Employees need AWS access through the company identity provider without separate IAM users. What should provide it?

AWS IAM Identity Center with federation. It gives workforce users centrally managed access and temporary credentials instead of another set of long-term identities.

An EC2 application needs S3 access without stored access keys. What identity should it use?

An IAM role attached through an instance profile. The workload receives rotating temporary credentials, so no long-term secret has to live on the instance.

A company needs a maximum-permissions guardrail across member accounts. Which control fits?

An AWS Organizations service control policy (SCP). An SCP limits what member-account principals can be allowed to do; it does not grant permissions by itself.

How should the root user of a standalone AWS account or Organizations management account be secured?

Use it only for root-required tasks, protect sign-in with MFA, and do not create root access keys. Centralized root access applies to member accounts, so these root credentials still need direct protection.

Which identities can be members of an IAM group?

IAM users only. Groups collect permissions for users; roles and other groups cannot be group members.

An operator in one AWS account needs temporary access to resources in another. What is the standard design?

Assume a cross-account IAM role. The target role trusts the source principal, and the source principal is allowed to call STS to assume it.

A developer may create roles, but those roles must never exceed a fixed permission ceiling. What should constrain them?

An IAM permissions boundary. It caps the permissions an identity-based policy can grant without supplying permissions on its own.

Which service identifies resources shared with principals outside the trusted zone?

IAM Access Analyzer. It analyzes supported resource policies to surface public and cross-account access.

A corporate directory supports SAML 2.0 and staff need console access with existing identities. What access pattern fits?

SAML federation to IAM roles. Authentication stays with the corporate identity provider while AWS issues temporary role credentials.

An S3 bucket must grant another account direct access without sharing credentials. Which policy type can do that?

A resource-based bucket policy. It names the external principal on the resource and avoids distributing the bucket owner's credentials.

Permissions must follow project ownership as resources and staff change. Which authorization model reduces policy churn?

Attribute-based access control using tags. Policy conditions compare principal and resource attributes, so matching tags drive access without one policy per project.

A company wants a governed multi-account landing zone with account provisioning and guardrails. Which service fits?

AWS Control Tower. It sets up and governs a multi-account environment on top of AWS Organizations using an opinionated landing-zone model.

An external CI system supports OIDC and needs AWS API access without stored keys. What should it use?

OIDC federation to an IAM role. Short-lived web-identity credentials remove the need to keep an AWS access key in the CI system.

What credential model distinguishes an IAM role from an IAM user?

A role supplies temporary session credentials. It is assumed when needed rather than owning a permanent password or access key.

An action is allowed by one applicable policy and explicitly denied by another. What is the result?

The request is denied. An applicable explicit deny overrides an allow during policy evaluation.

Who patches the guest operating system on an Amazon EC2 instance?

The customer. AWS secures the underlying cloud infrastructure, while the customer manages the guest OS, applications, and their configuration.

When is an IAM user more defensible than federation for human access?

Only when the access pattern cannot use roles or federation and requires a long-term identity. Treat it as an exception, restrict it tightly, and rotate credentials when required.

A third-party SaaS provider assumes customer roles. What condition helps prevent the confused-deputy problem?

A unique external ID in the role trust policy. It binds the assume-role request to the intended customer relationship.

In one account, an identity policy and a resource policy each grant different actions, with no deny. How are they evaluated?

Their allows are combined. For same-account access, either policy can contribute permission unless another applicable control restricts it.

What AWS infrastructure boundary is designed as an isolated failure domain within a Region?

An Availability Zone. Separate AZs have distinct infrastructure, so spreading components across them reduces dependence on one failure domain.

Where should an application's AWS access key not be stored?

In source code or an application image. Embedded long-term credentials leak through repositories and artifacts; use a workload role and temporary credentials.

Sensitive API calls should work only in sessions authenticated with MFA. How can this be enforced?

Use an IAM policy condition that requires MFA context. The condition narrows the allowed action to sessions that meet the stronger authentication requirement.

How can a team shrink broad permissions using observed API activity?

Generate a policy with IAM Access Analyzer, then review it. Access activity provides evidence for a narrower starting policy, while human review preserves required edge cases.

Can a service control policy grant a member-account role permission to call an API?

No. An SCP defines the outer permission boundary; an IAM or resource policy must still allow the API call.

Security operations should manage an organization-integrated service without daily use of the management account. What should be configured?

A delegated administrator account for that service. It separates operational administration from the highly privileged Organizations management account.

A role session needs fewer permissions than the role normally allows. What can narrow that session?

A session policy. It intersects with the role's permissions and cannot expand beyond what the role already allows.

How does moving from self-managed EC2 databases to a managed database change security responsibility?

AWS takes on more infrastructure and platform operations, but the customer still owns data, identities, and configuration. Managed does not mean responsibility-free.

How should an organization handle root credentials in member accounts after enabling centralized root access?

Remove the member accounts' root credentials and use centrally managed privileged root sessions when needed. Recover a member's credentials only for an exceptional task that still requires direct root sign-in, then remove them again.

Why place production and experimentation in separate AWS accounts instead of only separate VPCs?

Accounts provide a stronger isolation and policy boundary. They separate billing, quotas, identities, and blast radius while organization controls provide central governance.

Which service records account API activity for security investigation and governance?

AWS CloudTrail. Its event history and trails provide evidence of who called supported APIs, from where, and when.

A public web application must keep its EC2 application servers off the internet. What subnet layout fits?

Put the internet-facing load balancer in public subnets and the instances in private subnets. Only the load balancer accepts public traffic; security groups allow the app tier from it.

Which VPC packet filter automatically allows response traffic for an allowed connection?

A security group. It is stateful, so return traffic for an established allowed flow does not need a separate inbound or outbound rule.

A public HTTP application must block SQL injection patterns and abusive request paths. Which service is the direct fit?

AWS WAF. It filters web requests at the application layer using managed or custom rules.

Which service continuously analyzes AWS telemetry for suspicious account and workload activity?

Amazon GuardDuty. It detects threats from sources such as CloudTrail events, VPC flow data, and DNS activity without becoming an inline firewall.

IPv4 instances in a private subnet need outbound internet access but must not accept internet-initiated connections. What should the route use?

A NAT gateway in a public subnet. The private route sends outbound IPv4 traffic through it while the instances remain without direct public ingress.

Which subnet-level control requires explicit rules for both request and response traffic?

A network ACL. It is stateless and evaluates numbered allow and deny rules separately in each direction.

Which managed protection targets distributed denial-of-service attacks against supported AWS edge and load-balancing resources?

AWS Shield. Shield Standard is included for common network and transport attacks; Shield Advanced adds stronger response and protection features for higher-risk workloads.

Which service discovers and reports sensitive data in Amazon S3?

Amazon Macie. It uses managed data identifiers and classification jobs to find sensitive content and risky S3 exposure.

Private subnets need access to a supported AWS API without traversing a NAT gateway or public internet. Which construct fits?

An interface VPC endpoint powered by AWS PrivateLink. It places private endpoint network interfaces in the VPC for the service API.

An application tier should accept traffic only from the load-balancer tier, even as instance IPs change. What rule is best?

Reference the load balancer's security group in the application's inbound rule. Identity by group survives scaling and avoids brittle IP allowlists.

A public load balancer needs a trusted TLS certificate with managed renewal. Which service should issue and manage it?

AWS Certificate Manager (ACM). ACM provisions supported public certificates and handles renewal while they remain correctly associated and eligible.

Which service should assess supported compute workloads and container images for software vulnerabilities?

Amazon Inspector. It continuously scans supported EC2, container image, and Lambda package surfaces and reports prioritized findings.

Private workloads need S3 access without NAT cost or internet routing. Which endpoint type fits?

An S3 gateway endpoint. Route tables direct S3 traffic privately through the endpoint without hourly interface-endpoint charges.

A subnet needs a coarse deny rule for traffic from a known hostile CIDR. Which VPC control can express it?

A network ACL. Unlike security groups, network ACLs support explicit deny rules at the subnet boundary.

How should a global web application filter malicious HTTP requests before they reach the regional origin?

Associate AWS WAF with the CloudFront distribution. Edge filtering blocks matching requests closer to viewers and reduces unwanted origin traffic.

An application needs a database password stored securely and rotated automatically. Which service is designed for it?

AWS Secrets Manager. It stores encrypted secrets and supports managed or Lambda-based rotation workflows.

A branch office needs an encrypted connection to a VPC quickly over existing internet links. Which connection fits?

AWS Site-to-Site VPN. IPsec encrypts traffic over the internet and usually provisions faster than a dedicated private circuit.

Connections to a private instance are timing out. Which record helps determine whether network traffic was accepted or rejected?

VPC Flow Logs. They capture metadata about IP flows for investigation, though not packet payloads.

A service needs very high-performance TCP load balancing and stable IP addresses. Which load balancer fits?

A Network Load Balancer. It operates at Layer 4 and supports static IP addressing while handling connection-oriented traffic at scale.

A team needs hierarchical application configuration and encrypted parameters but no built-in database-secret rotation. Which service fits?

AWS Systems Manager Parameter Store. It suits configuration and secure strings; Secrets Manager is the stronger fit when rotation is the decisive requirement.

Does a dedicated AWS Direct Connect link encrypt traffic by itself?

No. Direct Connect supplies private dedicated connectivity, but encryption needs another mechanism such as IPsec VPN or an applicable MACsec design.

AWS Solutions Architect Associate SAA-C03 Flashcards: Architecture Decisions & Trade-Offs

Review SAA-C03 architecture choices through 300 original cards on security, resilience, performance, and cost trade-offs.

Από τον συντάκτη Open Study Contributor

Σχετικά με αυτήν τη δέσμη

These AWS Solutions Architect Associate flashcards give current SAA-C03 candidates 300 original prompts for choosing among plausible cloud architectures. Each answer names the decision first, then explains the constraint that makes it fit.

What the cards practice

Requirement → architecture choice: choose a service, feature, or pattern from security, resilience, performance, and cost constraints.
Nearby options → decisive trade-off: separate choices such as Multi-AZ from read replicas, queues from event buses, and edge caching from network acceleration.
Failure mode → mitigation: recall the design change that limits a blast radius, preserves work, or meets a recovery target.

The deck deliberately leaves out reverse service-to-definition drills, exhaustive service inventories, copied multiple-choice questions, exam dumps, volatile scheduling and scoring details, hands-on labs, and full practice exams. Those directions either reward glossary recognition or test a different skill.

The sequence follows the current four-domain outline: 90 secure cards, 78 resilient cards, 72 high-performing cards, and 60 cost-optimized cards. It starts with identity, policy, network, and data-protection prerequisites; moves through decoupling and recovery; then applies storage, compute, database, networking, analytics, and cost trade-offs. Related variants are separated so one answer does not immediately cue the next.

An AI tool helped draft and sequence the original cards and generated the cover. Every final front and back was manually checked against the current AWS content outline and official service documentation for correctness, relevance, clarity, and one main retrieval target.

The common-knowledge service facts and AWS marks remain Amazon Web Services' property. The CC0 dedication applies only to the original wording, selection, sequence, metadata, and generated cover to the extent those elements can be dedicated. No AWS exam questions, answer keys, mark schemes, or AWS documentation text were copied; scope was checked against the official AWS Certified Solutions Architect - Associate SAA-C03 exam guide. This is an independent, unofficial study resource and is not affiliated with, endorsed by, or sponsored by Amazon Web Services.

Κάρτες σε αυτήν τη δέσμη

Κάρτα 1
Ερώτηση
Employees need AWS access through the company identity provider without separate IAM users. What should provide it?
Απάντηση
AWS IAM Identity Center with federation. It gives workforce users centrally managed access and temporary credentials instead of another set of long-term identities.
Κάρτα 2
Ερώτηση
An EC2 application needs S3 access without stored access keys. What identity should it use?
Απάντηση
An IAM role attached through an instance profile. The workload receives rotating temporary credentials, so no long-term secret has to live on the instance.
Κάρτα 3
Ερώτηση
A company needs a maximum-permissions guardrail across member accounts. Which control fits?
Απάντηση
An AWS Organizations service control policy (SCP). An SCP limits what member-account principals can be allowed to do; it does not grant permissions by itself.
Κάρτα 4
Ερώτηση
How should the root user of a standalone AWS account or Organizations management account be secured?
Απάντηση
Use it only for root-required tasks, protect sign-in with MFA, and do not create root access keys. Centralized root access applies to member accounts, so these root credentials still need direct protection.
Κάρτα 5
Ερώτηση
Which identities can be members of an IAM group?
Απάντηση
IAM users only. Groups collect permissions for users; roles and other groups cannot be group members.
Κάρτα 6
Ερώτηση
An operator in one AWS account needs temporary access to resources in another. What is the standard design?
Απάντηση
Assume a cross-account IAM role. The target role trusts the source principal, and the source principal is allowed to call STS to assume it.
Κάρτα 7
Ερώτηση
A developer may create roles, but those roles must never exceed a fixed permission ceiling. What should constrain them?
Απάντηση
An IAM permissions boundary. It caps the permissions an identity-based policy can grant without supplying permissions on its own.
Κάρτα 8
Ερώτηση
Which service identifies resources shared with principals outside the trusted zone?
Απάντηση
IAM Access Analyzer. It analyzes supported resource policies to surface public and cross-account access.
Κάρτα 9
Ερώτηση
A corporate directory supports SAML 2.0 and staff need console access with existing identities. What access pattern fits?
Απάντηση
SAML federation to IAM roles. Authentication stays with the corporate identity provider while AWS issues temporary role credentials.
Κάρτα 10
Ερώτηση
An S3 bucket must grant another account direct access without sharing credentials. Which policy type can do that?
Απάντηση
A resource-based bucket policy. It names the external principal on the resource and avoids distributing the bucket owner's credentials.
Κάρτα 11
Ερώτηση
Permissions must follow project ownership as resources and staff change. Which authorization model reduces policy churn?
Απάντηση
Attribute-based access control using tags. Policy conditions compare principal and resource attributes, so matching tags drive access without one policy per project.
Κάρτα 12
Ερώτηση
A company wants a governed multi-account landing zone with account provisioning and guardrails. Which service fits?
Απάντηση
AWS Control Tower. It sets up and governs a multi-account environment on top of AWS Organizations using an opinionated landing-zone model.
Κάρτα 13
Ερώτηση
An external CI system supports OIDC and needs AWS API access without stored keys. What should it use?
Απάντηση
OIDC federation to an IAM role. Short-lived web-identity credentials remove the need to keep an AWS access key in the CI system.
Κάρτα 14
Ερώτηση
What credential model distinguishes an IAM role from an IAM user?
Απάντηση
A role supplies temporary session credentials. It is assumed when needed rather than owning a permanent password or access key.
Κάρτα 15
Ερώτηση
An action is allowed by one applicable policy and explicitly denied by another. What is the result?
Απάντηση
The request is denied. An applicable explicit deny overrides an allow during policy evaluation.
Κάρτα 16
Ερώτηση
Who patches the guest operating system on an Amazon EC2 instance?
Απάντηση
The customer. AWS secures the underlying cloud infrastructure, while the customer manages the guest OS, applications, and their configuration.
Κάρτα 17
Ερώτηση
When is an IAM user more defensible than federation for human access?
Απάντηση
Only when the access pattern cannot use roles or federation and requires a long-term identity. Treat it as an exception, restrict it tightly, and rotate credentials when required.
Κάρτα 18
Ερώτηση
A third-party SaaS provider assumes customer roles. What condition helps prevent the confused-deputy problem?
Απάντηση
A unique external ID in the role trust policy. It binds the assume-role request to the intended customer relationship.
Κάρτα 19
Ερώτηση
In one account, an identity policy and a resource policy each grant different actions, with no deny. How are they evaluated?
Απάντηση
Their allows are combined. For same-account access, either policy can contribute permission unless another applicable control restricts it.
Κάρτα 20
Ερώτηση
What AWS infrastructure boundary is designed as an isolated failure domain within a Region?
Απάντηση
An Availability Zone. Separate AZs have distinct infrastructure, so spreading components across them reduces dependence on one failure domain.
Κάρτα 21
Ερώτηση
Where should an application's AWS access key not be stored?
Απάντηση
In source code or an application image. Embedded long-term credentials leak through repositories and artifacts; use a workload role and temporary credentials.
Κάρτα 22
Ερώτηση
Sensitive API calls should work only in sessions authenticated with MFA. How can this be enforced?
Απάντηση
Use an IAM policy condition that requires MFA context. The condition narrows the allowed action to sessions that meet the stronger authentication requirement.
Κάρτα 23
Ερώτηση
How can a team shrink broad permissions using observed API activity?
Απάντηση
Generate a policy with IAM Access Analyzer, then review it. Access activity provides evidence for a narrower starting policy, while human review preserves required edge cases.
Κάρτα 24
Ερώτηση
Can a service control policy grant a member-account role permission to call an API?
Απάντηση
No. An SCP defines the outer permission boundary; an IAM or resource policy must still allow the API call.
Κάρτα 25
Ερώτηση
Security operations should manage an organization-integrated service without daily use of the management account. What should be configured?
Απάντηση
A delegated administrator account for that service. It separates operational administration from the highly privileged Organizations management account.
Κάρτα 26
Ερώτηση
A role session needs fewer permissions than the role normally allows. What can narrow that session?
Απάντηση
A session policy. It intersects with the role's permissions and cannot expand beyond what the role already allows.
Κάρτα 27
Ερώτηση
How does moving from self-managed EC2 databases to a managed database change security responsibility?
Απάντηση
AWS takes on more infrastructure and platform operations, but the customer still owns data, identities, and configuration. Managed does not mean responsibility-free.
Κάρτα 28
Ερώτηση
How should an organization handle root credentials in member accounts after enabling centralized root access?
Απάντηση
Remove the member accounts' root credentials and use centrally managed privileged root sessions when needed. Recover a member's credentials only for an exceptional task that still requires direct root sign-in, then remove them again.
Κάρτα 29
Ερώτηση
Why place production and experimentation in separate AWS accounts instead of only separate VPCs?
Απάντηση
Accounts provide a stronger isolation and policy boundary. They separate billing, quotas, identities, and blast radius while organization controls provide central governance.
Κάρτα 30
Ερώτηση
Which service records account API activity for security investigation and governance?
Απάντηση
AWS CloudTrail. Its event history and trails provide evidence of who called supported APIs, from where, and when.
Κάρτα 31
Ερώτηση
A public web application must keep its EC2 application servers off the internet. What subnet layout fits?
Απάντηση
Put the internet-facing load balancer in public subnets and the instances in private subnets. Only the load balancer accepts public traffic; security groups allow the app tier from it.
Κάρτα 32
Ερώτηση
Which VPC packet filter automatically allows response traffic for an allowed connection?
Απάντηση
A security group. It is stateful, so return traffic for an established allowed flow does not need a separate inbound or outbound rule.
Κάρτα 33
Ερώτηση
A public HTTP application must block SQL injection patterns and abusive request paths. Which service is the direct fit?
Απάντηση
AWS WAF. It filters web requests at the application layer using managed or custom rules.
Κάρτα 34
Ερώτηση
Which service continuously analyzes AWS telemetry for suspicious account and workload activity?
Απάντηση
Amazon GuardDuty. It detects threats from sources such as CloudTrail events, VPC flow data, and DNS activity without becoming an inline firewall.
Κάρτα 35
Ερώτηση
IPv4 instances in a private subnet need outbound internet access but must not accept internet-initiated connections. What should the route use?
Απάντηση
A NAT gateway in a public subnet. The private route sends outbound IPv4 traffic through it while the instances remain without direct public ingress.
Κάρτα 36
Ερώτηση
Which subnet-level control requires explicit rules for both request and response traffic?
Απάντηση
A network ACL. It is stateless and evaluates numbered allow and deny rules separately in each direction.
Κάρτα 37
Ερώτηση
Which managed protection targets distributed denial-of-service attacks against supported AWS edge and load-balancing resources?
Απάντηση
AWS Shield. Shield Standard is included for common network and transport attacks; Shield Advanced adds stronger response and protection features for higher-risk workloads.
Κάρτα 38
Ερώτηση
Which service discovers and reports sensitive data in Amazon S3?
Απάντηση
Amazon Macie. It uses managed data identifiers and classification jobs to find sensitive content and risky S3 exposure.
Κάρτα 39
Ερώτηση
Private subnets need access to a supported AWS API without traversing a NAT gateway or public internet. Which construct fits?
Απάντηση
An interface VPC endpoint powered by AWS PrivateLink. It places private endpoint network interfaces in the VPC for the service API.
Κάρτα 40
Ερώτηση
An application tier should accept traffic only from the load-balancer tier, even as instance IPs change. What rule is best?
Απάντηση
Reference the load balancer's security group in the application's inbound rule. Identity by group survives scaling and avoids brittle IP allowlists.
Κάρτα 41
Ερώτηση
A public load balancer needs a trusted TLS certificate with managed renewal. Which service should issue and manage it?
Απάντηση
AWS Certificate Manager (ACM). ACM provisions supported public certificates and handles renewal while they remain correctly associated and eligible.
Κάρτα 42
Ερώτηση
Which service should assess supported compute workloads and container images for software vulnerabilities?
Απάντηση
Amazon Inspector. It continuously scans supported EC2, container image, and Lambda package surfaces and reports prioritized findings.
Κάρτα 43
Ερώτηση
Private workloads need S3 access without NAT cost or internet routing. Which endpoint type fits?
Απάντηση
An S3 gateway endpoint. Route tables direct S3 traffic privately through the endpoint without hourly interface-endpoint charges.
Κάρτα 44
Ερώτηση
A subnet needs a coarse deny rule for traffic from a known hostile CIDR. Which VPC control can express it?
Απάντηση
A network ACL. Unlike security groups, network ACLs support explicit deny rules at the subnet boundary.
Κάρτα 45
Ερώτηση
How should a global web application filter malicious HTTP requests before they reach the regional origin?
Απάντηση
Associate AWS WAF with the CloudFront distribution. Edge filtering blocks matching requests closer to viewers and reduces unwanted origin traffic.
Κάρτα 46
Ερώτηση
An application needs a database password stored securely and rotated automatically. Which service is designed for it?
Απάντηση
AWS Secrets Manager. It stores encrypted secrets and supports managed or Lambda-based rotation workflows.
Κάρτα 47
Ερώτηση
A branch office needs an encrypted connection to a VPC quickly over existing internet links. Which connection fits?
Απάντηση
AWS Site-to-Site VPN. IPsec encrypts traffic over the internet and usually provisions faster than a dedicated private circuit.
Κάρτα 48
Ερώτηση
Connections to a private instance are timing out. Which record helps determine whether network traffic was accepted or rejected?
Απάντηση
VPC Flow Logs. They capture metadata about IP flows for investigation, though not packet payloads.
Κάρτα 49
Ερώτηση
A service needs very high-performance TCP load balancing and stable IP addresses. Which load balancer fits?
Απάντηση
A Network Load Balancer. It operates at Layer 4 and supports static IP addressing while handling connection-oriented traffic at scale.
Κάρτα 50
Ερώτηση
A team needs hierarchical application configuration and encrypted parameters but no built-in database-secret rotation. Which service fits?
Απάντηση
AWS Systems Manager Parameter Store. It suits configuration and secure strings; Secrets Manager is the stronger fit when rotation is the decisive requirement.
Κάρτα 51
Ερώτηση
Does a dedicated AWS Direct Connect link encrypt traffic by itself?
Απάντηση
No. Direct Connect supplies private dedicated connectivity, but encryption needs another mechanism such as IPsec VPN or an applicable MACsec design.
Κάρτα 52
Ερώτηση
A VPC needs centrally managed stateful inspection and domain-aware egress filtering. Which service fits?
Απάντηση
AWS Network Firewall. It provides managed network inspection with stateless and stateful rule groups for routed VPC traffic.
Κάρτα 53
Ερώτηση
Where can HTTPS be terminated so private HTTP targets do not each manage a public certificate?
Απάντηση
At an Application Load Balancer HTTPS listener. ACM integrates with the listener, centralizing public TLS while target traffic remains governed inside the VPC.
Κάρτα 54
Ερώτηση
A consumer web app needs a managed sign-up directory and user authentication tokens. Which component fits?
Απάντηση
An Amazon Cognito user pool. It manages application users and issues tokens after authentication.
Κάρτα 55
Ερώτηση
An API Gateway API must be callable only from approved VPCs through private connectivity. Which API type fits?
Απάντηση
A private API reached through an interface VPC endpoint. Its resource policy can restrict which VPC endpoints or VPCs may invoke it.
Κάρτα 56
Ερώτηση
A security team must apply common WAF and network protections across many accounts. Which service centralizes those policies?
Απάντηση
AWS Firewall Manager. It manages supported firewall and protection policies across accounts in AWS Organizations.
Κάρτα 57
Ερώτηση
How should a workload obtain a secret without placing the value in an AMI or container image?
Απάντηση
Retrieve it at runtime with a workload role. The image contains no secret, and IAM plus the secret's policy controls access to the current value.
Κάρτα 58
Ερώτηση
IPv6 workloads need outbound internet access without accepting unsolicited inbound connections. Which gateway fits?
Απάντηση
An egress-only internet gateway. It supports outbound-initiated IPv6 connectivity while blocking internet-initiated connections to the VPC.
Κάρτα 59
Ερώτηση
Authenticated mobile users need temporary AWS credentials to access permitted AWS resources. Which component supplies them?
Απάντηση
An Amazon Cognito identity pool. It exchanges supported identities for temporary role credentials with scoped AWS access.
Κάρτα 60
Ερώτηση
What routing property makes a VPC subnet public?
Απάντηση
Its route table has a route to an internet gateway. An instance still needs a public IPv4 address or IPv6 address and permissive controls to communicate directly with the internet.
Κάρτα 61
Ερώτηση
S3 objects need customer-controlled key permissions and an audit trail of key use. Which server-side encryption option fits?
Απάντηση
SSE-KMS with a customer managed KMS key. KMS adds key-policy control and CloudTrail-visible cryptographic operations beyond S3-managed keys.
Κάρτα 62
Ερώτηση
Which S3 control should be the broad guardrail against accidental public buckets and objects?
Απάντηση
S3 Block Public Access. Apply it at the account and bucket levels where public access is not required, then use explicit private policies.
Κάρτα 63
Ερώτηση
Which S3 feature helps recover from accidental overwrites and deletes?
Απάντηση
S3 Versioning. It preserves prior object versions and turns a normal delete into a delete marker instead of immediately erasing older versions.
Κάρτα 64
Ερώτηση
What happens when an encrypted EBS snapshot creates a new volume?
Απάντηση
The new volume is encrypted. EBS encryption propagates through snapshots and volumes created from those encrypted snapshots.
Κάρτα 65
Ερώτηση
What is the mandatory primary authorization document for a KMS key?
Απάντηση
The KMS key policy. Every KMS key has one, and IAM allows take effect only when the key policy enables that path.
Κάρτα 66
Ερώτηση
An S3 data lake wants policy-only ownership and no object ACL management. Which setting fits?
Απάντηση
S3 Object Ownership with Bucket owner enforced. It disables ACLs and makes the bucket owner own uploaded objects, simplifying authorization.
Κάρτα 67
Ερώτηση
Compliance records must be protected from deletion or overwrite for a retention period. Which S3 feature fits?
Απάντηση
S3 Object Lock. It provides write-once-read-many retention on versioned objects, with governance or compliance controls.
Κάρτα 68
Ερώτηση
An unencrypted RDS database must become encrypted without changing it in place. What migration path fits?
Απάντηση
Snapshot it, copy the snapshot with encryption, and restore a new database. RDS storage encryption is chosen for the new resource rather than toggled on the existing instance.
Κάρτα 69
Ερώτηση
A large object must be encrypted without sending the whole payload to KMS. Which pattern fits?
Απάντηση
Envelope encryption. A data key encrypts the payload locally, and the KMS key protects the much smaller data key.
Κάρτα 70
Ερώτηση
Several applications need different S3 access policies over the same shared dataset. What reduces one giant bucket policy?
Απάντηση
S3 Access Points. Each access point has its own endpoint and policy, letting access be separated by application or team.
Κάρτα 71
Ερώτηση
What bucket prerequisite applies to S3 replication?
Απάντηση
Versioning must be enabled on both source and destination buckets. Replication operates on object versions rather than an unversioned overwrite stream.
Κάρτα 72
Ερώτηση
An application uses TLS on regional load balancers in two Regions. Where must its ACM certificates be available?
Απάντηση
In each load balancer's Region. ACM certificates are regional resources for regional services, so each deployment needs an eligible certificate there.
Κάρτα 73
Ερώτηση
What happens to existing ciphertext when a KMS key's material rotates?
Απάντηση
It is not re-encrypted. KMS keeps the prior key material so the same logical key can decrypt older ciphertext while new encryption uses current material.
Κάρτα 74
Ερώτηση
How can a bucket reject requests that do not use TLS?
Απάντηση
Add a bucket-policy deny conditioned on insecure transport. The explicit deny blocks requests where the secure-transport context is false.
Κάρτα 75
Ερώτηση
S3 data must have an automatically maintained copy in another Region. Which feature fits?
Απάντηση
S3 Cross-Region Replication. It asynchronously copies eligible object versions to a bucket in a different Region under configured rules.
Κάρτα 76
Ερώτηση
Which Region must hold an ACM certificate used by Amazon CloudFront?
Απάντηση
US East (N. Virginia), us-east-1. CloudFront requires its viewer certificate in that Region even when the origins live elsewhere.
Κάρτα 77
Ερώτηση
A key type does not support automatic KMS rotation. How can the application rotate it?
Απάντηση
Create a replacement KMS key and repoint an alias or application configuration. Manual replacement is the rotation path for unsupported key types.
Κάρτα 78
Ερώτηση
A private S3 object needs temporary download access for one user without making the bucket public. What should be issued?
Απάντηση
A presigned URL. It delegates time-limited permission derived from the signer's credentials for a specific S3 request.
Κάρτα 79
Ερώτηση
Separate teams in one Region need automatically replicated S3 copies under different accounts. Which feature fits?
Απάντηση
S3 Same-Region Replication. It maintains eligible copies between buckets in the same Region, including cross-account destinations.
Κάρτα 80
Ερώτηση
After a secret rotates, what application design prevents continued use of the old value?
Απάντηση
Retrieve or refresh the secret at runtime instead of caching it indefinitely. Rotation only helps when consumers adopt the current version safely.
Κάρτα 81
Ερώτηση
Another account must use a customer managed KMS key. What two authorization sides are required?
Απάντηση
The key policy must trust the external account, and that account must allow its principal to use the key. Cross-account KMS access needs permission on both sides.
Κάρτα 82
Ερώτηση
A CloudFront distribution should read from a private S3 origin while direct bucket access stays blocked. Which control fits?
Απάντηση
CloudFront Origin Access Control (OAC). The bucket policy trusts signed CloudFront origin requests instead of exposing S3 publicly.
Κάρτα 83
Ερώτηση
Backups must resist deletion or shortened retention, including by privileged operators. Which control fits?
Απάντηση
AWS Backup Vault Lock in compliance mode after its grace period. It enforces write-once-read-many retention, so even privileged users cannot alter or delete protected recovery points early.
Κάρτα 84
Ερώτηση
A data owner needs evidence of which S3 objects contain regulated identifiers before tightening access. What should run first?
Απάντηση
An Amazon Macie sensitive-data discovery job. Classification findings identify likely sensitive objects so controls can follow the data's risk.
Κάρτα 85
Ερώτηση
A requirement calls for customer-controlled keys in dedicated single-tenant hardware security modules. Which service fits?
Απάντηση
AWS CloudHSM. It provides dedicated HSMs under customer control; KMS is the simpler managed choice when that control boundary is not required.
Κάρτα 86
Ερώτηση
Records must be retained for a policy period and then deleted automatically. What design principle should drive storage controls?
Απάντηση
Encode the retention policy in lifecycle and backup controls. Automated transitions, expiration, and locked retention reduce reliance on manual cleanup while matching governance requirements.
Κάρτα 87
Ερώτηση
A company needs centrally governed backup schedules and retention across supported services and accounts. Which service fits?
Απάντηση
AWS Backup with organization backup policies. It centralizes plans, vaults, monitoring, and policy-based protection for supported resources.
Κάρτα 88
Ερώτηση
A shared data lake needs table-, column-, and row-level permissions across analytics services. Which service should govern it?
Απάντηση
AWS Lake Formation. It centralizes fine-grained data-lake permissions instead of relying only on broad S3 access.
Κάρτα 89
Ερώτηση
An application encrypts in one Region and must decrypt in another without a cross-Region KMS call. Which key design fits?
Απάντηση
Related KMS multi-Region keys. Their interoperable key material supports regional cryptographic operations, while policies and grants remain regional.
Κάρτα 90
Ερώτηση
How can an auditor detect whether delivered CloudTrail log files were changed or deleted?
Απάντηση
Enable CloudTrail log file integrity validation. Digest files provide a cryptographic chain that can validate delivered log-file integrity.
Κάρτα 91
Ερώτηση
A web tier must add and remove instances freely as traffic changes. What application property makes this safe?
Απάντηση
Keep the web tier stateless. Store sessions and durable data outside individual instances so any healthy instance can serve any request.
Κάρτα 92
Ερώτηση
Requests for /orders and /images must scale as separate target groups behind one endpoint. Which component fits?
Απάντηση
An Application Load Balancer with path-based rules. Layer 7 routing sends each path to its own independently scalable target group.
Κάρτα 93
Ερώτηση
A team needs a managed public API front door with authorization, throttling, and request routing. Which service fits?
Απάντηση
Amazon API Gateway. It provides the API layer without requiring the team to run and scale gateway servers.
Κάρτα 94
Ερώτηση
A producer spikes faster than workers can process jobs, but accepted work must not be lost. What should separate them?
Απάντηση
An Amazon SQS queue. The durable buffer absorbs the spike and lets consumers drain work at their own rate.
Κάρτα 95
Ερώτηση
One event must be delivered to several independent queues for parallel processing. Which messaging pattern fits?
Απάντηση
Publish to an Amazon SNS topic subscribed by multiple SQS queues. Each consumer gets its own durable copy and failure boundary.
Κάρτα 96
Ερώτηση
Events from many sources must reach different targets based on fields in each event. Which service fits?
Απάντηση
Amazon EventBridge. Event-bus rules match event patterns and route selected events to targets without point-to-point integrations.
Κάρτα 97
Ερώτηση
A business process needs branching, retries, timeouts, and visible state across several services. Which service fits?
Απάντηση
AWS Step Functions. A state machine makes workflow control explicit instead of burying orchestration in custom glue code.
Κάρτα 98
Ερώτηση
Short event-driven code must scale without server management and sits idle between requests. Which compute model fits?
Απάντηση
AWS Lambda. It provisions execution capacity on demand and charges for requests and execution instead of continuously running servers.
Κάρτα 99
Ερώτηση
A long-running container needs custom runtime dependencies, but the team does not want to manage cluster instances. Which compute option fits?
Απάντηση
AWS Fargate with Amazon ECS or EKS. Fargate supplies task or pod compute while the team keeps the container model.
Κάρτα 100
Ερώτηση
A relational database is healthy but read traffic overwhelms the writer. What should absorb the reads?
Απάντηση
One or more read replicas. Applications route read-only queries to asynchronously replicated instances, leaving writes on the source.
Κάρτα 101
Ερώτηση
Which storage type fits durable, massively scalable files accessed through APIs rather than mounted as a disk?
Απάντηση
Object storage with Amazon S3. Objects live in buckets and are addressed by keys, which suits static assets, backups, and data lakes.
Κάρτα 102
Ερώτηση
Many Linux instances across Availability Zones need a shared managed NFS file system. Which storage service fits?
Απάντηση
Amazon EFS. It provides elastic regional file storage that multiple clients can mount concurrently.
Κάρτα 103
Ερώτηση
A database on one EC2 instance needs low-latency persistent block storage. Which service fits?
Απάντηση
Amazon EBS. It presents durable block volumes to EC2 and supports volume types tuned for different IOPS and throughput needs.
Κάρτα 104
Ερώτηση
A team wants AWS-native container orchestration and has no Kubernetes requirement. Which managed orchestrator is simpler?
Απάντηση
Amazon ECS. EKS is the fit when Kubernetes APIs and ecosystem compatibility are requirements; otherwise ECS removes that control-plane complexity.
Κάρτα 105
Ερώτηση
The same database records are requested repeatedly with low-latency requirements. What layer reduces database load?
Απάντηση
An in-memory cache such as Amazon ElastiCache. Serving hot data from memory cuts repeated database reads when the application can tolerate cache semantics.
Κάρτα 106
Ερώτηση
Global users repeatedly download cacheable content from one regional origin. What should serve it closer to them?
Απάντηση
Amazon CloudFront. Edge caching reduces origin load and viewer latency for cacheable responses.
Κάρτα 107
Ερώτηση
Why split a system into independently deployable services around clear business capabilities?
Απάντηση
To isolate change, failure, and scaling boundaries. A service can evolve or scale without forcing the whole application to move together, provided its interface stays stable.
Κάρτα 108
Ερώτηση
What should exceed a queue worker's normal processing time so another worker does not immediately receive the same in-flight job?
Απάντηση
The SQS visibility timeout. It temporarily hides a received message, but the worker must still delete it after success.
Κάρτα 109
Ερώτηση
A downstream processor is slower than incoming work. Which signal should often drive worker scaling?
Απάντηση
Queue backlog relative to processing capacity. Scaling on depth or age of work responds to actual pressure better than producer CPU alone.
Κάρτα 110
Ερώτηση
A standard queue can deliver a message more than once. What property must the consumer have?
Απάντηση
Idempotency. Reprocessing the same operation identifier should not create a second business effect.
Κάρτα 111
Ερώτηση
A public API must protect a backend from sudden request floods while returning controlled errors. What should the front door enforce?
Απάντηση
API Gateway throttling and quotas. They bound request rates before excess traffic consumes backend capacity.
Κάρτα 112
Ερώτηση
Partners must upload files over SFTP while data lands in managed AWS storage. Which service avoids running SFTP servers?
Απάντηση
AWS Transfer Family. It provides managed file-transfer protocol endpoints backed by services such as Amazon S3 or EFS.
Κάρτα 113
Ερώτηση
When are containers a better fit than functions for a new service?
Απάντηση
When the workload needs a portable custom runtime, persistent process, or execution shape that does not fit function limits. Containers trade some simplicity for more runtime control.
Κάρτα 114
Ερώτηση
An asynchronous function invocation keeps failing after retries. Where should the failed event go for recovery?
Απάντηση
An on-failure destination or dead-letter target. Preserving the event outside the function makes the failure inspectable and replayable.
Κάρτα 115
Ερώτηση
Queue consumers make too many empty receive calls. Which setting reduces them?
Απάντηση
SQS long polling. A receive request waits briefly for a message, reducing empty responses and needless API calls.
Κάρτα 116
Ερώτηση
Several topic subscribers need only the events relevant to them. What prevents every subscriber from processing every message?
Απάντηση
SNS subscription filter policies. Each subscription selects messages by attributes or message-body fields before delivery.
Κάρτα 117
Ερώτηση
A team needs to reprocess past application events after deploying a corrected consumer. Which feature fits?
Απάντηση
EventBridge archive and replay. The archive retains matching events and can resend a chosen time range to its source event bus.
Κάρτα 118
Ερώτηση
A workflow can run for hours and needs durable, auditable execution with non-idempotent steps. Which workflow type fits?
Απάντηση
A Step Functions Standard Workflow. It supports long-running stateful orchestration and an exactly-once execution model unless retries are configured.
Κάρτα 119
Ερώτηση
One HTTP load balancer must route to EC2 instances, containers by IP, and Lambda targets. Which load balancer supports that model?
Απάντηση
An Application Load Balancer. Its target groups support multiple target types while listener rules keep routing at Layer 7.
Κάρτα 120
Ερώτηση
Many short-lived functions cause a relational database connection storm. What managed layer should pool connections?
Απάντηση
Amazon RDS Proxy. It shares and reuses database connections, protecting the database from bursts of client sessions.
Κάρτα 121
Ερώτηση
Existing applications use standard message-broker APIs and must decouple without a messaging rewrite. Which managed service fits?
Απάντηση
Amazon MQ. It runs managed ActiveMQ or RabbitMQ brokers for applications that need familiar broker protocols and APIs rather than a cloud-native queue redesign.
Κάρτα 122
Ερώτηση
A key-value workload needs managed horizontal scaling and single-digit-millisecond access without database servers. Which database fits?
Απάντηση
Amazon DynamoDB. Its partitioned serverless design scales key-value and document access without instance management.
Κάρτα 123
Ερώτηση
A workflow must pause until a human or external system reports completion. Which orchestration pattern fits?
Απάντηση
A Step Functions callback with a task token. The workflow persists its state and resumes only when the external actor returns the token.
Κάρτα 124
Ερώτηση
Why should presentation, application, and data tiers have separate scaling boundaries?
Απάντηση
Each tier can match its own bottleneck and failure pattern. Scaling the whole stack together wastes capacity and increases coupling.
Κάρτα 125
Ερώτηση
Jobs for each customer must stay ordered and duplicate sends should be suppressed within the queue's deduplication model. Which queue type fits?
Απάντηση
An SQS FIFO queue with a message group per ordering boundary. FIFO preserves order within a group and supports deduplication, with less throughput flexibility than a standard queue.
Κάρτα 126
Ερώτηση
Why prefer a purpose-built managed service over one generic database for every workload?
Απάντηση
Its data model and operational behavior match the access pattern. Better fit can reduce custom code, scaling friction, and failure modes.
Κάρτα 127
Ερώτηση
Traffic growth is unpredictable and downtime for resizing is unacceptable. Which scaling direction is the better default?
Απάντηση
Horizontal scaling. Adding replaceable instances avoids one ever-larger machine and supports elastic capacity across failure domains.
Κάρτα 128
Ερώτηση
A very high-volume, short, idempotent event workflow needs lower orchestration overhead. Which workflow type fits?
Απάντηση
A Step Functions Express Workflow. It is designed for high-rate, short executions and uses at-least-once semantics for asynchronous runs.
Κάρτα 129
Ερώτηση
A few malformed messages repeatedly fail and block useful retry capacity. Where should they be isolated?
Απάντηση
In an SQS dead-letter queue. A redrive policy moves repeatedly failing messages aside for inspection instead of cycling them forever.
Κάρτα 130
Ερώτηση
A regional web application must survive one Availability Zone failing. What baseline topology fits?
Απάντηση
An Application Load Balancer and Auto Scaling group spanning at least two AZs. Healthy capacity remains reachable when one AZ is unavailable.
Κάρτα 131
Ερώτηση
A relational database needs automatic failover inside one Region, not read scaling. Which deployment fits?
Απάντηση
An RDS Multi-AZ DB instance deployment. Its synchronous standby is for high availability and cannot serve read traffic.
Κάρτα 132
Ερώτηση
DNS must direct users to a standby endpoint only when the primary becomes unhealthy. Which routing policy fits?
Απάντηση
Route 53 failover routing. Health evaluation controls an active-passive DNS response between primary and secondary records.
Κάρτα 133
Ερώτηση
Which disaster-recovery pattern costs least during normal operation but usually has the longest recovery time?
Απάντηση
Backup and restore. Only protected data and recovery artifacts are maintained until a disaster requires rebuilding the environment.
Κάρτα 134
Ερώτηση
Which S3 class characteristic protects ordinary regional objects from a single Availability Zone loss?
Απάντηση
Storage across multiple Availability Zones. Regional S3 classes redundantly store data across AZs; a one-zone class deliberately trades that resilience for cost or latency goals.
Κάρτα 135
Ερώτηση
An EC2 instance fails health checks in an Auto Scaling group. What resilience behavior should follow?
Απάντηση
Auto Scaling replaces the unhealthy instance. Desired capacity is maintained with a new instance instead of preserving a broken server.
Κάρτα 136
Ερώτηση
A key-value application needs active-active writes in multiple Regions with managed replication. Which feature fits?
Απάντηση
DynamoDB global tables. Multi-Region replicas accept local reads and writes and replicate changes between participating Regions.
Κάρτα 137
Ερώτηση
Which recovery objective states the maximum acceptable time to restore service after disruption?
Απάντηση
Recovery Time Objective (RTO). It sets the downtime target that the recovery architecture and runbook must meet.
Κάρτα 138
Ερώτηση
A secondary Region should keep only core data and critical services ready, then scale the rest after a disaster. Which DR pattern fits?
Απάντηση
Pilot light. A minimal live core shortens recovery compared with backup-and-restore while keeping steady-state cost below a warm standby.
Κάρτα 139
Ερώτηση
How should a team recover consistently from a damaged server fleet without repairing instances by hand?
Απάντηση
Replace the fleet from versioned immutable images and infrastructure definitions. Rebuilding known-good instances is more predictable than repairing drifted servers in place.
Κάρτα 140
Ερώτηση
Users should resolve to the deployed Region that currently offers them the lowest network latency. Which DNS policy fits?
Απάντηση
Route 53 latency-based routing. It selects among regional endpoints using AWS latency measurements and can combine that choice with health evaluation.
Κάρτα 141
Ερώτηση
Which recovery objective states the maximum acceptable amount of data loss measured in time?
Απάντηση
Recovery Point Objective (RPO). It determines how current replicated or backed-up data must be at recovery.
Κάρτα 142
Ερώτηση
An Aurora cluster needs faster failover and read scaling. What should be added across Availability Zones?
Απάντηση
Aurora Replicas in multiple AZs. Readers serve read traffic and provide promotion targets if the writer fails.
Κάρτα 143
Ερώτηση
A smaller but fully functional copy runs in another Region and scales up during disaster. Which DR pattern is this?
Απάντηση
Warm standby. The secondary environment already serves the complete workload at reduced capacity, trading higher steady cost for faster recovery.
Κάρτα 144
Ερώτηση
What artifact lets a team rebuild network and compute resources consistently in a recovery Region?
Απάντηση
Version-controlled infrastructure as code, such as AWS CloudFormation templates. A declared environment can be recreated and reviewed instead of reconstructed from memory.
Κάρτα 145
Ερώτηση
A DNS failover record should stop returning an unhealthy external endpoint. What must inform routing?
Απάντηση
A Route 53 health check associated with the record. DNS failover needs endpoint health evidence rather than a static primary designation.
Κάρτα 146
Ερώτηση
How should critical backups be protected from compromise of the workload account?
Απάντηση
Copy them into a separately controlled backup account. Cross-account isolation reduces the chance that one compromised administrator can destroy production and recovery copies.
Κάρτα 147
Ερώτηση
Which multi-Region pattern offers the lowest failover delay but usually the highest complexity and steady cost?
Απάντηση
Active-active. Multiple Regions serve traffic simultaneously, so recovery avoids starting a cold stack but requires distributed data and conflict handling.
Κάρτα 148
Ερώτηση
A DR Region has infrastructure templates but insufficient service quota for recovery capacity. What is the design flaw?
Απάντηση
The recovery plan cannot meet its intended scale. Quotas are regional constraints and must be raised and tested before an incident.
Κάρτα 149
Ερώτηση
A service-level requirement is based on successful checkout rate, not server CPU. What should alerting monitor?
Απάντηση
A metric tied to successful checkouts. Business-outcome signals expose availability loss that infrastructure utilization alone can miss.
Κάρτα 150
Ερώτηση
A request crosses several services and intermittently slows down. Which service helps locate the slow segment?
Απάντηση
AWS X-Ray. Distributed traces connect service calls and latency so the bottleneck can be isolated across the request path.
300 κάρτες
AWS Solutions Architect Associate SAA-C03 Flashcards: Architecture Decisions & Trade-Offs
Μελετήστε αυτήν τη δέσμη δωρεάν
Το Nibomo ανοίγει για να ξεκινήσετε τη μελέτη.
Κάρτα 151
Ερώτηση
A downstream dependency is failing and retries are exhausting every caller. Which application pattern limits the cascade?
Απάντηση
A circuit breaker. It stops repeated calls to the unhealthy dependency for a period, preserving caller resources and allowing recovery.
Κάρτα 152
Ερώτηση
A regional disaster must not remove both the primary S3 dataset and its recovery copy. Where should replication send it?
Απάντηση
To a bucket in another Region. Cross-Region Replication separates the copy from a regional failure boundary, subject to replication timing and configuration.
Κάρτα 153
Ερώτηση
An EBS recovery volume is needed in another Region. What must happen to its snapshot first?
Απάντηση
Copy the snapshot to the target Region. EBS snapshots are regional resources even though their data is stored redundantly within the Region.
Κάρτα 154
Ερώτηση
How can relational database clients reduce connection disruption during failover?
Απάντηση
Connect through Amazon RDS Proxy. The proxy pools connections and can redirect them to the new database instance while shielding clients from some failover handling.
Κάρτα 155
Ερώτηση
Which Aurora endpoint should an application use for writes so failover does not require a configured instance hostname change?
Απάντηση
The cluster writer endpoint. It follows the current primary instance as Aurora promotes a replacement writer.
Κάρτα 156
Ερώτηση
A global TCP application needs fixed anycast IP addresses and rapid routing away from unhealthy regional endpoints. Which service fits?
Απάντηση
AWS Global Accelerator. It routes traffic over the AWS global network to healthy endpoints while keeping stable client-facing IPs.
Κάρτα 157
Ερώτηση
A distribution should use a secondary origin when the primary returns configured failure responses. Which feature fits?
Απάντηση
CloudFront origin failover with an origin group. CloudFront can retry eligible requests against the secondary origin based on selected status codes.
Κάρτα 158
Ερώτηση
A global application needs one S3 access endpoint with routing across replicated buckets in multiple Regions. Which feature fits?
Απάντηση
An S3 Multi-Region Access Point. It provides a global endpoint and can route requests among participating regional buckets.
Κάρτα 159
Ερώτηση
A DynamoDB table must be restored to a recent second within its supported recovery window after accidental writes. Which feature fits?
Απάντηση
Point-in-time recovery. It provides continuous backups and restores the table to a new table at a chosen recoverable time.
Κάρτα 160
Ερώτηση
Why is a successful backup job not enough evidence for disaster readiness?
Απάντηση
Recovery requires tested restores. A restore exercise validates permissions, dependencies, timing, data integrity, and the runbook against the stated RTO and RPO.
Κάρτα 161
Ερώτηση
Why is deploying stateless compute in two Regions insufficient for regional recovery?
Απάντηση
The application's state and dependencies also need a recovery design. Data replication, secrets, configuration, DNS, and quotas determine whether the second Region can actually serve.
Κάρτα 162
Ερώτηση
How does a load balancer reduce the impact of one broken target?
Απάντηση
It stops routing new requests to targets that fail health checks. Redundant healthy targets must still exist in other failure domains.
Κάρτα 163
Ερώτηση
Many clients retry a throttled service at the same time. Which retry strategy avoids another synchronized surge?
Απάντηση
Exponential backoff with jitter. Increasing delays reduce pressure, and randomness spreads retries instead of aligning them.
Κάρτα 164
Ερώτηση
Which service assesses an application's resilience posture against defined recovery targets?
Απάντηση
AWS Resilience Hub. It evaluates supported application resources and recommends resilience improvements and tests.
Κάρτα 165
Ερώτηση
How does a durable queue keep a temporary consumer outage from becoming a producer outage?
Απάντηση
It accepts and retains work while consumers are unavailable. Producers no longer need every consumer to respond synchronously.
Κάρτα 166
Ερώτηση
What usually happens to steady-state cost as a DR design moves from backup-and-restore toward active-active?
Απάντηση
Cost rises as recovery capacity stays more ready. Faster RTO generally requires more live infrastructure, replication, and operational complexity before a disaster.
Κάρτα 167
Ερώτηση
A backup must remain recoverable after a regional disruption. Which copy strategy fits?
Απάντηση
Maintain a backup copy in another Region. Regional separation protects recovery data from sharing the production Region's failure boundary.
Κάρτα 168
Ερώτηση
A relational database needs automatic failover and readable standby capacity across three Availability Zones. Which RDS deployment fits?
Απάντηση
An RDS Multi-AZ DB cluster. Its writer and two readable instances span three AZs, combining high availability with read capacity unlike a Multi-AZ DB instance's non-readable standby.
Κάρτα 169
Ερώτηση
What should drive the first choice among object, file, and block storage?
Απάντηση
The workload's access protocol and sharing pattern. Object storage uses API-addressed objects, file storage provides a shared hierarchy, and block storage presents volumes to compute.
Κάρτα 170
Ερώτηση
A very large object must upload to S3 quickly and recover efficiently from a network interruption. Which upload method fits?
Απάντηση
Multipart upload. Parts transfer independently and in parallel, and only failed parts need to be retried.
Κάρτα 171
Ερώτηση
A general EC2 workload needs SSD block storage with performance provisioned independently of capacity. Which volume type fits?
Απάντηση
EBS gp3. It is the general-purpose SSD choice and lets IOPS and throughput be tuned without inflating volume size solely for performance.
Κάρτα 172
Ερώτηση
A shared file workload has unpredictable throughput bursts and should not manage provisioned throughput. Which EFS mode fits?
Απάντηση
EFS Elastic Throughput. It automatically adjusts throughput to workload activity, trading manual capacity planning for usage-based scaling.
Κάρτα 173
Ερώτηση
An HPC job needs a high-throughput parallel file system that can process data from S3. Which service fits?
Απάντηση
Amazon FSx for Lustre. It provides a managed parallel file system for compute-intensive workloads and integrates with S3 datasets.
Κάρτα 174
Ερώτηση
An EC2 workload needs the lowest-latency temporary scratch space and can rebuild all data after host loss. Which storage fits?
Απάντηση
EC2 instance store. It is physically attached ephemeral block storage, so performance is high but data does not survive every stop, termination, or host failure.
Κάρτα 175
Ερώτηση
On-premises file clients need low-latency cached access while durable objects live in S3. Which hybrid service fits?
Απάντηση
Amazon S3 File Gateway. It exposes file protocols locally, caches hot data, and stores files as S3 objects.
Κάρτα 176
Ερώτηση
A large active NFS dataset must move repeatedly to AWS over the network with parallel transfer and verification. Which service fits?
Απάντηση
AWS DataSync. It accelerates and automates online data movement between supported storage systems with integrity checks.
Κάρτα 177
Ερώτηση
Users far from one S3 bucket need faster long-distance uploads over the public internet. Which feature may help?
Απάντηση
S3 Transfer Acceleration. It accepts traffic at nearby edge locations and carries it over the AWS network to the bucket; measure it because benefit depends on the path.
Κάρτα 178
Ερώτηση
A latency-sensitive database needs sustained high IOPS and durability beyond general-purpose SSD. Which EBS family fits?
Απάντηση
Provisioned IOPS SSD, typically io2. It is designed for demanding transactional workloads that need predictable provisioned I/O performance.
Κάρτα 179
Ερώτηση
Windows applications need a managed shared file system with SMB and Active Directory integration. Which service fits?
Απάντηση
Amazon FSx for Windows File Server. It supplies Windows-native file semantics and managed integration instead of adapting an NFS service.
Κάρτα 180
Ερώτηση
A large sequential workload needs high-throughput HDD block storage rather than low-latency transactional IOPS. Which EBS type fits?
Απάντηση
Throughput Optimized HDD (st1). It targets frequently accessed, throughput-intensive sequential data such as logs and big-data workloads.
Κάρτα 181
Ερώτηση
Clients repeatedly need different portions of a very large S3 object. What request pattern avoids downloading it all?
Απάντηση
Parallel or selective byte-range GET requests. Fetching only required ranges can increase aggregate throughput and reduce unnecessary transfer.
Κάρτα 182
Ερώτηση
One EBS volume cannot provide enough aggregate throughput, and the application can tolerate losing the stripe if one volume fails. Which layout increases performance?
Απάντηση
RAID 0 across multiple EBS volumes. Striping aggregates performance but adds no redundancy, so durable recovery must come from elsewhere.
Κάρτα 183
Ερώτηση
A CPU-bound batch workload has little memory pressure. Which EC2 instance family category fits first?
Απάντηση
Compute optimized. Its resource balance favors processor performance instead of paying for memory or storage the workload does not need.
Κάρτα 184
Ερώτηση
An Auto Scaling group should keep average CPU near a chosen utilization as load changes. Which policy fits?
Απάντηση
Target tracking scaling. It adjusts desired capacity to keep the selected metric near its target, like a thermostat.
Κάρτα 185
Ερώτηση
A Lambda function is CPU-bound and needs to finish faster. Which configuration should be tested first?
Απάντηση
Increase the function's memory setting. Lambda allocates more CPU with more memory, so profiling several sizes reveals the best latency and cost point.
Κάρτα 186
Ερώτηση
Tightly coupled EC2 nodes need the lowest possible inter-instance network latency in one Availability Zone. Which placement strategy fits?
Απάντηση
A cluster placement group. It packs supported instances close together for high-throughput, low-latency networking, trading away AZ-level distribution.
Κάρτα 187
Ερώτηση
An in-memory analytics engine holds a very large working set in RAM. Which EC2 category fits?
Απάντηση
Memory optimized. These instances provide a higher memory-to-compute ratio for large in-memory datasets.
Κάρτα 188
Ερώτηση
One function must guarantee capacity while preventing it from consuming all account concurrency. Which setting helps?
Απάντηση
Reserved concurrency. It guarantees up to the reserved amount for that function and also caps its maximum concurrent executions.
Κάρτα 189
Ερώτηση
Thousands of queued container jobs need managed scheduling onto dynamically provisioned compute. Which service fits?
Απάντηση
AWS Batch. It queues and schedules batch jobs while managing compute environments based on job requirements.
Κάρτα 190
Ερώτηση
A group should add much more capacity for a severe alarm breach than for a small breach. Which policy fits?
Απάντηση
Step scaling. Different breach ranges trigger different capacity adjustments, matching response size to observed pressure.
Κάρτα 191
Ερώτηση
A machine-learning training job needs GPUs or purpose-built accelerators. Which EC2 category fits?
Απάντηση
Accelerated computing instances. Their attached accelerators outperform general-purpose CPUs for supported graphics, inference, and training workloads.
Κάρτα 192
Ερώτηση
A team needs managed clusters for Apache Spark and Hadoop processing over large datasets. Which service fits?
Απάντηση
Amazon EMR. It provisions and manages big-data frameworks while retaining control over cluster sizing and engines.
Κάρτα 193
Ερώτηση
A container service has no host-management requirement and each task needs a defined CPU and memory shape. Which launch model fits?
Απάντηση
AWS Fargate. Tasks receive requested serverless container capacity without choosing or maintaining EC2 hosts.
Κάρτα 194
Ερώτηση
Scale-out is slow because instances spend several minutes installing software before joining service. Which feature can reduce launch latency?
Απάντηση
An EC2 Auto Scaling warm pool. Pre-initialized instances wait in a reusable state so they can enter service faster during scale-out.
Κάρτα 195
Ερώτηση
A distributed database needs very high local I/O throughput and large instance-attached datasets. Which EC2 category fits?
Απάντηση
Storage optimized. These instances balance compute with high sequential or random I/O for data-intensive local storage workloads.
Κάρτα 196
Ερώτηση
A supported Linux workload can run on Arm and needs better price-performance. Which processor family should be benchmarked?
Απάντηση
AWS Graviton-based instances. Native Arm-compatible applications can gain price-performance benefits, but dependencies should be verified and measured.
Κάρτα 197
Ερώτηση
Users in one metropolitan area need single-digit-millisecond access to compute that still uses AWS services and APIs. Which placement may fit?
Απάντηση
An AWS Local Zone. It places selected resources closer to that population than the parent Region, when the required services are available there.
Κάρτα 198
Ερώτηση
A transactional application needs SQL joins, referential integrity, and a familiar relational engine. Which managed database family fits?
Απάντηση
Amazon RDS or Amazon Aurora. Relational services preserve SQL and transaction semantics while AWS manages common database operations.
Κάρτα 199
Ερώτηση
What key-design property prevents a high-throughput DynamoDB table from concentrating traffic on one partition?
Απάντηση
A high-cardinality partition key with traffic spread across values. Even distribution lets DynamoDB use partitioned capacity instead of creating a hot key.
Κάρτα 200
Ερώτηση
An application can tolerate stale data and wants to offload repeated relational reads. Which pattern fits?
Απάντηση
Cache-aside with Amazon ElastiCache. The application checks the cache first, loads misses from the database, and controls invalidation.
Κάρτα 201
Ερώτηση
A workload stores flexible JSON-like documents and needs MongoDB-compatible APIs on a managed service. Which database fits?
Απάντηση
Amazon DocumentDB (with MongoDB compatibility). Its document model suits nested semi-structured records when relational joins are not the core access pattern.
Κάρτα 202
Ερώτηση
A MySQL-compatible workload needs managed read scaling and fast replica promotion. Which database design fits?
Απάντηση
Amazon Aurora with Aurora Replicas. Readers share the cluster storage layer, serve read traffic, and act as failover targets.
Κάρτα 203
Ερώτηση
A DynamoDB application needs microsecond read latency for eventually consistent hot keys without application-managed cache logic. Which feature fits?
Απάντηση
DynamoDB Accelerator (DAX). It is an API-compatible in-memory cache for DynamoDB reads.
Κάρτα 204
Ερώτηση
A fraud system must traverse many relationships among accounts, devices, and transactions. Which database type fits?
Απάντηση
A graph database such as Amazon Neptune. Graph-native relationships and traversals avoid forcing connected data into join-heavy tables.
Κάρτα 205
Ερώτηση
A company needs complex SQL analytics across large structured datasets with many joins. Which service fits?
Απάντηση
Amazon Redshift. Its columnar data-warehouse architecture is optimized for analytical queries rather than row-by-row transactional access.
Κάρτα 206
Ερώτηση
Why should an application avoid routing read-after-write requests to an ordinary RDS read replica?
Απάντηση
Replication is asynchronous, so the replica may lag. Strongly current reads should use the writer unless the engine and design provide another consistency guarantee.
Κάρτα 207
Ερώτηση
A DynamoDB table needs an additional query pattern on a different partition key. What should be added?
Απάντηση
A global secondary index. It provides another partition-and-sort-key view that can be queried without scanning the base table.
Κάρτα 208
Ερώτηση
An application needs full-text search and near-real-time log analytics. Which managed engine fits?
Απάντηση
Amazon OpenSearch Service. It indexes documents for search, aggregation, and operational analytics rather than primary relational transactions.
Κάρτα 209
Ερώτηση
A microservice needs a durable primary database with in-memory access and Redis-compatible APIs. Which service fits?
Απάντηση
Amazon MemoryDB. It combines an in-memory data model with Multi-AZ durability, unlike using an ephemeral cache as the system of record.
Κάρτα 210
Ερώτηση
A bursty serverless application spends too much database capacity on opening relational connections. Which service fits?
Απάντηση
Amazon RDS Proxy. Connection pooling and reuse let many clients share fewer database connections.
Κάρτα 211
Ερώτηση
An application needs Cassandra-compatible wide-column storage without provisioning or operating database nodes. Which service fits?
Απάντηση
Amazon Keyspaces (for Apache Cassandra). It provides managed, serverless Cassandra-compatible tables that scale without cluster administration.
Κάρτα 212
Ερώτηση
Which Aurora endpoint distributes new read-only connections among available replicas?
Απάντηση
The reader endpoint. It balances connections across Aurora Replicas; it does not split individual queries from one connection.
Κάρτα 213
Ερώτηση
A load balancer must route HTTP requests by host name, path, and header. Which type fits?
Απάντηση
An Application Load Balancer. Layer 7 listener rules understand HTTP request attributes and route them to target groups.
Κάρτα 214
Ερώτηση
A website serves the same static objects to users worldwide. Which service lowers latency and origin traffic?
Απάντηση
Amazon CloudFront. Edge locations cache objects close to viewers and fetch misses from the origin.
Κάρτα 215
Ερώτηση
Dozens of VPCs and on-premises networks need transitive hub-and-spoke connectivity. Which service fits?
Απάντηση
AWS Transit Gateway. It replaces a growing mesh of point-to-point connections with a regional routing hub.
Κάρτα 216
Ερώτηση
A hybrid workload needs more consistent private network performance than internet-based VPN alone. Which connection fits?
Απάντηση
AWS Direct Connect. A dedicated connection provides a private path with more predictable network behavior than the public internet.
Κάρτα 217
Ερώτηση
A global application sends non-cacheable TCP traffic to healthy regional endpoints and needs stable anycast IPs. Which service fits?
Απάντηση
AWS Global Accelerator. It improves the network path to regional endpoints without caching application content.
Κάρτα 218
Ερώτηση
A service needs extreme TCP or UDP connection performance without HTTP-aware routing. Which load balancer fits?
Απάντηση
A Network Load Balancer. It operates at Layer 4 and preserves a transport-level model instead of inspecting HTTP paths.
Κάρτα 219
Ερώτηση
Which DNS policy chooses among regional endpoints by expected user latency?
Απάντηση
Route 53 latency-based routing. It answers with the Region AWS expects to provide the lowest latency for the requester.
Κάρτα 220
Ερώτηση
Two VPCs need direct private connectivity, with no requirement for transitive routing or a central hub. Which option fits?
Απάντηση
VPC peering. It creates direct private routes between the two VPCs, but peering relationships are not transitive.
Κάρτα 221
Ερώτηση
What placement principle reduces latency between compute and a regional data store?
Απάντηση
Keep dependent resources in the same Region and, when the service model permits, avoid unnecessary AZ crossings. Data locality shortens the network path and can also reduce transfer cost.
Κάρτα 222
Ερώτηση
A hybrid connection is needed quickly while a dedicated circuit is being provisioned. Which option provides the faster setup?
Απάντηση
AWS Site-to-Site VPN. It uses internet connectivity and can serve as the initial or backup path while Direct Connect is arranged.
Κάρτα 223
Ερώτηση
Third-party virtual firewalls must scale transparently in the network path. Which load balancer fits?
Απάντηση
A Gateway Load Balancer. It distributes traffic across virtual network appliances while preserving an inline service-insertion model.
Κάρτα 224
Ερώτηση
Should a dynamic non-HTTP application choose a CDN cache or a global network accelerator?
Απάντηση
Choose the accelerator when traffic is non-cacheable and needs optimized routing; choose the CDN for cacheable HTTP content. The decisive constraint is caching and protocol behavior, not simply global users.
Κάρτα 225
Ερώτηση
A provider must expose one service privately to many consumer VPCs without routing entire networks together. Which service fits?
Απάντηση
AWS PrivateLink. Consumers use interface endpoints to reach the service privately without transitive VPC connectivity.
Κάρτα 226
Ερώτηση
A growing multi-account network needs centrally planned, non-overlapping IP address allocation. Which service fits?
Απάντηση
Amazon VPC IP Address Manager (IPAM). It plans, tracks, and monitors address space across accounts and Regions.
Κάρτα 227
Ερώτηση
Which service moves large datasets online between on-premises storage and S3, EFS, or FSx with scheduling and verification?
Απάντηση
AWS DataSync. It automates parallel transfer and integrity validation for supported storage endpoints.
Κάρτα 228
Ερώτηση
Analysts need occasional SQL queries directly over files in S3 without running a database cluster. Which service fits?
Απάντηση
Amazon Athena. It performs serverless SQL queries on data in place and charges by query work such as bytes scanned.
Κάρτα 229
Ερώτηση
Multiple applications need to process the same ordered stream of real-time records independently. Which service fits?
Απάντηση
Amazon Kinesis Data Streams. Consumers read retained stream records independently, with ordering maintained within each shard.
Κάρτα 230
Ερώτηση
A team needs serverless data discovery, a central catalog, and managed ETL jobs. Which service fits?
Απάντηση
AWS Glue. Crawlers and the Data Catalog describe datasets, while Glue jobs transform and load them without a persistent cluster.
Κάρτα 231
Ερώτηση
An on-premises application needs iSCSI block volumes backed by cloud storage. Which hybrid service fits?
Απάντηση
AWS Storage Gateway Volume Gateway. It presents local iSCSI volumes while integrating the data with AWS-managed cloud storage and snapshots.
Κάρτα 232
Ερώτηση
Business users need managed interactive dashboards over AWS data sources. Which service fits?
Απάντηση
Amazon Quick Sight, part of Amazon Quick. It provides managed business-intelligence analysis and published interactive dashboards rather than a data-processing engine.
Κάρτα 233
Ερώτηση
Athena queries usually filter by date, but every query scans the whole S3 dataset. What layout change helps?
Απάντηση
Partition the dataset by the common date filter and query those partitions. Partition pruning limits the files scanned for each request.
Κάρτα 234
Ερώτηση
Streaming records should land in S3 or another supported destination with managed buffering and delivery. Which service fits?
Απάντηση
Amazon Data Firehose. It buffers, optionally transforms, and delivers streaming data without consumer fleet management.
Κάρτα 235
Ερώτηση
A team must upload data from its own storage devices through a high-speed AWS facility instead of ordering an AWS transfer device. Which service fits?
Απάντηση
AWS Data Transfer Terminal. The team reserves a secure, network-ready physical location, brings its own devices, and transfers data to AWS over the facility's connection.
Κάρτα 236
Ερώτηση
A data team needs Apache Spark clusters with control over versions, instances, and tuning. Which service fits better than a simple ETL job?
Απάντηση
Amazon EMR. It provides managed big-data clusters when framework control and large-scale distributed processing are decisive.
Κάρτα 237
Ερώτηση
A BI team needs repeatable complex joins across a large centralized analytical warehouse. Which service fits?
Απάντηση
Amazon Redshift. It is built for structured warehouse analytics and high-throughput SQL reporting.
Κάρτα 238
Ερώτηση
Athena queries read only a few columns from a large S3 dataset. Which file format usually reduces scanned data?
Απάντηση
A compressed columnar format such as Parquet. Column pruning and compression avoid reading irrelevant row fields.
Κάρτα 239
Ερώτηση
External partners use SFTP, but files must arrive directly in S3. Which managed endpoint fits?
Απάντηση
AWS Transfer Family. It supports familiar managed file-transfer protocols while using AWS storage as the backend.
Κάρτα 240
Ερώτηση
An application requires Apache Kafka APIs and ecosystem compatibility without operating Kafka brokers alone. Which service fits?
Απάντηση
Amazon Managed Streaming for Apache Kafka (Amazon MSK). It preserves Kafka compatibility while AWS manages broker infrastructure tasks.
Κάρτα 241
Ερώτηση
S3 access patterns are unknown and change over time, but objects need millisecond access when active. Which class fits?
Απάντηση
S3 Intelligent-Tiering. It moves objects among access tiers based on observed use, adding a monitoring fee while avoiding retrieval fees for its automatic low-latency tiers.
Κάρτα 242
Ερώτηση
A fault-tolerant batch fleet can checkpoint and lose instances with short notice. Which purchase option offers the largest discount potential?
Απάντηση
EC2 Spot Instances. They use spare capacity at a discount, and the workload must handle interruption and capacity changes.
Κάρτα 243
Ερώτηση
A new DynamoDB workload has unpredictable traffic and no reliable capacity forecast. Which mode fits first?
Απάντηση
On-demand capacity mode. It automatically handles request volume without capacity planning, trading convenience for a higher per-request price than well-used provisioned capacity.
Κάρτα 244
Ερώτηση
Private instances send heavy S3 traffic through a NAT gateway. What network change removes that NAT processing path?
Απάντηση
Add an S3 gateway VPC endpoint and route S3 traffic through it. Gateway endpoints have no hourly or data-processing charge and keep traffic on the AWS network.
Κάρτα 245
Ερώτηση
Long-lived data is rarely read, must survive an Availability Zone loss, and needs millisecond retrieval. Which S3 class fits?
Απάντηση
S3 Standard-Infrequent Access. It stores data across multiple AZs with lower storage cost, balanced by retrieval charges and minimum-duration rules.
Κάρτα 246
Ερώτηση
Compute usage is steady, but the team wants flexibility across eligible instance families, Regions, and EC2, Lambda, or Fargate. Which discount model fits?
Απάντηση
A Compute Savings Plan. The organization commits to an hourly spend level and receives discounted eligible compute usage with broad service and configuration flexibility.
Κάρτα 247
Ερώτηση
A DynamoDB workload has stable, predictable traffic that consistently uses reserved throughput. Which mode can cost less?
Απάντηση
Provisioned capacity mode with appropriate scaling. Paying for planned read and write capacity can beat on-demand pricing when utilization is predictable.
Κάρτα 248
Ερώτηση
Two chatty EC2 tiers do not need AZ separation from each other, and cross-AZ transfer dominates cost. What placement can help?
Απάντηση
Keep the chatty path in the same Availability Zone where resilience requirements allow. Cross-AZ architecture improves failure isolation but can add data-transfer charges.
Κάρτα 249
Ερώτηση
Infrequently accessed S3 data is recreatable and may be lost with one Availability Zone. Which class can cut cost?
Απάντηση
S3 One Zone-Infrequent Access. It keeps data in one AZ, so it suits replaceable data rather than the only copy of critical records.
Κάρτα 250
Ερώτηση
A stable EC2 workload needs both a billing discount and reserved capacity in one specific Availability Zone. Which Reserved Instance scope fits?
Απάντηση
A zonal Reserved Instance. It reserves matching capacity in the chosen AZ and provides the discount there; a regional Reserved Instance provides AZ flexibility but does not reserve capacity.
Κάρτα 251
Ερώτηση
A large DynamoDB table stores infrequently accessed historical data, and storage cost dominates request cost. Which table class may fit?
Απάντηση
DynamoDB Standard-Infrequent Access. It lowers storage cost while raising request cost, so it fits storage-heavy, low-access tables.
Κάρτα 252
Ερώτηση
Global users repeatedly download the same public objects from a regional origin. What can reduce origin transfer and requests?
Απάντηση
Cache the objects with Amazon CloudFront. A high cache-hit ratio serves viewers from edge locations and reduces repeated origin delivery.
Κάρτα 253
Ερώτηση
Archive data is read about quarterly but still needs millisecond retrieval. Which S3 class fits?
Απάντηση
S3 Glacier Instant Retrieval. It lowers storage cost for rarely accessed archives while preserving real-time access, with retrieval and minimum-duration charges.
Κάρτα 254
Ερώτηση
A new workload is short-lived, cannot be interrupted, and has unknown steady demand. Which EC2 purchase option avoids commitment?
Απάντηση
On-Demand Instances. They provide full flexibility without a term commitment, making them suitable while demand is uncertain.
Κάρτα 255
Ερώτηση
A relational workload is intermittent and must scale database capacity without manual instance changes. Which option fits?
Απάντηση
Aurora Serverless v2. It adjusts Aurora capacity in fine-grained steps, which suits variable demand that would leave provisioned instances idle.
Κάρτα 256
Ερώτηση
What is the main trade-off between one shared NAT gateway and one NAT gateway per Availability Zone?
Απάντηση
A shared gateway can cost less, while per-AZ gateways improve fault isolation and avoid cross-AZ routing for local private subnets. Choose from availability and traffic economics together.
Κάρτα 257
Ερώτηση
Archives are read roughly yearly and can wait minutes or hours for restore. Which S3 class fits?
Απάντηση
S3 Glacier Flexible Retrieval. It trades immediate access for lower archive storage cost and several retrieval-speed options.
Κάρτα 258
Ερώτηση
An EC2 fleet averages low CPU and memory use for months. What should happen before buying a larger commitment?
Απάντηση
Right-size the instances using measured utilization. Commitments discount usage, but they do not fix paying for capacity the workload never needs.
Κάρτα 259
Ερώτηση
An RDS database has a stable multi-year production baseline. Which purchase choice can discount its instance cost?
Απάντηση
Reserved DB instances. A term commitment discounts predictable RDS instance usage, after the database has been right-sized.
Κάρτα 260
Ερώτηση
When can an interface VPC endpoint cost more than keeping low-volume service traffic on an existing NAT path?
Απάντηση
When endpoint hourly and data-processing charges exceed the avoided NAT and transfer cost. Private routing is valuable, but endpoint count and traffic volume still matter.
Κάρτα 261
Ερώτηση
Compliance archives are almost never read and can tolerate the longest restore time. Which S3 class minimizes storage cost?
Απάντηση
S3 Glacier Deep Archive. It is the lowest-cost S3 archive tier for very rare access, with long minimum duration and hours-scale retrieval.
Κάρτα 262
Ερώτηση
Traffic varies through the day and idle EC2 instances dominate cost. Which capacity strategy fits?
Απάντηση
Auto Scaling with sensible minimum and maximum capacity. Matching instance count to demand removes idle capacity while preserving required headroom.
Κάρτα 263
Ερώτηση
An RDS instance has consistently low CPU, memory, and I/O demand. What should reduce cost before changing engines?
Απάντηση
Right-size the DB instance and storage to measured needs. A smaller supported configuration removes idle capacity with less migration risk than an engine redesign.
Κάρτα 264
Ερώτηση
When can a dedicated hybrid link become economical compared with internet VPN?
Απάντηση
When sustained data volume, required consistency, or private connectivity justifies its port and provider costs. VPN usually has a lower entry cost for modest or temporary traffic.
Κάρτα 265
Ερώτηση
Objects become cold predictably after 30 days and expire after a policy period. What should automate the change?
Απάντηση
An S3 Lifecycle rule. It transitions eligible objects to cheaper classes and expires them on a schedule without manual jobs.
Κάρτα 266
Ερώτηση
A small event handler runs for seconds a few times per hour. Which compute model avoids paying for an idle server?
Απάντηση
AWS Lambda. Request-based execution suits intermittent work when the function limits and event model fit.
Κάρτα 267
Ερώτηση
When is a cache more cost-effective than adding another relational read replica?
Απάντηση
When many requests reuse the same hot data and can tolerate cache freshness rules. A cache can remove repeated reads; a replica is better for broad SQL read scaling.
Κάρτα 268
Ερώτηση
A small branch sends modest traffic to AWS and does not need a dedicated circuit. Which connection is the lower-entry-cost fit?
Απάντηση
AWS Site-to-Site VPN. It uses the internet and avoids dedicated-link provisioning, with less predictable performance than Direct Connect.
Κάρτα 269
Ερώτηση
A general SSD volume is overprovisioned only because its older type ties performance to size. Which EBS type can decouple them?
Απάντηση
EBS gp3. Capacity, IOPS, and throughput can be tuned independently, which avoids buying unused storage just to reach performance targets.
Κάρτα 270
Ερώτηση
A small container workload has irregular demand and the team cannot keep EC2 hosts well utilized. Which launch model may cost less operationally?
Απάντηση
AWS Fargate. Per-task capacity avoids an idle host fleet, though steady high utilization should be compared with optimized EC2 capacity.
Κάρτα 271
Ερώτηση
Automated database backups are kept far longer than the business recovery policy requires. What should change?
Απάντηση
Align backup retention with the validated recovery requirement. Extra retention adds storage cost without value when legal, audit, and recovery needs do not require it.
Κάρτα 272
Ερώτηση
When does Transit Gateway usually justify its attachment and processing charges over many peerings?
Απάντηση
When centralized, transitive connectivity replaces a complex VPC and hybrid mesh. The operational simplicity can outweigh service charges at larger network scale.
Κάρτα 273
Ερώτηση
Which EBS type is cost-effective for large, frequently accessed sequential workloads that need throughput rather than transactional IOPS?
Απάντηση
Throughput Optimized HDD (st1). It fits big sequential scans such as logs or data processing, not boot volumes or small random I/O.
Κάρτα 274
Ερώτηση
A Linux application and its dependencies support Arm. What compute change should be benchmarked for price-performance?
Απάντηση
Move to Graviton-based instances or runtimes. AWS-designed Arm processors can improve price-performance when the software stack is compatible.
Κάρτα 275
Ερώτηση
A relational database is write-bound, while read replicas sit mostly idle. What does that imply?
Απάντηση
Read replicas do not address the actual bottleneck and may be removable. They scale reads; write capacity needs another design or database choice.
Κάρτα 276
Ερώτηση
Three VPCs need a few direct, non-transitive private links. Which connectivity can avoid a paid routing hub?
Απάντηση
VPC peering. A small set of direct relationships can be simpler and cheaper, but the design becomes hard to manage as the mesh grows.
Κάρτα 277
Ερώτηση
Most files in an EFS file system go untouched after a few weeks. What should reduce storage cost automatically?
Απάντηση
EFS lifecycle management. It moves inactive files to lower-cost EFS storage classes according to the configured policy.
Κάρτα 278
Ερώτηση
Capacity demand rises at the same known time every weekday. Which scaling method can add capacity before the rise?
Απάντηση
Scheduled scaling. A recurring action changes desired or boundary capacity at the known time instead of waiting for utilization to climb.
Κάρτα 279
Ερώτηση
Which managed service moves database data with ongoing replication to reduce migration downtime?
Απάντηση
AWS Database Migration Service (AWS DMS). It copies data and can keep source and target synchronized during a migration.
Κάρτα 280
Ερώτηση
Private workloads reach DynamoDB through a NAT gateway. Which endpoint can remove that path without hourly endpoint charges?
Απάντηση
A DynamoDB gateway VPC endpoint. Route-table entries keep supported traffic private and avoid NAT processing for that service.
Κάρτα 281
Ερώτηση
Old EBS snapshots accumulate after every backup cycle. What policy prevents indefinite spend?
Απάντηση
An automated retention policy that expires unneeded snapshots. Recovery requirements should set how many copies and ages remain, rather than keeping every snapshot.
Κάρτα 282
Ερώτηση
Demand follows a recurring pattern but its required capacity changes over time. Which scaling method forecasts it?
Απάντηση
Predictive scaling. It analyzes historical load and schedules capacity ahead of forecast demand, while dynamic scaling can handle deviations.
Κάρτα 283
Ερώτηση
A database migration changes from one engine family to another and the schema is incompatible. What tool handles much of the conversion?
Απάντηση
AWS DMS Schema Conversion. It converts schema objects and much database code for a heterogeneous migration; AWS DMS then moves and replicates the data.
Κάρτα 284
Ερώτηση
What is the first architecture question when network transfer becomes a major AWS bill item?
Απάντηση
Why is the data crossing a Region, Availability Zone, or internet boundary? Removing unnecessary movement often beats negotiating around the same inefficient path.
Κάρτα 285
Ερώτηση
A data publisher wants approved external users to pay request and download charges for a shared S3 dataset. Which feature fits?
Απάντηση
S3 Requester Pays. Authenticated requesters identify themselves as the payer, while the bucket owner still pays storage charges.
Κάρτα 286
Ερώτηση
Development instances sit unused every night and weekend. What is the simplest cost control?
Απάντηση
Stop or scale them down on a schedule. Non-production availability requirements rarely justify paying for full capacity when nobody uses it.
Κάρτα 287
Ερώτηση
Expired session records should leave a DynamoDB table automatically without a cleanup fleet. Which feature fits?
Απάντηση
DynamoDB Time to Live (TTL). An expiry attribute marks items for background deletion without consuming application write capacity for each cleanup.
Κάρτα 288
Ερώτηση
Millions of tiny payloads create high request overhead and poor network efficiency. What transport change can help?
Απάντηση
Batch and compress data where latency requirements allow. Fewer larger transfers reduce per-request overhead and bytes moved.
Κάρτα 289
Ερώτηση
What decides between DataSync and Data Transfer Terminal for a large migration using customer-owned storage devices?
Απάντηση
Whether the source network can meet the deadline and cost target. Use DataSync remotely over a suitable network; use Data Transfer Terminal when bringing the devices to a high-speed AWS facility is the better transfer path.
Κάρτα 290
Ερώτηση
How should a Spot fleet reduce the chance that one capacity pool interrupts all workers?
Απάντηση
Diversify across instance types and Availability Zones. More eligible pools improve the fleet's chance of finding spare capacity and surviving a constrained pool.
Κάρτα 291
Ερώτηση
How can choosing a purpose-built database reduce total cost even when its unit price is not the lowest?
Απάντηση
It removes mismatched infrastructure and custom workaround code. The right data model can need fewer resources and less operations work for the required access pattern.
Κάρτα 292
Ερώτηση
A metered downstream API can process a fixed rate, but clients create expensive bursts. What control protects cost and capacity?
Απάντηση
Throttle requests and buffer acceptable asynchronous work. A rate boundary prevents uncontrolled consumption while a queue preserves work that need not finish immediately.
Κάρτα 293
Ερώτηση
A provisioned file system has far more capacity and throughput than monitoring shows it uses. What is the first cost action?
Απάντηση
Right-size it against measured demand and headroom. Paying for unused provisioned capacity is avoidable when a smaller setting still meets performance and growth requirements.
Κάρτα 294
Ερώτηση
Which service recommends rightsizing for supported compute resources from utilization data?
Απάντηση
AWS Compute Optimizer. It analyzes metrics and recommends configurations, which should still be checked against workload constraints.
Κάρτα 295
Ερώτηση
An RDS database grows unpredictably, and permanently overallocating storage wastes money. Which feature helps?
Απάντηση
RDS storage autoscaling. It increases allocated storage when needed within a configured maximum, reducing the need for a large speculative allocation.
Κάρτα 296
Ερώτηση
A dedicated connection is provisioned far above observed peak throughput. What should happen before renewal?
Απάντηση
Right-size bandwidth against measured demand and required headroom. Excess fixed capacity adds cost without improving an unconstrained workload.
Κάρτα 297
Ερώτηση
Which service feature gives organization-wide S3 usage and activity metrics to find cost and protection opportunities?
Απάντηση
S3 Storage Lens. Its aggregated metrics and recommendations expose storage patterns that can guide lifecycle, cleanup, and protection changes.
Κάρτα 298
Ερώτηση
A large in-memory application needs long idle periods but expensive startup from scratch. Which EC2 state may balance cost and restart time?
Απάντηση
EC2 hibernation. It saves RAM state to the encrypted root EBS volume and stops instance compute billing, subject to hibernation requirements and storage cost.
Κάρτα 299
Ερώτηση
What evidence should drive a database cost change: list price alone or workload metrics plus access patterns?
Απάντηση
Workload metrics plus access patterns. Capacity, consistency, latency, availability, and operational needs determine whether a cheaper-looking engine is actually cheaper to run.
Κάρτα 300
Ερώτηση
How can a company identify which applications drive shared network and transfer spend?
Απάντηση
Use consistent cost allocation tags and detailed billing data. Ownership metadata lets Cost Explorer or the Cost and Usage Report attribute spend before teams optimize it.

Blue geometric architecture hub linked to a shield, layered blocks, a speed gauge, and a bar chart.

300 κάρτες