Free AWS Certified Cloud Practitioner (CLF-C02) Sample Questions

Correct answer: B — Operational Excellence

• A. Incorrect. The Security pillar focuses on protecting information, systems, and assets while delivering business value through risk assessments and mitigation strategies. While IaC can enhance security by creating repeatable and auditable environments, its core principle is more directly aligned with operational practices.
• B. Correct. The Operational Excellence pillar focuses on running and monitoring systems to deliver business value and to continuously improve supporting processes and procedures. A key design principle of this pillar is 'Perform operations as code,' which directly advocates for using Infrastructure as Code (IaC) to automate deployments, reduce human error, and ensure consistency.
• C. Incorrect. The Reliability pillar is concerned with a system's ability to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations. While IaC can help in quickly redeploying a failed environment, the practice itself is a principle of operational excellence.
• D. Incorrect. The Performance Efficiency pillar focuses on using computing resources efficiently to meet system requirements and to maintain that efficiency as demand changes and technologies evolve. This is distinct from automating the deployment process itself.

Correct answer: B — To help cloud architects build secure, high-performing, resilient, and efficient infrastructure

• A. This is incorrect. The AWS Well-Architected Framework provides high-level architectural best practices and design principles, not detailed, step-by-step deployment instructions for specific AWS services.
• B. This is correct. The primary purpose of the AWS Well-Architected Framework is to provide a consistent approach for customers and partners to evaluate architectures and implement designs that are secure, high-performing, resilient, and efficient, based on its established pillars.
• C. This is incorrect. The framework is a set of principles and questions for review; it does not perform any automated actions or remediation. While tools like AWS Config can identify misconfigurations, the framework itself is for guidance and evaluation.
• D. This is incorrect. While Cost Optimization is a key pillar of the framework, its scope is much broader than just cost management. It is not a billing tool like AWS Cost Explorer or AWS Budgets, but rather provides best practices for designing cost-effective architectures.

Correct answer: D — Adopt a consumption model

• A. This design principle is part of the Reliability pillar. It emphasizes regularly testing failure scenarios and recovery processes to ensure the system can withstand and recover from disruptions.
• B. This design principle is a cornerstone of the Security pillar. It involves implementing the principle of least privilege and enforcing separation of duties with appropriate authorization for each interaction with your AWS resources.
• C. This design principle belongs to the Operational Excellence pillar. It encourages designing infrastructure and applications that allow changes to be made in small, incremental steps that can be reversed if they fail, minimizing the impact of failed changes.
• D. This is a key design principle of the Cost Optimization pillar. Adopting a consumption model means you pay only for the computing resources you consume and increase or decrease usage depending on business requirements, rather than making large upfront capital investments.

Correct answer: C — Elasticity

• A. Incorrect. High availability refers to a system's ability to remain operational and accessible for a high percentage of time, minimizing downtime. It focuses on uninterrupted service, not on the model of acquiring and releasing resources.
• B. Incorrect. Agility is the ability to rapidly develop, test, and launch applications, allowing businesses to innovate and respond to market changes faster. While elasticity is a key enabler of agility, agility itself is a broader business benefit of the cloud.
• C. Correct. Elasticity is the core cloud concept that describes the ability to acquire resources as you need them and release them when you no longer need them. This allows you to scale up or down to meet demand without being locked into long-term contracts.
• D. Incorrect. Fault tolerance is the ability of a system to continue operating without interruption even if one or more of its components fail. This is achieved through redundancy and is distinct from the ability to scale resources on demand.

Correct answer: C — High availability

• A. Incorrect. Deploying an application across multiple data centers for redundancy typically increases costs due to duplicated resources and potential inter-data center data transfer fees. Cost savings in the cloud are generally achieved through mechanisms like pay-as-you-go pricing and economies of scale, not by building redundant infrastructure.
• B. Incorrect. Agility refers to the ability to rapidly develop, test, and launch applications and to scale resources quickly in response to change. While the cloud enables agility, the specific strategy of deploying across multiple data centers is primarily focused on resilience and fault tolerance, not the speed of innovation.
• C. Correct. This strategy describes deploying an application across multiple Availability Zones (AZs) within a single AWS Region. AZs are physically separate data centers. This design ensures high availability by allowing the application to remain operational in another AZ if one experiences a failure, directly addressing the requirement for minimal downtime.
• D. Incorrect. Global reach is the ability to deploy applications across multiple AWS Regions around the world to serve a global user base with low latency. The scenario describes a deployment within a *single* AWS Region, not across multiple global regions.

Correct answer: C — Server hardware maintenance costs.

• A. Software licensing costs are present in both on-premises and cloud environments. Customers may bring their own licenses (BYOL) to the cloud or acquire them through the AWS Marketplace, so this cost is not eliminated by migrating to AWS.
• B. Data transfer costs exist in both models, although they are structured differently. On-premises environments incur costs for internet bandwidth from an ISP, while AWS charges for data transfer out (egress) to the internet. Therefore, this is not a cost exclusive to on-premises data centers.
• C. In an on-premises model, the customer owns the physical hardware and is directly responsible for all maintenance, repair, and replacement costs. In the AWS Cloud, AWS owns and maintains the physical infrastructure as part of the shared responsibility model. This cost is bundled into the service fees, eliminating a direct, separate hardware maintenance cost for the customer.
• D. Application development costs are associated with the creation of software, which is a process independent of the deployment environment. These costs are incurred regardless of whether the application is hosted on-premises or in the cloud.

Correct answer: C — Use their existing, eligible software licenses on AWS infrastructure to reduce costs.

• A. Incorrect. The BYOL model does not provide free access to AWS-provided software licenses. It is specifically designed for customers to use their own existing licenses on AWS infrastructure, not obtain new ones from AWS for free.
• B. Incorrect. While customers can purchase new software licenses from the AWS Marketplace, this is a separate activity from the BYOL model. BYOL focuses on utilizing existing licenses that a customer already owns.
• C. Correct. The BYOL model enables customers to use their pre-existing, eligible software licenses (e.g., for Windows Server, SQL Server) on AWS infrastructure. This allows them to leverage prior investments and significantly reduce software licensing costs when migrating to the cloud.
• D. Incorrect. The BYOL model is distinct from the pay-as-you-go (or license-included) model. With BYOL, customers continue to manage their own licenses. It does not involve converting them into a usage-based model managed by AWS.

Correct answer: C — Rehosting

• A. Incorrect. Replatforming, sometimes called 'lift and tinker,' involves moving an application to the cloud while making a few cloud-based optimizations to achieve tangible benefits, such as moving from a self-managed database to a managed database service like Amazon RDS. This goes beyond a simple 'lift and shift' but does not involve changing the application's core architecture.
• B. Incorrect. Refactoring, also known as re-architecting, involves fundamentally changing and reimagining the application's architecture and code to take full advantage of cloud-native features and services. This is a significant modification and is the most complex migration strategy, unlike 'lift and shift'.
• C. Correct. Rehosting is the migration strategy commonly known as 'lift and shift.' It involves moving an application from an on-premises environment to the AWS Cloud with minimal or no modifications. This is often the fastest migration path for organizations looking to quickly move their workloads to the cloud.
• D. Incorrect. Repurchasing, also known as 'drop and shop,' involves moving away from the existing application entirely and adopting a different product, typically a Software-as-a-Service (SaaS) solution that provides the same or similar functionality. This is a replacement, not a migration of the existing application.

Correct answer: C — AWS Snowball Edge

• A. Incorrect. AWS DataSync is an online data transfer service. While it can move large amounts of data, it relies on a network connection. Given the slow and limited bandwidth, transferring 80 TB with DataSync would be extremely slow, potentially unreliable, and not the most efficient solution for this scenario.
• B. Incorrect. Amazon S3 Transfer Acceleration speeds up data transfers over long distances by using AWS edge locations. However, it still depends on the user's initial internet connection to reach the edge location. It cannot overcome the fundamental bottleneck of a slow and limited local bandwidth.
• C. Correct. AWS Snowball Edge is a petabyte-scale physical data transport solution. AWS ships a secure appliance to the customer, who can then transfer data to it locally at high speed and ship it back to AWS. This method bypasses the slow internet connection entirely, making it the most suitable and cost-effective solution for large, one-time data transfers where network connectivity is a constraint.
• D. Incorrect. AWS Direct Connect establishes a dedicated, private network connection to AWS. This is a long-term solution that involves significant setup time and ongoing costs, making it neither practical nor cost-effective for a one-time data transfer.

Correct answer: A — AWS Artifact

• A. Correct. AWS Artifact is a centralized, no-cost, self-service portal that provides on-demand access to AWS's security and compliance reports, such as ISO certifications, PCI DSS reports, and Service Organization Control (SOC) reports. It also allows customers to review, accept, and manage online agreements like the Business Associate Addendum (BAA).
• B. Incorrect. The AWS Security Blog is a valuable resource for staying up-to-date with security announcements, best practices, tutorials, and insights from AWS experts. However, it is not a repository for formal compliance reports or legal agreements.
• C. Incorrect. The AWS Knowledge Center is a support resource that contains a collection of frequently asked questions, answers, articles, and videos for troubleshooting common technical issues with AWS services. It does not host compliance documentation.
• D. Incorrect. AWS Trusted Advisor is an online tool that provides real-time guidance to help customers provision their resources following AWS best practices across five pillars: cost optimization, performance, security, fault tolerance, and service limits. It does not provide access to compliance reports or agreements.

Correct answer: C — Action

• A. Incorrect. The Principal element specifies the user, account, service, or other entity (the 'who') that is allowed or denied access to a resource. It does not define the specific operations.
• B. Incorrect. The Effect element specifies whether the policy statement results in an 'Allow' or an explicit 'Deny'. It determines the outcome but does not list the actions.
• C. Correct. The Action element describes the specific API operation(s) that the policy allows or denies. The value is a string or list of strings identifying actions, such as `s3:GetObject` or `ec2:StartInstances`.
• D. Incorrect. The Resource element specifies the object or objects (the 'what') to which the actions apply, typically identified by an Amazon Resource Name (ARN). It does not specify the actions themselves.

Correct answer: B — AWS Shield

• A. AWS WAF (Web Application Firewall) is a service that helps protect web applications from common web exploits by filtering and monitoring HTTP/S traffic. While it can mitigate some application-layer attacks, its primary purpose is not managed DDoS protection.
• B. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. It provides always-on detection and automatic inline mitigations against both common and sophisticated DDoS attacks. It is available in two tiers: Shield Standard (automatic and at no extra cost) and Shield Advanced (for higher levels of protection).
• C. Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. It is designed to detect threats like compromised instances or unusual API calls, not to provide direct mitigation for DDoS attacks.
• D. AWS Firewall Manager is a security management service that simplifies the administration of firewall rules (including AWS WAF and AWS Shield Advanced) across multiple accounts and applications in an AWS Organization. It is used to manage protection policies, but it is not the DDoS protection service itself.

Correct answer: C — Patching the guest operating system on an Amazon EC2 instance.

• A. Incorrect. Securing the physical infrastructure that comprises AWS Regions and Availability Zones is a core responsibility of AWS. This falls under the category of security 'of' the cloud.
• B. Incorrect. AWS is solely responsible for managing, maintaining, and securing the physical hardware that makes up its global infrastructure. Customers do not have any role in managing this hardware.
• C. Correct. Customers are responsible for security 'in' the cloud. For an IaaS service like Amazon EC2, this includes managing the guest operating system (including security patches and updates), applications, and customer data.
• D. Incorrect. The hypervisor is the virtualization layer that allows multiple guest operating systems to run on a single physical host. AWS manages and secures the hypervisor as part of its responsibility for the infrastructure.

Correct answer: B — The developer and their company.

• A. This is incorrect. While AWS provides the tools for security, they do not automatically manage or rotate a customer's access keys. Key management falls under the customer's side of the shared responsibility model.
• B. This is correct. According to the AWS shared responsibility model, the customer is responsible for security 'in' the cloud. This includes managing IAM user credentials like access keys. If keys are compromised, it is the customer's (the developer and their company's) responsibility to immediately rotate them to secure the account.
• C. This is incorrect. The code repository hosting service (e.g., GitHub, GitLab) is a third-party platform. While some services may scan for and notify users of exposed secrets, they are not responsible for managing or rotating credentials for a different service like AWS.
• D. This is incorrect. AWS Support can provide guidance and best practices on how to respond to a security incident, but they will not perform the actions, such as rotating keys, on the customer's behalf. The responsibility to take action remains with the customer.

Correct answer: B — Assign an IAM role to the EC2 instance with the necessary permissions to access the S3 bucket.

• A. Incorrect. Creating an IAM user and embedding its access keys in application code is insecure because long-term credentials can be exposed if the code is compromised. This practice also makes credential rotation difficult and violates AWS security best practices.
• B. Correct. Assigning an IAM role to the EC2 instance is the recommended approach. The instance can then obtain temporary security credentials automatically, which are rotated by AWS and provide only the permissions defined in the role, eliminating the need to store long-term credentials on the instance.
• C. Incorrect. Using the AWS account root user credentials is extremely dangerous and strongly discouraged. The root user has unrestricted access to all resources and settings in the account, creating a massive security risk if used in an application.
• D. Incorrect. Storing IAM user credentials in a text file on the EC2 instance is a major security vulnerability. If the instance is compromised, an attacker can easily access these long-term credentials, potentially leading to a breach of AWS resources.

Correct answer: C — General Purpose

• A. Compute Optimized instances (e.g., C family) are designed for compute-intensive workloads that benefit from high-performance processors, such as batch processing, media transcoding, and high-performance computing (HPC). They do not offer a balanced blend of resources.
• B. Memory Optimized instances (e.g., R, X families) are tailored for workloads that require large memory capacity to process large datasets in memory, such as high-performance databases, in-memory caches, and real-time big data analytics.
• C. General Purpose instances (e.g., M, T families) provide a balanced combination of compute, memory, and networking resources. This makes them an ideal and cost-effective choice for a broad range of diverse workloads, including web servers, code repositories, and development environments.
• D. Accelerated Computing instances (e.g., P, G, F families) use hardware accelerators, like GPUs or FPGAs, for specific, intensive tasks such as machine learning, graphics rendering, or scientific computing, rather than for general, balanced workloads.

Correct answer: C — Amazon EC2 Auto Scaling

• A. Elastic Load Balancing (ELB) distributes incoming application traffic across multiple targets, such as EC2 instances. While it improves application availability and fault tolerance, it does not manage or adjust the number of instances; it only distributes the load among the existing instances.
• B. Amazon CloudFront is a global content delivery network (CDN) service. Its primary function is to deliver content to users with low latency and high transfer speeds by caching it at edge locations. It does not manage the number of compute instances.
• C. Amazon EC2 Auto Scaling is the correct service. It is specifically designed to monitor your applications and automatically adjust the number of EC2 instances based on demand. It scales capacity up during traffic spikes to maintain performance and scales down during lulls to reduce costs, ensuring you have the optimal number of instances at all times.
• D. AWS Lambda is a serverless compute service that runs code in response to events. While AWS automatically manages the underlying compute resources for Lambda functions, this service does not provision, manage, or scale a fleet of user-controlled Amazon EC2 instances.

Correct answer: D — Amazon DynamoDB

• A. Incorrect. Amazon RDS for MySQL is a managed relational database service. While suitable for many applications, it typically provides latency in the millisecond range and is not designed to deliver the microsecond performance required for a high-traffic gaming leaderboard.
• B. Incorrect. Amazon Aurora is a high-performance relational database compatible with MySQL and PostgreSQL. Although it offers significant performance improvements over standard RDS, its latency is still in the low-millisecond range, falling short of the specified microsecond requirement.
• C. Incorrect. Amazon S3 is an object storage service, not a database. It is designed for durability and scalability for storing files and objects, but it does not provide the low-latency transactional read and write capabilities needed for a real-time application like a leaderboard.
• D. Correct. Amazon DynamoDB is a fully managed NoSQL database service that delivers consistent, single-digit millisecond latency at any scale. For use cases requiring even faster performance, DynamoDB Accelerator (DAX) is an in-memory cache that can provide microsecond latency, making it the ideal choice for demanding applications like gaming leaderboards.

Correct answer: B — Amazon Forecast

• A. Amazon Personalize is a machine learning service designed for creating real-time personalized recommendations for users, not for general time-series forecasting.
• B. Amazon Forecast is a fully managed service that uses machine learning to deliver highly accurate time-series forecasts. It is specifically designed for use cases like predicting future product demand based on historical data.
• C. Amazon SageMaker is a broad platform for building, training, and deploying any type of machine learning model. While it could be used to build a custom forecasting model, Amazon Forecast is the specialized service for this task.
• D. Amazon QuickSight is a business intelligence (BI) service used for data visualization and creating interactive dashboards. It is used to analyze and display data, not to generate machine learning-based forecasts.

Correct answer: C — AWS X-Ray

• A. Incorrect. Amazon CloudWatch is a monitoring and observability service. It collects and tracks metrics, collects and monitors log files, and sets alarms for AWS resources and applications. While it is essential for observability, it does not provide a visual service map for tracing requests through a distributed application.
• B. Incorrect. AWS CloudTrail is a service for governance, compliance, and auditing. It records user activity and API calls made within an AWS account. It is not used for analyzing application performance or debugging microservices interactions.
• C. Correct. AWS X-Ray is specifically designed to help developers analyze and debug production, distributed applications, such as those built using a microservices architecture. It provides a visual service map that shows the application's components, their interactions, and helps identify performance bottlenecks, latencies, and errors.
• D. Incorrect. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It is used for configuration management and compliance, not for analyzing application performance or providing a visual map of microservices.

Correct answer: B — Amazon EFS

• A. Incorrect. Amazon EBS (Elastic Block Store) provides block-level storage volumes for use with a single EC2 instance. It functions like a direct-attached hard drive rather than a shared network file system like a NAS.
• B. Correct. Amazon EFS (Elastic File System) provides a fully managed, scalable, elastic file system that uses the Network File System (NFS) protocol. It can be mounted concurrently by multiple EC2 instances, providing a shared file system interface, which is directly analogous to a cloud-based Network Attached Storage (NAS) solution.
• C. Incorrect. Amazon S3 (Simple Storage Service) is an object storage service. It does not provide a traditional, mountable file system interface and is accessed via APIs. It is not designed to function like a NAS device.
• D. Incorrect. AWS Storage Gateway is a hybrid cloud storage service that connects on-premises environments with AWS cloud storage. While its File Gateway type can present a file interface, the service itself is a gateway or bridge, not the primary cloud-native file system service like EFS.

Correct answer: C — To improve its disaster recovery posture.

• A. Incorrect. Running an application across multiple AWS Regions significantly increases architectural complexity. It requires managing data replication, inter-Region latency, and complex failover processes.
• B. Incorrect. This is the opposite of a resilient strategy. A multi-Region architecture inherently involves using multiple Availability Zones across different geographic locations to increase fault tolerance, not restricting workloads to a single AZ.
• C. Correct. The primary benefit of a multi-Region architecture is improved disaster recovery and business continuity. By providing geographic redundancy, it ensures that if one entire Region experiences a catastrophic failure, the application can fail over to another Region, enhancing availability and resilience.
• D. Incorrect. A multi-Region strategy generally increases costs. This is due to the need for duplicated infrastructure, inter-Region data transfer fees, and the additional management overhead required to maintain the environment.

Correct answer: B — The network of Edge Locations.

• A. Incorrect. Availability Zones are distinct data centers within a single AWS Region. Their primary purpose is to provide high availability and fault tolerance for applications, not to reduce latency for a global user base.
• B. Correct. The network of Edge Locations is the foundation of Amazon CloudFront, AWS's Content Delivery Network (CDN). These locations are geographically distributed worldwide to cache content, like images and videos, closer to end-users. This significantly reduces latency by serving content from a nearby edge location instead of a distant origin server.
• C. Incorrect. While deploying applications across multiple AWS Regions can reduce latency for dynamic content and improve disaster recovery, it is not the most efficient or cost-effective method for serving static content globally. A CDN using the network of Edge Locations is the specialized and superior solution for this specific use case.
• D. Incorrect. A single data center, no matter how powerful, would result in high latency for users who are geographically distant from it. This approach is the opposite of what is needed for a global low-latency content delivery strategy.

Correct answer: B — NAT Gateway

• A. An Internet Gateway (IGW) is a VPC component that allows two-way communication between instances in a public subnet and the internet. It does not meet the requirement of preventing the internet from initiating connections to instances.
• B. A NAT (Network Address Translation) Gateway is a managed AWS service designed for this exact purpose. It enables instances in a private subnet to initiate outbound traffic to the internet or other AWS services, but prevents the internet from initiating a connection with those instances, thus fulfilling the security requirement.
• C. AWS Direct Connect is a cloud service that establishes a dedicated, private network connection from an on-premises data center to AWS. It is used for hybrid cloud connectivity, not for providing general internet access to EC2 instances.
• D. A Virtual Private Gateway (VGW) is the component on the AWS side of a Site-to-Site VPN connection. It is used to establish secure, encrypted connectivity between a VPC and an on-premises network over the internet, not to provide internet access to instances within the VPC.

Correct answer: D — Route Table

• A. Incorrect. A Security Group acts as a stateful virtual firewall for EC2 instances to control inbound and outbound traffic at the instance level. It does not contain routes to direct network traffic between subnets or to external networks.
• B. Incorrect. A Network Access Control List (ACL) is an optional layer of security for a VPC that acts as a stateless firewall for controlling traffic in and out of one or more subnets. It provides filtering but does not determine the routing paths for traffic.
• C. Incorrect. A Subnet Mask is a component of IP addressing used to define the range of IP addresses within a subnet by separating the network portion from the host portion of an IP address. It does not play a role in directing network traffic.
• D. Correct. A Route Table contains a set of rules, called routes, that are used to determine where network traffic originating from a subnet is directed. Each route specifies a destination CIDR block and a target (e.g., an internet gateway, a virtual private gateway, or another instance).

Correct answer: C — A Security Group attached to the instance.

• A. Incorrect. A Network Access Control List (NACL) is a stateless firewall that operates at the subnet level, controlling traffic in and out of one or more subnets. While it can filter traffic, a Security Group is the more appropriate and granular tool for controlling traffic at the individual instance level.
• B. Incorrect. AWS Identity and Access Management (IAM) policies are used to manage permissions and control access to AWS services and resources for users, groups, and roles. They do not control network traffic to an EC2 instance.
• C. Correct. A Security Group acts as a stateful, virtual firewall for an EC2 instance to control inbound and outbound traffic. It is the most appropriate tool for this scenario because rules can be configured to specifically allow traffic on ports 80 (HTTP) and 443 (HTTPS) at the instance level.
• D. Incorrect. AWS WAF (Web Application Firewall) is a service that protects web applications from common web exploits (Layer 7 attacks) like SQL injection or cross-site scripting. It does not perform basic port and protocol filtering and is typically associated with services like Application Load Balancers or Amazon CloudFront, not directly with an EC2 instance for this purpose.

Correct answer: D — Amazon Inspector

• A. Incorrect. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. Its primary function is to safeguard applications against DDoS attacks, not to assess them for vulnerabilities or configuration best practices.
• B. Incorrect. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It identifies active threats to your AWS environment but does not perform vulnerability scans on your applications.
• C. Incorrect. AWS WAF (Web Application Firewall) is a service that protects web applications from common web exploits by filtering and monitoring HTTP/HTTPS traffic. It acts as a protective shield but does not assess the application for internal vulnerabilities.
• D. Correct. Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. This directly addresses the need to assess applications for vulnerabilities and deviations from best practices to improve security and compliance.

Correct answer: B — All applications and infrastructure are deployed and run in the cloud.

• A. This option describes a hybrid cloud deployment model. In a hybrid model, an organization integrates its on-premises infrastructure with public cloud resources, which is different from an 'all-in cloud' strategy.
• B. This is the correct definition of an 'all-in cloud' deployment. It means that an organization has migrated its entire IT footprint, including all applications and infrastructure, to run exclusively on a cloud provider's platform, with no reliance on on-premises resources.
• C. This describes a colocation model, which is a traditional hosting strategy. In colocation, a company places its own physical servers in a third-party data center but is still responsible for managing them. This is not a cloud deployment model.
• D. This option defines a private cloud or on-premises deployment. While it utilizes cloud technologies, the infrastructure is hosted within the company's own data center. The term 'all-in cloud' typically refers to a full migration to a public cloud provider like AWS.

Correct answer: B — AWS Elastic Beanstalk

• A. Incorrect. AWS Lambda is a serverless compute service, often categorized as Function as a Service (FaaS). It runs code in response to events without requiring you to provision or manage servers, but it is not a PaaS designed for deploying and managing entire web applications.
• B. Correct. AWS Elastic Beanstalk is a classic example of a Platform as a Service (PaaS). Developers can simply upload their application code, and Elastic Beanstalk automatically handles the deployment, capacity provisioning, load balancing, auto-scaling, and application health monitoring, abstracting the underlying infrastructure.
• C. Incorrect. Amazon Elastic Compute Cloud (EC2) is an Infrastructure as a Service (IaaS). It provides scalable virtual servers (computing capacity), but the user is responsible for managing the operating system, runtime, scaling, load balancing, and other infrastructure components.
• D. Incorrect. AWS CloudFormation is an Infrastructure as Code (IaC) service. It allows you to model and provision AWS infrastructure resources in an automated and predictable way using templates, but it is not a platform for deploying or running applications itself.

Correct answer: C — S3 Standard stores data across multiple Availability Zones, while S3 One Zone-IA stores data in a single Availability Zone.

• A. Incorrect. Both S3 Standard and S3 One Zone-IA are designed for 99.999999999% (11 nines) of durability against object loss. However, S3 Standard is more resilient to infrastructure failure because it stores data across multiple Availability Zones.
• B. Incorrect. This statement reverses the storage models. S3 Standard stores data redundantly across a minimum of three Availability Zones, whereas S3 One Zone-IA stores data within a single Availability Zone.
• C. Correct. According to AWS documentation, this is the fundamental architectural difference affecting resilience. S3 Standard provides protection against the loss of an entire Availability Zone by storing data in at least three AZs. In contrast, data in S3 One Zone-IA is stored in a single AZ and would be lost if that AZ were to fail.
• D. Incorrect. While both storage classes are designed for the same 99.999999999% (11 nines) durability figure, this number refers to the statistical likelihood of object loss from component failures. The key difference lies in resilience: S3 Standard is designed to withstand an entire Availability Zone failure, whereas S3 One Zone-IA is not, making S3 Standard's data protection model more resilient.

Correct answer: B — It automatically scales storage in increments and self-heals by replicating data across multiple Availability Zones.

• A. Incorrect. Amazon Aurora uses a distributed, fault-tolerant storage system, not a single EBS volume. A single volume would be a single point of failure and cannot provide the automatic scaling and self-healing that Aurora offers.
• B. Correct. Aurora's storage automatically scales in 10 GB increments up to 128 TiB as needed, and it self-heals by replicating six copies of data across three Availability Zones. This ensures high durability and availability without manual intervention.
• C. Incorrect. Aurora storage is fully managed and scales automatically; users do not manually provision or attach volumes. This eliminates the administrative overhead of capacity planning and volume management.
• D. Incorrect. Aurora does not use Amazon S3 for primary data storage; it relies on a purpose-built, SSD-backed distributed storage layer for high performance and low latency. S3 may be used for backups or data loading, but not as the primary storage engine.

Correct answer: C — A user interface to visualize and analyze historical AWS costs and usage.

• A. This is incorrect. AWS Cost Explorer is a financial management tool. A detailed log of every API call for auditing and governance purposes is provided by AWS CloudTrail.
• B. This is incorrect. Real-time security alerts and remediation steps are functions of security services like AWS GuardDuty and AWS Security Hub, not a cost management tool like AWS Cost Explorer.
• C. This is correct. AWS Cost Explorer provides an easy-to-use interface that allows users to visualize, understand, and manage their AWS costs and usage over time. It helps in analyzing historical spending patterns and identifying cost drivers.
• D. This is incorrect. While AWS Cost Explorer can provide cost forecasts based on historical usage data, it is not designed to estimate costs for a new, planned architecture. The appropriate tool for that purpose is the AWS Pricing Calculator.

Correct answer: C — AWS Trust and Safety

• A. Incorrect. AWS Concierge Support is a feature of the Enterprise Support plan and primarily assists customers with billing and account management inquiries, not with security or abuse-related issues.
• B. Incorrect. The AWS Professional Services team provides consulting, implementation support, and guidance to help customers with their cloud adoption, migration, and optimization projects. They do not handle abuse reports.
• C. Correct. The AWS Trust and Safety team is the dedicated group responsible for investigating and taking action on reports of abusive or malicious activity originating from AWS resources, including AWS-owned IP addresses. This ensures the safety and integrity of the AWS network.
• D. Incorrect. AWS Solutions Architects provide technical guidance to help customers design and build secure, scalable, and resilient solutions on AWS. While they advise on security best practices, they are not the operational team for handling abuse reports.

Correct answer: D — Spot Instances

• A. Incorrect. On-Demand Instances offer flexibility with no long-term commitment, but they are not the lowest-cost option. They are better suited for workloads that are unpredictable but cannot tolerate interruptions, which is the opposite of the workload described.
• B. Incorrect. Reserved Instances provide a discount over On-Demand prices in exchange for a 1- or 3-year commitment. They are best for steady-state, predictable workloads, not for workloads that can run at any time and need the absolute lowest cost.
• C. Incorrect. Dedicated Hosts are the most expensive EC2 purchasing option. They provide a physical server dedicated to a single customer, which is typically required for specific software licensing or compliance needs, not for cost optimization of a batch workload.
• D. Correct. Spot Instances provide the deepest discounts on EC2 compute, often up to 90% off On-Demand prices, by allowing customers to use spare EC2 capacity. Since the workload is fault-tolerant and can run at any time, it can handle the potential interruptions of Spot Instances, making this the most cost-effective choice.

Correct answer: B — A digital catalog to find, buy, and deploy third-party software and services.

• A. Incorrect. A Q&A forum connecting users with community experts is the function of AWS re:Post, not AWS Marketplace. AWS Marketplace is a digital catalog for third-party software and services.
• B. Correct. AWS Marketplace is a curated digital catalog that enables customers to find, buy, and deploy third-party software and services that run on AWS. It streamlines procurement and deployment of solutions.
• C. Incorrect. Tracking AWS spending and usage to optimize costs is a function of AWS Billing and Cost Management tools like AWS Cost Explorer and AWS Budgets. AWS Marketplace focuses on software procurement, not cost tracking.
• D. Incorrect. Managing infrastructure as code using templates is provided by AWS CloudFormation or the AWS CDK. AWS Marketplace is not an infrastructure-as-code service; it is a catalog for third-party software.