Practice Exam 2

This second full-length practice exam uses 65 new questions with no repeats from Practice Exam 1. The domain mix again follows the official weighting: about 16 questions on Cloud Concepts, 20 on Security and Compliance, 22 on Cloud Technology and Services, and 7 on Billing, Pricing, and Support. Take it under exam conditions: 90 minutes, no notes, no pausing. Questions marked “Choose two” need exactly two answers. Answers, explanations, and domain tags follow the last question.

Questions

• 1. A video-transcoding task takes about two hours to process each file. Which AWS service can NOT run this task in a single invocation because of its maximum execution time?

• A. AWS Lambda B. AWS Batch
• C. Amazon EC2 D. Amazon ECS on AWS Fargate

• 2. A company runs its business logic in AWS Lambda functions. Under the shared responsibility model, what is the company responsible for?

• A. Securing the physical hosts in the data center B. Scaling the underlying servers when invocations increase
• C. Writing secure function code and managing the

functions’ IAM permissions

• D. Patching the operating system that runs the functions

• 3. A company wants to review its workloads against AWS architectural best practices, record the results, and get an improvement plan. Which tool should it use, at no additional charge?

• A. AWS Artifact B. AWS Pricing Calculator
• C. Amazon Inspector D. AWS Well-Architected Tool

• 4. An application needs very high I/O temporary storage for scratch data. Losing the data when the instance stops or terminates is acceptable. Which storage option is the best fit?

• A. Amazon EBS Provisioned IOPS volume B. Amazon S3 Standard
• C. Amazon EFS D. EC2 instance store

• 5. Which task can be performed only by the root user of a standalone AWS account?

• A. Close the AWS account B. Create an IAM user
• C. Launch an EC2 instance D. View AWS CloudTrail event history

• 6. A company is certain it will run one specific EC2 instance type in one Region, 24 hours a day, for the next three years. It does not need any flexibility and wants the largest possible discount. Which option should it buy?

• A. 3-year Standard Reserved Instances with All Upfront

payment

• B. 1-year Convertible Reserved Instances with No Upfront

payment

• C. 1-year Standard Reserved Instances with Partial Upfront

payment

• D. On-Demand Instances

• 7. An operations team defines its runbooks and infrastructure as code, and it deploys frequent, small, reversible changes. Which pillar of the AWS Well-Architected Framework do these practices support MOST directly?

• A. Security B. Operational Excellence
• C. Sustainability D. Cost Optimization

• 8. A mobile game needs a leaderboard database that handles millions of requests per second with single-digit millisecond latency and no servers to manage. Which service should it use?

• A. Amazon DynamoDB B. Amazon RDS for PostgreSQL
• C. Amazon Neptune D. Amazon Redshift

• 9. Twenty data analysts all need the same set of IAM permissions in one AWS account. What is the most efficient way to manage their permissions?

• A. Give each analyst the root user password. B. Attach the same inline policy to each analyst separately.
• C. Give all analysts the credentials of one shared IAM user. D. Create an IAM group, attach the policy to the group, and add the analysts to it.

• 10. A company replaces its self-managed customer relationship management (CRM) software with a software-as-a-service CRM product. Which migration strategy is this?

• A. Retain B. Repurchase
• C. Rehost D. Replatform

• 11. A website’s relational database is overloaded by repeated identical read queries. The team wants to keep frequently requested results in memory to reduce database load and speed up responses. Which service should it add?

• A. AWS Backup B. Amazon ElastiCache
• C. Amazon Athena D. Amazon S3 Glacier

• 12. A company wants every console sign-in to require something the user knows and something the user has. What should it enable?

• A. A stronger password policy only B. AWS CloudTrail
• C. Multi-factor authentication (MFA) D. A service control policy

• 13. A company wants a MySQL-compatible relational database with higher performance than standard MySQL and with storage that is automatically copied six ways across three Availability Zones. Which service fits?

• A. Amazon DocumentDB B. Amazon RDS for SQL Server
• C. Amazon DynamoDB D. Amazon Aurora

• 14. During migration planning, a company discovers that 15% of its applications are no longer used by anyone. What should it do with them according to the 7 Rs?

• A. Relocate B. Retain
• C. Retire D. Refactor

• 15. A retail company wants customers of its mobile app to sign up, sign in, and optionally use social identity providers to log in. Which service should it use?

• A. Amazon Cognito B. IAM users for each customer
• C. AWS IAM Identity Center D. AWS Directory Service

• 16. Which Amazon RDS feature provides high availability by maintaining a synchronous standby in a different Availability Zone with automatic failover?

• A. Performance Insights B. Read replicas
• C. Multi-AZ deployment D. Automated backups

• 17. A manager wants to see how the company’s AWS costs have changed by service over the past 12 months and to forecast next month’s spend. Which tool should be used?

• A. AWS Artifact B. AWS Cost Explorer
• C. AWS Pricing Calculator D. AWS Trusted Advisor

• 18. A company plans to break its monolithic application into microservices that use AWS Lambda and Amazon DynamoDB so that it can add features faster and scale each part independently. Which migration strategy is this?

• A. Refactor B. Retire
• C. Repurchase D. Rehost

• 19. Regulations require a company to store its encryption keys in dedicated, single-tenant hardware security modules under its exclusive control. Which service meets this requirement?

• A. Amazon Macie B. AWS Secrets Manager
• C. AWS Certificate Manager D. AWS CloudHSM

• 20. A company needs to run complex analytic queries across petabytes of structured historical sales data. Which service is designed for this?

• A. Amazon ElastiCache B. Amazon RDS for MySQL
• C. Amazon DynamoDB D. Amazon Redshift

• 21. A company wants to provision public SSL/TLS certificates for its Application Load Balancer and have them renewed automatically. Which service should it use?

• A. AWS Certificate Manager (ACM) B. AWS Secrets Manager
• C. AWS Key Management Service (AWS KMS) D. AWS Shield

• 22. Which pillar of the AWS Well-Architected Framework includes the design principles “democratize advanced technologies”, “use serverless architectures”, and “experiment more often”?

• A. Performance Efficiency B. Security
• C. Operational Excellence D. Reliability

• 23. A data engineering team needs a serverless service to discover data, build a central data catalog, and run extract, transform, and load (ETL) jobs. Which service fits?

• A. Amazon QuickSight B. AWS Glue
• C. Amazon Kinesis Data Streams D. Amazon Neptune

• 24. A security analyst receives an Amazon GuardDuty finding and needs to analyze related activity and visualize relationships between resources to find the root cause. Which service helps MOST?

• A. AWS Trusted Advisor B. AWS Artifact
• C. Amazon Detective D. Amazon Macie

• 25. Business users want interactive dashboards and reports built from data in Amazon Redshift and Amazon S3. Which AWS service provides business intelligence dashboards?

• A. Amazon EMR B. Amazon CloudWatch
• C. Amazon QuickSight D. AWS Glue

• 26. Which perspective of the AWS Cloud Adoption Framework helps orchestrate cloud initiatives while maximizing organizational benefits and minimizing transformation-related risks?

• A. People B. Platform
• C. Security D. Governance

• 27. A company uses AWS Organizations and wants to apply a consistent set of AWS WAF rules to all its web applications across every account, including accounts created in the future. Which service should it use?

• A. AWS Config only B. AWS Firewall Manager
• C. Network ACLs D. Amazon GuardDuty

• 28. When a new order is placed, a company wants to send an email and an SMS text message to several subscribers at once. Which service should it use?

• A. Amazon SNS B. Amazon Kinesis Data Streams
• C. AWS Step Functions D. Amazon SQS

• 29. A company wants its monthly AWS bill broken down by department and project. Which feature should it use?

• A. Cost allocation tags B. AWS Health Dashboard
• C. Security groups D. Service control policies

• 30. A company prepares for an annual external audit and wants to continuously and automatically collect evidence about how its AWS resources are used and configured, mapped to compliance frameworks. Which service should it use?

• A. AWS Artifact B. AWS Shield
• C. AWS Audit Manager D. Amazon Inspector

• 31. Which AWS CAF perspective focuses on building an enterprise-grade, scalable hybrid cloud platform and modernizing existing workloads?

• A. Governance B. People
• C. Business D. Platform

• 32. A company wants to trigger AWS Lambda functions when events arrive from a third-party SaaS application, routing each event to a target based on rules. Which service should it use?

• A. AWS Config B. Amazon Route 53
• C. Amazon SQS D. Amazon EventBridge

• 33. A company wants to protect data in transit between users’ web browsers and its Application Load Balancer. What should it do?

• A. Use an HTTPS listener with a TLS certificate. B. Enable default encryption on the S3 bucket.
• C. Enable encryption on the EBS volumes. D. Attach an IAM policy to the load balancer.

• 34. An insurance company needs to coordinate a multistep claims process that calls several Lambda functions in order, with retries and error handling, and wants a visual view of each run. Which service fits?

• A. AWS Glue B. Amazon SNS
• C. AWS Step Functions D. Amazon CloudFront

• 35. In which phase of the AWS CAF cloud transformation journey does an organization identify and prioritize transformation opportunities in line with its strategic objectives?

• A. Envision B. Align
• C. Launch D. Scale

• 36. A security team wants to find any S3 buckets, IAM roles, or KMS keys in its account that are shared with an external entity outside its organization. Which feature helps identify them?

• A. AWS Elastic Beanstalk B. AWS Cost Explorer
• C. IAM Access Analyzer D. Amazon Polly

• 37. EC2 instances in a private subnet must download software updates from the internet, but they must not be reachable from the internet. What should be added?

• A. Amazon CloudFront B. Elastic IP addresses on each instance
• C. An internet gateway attached directly to the instances D. A NAT gateway

• 38. A company wants to buy a third-party firewall appliance that runs on AWS and have the charges appear on its AWS bill. Where should it look?

• A. AWS Artifact B. AWS re:Post
• C. AWS Professional Services D. AWS Marketplace

• 39. A company wants to set up a new multi-account AWS environment quickly, following AWS best practices, with preconfigured guardrails and a dashboard of compliance status. Which service should it use?

• A. AWS Budgets B. Amazon Inspector
• C. AWS Control Tower D. AWS CloudFormation alone

• 40. A company’s IT staff used to spend most of their time racking servers and replacing failed disks. After moving to AWS, they spend that time on projects that set the business apart. Which advantage of cloud computing does this show?

• A. Benefit from massive economies of scale B. Trade variable expense for fixed expense
• C. Stop spending money running and maintaining data

centers

• D. Go global in minutes

• 41. A company has 60 VPCs across several accounts and also connects to two on-premises data centers. It wants a central hub to simplify routing between all of these networks. Which service should it use?

• A. VPC peering between every pair of VPCs B. AWS Transit Gateway
• C. Amazon Route 53 D. AWS Global Accelerator

• 42. Which statement about security groups is correct?

• A. They support explicit deny rules. B. Their rules are evaluated in numbered order.
• C. They apply only at the subnet level. D. They are stateful, so return traffic for an allowed request is automatically allowed.

• 43. A multiplayer game uses UDP and needs two static IP addresses that route players over the AWS global network to the nearest healthy Regional endpoint. Which service fits?

• A. AWS Direct Connect B. Amazon CloudFront
• C. AWS Global Accelerator D. Amazon Route 53 private hosted zones

• 44. Deploying an application across multiple Availability Zones primarily improves which characteristic?

• A. High availability B. Licensing flexibility
• C. Lower data transfer charges D. Faster developer onboarding

• 45. Which DDoS protection is automatically included for all AWS customers at no additional cost?

• A. AWS Shield Standard B. AWS Firewall Manager
• C. Amazon GuardDuty D. AWS Shield Advanced

• 46. A company needs to transfer 50 TB of files from an on-premises NAS to Amazon S3 and Amazon EFS over its network connection, on a recurring schedule, with automatic integrity checks. Which service fits?

• A. AWS Database Migration Service B. AWS DataSync
• C. AWS Storage Gateway Tape Gateway D. Amazon Kinesis Data Streams

• 47. A large company runs business-critical workloads on AWS. It wants a designated Technical Account Manager and a 15-minute response time when a business-critical system goes down. Which AWS Support plan meets these requirements?

• A. Enterprise B. Business
• C. Developer D. Enterprise On-Ramp

• 48. A company keeps its manufacturing control systems in its own data center but runs its customer website and analytics on AWS, with the two environments connected by a VPN. Which cloud deployment model is this?

• A. On-premises only B. All-in cloud
• C. Hybrid D. Software as a service

• 49. Which AWS services help an organization meet requirements to log API activity and track resource configuration changes over time? (Choose two.)

• A. Amazon Translate B. AWS Config
• C. Amazon Lightsail D. AWS CloudTrail
• E. Amazon Polly

• 50. A company wants to lift and shift hundreds of physical and virtual servers to AWS using continuous block-level replication, with minimal downtime at cutover. Which service should it use?

• A. AWS Application Migration Service B. AWS Database Migration Service
• C. AWS Transfer Family D. AWS DataSync

• 51. A security team wants a downloadable list of all IAM users in an account showing the status of their passwords, access keys, and MFA devices. Which IAM feature provides this?

• A. AWS Artifact report B. Amazon CloudWatch dashboard
• C. IAM credential report D. AWS Cost and Usage Report

• 52. A social media company wants to automatically detect inappropriate content and identify objects in user-uploaded images. Which service fits?

• A. Amazon Transcribe B. Amazon Rekognition
• C. Amazon Textract D. Amazon Comprehend

• 53. A company wants to move a large number of VMware vSphere virtual machines to a VMware-based environment running on AWS without buying new hardware, rewriting applications, or changing its existing VMware operations. Which migration strategy is this?

• A. Relocate B. Retire
• C. Repurchase D. Refactor

• 54. A healthcare company plans to store protected health information (PHI) on AWS. Who is responsible for making sure the company’s workload meets HIPAA requirements?

• A. An AWS Partner, who automatically becomes

accountable

• B. No one, because cloud workloads are exempt from

Hipaa

• C. AWS alone, because AWS data centers are HIPAA

compliant

• D. The company, by using HIPAA-eligible services,

accepting a Business Associate Addendum, and configuring

them correctly

• 55. Employees want to ask questions in natural language and get answers drawn from the company’s own documents in systems such as SharePoint and Confluence, with existing access permissions respected. Which service fits?

• A. Amazon Kinesis Data Firehose B. Amazon Polly
• C. Amazon Q Developer D. Amazon Q Business

• 56. Which type of data transfer is typically free of charge?

• A. Data transferred out from EC2 to the internet B. Data transferred in to AWS from the internet
• C. Data transferred between AWS Regions D. Data transferred out through a NAT gateway

• 57. While building a business case for the cloud, a company finds that it can use its existing eligible software licenses on AWS instead of paying for license-included instances. What is this approach called?

• A. Consolidated billing B. Bring your own license (BYOL)
• C. AWS Free Tier D. Savings Plans

• 58. A team of data scientists wants a fully managed service to build, train, and deploy its own custom machine learning models. Which service should it use?

• A. Amazon Translate B. Amazon SageMaker AI
• C. Amazon Lex D. Amazon QuickSight

• 59. A company must ensure that all data at rest on new Amazon EBS volumes is encrypted. What should it do?

• A. Subscribe to AWS Shield Advanced. B. Enable Amazon EBS encryption, which uses AWS KMS keys.
• C. Attach a security group to each volume. D. Request a certificate from AWS Certificate Manager.

• 60. Which Amazon S3 storage classes are designed for long-term archive data that does not need immediate access? (Choose two.)

• A. Amazon EBS gp3 B. S3 Glacier Flexible Retrieval
• C. S3 Glacier Deep Archive D. S3 Express One Zone
• E. Amazon EFS Standard

• 61. Which of the following are design principles of the Reliability pillar of the AWS Well-Architected Framework? (Choose two.)

• A. Test recovery procedures only after a real outage B. Run everything on one large instance to reduce complexity
• C. Make infrastructure changes manually to keep tight

control

• D. Automatically recover from failure
• E. Scale horizontally to increase aggregate workload

availability

• 62. An auditor from another company’s AWS account needs temporary, read-only access to resources in your account. What is the AWS-recommended approach?

• A. Make the resources publicly accessible for the audit

period.

• B. Create an IAM role with read-only permissions that the

auditor’s account is allowed to assume.

• C. Create a permanent IAM user and email the password to

the auditor.

• D. Share the root user credentials with the auditor.

• 63. Administrators need shell access to EC2 instances in private subnets without opening inbound SSH ports or managing bastion hosts. Which capability should they use?

• A. Amazon Route 53 B. AWS Direct Connect
• C. AWS Systems Manager Session Manager D. Amazon Inspector

• 64. A finance team needs the most detailed, line-item data about AWS costs and usage, delivered as files to an S3 bucket for analysis in its own tools. What should it use?

• A. AWS Budgets B. AWS Cost and Usage Report through AWS Data Exports
• C. AWS Health Dashboard D. AWS Pricing Calculator

• 65. Which pillar of the AWS Well-Architected Framework includes the design principles “enable traceability” and “apply security at all layers”?

• A. Reliability B. Sustainability
• C. Cost Optimization D. Security

Answers and explanations

• 1. A (Domain 3). A Lambda invocation can run for at most 15 minutes, so a two-hour job does not fit. EC2, AWS Batch, and Fargate tasks can all run for hours.
• 2. C (Domain 2). With Lambda, AWS manages the operating system, runtime infrastructure, physical hosts, and scaling. The customer is responsible for the code, its dependencies, the data, and the IAM permissions.
• 3. D (Domain 1). The AWS Well-Architected Tool is a free console tool for reviewing workloads against the framework and tracking improvement plans. Inspector scans for vulnerabilities, and Artifact provides compliance reports.
• 4. D (Domain 3). Instance store provides very fast, temporary block storage physically attached to the host, and its data is lost when the instance stops or terminates. EBS persists and costs more for provisioned IOPS that this use case does not need.
• 5. A (Domain 2). Closing a standalone account is one of the tasks that requires root user credentials. Properly authorized IAM identities can create users, launch instances, and view CloudTrail history.
• 6. A (Domain 4). Standard Reserved Instances with a three-year term and All Upfront payment give the largest RI discount. Convertible RIs and shorter terms trade discount for flexibility the company does not need.
• 7. B (Domain 1). “Perform operations as code” and “make frequent, small, reversible changes” are Operational Excellence design principles.
• 8. A (Domain 3). DynamoDB is a serverless key-value and document database that delivers single-digit millisecond performance at very large scale. RDS needs DB instances to be sized, and Redshift is built for analytics.
• 9. D (Domain 2). IAM groups let you attach permissions once and manage membership as people join or leave. Shared credentials and the root user break security best practices, and per-user policies are hard to maintain.
• 10. B (Domain 1). Moving to a different product, usually SaaS, is Repurchase (“drop and shop”).
• 11. B (Domain 3). ElastiCache (Valkey, Redis OSS, or Memcached) keeps frequently read data in memory to offload the database and reduce latency.
• 12. C (Domain 2). MFA combines a password (something you know) with a device or passkey (something you have). A password policy alone is still a single factor.
• 13. D (Domain 3). Aurora is MySQL- and PostgreSQL-compatible and stores six copies of data across three AZs. DocumentDB is MongoDB-compatible, and DynamoDB is NoSQL.
• 14. C (Domain 1). Retire means decommissioning applications that are no longer useful, which reduces cost and migration effort. Retain means keeping applications where they are for now.
• 15. A (Domain 2). Amazon Cognito provides sign-up, sign-in, and social or enterprise federation for customer-facing apps. IAM Identity Center is for workforce users, not app customers.
• 16. C (Domain 3). Multi-AZ keeps a standby in another AZ and fails over automatically. Read replicas mainly scale read traffic and are not the HA feature this question describes.
• 17. B (Domain 4). Cost Explorer shows historical costs by service, account, or tag and forecasts future spend. The Pricing Calculator estimates costs for planned architectures.
• 18. A (Domain 1). Re-architecting an application to use cloud-native features such as serverless and microservices is Refactor.
• 19. D (Domain 2). CloudHSM provides dedicated, single-tenant hardware security modules that you control. KMS is a multi-tenant managed key service, and Secrets Manager stores secrets.
• 20. D (Domain 3). Redshift is AWS’s petabyte-scale data warehouse for complex analytic queries. DynamoDB and RDS are for transactional workloads, and ElastiCache is a cache.
• 21. A (Domain 2). ACM provisions, manages, and automatically renews public SSL/TLS certificates for integrated services such as Elastic Load Balancing. KMS manages encryption keys, not certificates.
• 22. A (Domain 1). These are Performance Efficiency design principles, along with “go global in minutes” and “consider mechanical sympathy”.
• 23. B (Domain 3). AWS Glue is a serverless data integration service with crawlers, a Data Catalog, and ETL jobs. QuickSight builds dashboards, and Kinesis ingests streams.
• 24. C (Domain 2). Detective collects and graphs log data so you can investigate the root cause of findings from GuardDuty and other services. Macie finds sensitive data, and Trusted Advisor gives best-practice checks.
• 25. C (Domain 3). QuickSight (offered today as part of Amazon Quick Suite) is AWS’s business intelligence service for interactive dashboards. CloudWatch dashboards show operational metrics, not business reports.
• 26. D (Domain 1). The Governance perspective orchestrates cloud initiatives, maximizing benefits and minimizing risks. Platform is technical, and People covers culture and skills.
• 27. B (Domain 2). Firewall Manager centrally configures and enforces AWS WAF rules, Shield Advanced protections, and other firewall policies across accounts in an organization, including new accounts.
• 28. A (Domain 3). SNS is a publish/subscribe service that pushes one message to many subscribers over protocols such as email, SMS, and HTTP. SQS holds messages for consumers to poll.
• 29. A (Domain 4). Cost allocation tags label resources so that costs can be grouped by department, project, or any other key in billing reports and Cost Explorer.
• 30. C (Domain 2). Audit Manager continuously collects evidence from your AWS usage and maps it to frameworks to prepare for audits. Artifact provides AWS’s own compliance reports, not evidence about your resources.
• 31. D (Domain 1). The Platform perspective covers building a scalable hybrid cloud platform and modernizing workloads. Business, Governance, and People are business-focused perspectives.
• 32. D (Domain 3). EventBridge is a serverless event bus that receives events from AWS services, your apps, and supported SaaS partners, and routes them to targets using rules.
• 33. A (Domain 2). Encryption in transit uses TLS, so an HTTPS listener with a certificate (for example from ACM) protects traffic between browsers and the load balancer. The other options address data at rest or permissions.
• 34. C (Domain 3). Step Functions orchestrates multistep workflows with built-in retries, error handling, and a visual console view of each execution.
• 35. A (Domain 1). Envision is where you identify and prioritize transformation opportunities. Align identifies gaps and dependencies, Launch delivers pilots, and Scale expands them.
• 36. C (Domain 2). IAM Access Analyzer identifies resources such as S3 buckets, IAM roles, and KMS keys that are shared with an external entity.
• 37. D (Domain 3). A NAT gateway in a public subnet lets instances in private subnets start outbound internet connections while blocking unsolicited inbound connections. Giving instances public addresses would expose them.
• 38. D (Domain 4). AWS Marketplace is a curated catalog of third-party software, data, and services, and purchases are billed through the AWS bill.
• 39. C (Domain 2). Control Tower sets up and governs a multi-account landing zone with preconfigured controls (guardrails) and a dashboard. CloudFormation alone would require building all of this yourself.
• 40. C (Domain 1). Letting AWS handle racking, stacking, and powering servers frees staff for differentiating work, which is “stop spending money running and maintaining data centers”.
• 41. B (Domain 3). Transit Gateway acts as a central hub that connects many VPCs and on-premises networks. A full mesh of VPC peering connections between 60 VPCs would be very hard to manage.
• 42. D (Domain 2). Security groups are stateful and support only allow rules, and they apply at the network interface (instance) level. Numbered rule order and deny rules are features of network ACLs.
• 43. C (Domain 3). Global Accelerator provides static anycast IP addresses and routes TCP and UDP traffic over the AWS global network to the best healthy endpoint. CloudFront is focused on caching and delivering HTTP content.
• 44. A (Domain 1). Spreading across AZs keeps the application running if one AZ has a problem, which improves availability. It usually adds a small amount of inter-AZ data transfer cost rather than reducing it.
• 45. A (Domain 2). Shield Standard is automatically applied to all AWS customers at no extra cost. Shield Advanced is a paid subscription.
• 46. B (Domain 3). DataSync automates and accelerates online data transfer between on-premises storage and AWS storage services, with scheduling and integrity verification. DMS is for databases.
• 47. A (Domain 4). The Enterprise plan includes a designated TAM and a 15-minute response time for business-critical system down cases. Enterprise On-Ramp provides a pool of TAMs and a 30-minute response time.
• 48. C (Domain 1). A hybrid deployment connects on-premises infrastructure with cloud resources.
• 49. B and D (Domain 2). CloudTrail logs API activity, and AWS Config records configuration changes and evaluates compliance. Polly, Lightsail, and Translate are unrelated to auditing.
• 50. A (Domain 3). AWS Application Migration Service replicates source servers continuously at the block level and launches them on AWS with short cutover windows. DMS migrates databases only.
• 51. C (Domain 2). The IAM credential report lists every IAM user and the status of passwords, access keys, and MFA devices.
• 52. B (Domain 3). Rekognition detects objects, faces, text, and unsafe content in images and video. Textract extracts text from documents, and Comprehend analyzes text.
• 53. A (Domain 1). Relocate moves workloads to a cloud version of the same platform, such as a VMware-based environment on AWS, at the hypervisor level without new hardware or application changes.
• 54. D (Domain 2). Under the shared responsibility model, AWS secures the infrastructure and offers HIPAA-eligible services, but the customer must sign the Business Associate Addendum and configure and use the services in a compliant way.
• 55. D (Domain 3). Amazon Q Business is a generative AI assistant that connects to enterprise data sources and respects existing permissions. Q Developer focuses on software development.
• 56. B (Domain 4). Inbound data transfer from the internet is generally free. Data transferred out to the internet, between Regions, or processed by a NAT gateway is charged.
• 57. B (Domain 1). Bringing eligible existing licenses to AWS is the BYOL model, an important factor in cloud cost comparisons. Savings Plans and consolidated billing are pricing and billing features, not licensing approaches.
• 58. B (Domain 3). SageMaker AI is the fully managed service for building, training, and deploying custom ML models. Translate and Lex are pre-trained AI services, and QuickSight is for BI.
• 59. B (Domain 2). EBS encryption encrypts volumes, snapshots, and data in transit between the instance and the volume using AWS KMS keys, and you can turn on encryption by default for a Region. Security groups, ACM, and Shield do not encrypt data at rest.
• 60. B and C (Domain 3). Glacier Flexible Retrieval and Glacier Deep Archive are low-cost archive classes with retrieval times of minutes to hours. S3 Express One Zone is a high-performance class, and EBS and EFS are not S3 storage classes.
• 61. D and E (Domain 1). Automatic recovery and horizontal scaling are Reliability design principles, along with testing recovery procedures, stopping guessing capacity, and managing change through automation.
• 62. B (Domain 2). A cross-account IAM role provides temporary credentials with only the permissions needed. Sharing root credentials, long-term users, and public resources all violate best practices.
• 63. C (Domain 3). Session Manager, a capability of AWS Systems Manager, provides browser or CLI shell access without inbound ports, bastion hosts, or SSH keys, and can log sessions.
• 64. B (Domain 4). The Cost and Usage Report, delivered through AWS Data Exports, contains the most detailed line-item cost and usage data and is written to S3. Budgets alerts on thresholds, and the Pricing Calculator estimates future costs.
• 65. D (Domain 1). “Implement a strong identity foundation”, “enable traceability”, “apply security at all layers”, “automate security best practices”, “protect data in transit and at rest”, “keep people away from data”, and “prepare for security events” are Security pillar design principles.

Scoring guide

Count one point for each correct answer. For “Choose two” questions, award the point only if both choices are correct. The real exam reports a scaled score from 100 to 1000, so treat this table as a guide rather than a prediction. Correct answers Percent What it means

59-65 90-100% Ready. Book the exam.

52-58 80-89% Very likely to pass. Review missed topics.

46-51 70-79% Borderline. Reread weak domains, retake in a week.

Below 46 Under 70% Not ready yet. Restudy weak chapters first.

• Count your misses by domain tag to see where to focus:
• Domain Questions in this exam Misses to worry about
• 1: Cloud Concepts 16 More than 3
• 2: Security and Compliance 20 More than 4
• 3: Technology and Services 22 More than 4
• 4: Billing, Pricing, and Support 7 More than 1

If you scored well on both practice exams, return to Chapter 17 for a final pass through the lookalike table and the numbers to remember, then schedule your exam.