THIS IS JUST A PREVIEW OF AROUND 20 QUESTIONS

THE ORIGINAL EBOOK HAS 400+ QUESTIONS

Get the full practice exam at

https://cloudcertificationstore.com/b/Yzkqb

Practice Exam Questions

Question 1

A Linux fleet on Amazon EC2 runs an order-processing service. The operations team needs memory-utilization and disk-space metrics in CloudWatch, but the default EC2 metrics do not include those operating-system measurements. What should the CloudOps engineer configure?

A. Create metric filters on CloudTrail management events for the instances.

B. Enable EC2 detailed monitoring and use the additional one-minute default instance metrics as memory and disk-space telemetry.

C. Install and configure the CloudWatch agent on the instances to publish the required operating-system metrics.

D. Use Systems Manager Inventory alone to publish real-time memory and disk utilization as CloudWatch metrics.

Correct Answer: C. Install and configure the CloudWatch agent on the instances to publish the required operating-system metrics.

The CloudWatch agent collects guest operating-system metrics and logs that EC2 does not publish by default, making it the appropriate mechanism for memory and filesystem monitoring.

Why not the other options?

A. Create metric filters on CloudTrail management events for the instances. - CloudTrail records AWS API activity rather than guest operating-system memory and filesystem utilization, so metric filters on those events cannot supply the required measurements.

B. Enable EC2 detailed monitoring and use the additional one-minute default instance metrics as memory and disk-space telemetry. - Detailed monitoring increases the frequency of supported EC2 service metrics, but it does not add guest operating-system memory or filesystem utilization metrics.

D. Use Systems Manager Inventory alone to publish real-time memory and disk utilization as CloudWatch metrics. - Systems Manager Inventory collects managed-node metadata and software inventory; it is not the CloudWatch OS-metric collector for continuous memory and disk-space measurements.

Question 2

An API runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer. CPU is a reliable indicator of load, and the team wants the group to maintain an average of about 55% CPU without manually calculating scaling steps. Which policy should it use?

A. Use a step scaling policy that adds a fixed number of instances when CPU crosses an alarm threshold.

B. Configure an Auto Scaling target tracking policy with average CPU utilization as the target metric.

C. Use scheduled scaling actions that change desired capacity at fixed times.

D. Keep desired capacity fixed and increase the Auto Scaling group maximum size.

Correct Answer: B. Configure an Auto Scaling target tracking policy with average CPU utilization as the target metric.

Target tracking automatically adjusts desired capacity to keep a selected metric near a defined target, which matches a stable CPU-based scaling objective.

Why not the other options?

A. Use a step scaling policy that adds a fixed number of instances when CPU crosses an alarm threshold. - Step scaling can react to CPU alarms, but it does not directly maintain the requested utilization target and requires the team to define scaling increments.

C. Use scheduled scaling actions that change desired capacity at fixed times. - Scheduled scaling is appropriate for predictable time-based demand, not continuous adjustment to the current CPU utilization.

D. Keep desired capacity fixed and increase the Auto Scaling group maximum size. - Raising the maximum only permits future scaling; it does not create a policy that adjusts capacity to maintain 55% CPU.

Question 3

A platform team needs a repeatable golden AMI that includes current operating-system patches, security agents, and application prerequisites. The image should be rebuilt and tested automatically every month. Which service is the best fit?

A. Use Systems Manager Patch Manager to patch the running fleet without rebuilding the golden image.

B. Use Auto Scaling instance refresh as the image build system.

C. Use Amazon EC2 Image Builder with an automated image pipeline.

D. Maintain a long-lived base AMI manually and patch instances only after launch.

Correct Answer: C. Use Amazon EC2 Image Builder with an automated image pipeline.

EC2 Image Builder automates image creation, component application, testing, and distribution, making it suitable for a maintained golden-image pipeline.

Why not the other options?

A. Use Systems Manager Patch Manager to patch the running fleet without rebuilding the golden image. - Patch Manager can patch managed nodes, but it does not satisfy the requirement for a monthly golden AMI pipeline with image tests.

B. Use Auto Scaling instance refresh as the image build system. - Instance refresh replaces fleet instances from a launch template; it does not create, patch, test, and publish a new AMI.

D. Maintain a long-lived base AMI manually and patch instances only after launch. - Post-launch patching can keep instances current, but it does not produce the repeatable, automatically rebuilt and tested golden image requested.

Question 4

An EC2 web server has a public IPv4 address in a subnet, and an internet gateway is attached to the VPC. The security group allows HTTPS, but clients on the internet still cannot reach the server. The subnet route table has only the local route. What should be added?

A. Associate an Elastic IP address with the instance but keep only the local route.

B. Add a NAT gateway to the public subnet and route 0.0.0.0/0 to it for inbound web traffic.

C. Add a default route for 0.0.0.0/0 that targets the internet gateway.

D. Add only a more permissive network ACL and leave the route table unchanged.

Correct Answer: C. Add a default route for 0.0.0.0/0 that targets the internet gateway.

A subnet is public when its route table sends internet-bound traffic to an internet gateway and the instance has a suitable public address and security controls.

Why not the other options?

A. Associate an Elastic IP address with the instance but keep only the local route. - A public address alone is insufficient; the subnet still needs a route to the attached internet gateway for internet connectivity.

B. Add a NAT gateway to the public subnet and route 0.0.0.0/0 to it for inbound web traffic. - A NAT gateway provides outbound IPv4 connectivity for private resources and is not the route target that makes a public subnet directly reachable from the internet.

D. Add only a more permissive network ACL and leave the route table unchanged. - Packet filters cannot provide an internet route when the subnet has no default route to the internet gateway.

Question 5

A finance operations team signs in to the AWS Management Console with IAM users for a legacy account. The security policy now requires an additional authentication factor for console access. Which change directly satisfies the requirement?

A. Create an IAM group named MFARequired without configuring MFA devices or policy conditions.

B. Increase the IAM user password complexity requirements but keep single-factor sign-in.

C. Replace console passwords with long-lived access keys for each finance user.

D. Enable multi-factor authentication (MFA) for the IAM users and require its use through the applicable IAM policy conditions.

Correct Answer: D. Enable multi-factor authentication (MFA) for the IAM users and require its use through the applicable IAM policy conditions.

MFA adds a second authentication factor, and IAM policy conditions can require MFA-backed sessions for protected actions.

Why not the other options?

A. Create an IAM group named MFARequired without configuring MFA devices or policy conditions. - A group name alone does not register MFA devices or enforce their use during authentication and authorization.

B. Increase the IAM user password complexity requirements but keep single-factor sign-in. - A stronger password policy improves the first authentication factor but does not add the required second factor.

C. Replace console passwords with long-lived access keys for each finance user. - Access keys are programmatic credentials and do not provide an additional authentication factor for console sign-in.

Question 6

A container platform runs services on Amazon ECS with EC2 capacity. Engineers want application log files and host-level metrics sent to a centralized CloudWatch destination without maintaining separate collection scripts on every container host. Which approach best meets the requirement?

A. Deploy and manage the CloudWatch agent configuration for the ECS container instances.

B. Run a separate custom log-forwarding script on every ECS container instance and manage its configuration manually.

C. Enable ECS Exec for every task and retrieve logs interactively during incidents.

D. Rely only on the default ECS service and cluster metrics already published to CloudWatch.

Correct Answer: A. Deploy and manage the CloudWatch agent configuration for the ECS container instances.

The CloudWatch agent can centralize host metrics and log collection for ECS workloads running on EC2 capacity, avoiding custom per-host collection scripts.

Why not the other options?

B. Run a separate custom log-forwarding script on every ECS container instance and manage its configuration manually. - Custom scripts can collect telemetry, but they create exactly the per-host maintenance burden the team wants to avoid when the CloudWatch agent can be centrally configured.

C. Enable ECS Exec for every task and retrieve logs interactively during incidents. - ECS Exec provides interactive access for troubleshooting and does not continuously centralize application logs and host metrics in CloudWatch.

D. Rely only on the default ECS service and cluster metrics already published to CloudWatch. - Default ECS metrics provide service-level utilization signals but do not collect arbitrary host-level metrics and application log files from the container instances.

Question 7

A web tier behind an ALB has uneven request volume, and CPU varies by request complexity. The team wants scaling based directly on the average number of requests each target handles. What metric is most appropriate?

A. Use NetworkIn for the Auto Scaling group as the target tracking metric.

B. Create a custom metric from the ALB RequestCount statistic without normalizing it by healthy target count.

C. Use average EC2 CPUUtilization as the target tracking metric.

D. Use the ALBRequestCountPerTarget predefined metric in a target tracking scaling policy.

Correct Answer: D. Use the ALBRequestCountPerTarget predefined metric in a target tracking scaling policy.

ALBRequestCountPerTarget directly represents load distributed to each target and is supported as a predefined target tracking metric for Auto Scaling.

Why not the other options?

A. Use NetworkIn for the Auto Scaling group as the target tracking metric. - Network volume can correlate with traffic, but it does not measure the requested average ALB requests handled per target.

B. Create a custom metric from the ALB RequestCount statistic without normalizing it by healthy target count. - Total request count does not directly represent the average load carried by each target as instances scale in and out.

C. Use average EC2 CPUUtilization as the target tracking metric. - CPU can be useful, but the stem states that CPU varies by request complexity and asks to scale directly from request load per target.

Question 8

An Image Builder pipeline must install a company monitoring package and create a configuration file before the image is tested. Which Image Builder construct should contain those build steps?

A. Put the package installation logic in the Image Builder infrastructure configuration.

B. Put the installation commands in the Image Builder distribution configuration.

C. Put the commands in an ECR lifecycle policy.

D. Create an EC2 Image Builder component that defines the required build commands.

Correct Answer: D. Create an EC2 Image Builder component that defines the required build commands.

Image Builder components contain the ordered build, validation, or test actions that are applied by an image recipe and pipeline.

Why not the other options?

A. Put the package installation logic in the Image Builder infrastructure configuration. - Infrastructure configuration defines build/test infrastructure such as instance profile and networking, not the ordered package-install commands.

B. Put the installation commands in the Image Builder distribution configuration. - Distribution settings control where a completed image is copied or shared, not the build-time commands applied to the image.

C. Put the commands in an ECR lifecycle policy. - An ECR lifecycle policy expires container images and has no role in building an EC2 AMI.

Question 9

Application instances in private IPv4 subnets need outbound internet access for operating-system updates but must not accept unsolicited inbound internet connections. Which VPC component should the team use?

A. Route the private subnet directly to the internet gateway while leaving instances without public IPv4 addresses.

B. Route outbound IPv4 traffic from the private subnets to a NAT gateway in a public subnet.

C. Use an egress-only internet gateway for the IPv4 default route.

D. Assign public IPv4 addresses to every private instance and route them to the internet gateway.

Correct Answer: B. Route outbound IPv4 traffic from the private subnets to a NAT gateway in a public subnet.

A NAT gateway translates outbound connections from private IPv4 addresses while preventing the internet from initiating connections through the NAT to those instances.

Why not the other options?

A. Route the private subnet directly to the internet gateway while leaving instances without public IPv4 addresses. - An internet gateway does not provide IPv4 source translation for private addresses; the instances need a NAT path for outbound internet access.

C. Use an egress-only internet gateway for the IPv4 default route. - Egress-only internet gateways are for IPv6; private IPv4 internet egress uses a NAT device such as a NAT gateway.

D. Assign public IPv4 addresses to every private instance and route them to the internet gateway. - That can provide internet connectivity, but it changes the private-instance security model and exposes public addressing that the scenario explicitly wants to avoid.

Question 10

An application on Amazon EC2 must read one DynamoDB table. The platform team wants to avoid storing long-lived AWS credentials on the instance. What should it configure?

A. Attach an IAM role with only the required DynamoDB permissions to the EC2 instance profile.

B. Store DynamoDB credentials in an unencrypted file on the instance root volume.

C. Store an IAM user access key in the instance user-data script and rotate it quarterly.

D. Attach a broad administrator role to the instance so it can reach the table.

Correct Answer: A. Attach an IAM role with only the required DynamoDB permissions to the EC2 instance profile.

An EC2 instance role supplies temporary credentials through the instance metadata service and can be limited to the exact table actions the workload needs.

Why not the other options?

B. Store DynamoDB credentials in an unencrypted file on the instance root volume. - Static credentials on disk are long-lived and do not use the EC2 role credential mechanism requested.

C. Store an IAM user access key in the instance user-data script and rotate it quarterly. - Long-lived user credentials on an instance create secret-management risk and are unnecessary when EC2 can receive temporary role credentials.

D. Attach a broad administrator role to the instance so it can reach the table. - An instance role avoids static keys, but AdministratorAccess violates the requirement to grant only the permissions needed for one table.

THIS IS JUST A PREVIEW OF AROUND 20 QUESTIONS

THE ORIGINAL EBOOK HAS 400+ QUESTIONS

Get the full practice exam at

https://cloudcertificationstore.com/b/Yzkqb

Question 11

An Amazon EKS platform team already exposes Prometheus-format application metrics from hundreds of pods. The team wants a managed, highly available metrics backend that preserves the Prometheus query model. Which AWS service should the team use?

A. Use Amazon Managed Service for Prometheus as the managed Prometheus-compatible metrics store.

B. Send the Prometheus samples to CloudWatch Logs and query them as log events.

C. Publish only the EKS default CloudWatch metrics and stop scraping Prometheus endpoints.

D. Use Amazon Managed Grafana as the primary storage backend for the Prometheus samples.

Correct Answer: A. Use Amazon Managed Service for Prometheus as the managed Prometheus-compatible metrics store.

Amazon Managed Service for Prometheus is designed to ingest and query Prometheus-compatible metrics while AWS manages the underlying service availability and scaling.

Why not the other options?

B. Send the Prometheus samples to CloudWatch Logs and query them as log events. - CloudWatch Logs can retain log records, but converting Prometheus samples to logs would discard the native Prometheus ingestion and query model.

C. Publish only the EKS default CloudWatch metrics and stop scraping Prometheus endpoints. - Default service metrics do not preserve the application-level Prometheus metrics that the workloads already expose.

D. Use Amazon Managed Grafana as the primary storage backend for the Prometheus samples. - Managed Grafana visualizes data from configured sources, but it is not the managed Prometheus-compatible time-series store requested.

Question 12

A payroll application experiences a predictable traffic increase at 08:00 every weekday. Scaling reactively causes a short latency spike while new instances launch. What should the CloudOps engineer add?

A. Keep enough instances running all day to cover the 08:00 peak.

B. Use only target tracking on CPU and let the group react after the 08:00 load begins.

C. Create scheduled scaling actions that raise capacity before the predictable weekday peak.

D. Use a step scaling policy that adds capacity only after an alarm enters ALARM.

Correct Answer: C. Create scheduled scaling actions that raise capacity before the predictable weekday peak.

Scheduled scaling is appropriate when demand follows a known timetable and capacity should be ready before the load arrives.

Why not the other options?

A. Keep enough instances running all day to cover the 08:00 peak. - A permanently elevated baseline can avoid the spike, but it wastes capacity outside the predictable window when scheduled scaling can time the increase.

B. Use only target tracking on CPU and let the group react after the 08:00 load begins. - Target tracking is reactive and can still incur the startup delay that the scenario specifically wants to avoid for a predictable peak.

D. Use a step scaling policy that adds capacity only after an alarm enters ALARM. - Step scaling also waits for a measured threshold breach and therefore does not pre-provision capacity before a known event.

Question 13

A company publishes container images for ECS services to Amazon ECR. Security policy requires old untagged images to be removed automatically after a defined period. What should the CloudOps engineer configure?

A. Enable repository scanning for the ECR repository.

B. Enable ECR image tag immutability for the repository.

C. Create an Amazon ECR lifecycle policy that expires images matching the retention criteria.

D. Run a scheduled ECS task that deletes images with hard-coded digests.

Correct Answer: C. Create an Amazon ECR lifecycle policy that expires images matching the retention criteria.

ECR lifecycle policies evaluate image attributes such as tags and age and can automatically expire images that no longer need to be retained.

Why not the other options?

A. Enable repository scanning for the ECR repository. - Image scanning reports vulnerabilities; it does not implement retention or deletion of repository images.

B. Enable ECR image tag immutability for the repository. - Tag immutability prevents overwriting tags but does not expire old untagged images.

D. Run a scheduled ECS task that deletes images with hard-coded digests. - Custom cleanup can be built, but ECR lifecycle policies provide the requested repository-native retention automation with less operational code.

Question 14

IPv6-only application instances in private subnets must initiate outbound internet connections, but the company does not want the internet to initiate new connections to those instances. What should be configured?

A. Route ::/0 through an IPv4 NAT gateway.

B. Add an egress-only internet gateway and route the IPv6 default route to it.

C. Create an S3 gateway endpoint and use it as the IPv6 default internet route.

D. Attach a normal internet gateway and assign globally routable IPv6 addresses with no inbound controls.

Correct Answer: B. Add an egress-only internet gateway and route the IPv6 default route to it.

An egress-only internet gateway allows VPC resources to initiate IPv6 internet connections while blocking unsolicited inbound initiation through that gateway.

Why not the other options?

A. Route ::/0 through an IPv4 NAT gateway. - A standard NAT gateway is not the egress-only IPv6 internet mechanism described by the requirement.

C. Create an S3 gateway endpoint and use it as the IPv6 default internet route. - A gateway endpoint is service-specific and cannot provide general outbound internet connectivity.

D. Attach a normal internet gateway and assign globally routable IPv6 addresses with no inbound controls. - A normal internet gateway can support IPv6, but it does not provide the outbound-only stateful behavior requested.

Question 15

A company wants employees to use its corporate identity provider to access multiple AWS accounts without creating separate IAM users in every account. Which approach best fits?

A. Create matching IAM users in every AWS account and synchronize their passwords with the corporate directory.

B. Federate the workforce through AWS IAM Identity Center (formerly AWS Single Sign-On (AWS SSO)) and assign account access with permission sets.

C. Create one shared IAM user that all employees use across the accounts.

D. Create cross-account roles but require employees to authenticate with long-lived IAM access keys first.

Correct Answer: B. Federate the workforce through AWS IAM Identity Center (formerly AWS Single Sign-On (AWS SSO)) and assign account access with permission sets.

IAM Identity Center centralizes workforce federation and uses permission sets to provision consistent role-based access across AWS accounts.

Why not the other options?

A. Create matching IAM users in every AWS account and synchronize their passwords with the corporate directory. - Duplicating users across accounts creates the identity sprawl the scenario wants to avoid and does not use centralized workforce federation.

C. Create one shared IAM user that all employees use across the accounts. - Shared credentials eliminate individual accountability and do not integrate the corporate identity provider.

D. Create cross-account roles but require employees to authenticate with long-lived IAM access keys first. - Cross-account roles can be useful, but the design still creates separate AWS credentials instead of federating the existing workforce identity through IAM Identity Center.

Question 16

A security audit asks which employee changed an IAM role trust policy yesterday and from which source IP address the API call originated. Which service should the CloudOps engineer query first?

A. Review AWS Config configuration history for the IAM role and infer the modifying identity from the changed document.

B. Use IAM Access Analyzer to determine which employee edited the trust policy.

C. Query AWS CloudTrail for the relevant IAM API event and request context.

D. Query VPC Flow Logs for the IAM API request and map the source address back to a user.

Correct Answer: C. Query AWS CloudTrail for the relevant IAM API event and request context.

CloudTrail records AWS API activity, including the calling identity, action, time, and request context, which directly answers an audit question about a policy change.

Why not the other options?

A. Review AWS Config configuration history for the IAM role and infer the modifying identity from the changed document. - Config can record supported configuration changes, but CloudTrail is the primary audit source for the API caller, source IP address, and request context.

B. Use IAM Access Analyzer to determine which employee edited the trust policy. - Access Analyzer evaluates policy access paths and validates policies; it does not provide the historical API-caller record for yesterday's change.

D. Query VPC Flow Logs for the IAM API request and map the source address back to a user. - Flow Logs contain VPC network-flow metadata and do not identify IAM management API actions or the authenticated principal that invoked them.

Question 17

An Auto Scaling group uses Spot Instances for batch workers. A Spot interruption rebalance recommendation is received, and the team wants replacement capacity to launch before the affected instance leaves when possible. Which feature should it use?

A. Enable Capacity Rebalancing for the Auto Scaling group.

B. Run an instance refresh whenever a Spot rebalance recommendation is emitted.

C. Use an Auto Scaling lifecycle hook that runs only after the Spot instance receives a termination notice.

D. Increase the Auto Scaling health check grace period for Spot instances.

Correct Answer: A. Enable Capacity Rebalancing for the Auto Scaling group.

Capacity Rebalancing lets Auto Scaling proactively launch replacement Spot capacity when interruption risk is detected, improving continuity for Spot-based fleets.

Why not the other options?

B. Run an instance refresh whenever a Spot rebalance recommendation is emitted. - Instance refresh is designed to replace a fleet for configuration changes; it is not the native response mechanism for individual Spot rebalance recommendations.

C. Use an Auto Scaling lifecycle hook that runs only after the Spot instance receives a termination notice. - A lifecycle hook can coordinate instance transitions, but Capacity Rebalancing is the feature designed to launch replacement capacity when a rebalance recommendation indicates elevated interruption risk.

D. Increase the Auto Scaling health check grace period for Spot instances. - The grace period delays health-based replacement during startup and does not proactively react to Spot interruption risk.

Question 18

An ECS deployment should always reference an immutable release image even if engineers later reuse a human-friendly tag in the repository. Which practice best supports that goal?

A. Reference only a mutable tag such as latest in every task definition.

B. Use immutable image tags or pin the task definition to a specific image digest for the release.

C. Rely on the repository image push timestamp instead of an immutable reference.

D. Disable ECR image tag immutability and allow release tags to be overwritten.

Correct Answer: B. Use immutable image tags or pin the task definition to a specific image digest for the release.

Pinning a digest or enforcing immutable tags ensures that the deployment identifies one exact container image rather than a movable label.

Why not the other options?

A. Reference only a mutable tag such as latest in every task definition. - A mutable tag can be repointed to different image content, so the same deployment definition might resolve to a different image later.

C. Rely on the repository image push timestamp instead of an immutable reference. - Timestamps help operators identify images but do not pin the task definition to exact image content.

D. Disable ECR image tag immutability and allow release tags to be overwritten. - Allowing release tags to move makes the image reference less deterministic, not more immutable.

Question 19

A database security group allows inbound TCP 5432 only from the application security group. The application initiates a connection and the database response is blocked by no explicit outbound return rule in the database security group. Which statement explains the behavior?

A. Add an inbound ephemeral-port rule to the database security group for the return traffic.

B. Add an outbound TCP 5432 rule on the database security group or all return packets will be dropped.

C. Replace the security group with a network ACL and add explicit request and return-path rules.

D. Rely on the stateful connection tracking of the security group for response traffic on the allowed connection.

Correct Answer: D. Rely on the stateful connection tracking of the security group for response traffic on the allowed connection.

Security groups maintain connection state, so traffic returning for an established allowed flow is permitted without a separate reverse rule.

Why not the other options?

A. Add an inbound ephemeral-port rule to the database security group for the return traffic. - The return packets leave the database toward the client; security-group state tracking permits them without a new inbound ephemeral rule.

B. Add an outbound TCP 5432 rule on the database security group or all return packets will be dropped. - Security groups are stateful, so response traffic for an established allowed inbound connection is automatically permitted regardless of a matching outbound rule.

C. Replace the security group with a network ACL and add explicit request and return-path rules. - Security groups do track connection state; network ACLs are the stateless control that requires explicit return-path rules.

Question 20

A vendor needs temporary read access to one S3 bucket from its AWS account. The company does not want to create local IAM users for the vendor. Which control is appropriate?

A. Grant the vendor access by adding its IP address only to an EC2 security group.

B. Create a local IAM user for the vendor and email the access keys.

C. Make the bucket public and rely on an obscure object prefix.

D. Use an S3 bucket policy that grants the vendor account or a specific vendor role the required read permissions.

Correct Answer: D. Use an S3 bucket policy that grants the vendor account or a specific vendor role the required read permissions.

An S3 resource policy can grant narrowly scoped cross-account access directly to the intended external principal without introducing shared long-lived credentials.

Why not the other options?

A. Grant the vendor access by adding its IP address only to an EC2 security group. - Security groups control network access to supported VPC resources and do not authorize S3 object operations by an external AWS principal.

B. Create a local IAM user for the vendor and email the access keys. - The scenario explicitly avoids local vendor users, and long-lived access keys add unnecessary credential-management risk.

C. Make the bucket public and rely on an obscure object prefix. - Public access grants far broader access than the single vendor principal and does not provide a security boundary.

.

.

.

(last 2 questions)

.

.

.

Question 419

A security team receives findings from Amazon GuardDuty, Amazon Inspector, and AWS Config across several accounts. Analysts want a centralized service that aggregates and normalizes supported security findings so they can prioritize and track remediation from one place. Which service should they use?

A. Amazon GuardDuty.

B. AWS Config.

C. Amazon Inspector.

D. AWS Security Hub.

Correct Answer: D. AWS Security Hub.

AWS Security Hub aggregates findings from supported AWS security services and partner products and provides a centralized view for prioritization and remediation workflows. It is designed to reduce fragmentation across multiple security finding sources.

Why not the other options?

A. Amazon GuardDuty. - GuardDuty produces threat-detection findings but does not serve as the central aggregation layer for Inspector, Config, and other supported security findings.

B. AWS Config. - AWS Config evaluates resource configuration and compliance but is not the central normalized findings service for the multiple security products listed.

C. Amazon Inspector. - Amazon Inspector generates vulnerability findings for supported workloads and software but does not aggregate the broader cross-service finding set.

Question 420

A CloudFront distribution caches responses from an application origin. Requests to /catalog?lang=en and /catalog?lang=fr should produce different content, but users sometimes receive the wrong language because the cache behavior ignores the lang query string. What should be changed?

A. Update only the origin request policy to forward lang while continuing to exclude lang from the cache key.

B. Disable caching for all /catalog requests so every language variant is fetched from the origin.

C. Update the CloudFront cache policy so the relevant lang query string is included in the cache key and forwarded as required.

D. Create two separate distributions, one for each language, while leaving the current cache policy unchanged.

Correct Answer: C. Update the CloudFront cache policy so the relevant lang query string is included in the cache key and forwarded as required.

CloudFront must distinguish cached variants using the values that affect the origin response. Including the lang query string in the cache key, and forwarding it according to the behavior, prevents English and French responses from sharing the same cached object.

Why not the other options?

A. Update only the origin request policy to forward lang while continuing to exclude lang from the cache key. - Forwarding the query string without including it in the cache key can still cause different language responses to share one cached object.

B. Disable caching for all /catalog requests so every language variant is fetched from the origin. - Disabling caching would avoid variant collisions but sacrifices the caching requirement and is unnecessary when the cache key can vary by the relevant query string.

D. Create two separate distributions, one for each language, while leaving the current cache policy unchanged. - Separate distributions could isolate variants but add unnecessary infrastructure when the existing distribution can cache the variants correctly with an appropriate cache policy.

(END OF PRACTICE EXAM QUESTIONS)