I85PREP
⌘ K
AWS CRAW study materials
AWS CRAW study resources

AWS Certified Cloud Practitioner (CLF-C02) practice questions

One question at a time. Build your AWS CRAW understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts

A company wants to avoid spending money on physical data center hardware and instead pay only for the compute capacity it consumes each month. Which cloud benefit does this describe?

  1. Trading capital expense for variable expense Correct answer.
  2. Fixed long-term capacity reservation
  3. Eliminating the need for security controls
  4. Increasing physical server density

Explanation

Cloud computing converts large upfront capital purchases into usage-based operating costs, so spending scales with actual consumption. This lets teams avoid over-provisioning for peak demand and pay only for resources consumed.

Question 2Cloud Concepts

Which statement correctly describes the AWS Shared Responsibility Model?

  1. The customer is responsible for the physical facilities that host the servers
  2. AWS is responsible for customer data classification and access policies
  3. Responsibility for patching is split evenly between AWS and the customer for every service
  4. AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud Correct answer.

Explanation

The model divides duties: AWS secures the underlying infrastructure (facilities, hardware, network), while customers secure what they put in the cloud, such as data, identities, and configurations. The split point varies by service type, such as managed versus unmanaged.

Question 3Cloud Concepts

A startup needs to deploy a web application quickly without forecasting server capacity in advance. Which characteristic of cloud computing most directly supports this?

  1. Manual racking of physical servers
  2. Single-tenant hardware isolation
  3. Elasticity with self-service provisioning Correct answer.
  4. Mandatory multi-year contracts

Explanation

Self-service provisioning lets teams launch resources on demand, and elasticity adjusts capacity to match load automatically. Together they remove the need to pre-purchase and forecast hardware precisely.

Question 4Cloud Concepts

Which AWS service category provides virtual servers that a customer configures and manages, including the guest operating system?

  1. Networking
  2. Storage
  3. Analytics
  4. Compute Correct answer.

Explanation

Compute services supply processing capacity; Amazon EC2 specifically delivers virtual servers where customers control the guest operating system and installed software. Networking, storage, and analytics are separate categories with different purposes.

Question 5Cloud Concepts

Which AWS global infrastructure component consists of one or more discrete data centers with independent power and networking?

  1. Edge location
  2. Availability Zone Correct answer.
  3. Local Zone
  4. Region

Explanation

An Availability Zone is a physically separate location within a Region, built from one or more data centers with redundant power, cooling, and networking. Regions are collections of these zones, and edge locations serve content closer to users.

Question 6Cloud Concepts

What is the primary purpose of deploying application tiers across multiple Availability Zones?

  1. To avoid the need for any backup strategy
  2. To increase fault tolerance by surviving the failure of a single zone Correct answer.
  3. To satisfy a requirement that all data reside in one data center
  4. To reduce the AWS bill by sharing one physical server

Explanation

Availability Zones are isolated from one another, so spreading workloads across them keeps the application running if one zone fails. This improves availability and fault tolerance rather than cost or backup coverage.

Question 7Cloud Concepts

Which pricing model lets a customer pay for compute capacity with no upfront commitment and no long-term contract?

  1. On-Demand Correct answer.
  2. Dedicated Host
  3. Savings Plan
  4. Reserved Instance

Explanation

On-Demand pricing bills per unit of usage with no commitment, which suits unpredictable or short-lived workloads. Reserved Instances and Savings Plans trade commitment for discounts, while Dedicated Hosts address licensing and isolation needs.

Question 8Cloud Concepts

Which statement best describes the AWS Well-Architected Framework?

  1. A set of design pillars and best-practice guidance for building reliable, secure, efficient systems on AWS Correct answer.
  2. A mandatory certification exam for every AWS customer
  3. A hardware specification for physical servers
  4. A billing report that lists monthly charges

Explanation

The framework organizes architectural guidance into pillars such as operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Teams use it to review workloads and identify improvement areas.

Question 9Cloud Concepts

A team runs a batch job only during a two-hour window each night and wants to minimize cost. Which approach best matches the workload?

  1. Run the fleet continuously so it is always warm
  2. Reserve a three-year term for a constant fleet of large instances
  3. Launch the required capacity on demand and terminate it when the job finishes Correct answer.
  4. Purchase dedicated physical hosts for the nightly job

Explanation

Short, intermittent workloads align with usage-based pricing, so creating capacity for the run and releasing it afterward avoids paying for idle time. Long commitments and always-on fleets waste money when the job runs only briefly.

Question 10Cloud Concepts

Which design choice best supports elasticity for a web tier whose traffic varies significantly by hour?

  1. Automatically adjust the number of instances based on demand metrics Correct answer.
  2. Provision permanently for the highest observed peak
  3. Use a single large instance sized for the yearly maximum
  4. Disable monitoring to reduce overhead

Explanation

Elasticity means capacity tracks demand, which is achieved by scaling the instance count in response to metrics such as utilization or request rate. Static provisioning for peak leaves idle capacity most of the time.

Question 11Cloud Concepts

Under the Shared Responsibility Model, which task belongs to the customer when using a managed relational database service?

  1. Configuring network access rules and managing database user permissions Correct answer.
  2. Replacing failed server hardware in the data center
  3. Maintaining the physical disks that store the database
  4. Patching the database engine's underlying host operating system

Explanation

For managed database services, AWS operates the infrastructure and the engine host, while the customer controls access through network rules, identity policies, and database-level permissions. Physical hardware and host operating system patching remain provider duties.

Question 12Cloud Concepts

A company must keep certain regulated data inside a specific country. Which AWS global infrastructure decision addresses this requirement directly?

  1. Selecting the Region located in that country for the data stores Correct answer.
  2. Using a content delivery network with global edge locations
  3. Enabling detailed monitoring on all resources
  4. Choosing a smaller instance type in any Region

Explanation

Data residency is controlled by where data is stored, so choosing a Region inside the required jurisdiction is the direct control. Instance size, monitoring, and edge caching do not change the physical location of stored data.

Question 13Cloud Concepts

Which combination best describes a highly available architecture for a stateful application?

  1. Replicate data across multiple Availability Zones and route traffic away from failed components Correct answer.
  2. Store all data on instance store volumes of a single server
  3. Run everything in one Availability Zone and rely on fast restarts
  4. Use one large instance and a manual recovery runbook

Explanation

High availability requires redundant components in separate failure domains plus automated detection and failover of traffic. Data replication ensures the standby tier can take over without losing state.

Question 14Cloud Concepts

A workload has steady, predictable usage for the next three years. Which purchasing approach most likely lowers cost the most?

  1. Dedicated Hosts for every instance regardless of licensing needs
  2. A committed Savings Plan or Reserved Instance covering the baseline Correct answer.
  3. Spot capacity for the entire production database tier
  4. On-Demand capacity for the entire fleet

Explanation

Commitment-based discounts exchange a term commitment for a lower rate, which fits stable, predictable baselines well. On-Demand costs more for constant load, and interruptible capacity is unsuitable for a database that must remain available.

Question 15Cloud Concepts

Which practice aligns with the operational excellence pillar of the Well-Architected Framework?

  1. Treating infrastructure changes as code and rehearsing them before production rollout Correct answer.
  2. Relying on a single engineer who holds all operational knowledge
  3. Avoiding post-incident reviews to save time
  4. Making undocumented configuration changes directly in production

Explanation

Operational excellence emphasizes automation, version-controlled change, testing, and learning from incidents. Codifying changes and rehearsing them reduces human error and makes rollback predictable.

Question 16Cloud Concepts

A company wants to migrate an on-premises application to AWS with minimal changes and keep full control of the guest operating system. Which approach best fits?

  1. Rehost the application onto virtual servers in the cloud Correct answer.
  2. Retire the application without replacement
  3. Repurchase a different vendor's software as a service
  4. Rebuild the application as a set of serverless functions

Explanation

Rehosting, often called lift and shift, moves the existing application to cloud virtual servers with little modification and preserves operating system control. Rebuilding or repurchasing changes the application substantially.

Question 17Cloud Concepts

Which statement about the AWS Cloud Adoption Framework is accurate?

  1. It defines the physical layout of AWS data centers
  2. It is a pricing calculator for estimating monthly bills
  3. It is a replacement for the Shared Responsibility Model
  4. It provides guidance organized around perspectives that address business, people, governance, platform, security, and operations capabilities Correct answer.

Explanation

The framework groups transformation guidance into perspectives so organizations can plan business, technical, and organizational change together. It is advisory guidance rather than a billing tool or a security responsibility model.

Question 18Cloud Concepts

A team is choosing between a relational database and a key-value store for a new service. Which factor most directly reflects a cloud design principle of decoupling?

  1. Using a single monolithic database for every workload to simplify operations
  2. Coupling the web tier directly to a specific server's local disk
  3. Storing session state on individual application servers
  4. Selecting a purpose-built data store for each access pattern instead of forcing one engine to serve all needs Correct answer.

Explanation

Cloud design favors purpose-built, managed services matched to each workload's access pattern, which reduces coupling and lets components scale independently. Local disk state and monolithic stores tie components together.

Question 19Cloud Concepts

Which statement best explains why loose coupling improves cloud applications?

  1. Components call each other synchronously without retries
  2. Components interact through durable interfaces so one component's failure does not immediately cascade Correct answer.
  3. All components share one process so failures are easier to trace
  4. Every component writes directly to the same database table

Explanation

Loose coupling uses asynchronous, durable interfaces such as queues or events so a slow or failed component does not block others. This isolation improves resilience and allows independent scaling.

Question 20Cloud Concepts

A company wants to reduce the environmental impact of its workloads while meeting performance goals. Which action aligns with the sustainability pillar?

  1. Storing multiple unneeded copies of the same dataset indefinitely
  2. Over-provisioning capacity to guarantee headroom
  3. Running duplicate environments continuously for every experiment
  4. Rightsizing instances and scaling down idle capacity Correct answer.

Explanation

Sustainability guidance focuses on using only the resources needed, which lowers energy consumption and cost. Rightsizing and eliminating idle capacity directly reduce waste.

Question 21Cloud Concepts

An application must continue processing messages even if a downstream consumer is temporarily unavailable. Which architectural choice best supports this?

  1. Have the producer call the consumer directly and fail on error
  2. Place a durable queue between the producer and the consumer Correct answer.
  3. Rely on the consumer polling the producer's local disk
  4. Store messages only in the producer's memory

Explanation

A durable queue decouples producer and consumer, buffering messages until the consumer recovers. Direct calls and in-memory or local-disk storage lose messages when the consumer is down or the host is replaced.

Question 22Cloud Concepts

A regulated workload requires that no other customer share the same physical server, and the company also needs to bring its own operating system licenses. Which option addresses both needs?

  1. On-Demand shared instances
  2. Spot Instances
  3. Dedicated Hosts Correct answer.
  4. A serverless function runtime

Explanation

Dedicated Hosts provide a physical server fully dedicated to one customer, which supports isolation requirements and brings visibility for per-socket licensing. Shared instances and serverless runtimes do not offer that control.

Question 23Cloud Concepts

A company wants to minimize the blast radius of a compromised workload credential. Which combination of design choices best achieves this?

  1. Grant least-privilege permissions to scoped roles and isolate workloads in separate accounts Correct answer.
  2. Disable logging so credentials are not recorded
  3. Share one long-lived access key across all workloads
  4. Attach administrator policies to every workload for simplicity

Explanation

Least privilege limits what a stolen credential can do, and account boundaries add a strong isolation layer that constrains lateral movement. Broad permissions and shared long-lived keys enlarge the impact of compromise.

Question 24Cloud Concepts

A team must choose between vertical scaling and horizontal scaling for a stateless API. Which reasoning is most sound?

  1. Vertical scaling is preferred because it removes the need for a load balancer and backups
  2. Vertical scaling improves fault tolerance by concentrating load on one host
  3. Horizontal scaling adds instances behind a load balancer, avoiding a single large-instance ceiling and enabling zone redundancy Correct answer.
  4. Horizontal scaling requires storing session state on each instance

Explanation

Stateless services can be scaled out across many instances, which removes the size ceiling of a single host and supports spreading across zones. Concentrating load on one host creates a single point of failure.

Question 25Cloud Concepts

A company wants to optimize cost for a fault-tolerant batch fleet that processes large volumes of independent work and can tolerate interruptions. Which approach is most appropriate?

  1. Run all workers continuously even when no work is queued
  2. Reserve three-year terms for every worker instance
  3. Use dedicated physical hosts for each worker
  4. Use interruptible spare capacity for the workers with checkpointing so progress survives reclaim Correct answer.

Explanation

Interruptible spare capacity offers large discounts for workloads that can pause and resume, and checkpointing preserves progress when capacity is reclaimed. Long commitments or always-on fleets waste money for variable batch demand.

Question 26Cloud Concepts

Which AWS global infrastructure component is a physically isolated group of data centers within a single geographic region?

  1. An Availability Zone Correct answer.
  2. An edge location
  3. A Region
  4. A local zone

Explanation

A Region is a geographic area that contains multiple isolated Availability Zones, and each Availability Zone consists of one or more discrete data centers with independent power, cooling, and networking. Edge locations are separate sites used for content delivery, and local zones extend a parent region closer to users.

Question 27Cloud Concepts

What does the AWS Shared Responsibility Model divide between AWS and the customer?

  1. Security of the cloud versus security in the cloud Correct answer.
  2. Reserved capacity versus on-demand capacity
  3. Regional services versus global services
  4. Capital expenses versus operating expenses

Explanation

The model assigns responsibility for the physical infrastructure and managed service foundations to AWS, described as security of the cloud, while the customer remains responsible for securing what it configures and runs in the cloud. The split shifts depending on whether the service is infrastructure, container, or abstracted.

Question 28Cloud Concepts

Which benefit describes the AWS Cloud value proposition of converting large upfront data center purchases into variable usage-based spending?

  1. Increase time to market
  2. Go global in minutes
  3. Trade capital expense for variable expense Correct answer.
  4. Stop guessing capacity

Explanation

Buying servers and facilities upfront is a capital expense, while cloud services are billed based on consumption, which is a variable expense. This lets organizations pay only for the capacity they actually use and avoid over-provisioning.

Question 29Cloud Concepts

Which AWS service provides a managed content delivery network that caches content at edge locations?

  1. AWS Global Accelerator
  2. AWS Direct Connect
  3. Amazon CloudFront Correct answer.
  4. Amazon Route 53

Explanation

CloudFront is the content delivery network that stores cached copies of content at edge locations to reduce latency for end users. Route 53 is DNS, Direct Connect is private network connectivity, and Global Accelerator routes traffic over the AWS global network without caching content.

Question 30Cloud Concepts

What is the main purpose of an AWS edge location?

  1. To host the primary database for a region
  2. To store encrypted backups for compliance
  3. To provide physical colocation for customer servers
  4. To place content and services close to end users for lower latency Correct answer.

Explanation

Edge locations exist to reduce latency by serving cached content and running services closer to users than the main region. They are not designed as primary data stores or colocation facilities for customer hardware.

Question 31Cloud Concepts

Which statement describes the AWS Well-Architected Framework's operational excellence pillar focus?

  1. Running and monitoring systems to deliver business value and continually improving processes Correct answer.
  2. Designing workloads to withstand failure and recover quickly
  3. Protecting data and systems through encryption and access control
  4. Using resources efficiently to avoid unnecessary cost

Explanation

Operational excellence covers the people and processes that run workloads, including monitoring, automation, and continuous improvement. The other pillars address reliability, security, and cost optimization respectively.

Question 32Cloud Concepts

Which AWS support plan provides access to a Technical Account Manager and concierge support for billing and account questions?

  1. AWS Enterprise Support Correct answer.
  2. AWS Business Support
  3. AWS Developer Support
  4. AWS Basic Support

Explanation

Enterprise Support includes a designated Technical Account Manager and a concierge team for billing and account inquiries, along with the highest response-time targets. Lower tiers offer progressively fewer personalized services.

Question 33Cloud Concepts

A startup wants to run a small proof-of-concept web application with unpredictable traffic and minimal upfront cost. Which pricing approach fits best?

  1. Spot Instances for the web servers
  2. Dedicated Hosts
  3. Savings Plans with a three-year commitment
  4. On-Demand Instances Correct answer.

Explanation

On-Demand pricing charges by the second or hour with no commitment, which suits short-lived and unpredictable proof-of-concept workloads. Committed plans and dedicated hardware only pay off with predictable or compliance-driven usage.

Question 34Cloud Concepts

A company wants to reduce the risk that a failure in one data center takes down its application. Which approach directly addresses this?

  1. Deploy the application across multiple Availability Zones in one Region Correct answer.
  2. Purchase Reserved Instances for all servers
  3. Deploy the application in a single Availability Zone with larger instances
  4. Move the application to an edge location

Explanation

Availability Zones are isolated from one another, so spreading instances across several zones removes a single data center as a single point of failure. Larger instances in one zone still share the same physical risk.

Question 35Cloud Concepts

A team wants to experiment with a new feature quickly and discard it if it fails, without buying hardware. Which cloud benefit does this illustrate?

  1. High availability
  2. Economies of scale
  3. Agility and rapid experimentation Correct answer.
  4. Global reach

Explanation

Cloud resources can be provisioned in minutes and released when no longer needed, which lowers the cost and risk of experimentation. This speed of iteration is the agility benefit rather than a resilience or geographic benefit.

Question 36Cloud Concepts

Under the Shared Responsibility Model for an Amazon EC2 instance, which responsibility belongs to the customer?

  1. Securing the facilities that house the servers
  2. Maintaining the physical hosts and hypervisor
  3. Patching the guest operating system and configuring security groups Correct answer.
  4. Replacing failed underlying storage hardware

Explanation

For infrastructure services such as EC2, AWS secures the physical layer and virtualization, while the customer manages the guest operating system, applications, and network controls such as security groups. The boundary is higher for abstracted services.

Question 37Cloud Concepts

A company needs very low-latency access to AWS services for users in a city far from the nearest Region. Which infrastructure option should it evaluate?

  1. AWS Local Zones Correct answer.
  2. An additional Availability Zone in the same Region
  3. A second edge location cache
  4. AWS Outposts in another country

Explanation

Local Zones place compute, storage, and other services close to a large population center to provide single-digit millisecond latency. They extend a parent Region rather than replacing it.

Question 38Cloud Concepts

Which design principle from the Well-Architected Framework recommends testing recovery procedures and simulating failures?

  1. Test recovery procedures Correct answer.
  2. Perform operations as code
  3. Implement a strong identity foundation
  4. Make architectural tradeoffs

Explanation

The reliability pillar advises regularly testing how systems respond to failure so that recovery paths are proven before a real incident. Identity foundations belong to security, and operations as code belongs to operational excellence.

Question 39Cloud Concepts

A company wants to forecast and control cloud spending by department. Which combination of AWS capabilities supports this?

  1. Auto Scaling and Elastic Load Balancing
  2. IAM roles and KMS keys
  3. Security groups and network ACLs
  4. Cost allocation tags and AWS Budgets Correct answer.

Explanation

Tags let costs be attributed to departments, and Budgets provides alerts and thresholds to control spending against forecasts. Network and scaling tools do not provide cost attribution.

Question 40Cloud Concepts

A workload must survive the loss of an entire AWS Region. Which approach is required?

  1. Spread instances across three Availability Zones in one Region
  2. Use a single Region with Multi-AZ storage
  3. Use edge locations to cache the application
  4. Replicate data and run capacity in a second Region with a failover mechanism Correct answer.

Explanation

Region-level resilience requires resources and data copies in at least two Regions plus a tested way to shift traffic, such as DNS failover. Multi-AZ designs protect against data center failure but not against the loss of a whole Region.

Question 41Cloud Concepts

A team runs a stateless service and expects demand to grow steadily for years. Which scaling strategy best avoids a hard capacity ceiling?

  1. Scaling only during business hours
  2. Manual provisioning of a fixed fleet
  3. Vertical scaling by moving to larger instance types
  4. Horizontal scaling behind a load balancer Correct answer.

Explanation

Adding more instances distributes load and can continue as demand grows, whereas a single larger instance eventually hits a maximum size. Horizontal scaling also pairs naturally with load balancing and Auto Scaling.

Question 42Cloud Concepts

Which practice best supports the security pillar principle of applying security at all layers?

  1. Granting broad administrative permissions to simplify operations
  2. Combining network controls, identity policies, encryption, and application-level authorization Correct answer.
  3. Relying only on a perimeter firewall
  4. Encrypting data at rest and leaving access open

Explanation

Defense in depth means multiple independent controls protect each layer, so compromising one does not expose everything. A single perimeter control or broad permissions creates a single point of failure.

Question 43Cloud Concepts

A company operates a steady production workload and also runs fault-tolerant image rendering that can be interrupted. Which combination most reduces total cost?

  1. Reserved Instances for the rendering fleet only
  2. On-Demand Instances for everything
  3. Dedicated Hosts for the rendering fleet
  4. Savings Plans for the baseline and Spot Instances for the rendering fleet Correct answer.

Explanation

A committed Savings Plan lowers the price of predictable baseline usage, while Spot capacity is deeply discounted for work that tolerates interruption. Matching each workload to its interruption tolerance minimizes total spend.

Question 44Cloud Concepts

An application must remain available even if a single Availability Zone loses power, and the database must fail over automatically. Which design meets this requirement?

  1. A single-zone deployment with frequent snapshots
  2. A read replica in the same zone
  3. A Multi-AZ deployment with a standby database in another zone Correct answer.
  4. A larger instance size in one zone

Explanation

Multi-AZ places a synchronous standby in a different zone and performs automatic failover, so a zone outage does not stop the database. Snapshots and same-zone replicas do not provide automatic cross-zone failover.

Question 45Cloud Concepts

A regulated customer requires that its workloads run on hardware not shared with other tenants and also needs to use its existing server-bound software licenses. Which AWS option fits?

  1. AWS Lambda
  2. Shared tenancy On-Demand Instances
  3. Spot Instances
  4. Dedicated Hosts Correct answer.

Explanation

Dedicated Hosts give a customer a physical server with visibility and control over socket and core usage, which supports both isolation requirements and bring-your-own-license terms. Shared tenancy and serverless options do not provide that control.

Question 46Cloud Concepts

A company wants to limit the impact of a leaked workload credential. Which combination best reduces blast radius?

  1. A single shared administrator role for all workloads
  2. Broad permissions on each instance profile
  3. Scoped IAM roles with least privilege plus short-lived credentials Correct answer.
  4. Long-lived access keys stored in application code

Explanation

Least-privilege roles limit what a stolen credential can do, and temporary credentials from roles expire quickly, shrinking the window of misuse. Long-lived shared keys with broad rights maximize damage.

Question 47Cloud Concepts

A company must keep data within a specific legal jurisdiction while serving users worldwide. Which approach best satisfies both goals?

  1. Store data in a Region inside that jurisdiction and use edge caching for global delivery Correct answer.
  2. Store data only at edge locations
  3. Replicate the database to every Region worldwide
  4. Use a single Availability Zone in the nearest country

Explanation

Choosing a Region inside the required jurisdiction keeps stored data within legal boundaries, while edge caching and global routing serve distant users without relocating the data. Worldwide replication would violate the residency constraint.

Question 48Cloud Concepts

A team is deciding between a managed service and self-managed servers on EC2 to reduce undifferentiated operational work. Which reasoning is most sound?

  1. Self-managed servers always cost less because the team controls every component
  2. Self-managed servers eliminate the need for monitoring
  3. A managed service shifts patching and availability work to AWS, freeing the team to focus on differentiators Correct answer.
  4. Managed services remove all customer responsibility for data and access

Explanation

Managed services take over routine tasks such as patching, backups, and failover, which reduces undifferentiated heavy lifting. The customer still owns data, access, and configuration choices.

Question 49Security and Compliance

A company wants to grant an application running on an EC2 instance temporary access to an S3 bucket without storing long-term credentials on the instance. Which mechanism should be used?

  1. Create an S3 bucket policy that allows anonymous access to the objects
  2. Distribute a shared IAM user credential to all instances in the account
  3. Attach an IAM role to the instance through an instance profile Correct answer.
  4. Embed IAM user access keys in the application configuration file

Explanation

An instance profile delivers temporary, automatically rotated credentials from an IAM role to the EC2 instance metadata service, so no long-term secrets are stored on disk. Applications and the AWS SDK retrieve these credentials automatically. This is the recommended pattern for granting AWS API permissions to EC2 workloads.

Question 50Security and Compliance

Which AWS service continuously evaluates resources against security best practices and identifies overly permissive access, exposed credentials, and public buckets?

  1. AWS CloudTrail
  2. AWS Trusted Advisor
  3. AWS Security Hub Correct answer.
  4. Amazon GuardDuty

Explanation

AWS Security Hub aggregates and normalizes findings from services such as GuardDuty, Inspector, and Macie, and runs automated security standards checks against your account. It surfaces issues such as public S3 buckets and permissive IAM configurations in a consolidated view. This makes it the central place for posture management across accounts.