capabilities the startup did not ask for, so it is not the lowest-cost plan that meets the stated need. Basic Support provides no technical case access whatsoever.

Answer: B
Inbound data transfer from the internet into AWS is generally not charged, while outbound transfer to the internet is, so an outbound-heavy service such as video streaming carries a materially different cost profile from its ingest path. Option C is the reversal that catches candidates who reason that AWS charges for whatever consumes resources; storage is billed separately by volume and duration, and the act of uploading is not what incurs a transfer charge. Option A ignores egress cost entirely and would badly understate the platform's bill.

Answer: C
The AWS Health Dashboard reports the health of AWS services and provides alerts and remediation guidance for events that affect the resources in a particular account. AWS Trusted Advisor is the usual mix-up because both offer proactive account-specific advice, but Trusted Advisor inspects the customer's own configuration against best practices for cost, security, and performance, whereas Health reports on events originating at AWS. CloudWatch dashboards visualize metrics the customer's own resources emit.

Answer: C
AWS Professional Services and the consulting partners in the AWS Partner Network, including system integrators, exist to be engaged for sustained delivery work such as designing and executing a migration alongside a customer's staff. Option A is the most plausible mistake because AWS Support really does employ expert engineers, but a support plan answers discrete technical questions and troubleshoots problems; it is not a delivery vehicle for a year-long project. AWS re:Post is a community question and answer service and cannot be tasked with execution.

Answer: C
Describing infrastructure in templates and provisioning it automatically means every environment is built from the same definition, which removes the manual steps where drift and human error originate. Rightsizing is tempting because it is also an automation-adjacent cost discipline, but rightsizing changes how large resources are, not whether environments are built consistently, so it does nothing about drift. Consolidating into one Availability Zone would actively reduce resilience and has no bearing on configuration consistency.