I85PREP
⌘ K
SAE-C01 study materials
SAE-C01 study resources

SAE-C01 (Alibaba Cloud Certifications) practice questions

One question at a time. Build your SAE-C01 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts and Architecture

Which AWS Cloud characteristic lets a company replace large upfront capital purchases with pay-as-you-go usage fees?

  1. Variable expense model Correct answer.
  2. High availability
  3. Elasticity
  4. Global reach

Explanation

The variable expense model means customers pay only for resources consumed, converting capital expenditure into operating expenditure. Elasticity and global reach describe scaling and geographic distribution, not the payment model.

Question 2Cloud Concepts and Architecture

A team wants to stop manually guessing server capacity and instead have capacity grow and shrink automatically with traffic. Which cloud benefit does this describe?

  1. Elasticity Correct answer.
  2. Auditability
  3. Durability
  4. Fault isolation

Explanation

Elasticity is the ability to acquire and release resources automatically as demand changes. Durability, auditability, and fault isolation are unrelated properties of storage, logging, and architecture.

Question 3Cloud Concepts and Architecture

What is the primary purpose of an AWS Region?

  1. A caching layer at the edge of the network
  2. A physically separate geographic area containing multiple isolated Availability Zones Correct answer.
  3. A logical grouping of accounts for billing
  4. A single data center within one building

Explanation

A Region is a geographic area composed of multiple Availability Zones that are physically separated and independently powered and cooled. This design allows fault tolerance across zones within the Region.

Question 4Cloud Concepts and Architecture

Which statement best describes an Availability Zone?

  1. A global content delivery network
  2. A software-defined network spanning continents
  3. A billing boundary for consolidated invoicing
  4. One or more discrete data centers with independent power, cooling, and networking Correct answer.

Explanation

An Availability Zone consists of one or more discrete data centers with redundant power, cooling, and networking, isolated from other zones. Deploying across zones protects workloads from single-zone failure.

Question 5Cloud Concepts and Architecture

Which AWS service model requires the customer to manage the guest operating system, patching, and runtime?

  1. Platform as a Service
  2. Infrastructure as a Service Correct answer.
  3. Software as a Service
  4. Function as a Service

Explanation

With IaaS the provider supplies compute, storage, and networking, while the customer manages the OS, middleware, and runtime. Higher-level models shift that responsibility to the provider.

Question 6Cloud Concepts and Architecture

Under the AWS shared responsibility model, which task belongs to the customer?

  1. Maintaining the physical security of data centers
  2. Replacing failed underlying storage hardware
  3. Patching the hypervisor layer
  4. Configuring security groups and identity policies for their workloads Correct answer.

Explanation

The customer is responsible for security in the cloud, including configuration of network controls, access policies, and data. Physical facilities, hypervisor, and hardware are provider responsibilities.

Question 7Cloud Concepts and Architecture

What does the AWS Well-Architected Framework operational excellence pillar primarily focus on?

  1. Running and monitoring systems to deliver business value and continually improving processes Correct answer.
  2. Minimizing environmental impact of workloads
  3. Designing workloads to withstand failure
  4. Protecting data and systems with controls

Explanation

Operational excellence covers running and monitoring workloads and improving supporting processes. The other pillars address resilience, sustainability, and security respectively.

Question 8Cloud Concepts and Architecture

A company needs to run a workload with strict data residency requirements in a specific country. What should it select first?

  1. An AWS Region located in that country Correct answer.
  2. A single Availability Zone in any Region
  3. A global edge network location
  4. A multi-Region replication policy

Explanation

Data residency is addressed by choosing a Region in the required jurisdiction, since data is stored in the Availability Zones of that Region. Edge locations and replication policies do not establish residency.

Question 9Cloud Concepts and Architecture

A workload must survive the loss of an entire data center without downtime. Which design meets this requirement with the least additional complexity?

  1. Deploy a single instance with a larger size
  2. Deploy across multiple edge locations
  3. Deploy across multiple Availability Zones in one Region Correct answer.
  4. Deploy all resources in one Availability Zone

Explanation

Spreading resources across multiple Availability Zones within a Region protects against the loss of a single data center. Multi-Region designs add complexity beyond what the requirement demands.

Question 10Cloud Concepts and Architecture

Which scenario best justifies a multi-Region architecture?

  1. Replacing the need for backups within a Region
  2. Serving users with low latency on different continents while meeting regional failover goals Correct answer.
  3. Reducing the cost of a single small web application
  4. Avoiding the use of identity and access management

Explanation

Multi-Region designs are justified by global latency requirements and disaster recovery objectives that a single Region cannot meet. Cost reduction for small workloads and backup replacement are not valid reasons.

Question 11Cloud Concepts and Architecture

What is the main benefit of an AWS edge location?

  1. Storing encrypted backups for long-term retention
  2. Caching content closer to end users to reduce latency Correct answer.
  3. Hosting relational databases for a Region
  4. Providing physical security for data centers

Explanation

Edge locations are distributed sites used by services such as content delivery networks to serve cached content near users, lowering latency. They are not used for primary database hosting or archival storage.

Question 12Cloud Concepts and Architecture

A startup wants to avoid forecasting peak capacity and instead scale automatically. Which cloud concept directly addresses this?

  1. Elasticity Correct answer.
  2. Durability
  3. Immutability
  4. Federation

Explanation

Elasticity allows resources to scale up and down automatically with demand, removing the need for upfront capacity forecasting. The other terms describe data integrity, change management, and identity respectively.

Question 13Cloud Concepts and Architecture

Which characteristic distinguishes a loosely coupled architecture?

  1. Components call each other synchronously in a fixed chain
  2. Components interact through well-defined interfaces so a failure in one does not cascade Correct answer.
  3. All components share a single database schema
  4. Components are deployed as one monolithic unit

Explanation

Loose coupling uses asynchronous or well-defined interfaces so components can fail or change independently. Shared schemas, fixed synchronous chains, and monoliths increase coupling.

Question 14Cloud Concepts and Architecture

A team is choosing between a managed database service and running a database on virtual servers. Which consideration favors the managed service?

  1. The team can install custom kernel modules
  2. The provider handles patching, backups, and failover automation Correct answer.
  3. The team avoids any vendor dependency
  4. The team gains full control of the host operating system

Explanation

Managed services shift operational tasks such as patching, backup, and failover to the provider, reducing administrative overhead. Host-level control and kernel customization favor self-managed servers.

Question 15Cloud Concepts and Architecture

Which design principle from the Well-Architected Framework recommends testing recovery procedures regularly?

  1. Stop guessing capacity
  2. Anticipate failure and validate recovery through game days Correct answer.
  3. Implement a strong identity foundation
  4. Optimize over time

Explanation

The reliability pillar recommends anticipating failure and validating recovery processes through regular testing such as game days. The other options belong to operational excellence, security, and performance efficiency.

Question 16Cloud Concepts and Architecture

A company wants to reduce the environmental impact of its workloads. Which action aligns with the sustainability pillar?

  1. Storing multiple full copies of all data indefinitely
  2. Running all workloads in every Region
  3. Increasing instance count to add redundancy
  4. Rightsizing instances and scaling down idle resources Correct answer.

Explanation

Sustainability emphasizes efficient resource use, so rightsizing and eliminating idle capacity reduce energy consumption. Over-provisioning and unnecessary duplication increase impact.

Question 17Cloud Concepts and Architecture

Which statement about the shared responsibility model for a managed container service is accurate?

  1. The customer is responsible for patching the physical hosts
  2. AWS secures the underlying infrastructure while the customer secures images, configurations, and access Correct answer.
  3. AWS is responsible for the customer's application code
  4. Responsibility for all layers is split evenly by percentage

Explanation

For managed container services, AWS secures the host infrastructure and the customer secures what they deploy, including images, configuration, and access controls. Responsibility is not divided by fixed percentages.

Question 18Cloud Concepts and Architecture

A workload requires very high durability for stored objects across facilities. Which approach supports that goal?

  1. Store data in one Availability Zone only
  2. Store data on a single attached disk
  3. Store data on a single instance store volume
  4. Store data in a Regional service that replicates across multiple Availability Zones Correct answer.

Explanation

Regional storage services replicate data across multiple Availability Zones, providing durability beyond a single facility. Instance store and single-disk options are tied to one host or zone.

Question 19Cloud Concepts and Architecture

What is the difference between high availability and disaster recovery?

  1. High availability and disaster recovery are the same concept
  2. High availability minimizes downtime from component failure, while disaster recovery restores service after a large-scale event Correct answer.
  3. High availability requires multiple Regions, while disaster recovery requires one
  4. High availability applies only to databases, while disaster recovery applies only to storage

Explanation

High availability addresses routine component failures with redundancy, while disaster recovery plans for restoring service after major events. They operate at different scopes and are not interchangeable.

Question 20Cloud Concepts and Architecture

An architect must choose a Region for a new workload with regulatory, latency, and cost constraints. Which factor is least relevant to the Region decision?

  1. Data residency laws in candidate Regions
  2. The number of Availability Zones in the architect's home country Correct answer.
  3. Service availability and pricing in candidate Regions
  4. Network latency to the primary user base

Explanation

Region selection depends on compliance, latency, service availability, and cost. The architect's home country zone count has no bearing on where the workload should run.

Question 21Cloud Concepts and Architecture

A team wants to migrate from capital-intensive infrastructure to a model where costs track usage. Which combination of cloud characteristics delivers this?

  1. Fault isolation combined with immutability
  2. Federation combined with edge caching
  3. Durability combined with global reach
  4. Variable expense model combined with elasticity Correct answer.

Explanation

Pay-as-you-go billing removes upfront capital expense, and elasticity ensures spend follows actual demand. The other combinations address resilience, change management, and identity or delivery concerns.

Question 22Cloud Concepts and Architecture

A company runs a stateful legacy application that cannot be modified. Which migration strategy requires the least application change?

  1. Rehost the application onto cloud infrastructure Correct answer.
  2. Repurchase a different vendor product
  3. Refactor the application into microservices
  4. Rebuild the application on serverless functions

Explanation

Rehosting moves the application to cloud infrastructure with minimal change, which suits unmodifiable legacy systems. Refactoring, rebuilding, and repurchasing all require significant change or replacement.

Question 23Cloud Concepts and Architecture

An application must remain available even if an entire Region becomes unavailable. Which requirement does this impose?

  1. Deployment in two Availability Zones of one Region
  2. Use of a single edge location
  3. Replication of data and deployment of resources in at least two Regions Correct answer.
  4. Use of larger instance types

Explanation

Surviving a full Region outage requires resources and data replicated in another Region. Multiple zones in one Region protect only against zone failures.

Question 24Cloud Concepts and Architecture

Which statement correctly distinguishes the customer's responsibility for data classification from AWS's responsibility?

  1. The customer secures physical media, while AWS defines data sensitivity
  2. The customer classifies and protects its data, while AWS secures the infrastructure that stores it Correct answer.
  3. Both parties share classification duties equally
  4. AWS classifies customer data and decides access permissions

Explanation

Under the shared responsibility model the customer owns data classification, access control, and protection, while AWS secures the underlying infrastructure. AWS does not classify customer data.

Question 25Cloud Concepts and Architecture

A workload has unpredictable traffic with long idle periods. Which architectural choice best balances cost and performance?

  1. Run fixed capacity sized for the average
  2. Provision permanently for peak capacity
  3. Use elastic scaling that releases capacity during idle periods Correct answer.
  4. Over-provision by a large safety margin

Explanation

Elastic scaling matches capacity to demand, so idle periods do not incur cost for unused resources. Static provisioning for peak, average, or safety margins wastes capacity during idle periods.

Question 26Cloud Concepts and Architecture

Which cloud computing characteristic allows a system to add or remove compute resources in response to real-time demand?

  1. Multi-tenancy
  2. Elasticity Correct answer.
  3. Fault tolerance
  4. Durability

Explanation

Elasticity is the ability to acquire and release resources automatically as demand changes, matching capacity to load. Durability concerns data persistence, multi-tenancy concerns resource sharing, and fault tolerance concerns continuing operation despite component failure.

Question 27Cloud Concepts and Architecture

Which benefit of moving to the cloud most directly reduces the need to guess future infrastructure needs months in advance?

  1. Elimination of all operational staffing
  2. Capacity that can be provisioned on demand Correct answer.
  3. Automatic encryption of all stored data
  4. Fixed monthly pricing regardless of usage

Explanation

On-demand provisioning lets teams obtain capacity when it is needed, replacing long-range capacity forecasting with iterative adjustment. Cost models still vary with usage, staffing is not eliminated, and encryption is a separate security control.

Question 28Cloud Concepts and Architecture

An application writes to a queue, and a separate pool of workers reads from that queue. Which architectural property does this pattern primarily provide?

  1. Decoupling between the producer and the consumers Correct answer.
  2. Reduced storage cost through compression
  3. Strong transactional consistency across services
  4. Automatic schema migration of the message payload

Explanation

A queue inserts an intermediary buffer so the producer and workers operate independently in time and scale. It does not by itself guarantee transactional consistency, compress data, or transform message schemas.

Question 29Cloud Concepts and Architecture

Which statement best describes an AWS Availability Zone?

  1. A separate geographic area isolated from all other areas by hundreds of kilometers
  2. One or more discrete data centers with independent power and networking within a Region Correct answer.
  3. A single logical grouping of edge caches serving one metropolitan area
  4. A virtual network dedicated to a single customer account

Explanation

An Availability Zone consists of one or more discrete data centers with redundant power, networking, and connectivity inside a Region. Edge locations, Regions, and virtual networks are distinct concepts.

Question 30Cloud Concepts and Architecture

A company must keep its primary database in one country but wants a read-only copy in a second country for reporting. Which AWS construct should it use to place each copy in the required jurisdiction?

  1. Multiple Availability Zones within one Region
  2. One placement group spanning both countries
  3. Two Regions, one in each country Correct answer.
  4. A single edge location in each country

Explanation

Regions are the top-level geographic boundary, so choosing a Region in each country places the data where the regulations require. Availability Zones and edge locations sit within a Region, and placement groups apply to compute instances within one Region.

Question 31Cloud Concepts and Architecture

An architect wants a workload to continue serving traffic if one Availability Zone fails, without manual intervention. Which design element is essential?

  1. Deploying all instances into a single subnet
  2. Distributing instances across at least two Availability Zones behind a load balancer Correct answer.
  3. Using one large instance sized for peak load
  4. Storing session state on the local disk of each instance

Explanation

Spreading capacity across multiple Availability Zones and routing with a load balancer lets healthy zones absorb traffic when one fails. Single-subnet or single-instance designs and instance-local session state create single points of failure.

Question 32Cloud Concepts and Architecture

Which practice most directly supports the reliability pillar's goal of recovering from failure through tested, repeatable steps?

  1. Granting all engineers full administrative access to production
  2. Increasing instance size to reduce the chance of overload
  3. Documenting an incident runbook that is reviewed only at annual audit
  4. Automating recovery actions and exercising them with controlled failure tests Correct answer.

Explanation

Automating recovery and rehearsing it with controlled fault injection turns recovery into a repeatable, verified process. Documentation alone without exercise, larger instances, and broad access do not build tested recovery capability.

Question 33Cloud Concepts and Architecture

A team is deciding whether to adopt a managed message broker instead of operating its own. Which consideration most strongly favors the managed service?

  1. The team wants to co-locate the broker on the same host as the application
  2. The team needs to install custom plugins written for a specific broker version
  3. The team wants to minimize undifferentiated operational work such as patching and failover Correct answer.
  4. The team wants full control over the broker's kernel parameters

Explanation

Managed services shift routine operational tasks such as patching, backups, and failover to the provider, which is the main trade-off against control. Deep kernel control, custom plugins, and host co-location generally require self-managed deployment.

Question 34Cloud Concepts and Architecture

A workload's traffic is steady and predictable, but the company wants to lower long-term compute cost. Which purchasing approach best fits this profile?

  1. Dedicated Hosts for all workloads
  2. Savings Plans or Reserved Instances covering the steady baseline Correct answer.
  3. Spot Instances for all production capacity
  4. On-Demand Instances for every hour of the year

Explanation

Commitment-based pricing such as Savings Plans or Reserved Instances trades a term commitment for a lower rate, which suits a predictable baseline. On-Demand is the most flexible but most expensive, Spot can be interrupted, and Dedicated Hosts are for licensing or isolation needs.

Question 35Cloud Concepts and Architecture

Which statement accurately describes how the shared responsibility model divides duties for infrastructure as a service?

  1. The customer is responsible for the physical security of the data centers
  2. AWS is responsible for classifying and encrypting the customer's data
  3. Responsibility for patching the guest operating system is shared equally
  4. AWS operates the physical facilities and virtualization layer while the customer secures guest operating systems and data Correct answer.

Explanation

In IaaS, AWS secures the facilities, hardware, and virtualization layer, while the customer manages the guest operating system, applications, and data. Physical security, data classification, and guest patching are not split equally.

Question 36Cloud Concepts and Architecture

A team wants to reduce the blast radius of a failure so that a problem in one component does not cascade across the whole system. Which technique best serves this goal?

  1. Increasing the size of every instance in the system
  2. Introducing bulkheads and timeouts between components Correct answer.
  3. Combining all functions into one large service to reduce network hops
  4. Removing retries so failed calls fail immediately

Explanation

Bulkheads isolate failure domains and timeouts prevent a slow dependency from consuming resources indefinitely, limiting cascading failure. Monolithic consolidation, removing retries, and uniformly larger instances do not bound the spread of failure.

Question 37Cloud Concepts and Architecture

An application must tolerate the loss of a single compute instance without user-visible errors. Which combination achieves this with the least operational burden?

  1. A single instance with a large attached volume and manual restart
  2. A cron job that emails an administrator when the instance stops
  3. Multiple instances behind a load balancer with health checks and automatic replacement Correct answer.
  4. A single instance with a longer backup retention period

Explanation

Redundant instances behind a load balancer with health checks and automatic replacement remove the instance as a single point of failure. Manual restart, longer backups, and alerting all involve detectable downtime.

Question 38Cloud Concepts and Architecture

An architect must decide how to keep a warm standby environment in a second Region ready for failover. Which trade-off does this approach primarily make?

  1. It removes the need for any failover testing
  2. It eliminates all data replication lag between Regions
  3. It reduces recovery time at the cost of continuously running idle capacity Correct answer.
  4. It guarantees that the standby Region will never be affected by an outage

Explanation

A warm standby keeps scaled-down but running capacity in the second Region, so failover is fast but you pay for resources that normally serve little traffic. It does not eliminate replication lag, remove testing needs, or guarantee immunity from outages.

Question 39Cloud Concepts and Architecture

A company operates in a regulated industry and must prove to auditors which controls it manages versus which the provider manages. Which action best supports this requirement?

  1. Mapping each control to the responsible party using the shared responsibility model and provider compliance reports Correct answer.
  2. Assuming the provider's compliance certification covers all customer-side controls
  3. Relying on the provider to classify the company's data
  4. Requesting that the provider patch the customer's guest operating systems

Explanation

Audit evidence requires an explicit control-by-control mapping that separates provider responsibilities from customer responsibilities, supported by the provider's compliance artifacts. Assuming blanket coverage, delegating data classification, or expecting the provider to patch guest systems misstates the boundary.

Question 40Cloud Concepts and Architecture

A batch workload can tolerate interruption and must complete within a flexible window at the lowest possible compute cost. Which approach best matches these constraints?

  1. On-Demand Instances running continuously
  2. Dedicated Hosts reserved for the workload
  3. Spot Instances with checkpointing and retry on interruption Correct answer.
  4. Reserved Instances purchased for three years

Explanation

Spot capacity offers the largest discount for workloads that can absorb interruption, and checkpointing plus retry makes interruptions tolerable. Continuous On-Demand, long commitments, and Dedicated Hosts all cost more for a workload that does not need guaranteed capacity.

Question 41Security and Compliance

Under the AWS shared responsibility model for a managed service such as Amazon RDS, which responsibility belongs to the customer?

  1. Managing database user accounts and their permissions Correct answer.
  2. Securing the physical data center hosting the database
  3. Patching the underlying database engine binaries
  4. Replacing failed storage drives in the host server

Explanation

For managed services, AWS operates the infrastructure and the managed platform layers, while the customer controls data, identities, and access configuration. Managing database users and their privileges is a customer-side identity and access task.

Question 42Security and Compliance

A company stores regulated data in Amazon S3 and must prove to auditors that objects cannot be read by unauthorized parties even if a bucket policy is misconfigured. Which control most directly satisfies this?

  1. Turning on S3 Transfer Acceleration
  2. Configuring default encryption with customer-managed KMS keys Correct answer.
  3. Enabling versioning on the bucket
  4. Enabling S3 server access logging

Explanation

Encryption at rest with customer-managed keys ensures stored objects are unreadable without decryption rights, adding a layer independent of bucket policy correctness. Access logging and versioning provide auditing and recovery but do not prevent reads.

Question 43Security and Compliance

Which AWS capability is designed to continuously evaluate resources against desired security configurations and flag noncompliant items?

  1. AWS CloudTrail
  2. Amazon GuardDuty
  3. AWS Config rules Correct answer.
  4. AWS Shield Advanced

Explanation

AWS Config records resource configurations and evaluates them against rules to detect drift and noncompliance. CloudTrail records API activity, GuardDuty detects threats, and Shield Advanced provides DDoS protection.

Question 44Security and Compliance

A security team wants to detect anomalous API activity and compromised credentials across an AWS account without deploying agents. Which service should they enable?

  1. Amazon Inspector
  2. AWS Artifact
  3. Amazon GuardDuty Correct answer.
  4. AWS Trusted Advisor

Explanation

GuardDuty is a managed threat-detection service that analyzes CloudTrail, VPC flow, and DNS logs to surface suspicious behavior such as credential misuse. It requires no agents on workloads.

Question 45Security and Compliance

An auditor asks for evidence that a customer's IAM policies follow least privilege. Which practice best supports that evidence?

  1. Reviewing IAM Access Analyzer findings and unused permissions regularly Correct answer.
  2. Disabling multi-factor authentication for automation accounts
  3. Sharing a single IAM user across the operations team
  4. Granting broad administrator policies to reduce support tickets

Explanation

IAM Access Analyzer identifies resources shared externally and unused permissions, producing evidence that privileges are reviewed and trimmed. Least privilege requires ongoing review rather than broad standing access.

Question 46Security and Compliance

Which statement correctly describes the scope of an AWS Organizations service control policy (SCP)?

  1. It sets the maximum permissions available to accounts in the organization. Correct answer.
  2. It grants permissions to IAM principals in member accounts.
  3. It encrypts data at rest across all member accounts.
  4. It replaces identity-based policies inside each member account.

Explanation

SCPs define a permissions guardrail, capping what principals in member accounts can do, but they do not themselves grant access. Effective permissions are the intersection of SCPs and identity-based policies.

Question 47Security and Compliance

A workload must store encryption keys in a hardware security module that the customer controls and that meets FIPS 140-2 Level 3. Which AWS service fits?

  1. AWS CloudHSM Correct answer.
  2. AWS Certificate Manager
  3. AWS KMS with AWS-managed keys
  4. AWS Secrets Manager

Explanation

CloudHSM provides dedicated, single-tenant hardware security modules validated to FIPS 140-2 Level 3 under customer control. KMS with AWS-managed keys is multi-tenant and less customer-controlled.

Question 48Security and Compliance

Which CloudTrail feature helps ensure that log files cannot be altered or deleted by a compromised account administrator?

  1. Sending trails to a CloudWatch Logs group
  2. Using management events only
  3. Log file integrity validation with digest files Correct answer.
  4. Enabling multi-region trails

Explanation

Digest files and log file integrity validation let you verify that delivered logs were not tampered with. Multi-region trails improve coverage but do not by themselves prevent or prove tampering.

Question 49Security and Compliance

A developer needs temporary credentials for an EC2 instance to call S3. Which approach aligns with security best practice?

  1. Storing access keys in a plaintext file on the instance
  2. Embedding long-term access keys in the application source
  3. Creating a shared IAM user for all instances
  4. Attaching an IAM role to the instance profile Correct answer.

Explanation

An attached IAM role lets the instance obtain automatically rotated temporary credentials from the instance metadata service. Long-term keys stored on the instance are a common cause of credential leakage.

Question 50Security and Compliance

Which service provides on-demand vulnerability scanning of Amazon EC2 instances and container images?

  1. AWS WAF
  2. Amazon Inspector Correct answer.
  3. Amazon Macie
  4. AWS Security Hub

Explanation

Inspector performs automated vulnerability management by scanning EC2 instances and container images for software vulnerabilities and unintended network exposure. Macie classifies sensitive data, Security Hub aggregates findings, and WAF filters web traffic.