I85PREP
⌘ K
CLF study materials
CLF study resources

CLF practice questions

One question at a time. Build your CLF understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts

A company wants to stop purchasing and maintaining physical servers for a new web application and instead pay only for the compute it consumes each month. Which cloud benefit does this describe?

  1. Gaining perpetual ownership of the underlying hardware
  2. Eliminating the need for any security controls
  3. Removing the need to monitor application performance
  4. Converting fixed capital expenditure into variable operational expenditure Correct answer.

Explanation

Cloud economics shift spending from upfront capital investment in hardware to usage-based operational spending. You pay for consumed resources and can scale spending down when demand falls. Ownership of hardware and security responsibility are not transferred to the customer.

Question 2Cloud Concepts

Which characteristic of cloud computing lets an application automatically add capacity during a traffic spike and release it afterward?

  1. Elasticity Correct answer.
  2. Fault tolerance
  3. Durability
  4. Multi-tenancy

Explanation

Elasticity is the ability to acquire and release resources automatically to match current demand. Multi-tenancy describes shared infrastructure, durability describes data persistence, and fault tolerance describes continued operation despite failures.

Question 3Cloud Concepts

What does the AWS Shared Responsibility Model assign to the customer?

  1. Securing the guest operating system, applications, and data they place in the cloud Correct answer.
  2. Maintenance of the underlying hypervisor layer
  3. Patching the firmware of the physical hosts
  4. Physical security of the data center buildings

Explanation

Under the shared responsibility model AWS secures the cloud itself, while the customer secures what they put in the cloud. Guest operating systems, application configuration, and data classification are customer duties. Physical facilities and virtualization infrastructure belong to AWS.

Question 4Cloud Concepts

Which statement best describes an AWS Region?

  1. A caching layer positioned close to end users
  2. A logical grouping of accounts used for billing
  3. A single data center within one city
  4. A separate geographic area containing multiple isolated Availability Zones Correct answer.

Explanation

A Region is a geographic area composed of multiple Availability Zones that are physically separated but connected by low-latency links. Data centers, edge locations, and account organizations are different constructs. Choosing a Region affects latency, compliance, and service availability.

Question 5Cloud Concepts

A startup wants to deploy an application without provisioning or managing any servers. Which cloud service model fits this goal most directly?

  1. Serverless computing Correct answer.
  2. Colocation hosting
  3. Infrastructure as a Service
  4. Virtual machine leasing

Explanation

Serverless computing lets you run code while the provider handles provisioning and scaling of the underlying capacity. IaaS and virtual machine leasing require the customer to manage servers. Colocation means placing your own hardware in a third-party facility.

Question 6Cloud Concepts

Which advantage explains why a global company can deploy workloads in a Region near its customers?

  1. Automatic elimination of all compliance obligations
  2. Free data transfer between all Regions
  3. Reduced network latency for end users Correct answer.
  4. Guaranteed 100 percent service uptime

Explanation

Placing workloads geographically closer to users shortens the network path and lowers latency. Regions do not remove compliance duties, do not make cross-Region transfer free, and do not guarantee absolute uptime.

Question 7Cloud Concepts

What is the primary purpose of an Availability Zone?

  1. To serve as the account root for identity management
  2. To host only archived backup data
  3. To provide a separate billing currency for each country
  4. To isolate failures so that one zone's outage does not affect others in the same Region Correct answer.

Explanation

Availability Zones are physically separate data center groupings with independent power and networking, so a failure in one zone is unlikely to affect another. Distributing resources across zones improves resilience. Billing, archival storage, and identity are unrelated functions.

Question 8Cloud Concepts

Which pricing concept reflects the discount AWS offers in exchange for a commitment to a consistent amount of compute usage over one or three years?

  1. On-Demand pricing
  2. Savings Plans Correct answer.
  3. Spot pricing
  4. Data transfer charges

Explanation

Savings Plans trade a usage commitment for lower rates compared with On-Demand pricing. On-Demand has no commitment, data transfer charges bill network usage, and Spot pricing uses spare capacity that can be interrupted.

Question 9Cloud Concepts

A team needs a managed relational database where AWS handles patching, backups, and failover while the team still controls schema and queries. Which service model does this represent?

  1. Software as a Service
  2. Platform as a Service Correct answer.
  3. Infrastructure as a Service
  4. Functions as a Service

Explanation

A managed database where the provider handles patching and failover while you control the schema and queries is a Platform as a Service offering. IaaS would leave patching to you, SaaS delivers a finished application, and Functions as a Service is event-driven code execution.

Question 10Cloud Concepts

A workload must remain available even if an entire data center loses power. Which deployment approach best supports this requirement?

  1. Distribute instances across multiple Availability Zones in one Region Correct answer.
  2. Deploy only to edge locations without any origin
  3. Run all instances in a single Availability Zone for lower latency
  4. Use one large instance sized for peak load

Explanation

Spreading instances across multiple Availability Zones protects against the loss of a single data center because zones have independent power and networking. A single zone or single instance creates a single point of failure, and edge locations do not replace origin compute.

Question 11Cloud Concepts

Which scenario best illustrates horizontal scaling?

  1. Increasing the size of an attached storage volume
  2. Extending a database backup retention period
  3. Upgrading an existing instance to a larger instance type
  4. Adding more instances behind a load balancer as request volume grows Correct answer.

Explanation

Horizontal scaling adds more nodes to share the load, which suits distributed and elastic workloads. Resizing an instance or volume is vertical scaling, and retention changes affect backup policy rather than capacity.

Question 12Cloud Concepts

Which task remains the customer's responsibility when using an AWS managed service such as Amazon RDS?

  1. Securing the data center network cabling
  2. Patching the database engine's underlying host operating system
  3. Classifying data and configuring who may access the database Correct answer.
  4. Maintaining the physical database servers

Explanation

Even with a managed service, the customer owns data classification, access management, and how the data is used. AWS handles the physical servers, host operating system patching, and facility networking. Confusing these layers is a common source of audit findings.

Question 13Cloud Concepts

A company wants to migrate to AWS but must keep certain regulated data inside a specific country. What should guide the choice of Region?

  1. The default Region configured in a colleague's account
  2. Regulatory and data residency requirements for that jurisdiction Correct answer.
  3. The number of edge locations in unrelated countries
  4. The alphabetical order of Region names

Explanation

Data residency and regulatory obligations determine which Regions are legally acceptable for regulated data. Region names, unrelated edge locations, and another user's defaults have no bearing on compliance. Documenting this choice is part of a well-architected migration.

Question 14Cloud Concepts

Which combination best describes the AWS Well-Architected Framework pillar focused on running systems to deliver business value and improve processes?

  1. Cost optimization
  2. Sustainability
  3. Reliability
  4. Operational excellence Correct answer.

Explanation

Operational excellence covers running and monitoring systems and continually improving supporting processes. Cost optimization focuses on spending efficiency, reliability on recovery and availability, and sustainability on environmental impact.

Question 15Cloud Concepts

A team is choosing between On-Demand Instances and Spot Instances for a batch job that can tolerate interruption. What is the main trade-off?

  1. Spot offers lower cost but capacity can be reclaimed with short notice Correct answer.
  2. On-Demand offers lower cost but requires a three-year commitment
  3. Spot offers higher cost but guarantees no interruption
  4. On-Demand capacity can be reclaimed by other customers at any time

Explanation

Spot Instances use spare capacity at a discount, but AWS may reclaim them with a brief interruption notice, so they suit fault-tolerant work. On-Demand provides predictable capacity at a higher price with no commitment.

Question 16Cloud Concepts

Why does designing for failure improve reliability in the cloud?

  1. It guarantees that no component will ever fail
  2. It eliminates the need for backups
  3. Assuming components will fail leads to redundancy and automated recovery Correct answer.
  4. It removes the need for any monitoring or alarms

Explanation

Treating failure as inevitable pushes architects toward redundancy, health checks, and automated recovery. It does not prevent failures, and monitoring and backups remain necessary to detect problems and restore data.

Question 17Cloud Concepts

Which statement accurately distinguishes high availability from disaster recovery?

  1. High availability tolerates component failure within a Region, while disaster recovery restores service after a large-scale event Correct answer.
  2. High availability means keeping data in one server, while disaster recovery means deleting old data
  3. High availability applies only to storage, while disaster recovery applies only to networking
  4. High availability and disaster recovery are identical concepts with different names

Explanation

High availability uses redundancy to keep a workload running through routine component failures. Disaster recovery addresses rare, large-scale events such as a regional outage and focuses on restoring service within defined targets.

Question 18Cloud Concepts

A media company stores video masters that are rarely accessed but must be retained for years at low cost. Which storage approach aligns best?

  1. A cache layer at edge locations
  2. Local instance storage that is erased when the instance stops
  3. A high-performance storage class for frequently accessed data
  4. An archival storage class designed for infrequent long-term retention Correct answer.

Explanation

Archival storage classes trade retrieval speed for much lower storage cost, which fits long-term retention of rarely accessed masters. High-performance and local instance storage cost more or are ephemeral, and edge caches are not durable archives.

Question 19Cloud Concepts

Which benefit does decoupling application components with a message queue provide?

  1. Components can fail or scale independently without losing queued work Correct answer.
  2. It guarantees messages are processed exactly once in order
  3. It eliminates all network latency between services
  4. It removes the need to secure the message payloads

Explanation

A queue buffers work so producers and consumers do not need to run in lockstep, letting each side fail or scale independently. Security still applies to payloads, delivery semantics depend on configuration, and queues do not remove network latency.

Question 20Cloud Concepts

Which practice best supports cost optimization for a development environment used only during business hours?

  1. Keeping all development resources running at peak size continuously
  2. Duplicating the production environment in every Region
  3. Scheduling automatic shutdown of non-production resources outside working hours Correct answer.
  4. Purchasing three-year commitments for every development instance

Explanation

Stopping idle development resources outside working hours reduces billed usage without affecting production. Long commitments for intermittent environments, continuous over-provisioning, and unnecessary multi-Region duplication all raise cost without added value.

Question 21Cloud Concepts

A company must prove that only approved users can read encrypted customer records in its cloud account. Which consideration falls to the customer rather than the provider?

  1. Patching the virtualization host firmware
  2. Maintaining redundant power in the facility
  3. Ensuring the physical disks in the data center are destroyed securely
  4. Defining identity policies and key access permissions for those records Correct answer.

Explanation

Identity and access policies and key permissions are configuration the customer controls, and they determine who can read the data. Disk destruction, facility power, and host firmware are provider responsibilities. Auditors typically ask for evidence of both layers.

Question 22Cloud Concepts

An architect must choose between a multi-Region active-active design and a single-Region multi-AZ design for an application with strict recovery objectives. Which reasoning is most sound?

  1. Multi-Region active-active lowers recovery time for regional events but raises cost and data consistency complexity Correct answer.
  2. Active-active multi-Region removes the need for data replication
  3. Single-Region multi-AZ has lower cost and equal protection against regional failure
  4. Multi-AZ always provides protection against a full regional outage

Explanation

Multi-Region active-active can reduce recovery time after a regional event, but it costs more and complicates data replication and consistency. Multi-AZ protects against zone failures, not a whole-Region failure, and active-active still requires replication design.

Question 23Cloud Concepts

A team plans to lift and shift a monolithic application to AWS unchanged, then refactor it over time. Which statement about this approach is most accurate?

  1. It speeds initial migration but may carry over inefficiencies and limit cloud-native benefits Correct answer.
  2. It guarantees lower operating cost than a re-architecture
  3. It removes the need to assess dependencies before migrating
  4. It automatically converts the application into microservices

Explanation

Rehosting moves workloads quickly but preserves existing design constraints, so benefits such as elasticity and cost efficiency may be limited until refactoring occurs. It does not transform architecture automatically, and dependency assessment remains essential.

Question 24Cloud Concepts

Which design decision best applies the principle of designing for cost awareness in a variable-demand workload?

  1. Matching instance size and count to measured demand and reviewing usage regularly Correct answer.
  2. Disabling all monitoring to reduce service charges
  3. Choosing the largest available instance type to avoid future resizing
  4. Keeping every environment running at production scale

Explanation

Right-sizing to measured demand and reviewing usage regularly keeps spend aligned with value. Over-provisioning wastes money, running all environments at production scale ignores differing needs, and disabling monitoring removes the data needed to optimize.

Question 25Cloud Concepts

A regulated workload requires that encryption keys remain under the customer's exclusive control while still using a managed cloud service. Which approach reflects this requirement?

  1. Relying solely on provider-managed keys with no customer visibility
  2. Storing plaintext data in a public bucket to simplify access
  3. Disabling encryption for performance reasons
  4. Using a customer-managed key service where the customer controls key policy and rotation Correct answer.

Explanation

Customer-managed keys let the customer define key policies, rotation, and access, which supports separation of duties and regulatory evidence. Provider-managed keys reduce customer control, and storing plaintext or disabling encryption violates the requirement.

Question 26Cloud Concepts

In the AWS Cloud, which model describes how customers obtain compute capacity without buying physical servers in advance?

  1. Fixed annual licensing of data center racks
  2. Leasing of colocation space from a third party
  3. Capital purchase of servers with a five-year depreciation
  4. Pay-as-you-go pricing for resources provisioned on demand Correct answer.

Explanation

Cloud providers let customers provision compute, storage, and networking as needed and pay only for what they consume, converting capital expense into variable operating expense. This elasticity removes the need to forecast and pre-purchase hardware capacity.

Question 27Cloud Concepts

A startup wants to launch a prototype quickly without hiring staff to install operating systems and middleware. Which cloud benefit does this primarily illustrate?

  1. Guaranteed lower prices than any competitor
  2. Elimination of all operational responsibilities
  3. Improved physical security of data centers
  4. Reduced need to manage undifferentiated heavy lifting Correct answer.

Explanation

Managed services in the cloud remove infrastructure tasks such as hardware provisioning, patching, and middleware setup, letting teams focus on their application. This is commonly described as avoiding undifferentiated heavy lifting.

Question 28Cloud Concepts

Which characteristic allows an application to add capacity automatically during a traffic spike and remove it afterward?

  1. Fault tolerance
  2. Durability
  3. Elasticity Correct answer.
  4. Multi-tenancy

Explanation

Elasticity is the ability to acquire and release resources automatically to match current demand, scaling out during peaks and scaling in when traffic falls. Durability and fault tolerance describe data persistence and resilience, not demand-driven capacity change.

Question 29Cloud Concepts

Which AWS global infrastructure component is a separate geographic area containing multiple isolated groups of data centers?

  1. Edge location
  2. Region Correct answer.
  3. Local Zone
  4. Availability Zone

Explanation

A Region is a geographic area made up of multiple Availability Zones, each comprising one or more discrete data centers. Edge locations and Local Zones are smaller extensions placed closer to end users rather than full geographic Regions.

Question 30Cloud Concepts

Which category of AWS service provides virtual servers that the customer configures and administers at the operating system level?

  1. Software as a Service
  2. Function as a Service
  3. Platform as a Service
  4. Infrastructure as a Service Correct answer.

Explanation

Infrastructure as a Service delivers virtualized compute, storage, and networking that the customer manages, including the guest operating system. Platform and function services abstract more of the runtime, and SaaS delivers a finished application.

Question 31Cloud Concepts

A company wants to stop guessing server capacity before each product launch. Which cloud concept directly addresses this?

  1. Long-term hardware leases
  2. Reserved capacity planning
  3. Manual capacity forecasting
  4. Right-sizing through elastic provisioning Correct answer.

Explanation

Elastic provisioning lets teams adjust resources to actual demand instead of predicting peak capacity in advance, which reduces both over-provisioning and shortages. Reserved capacity and forecasting still depend on estimates made before demand is known.

Question 32Cloud Concepts

Which statement best describes the shared responsibility model for a service such as Amazon EC2?

  1. AWS and the customer jointly administer the hypervisor and host firmware
  2. The customer is responsible for physical access controls at the data center
  3. AWS configures the customer's application security groups and patching
  4. AWS secures the physical facilities while the customer secures the guest operating system and applications Correct answer.

Explanation

For infrastructure services, AWS is responsible for security of the cloud, including facilities, hardware, and the hypervisor, while the customer is responsible for security in the cloud, such as the guest OS, patching, and applications. The split shifts toward the provider for higher-level managed services.

Question 33Cloud Concepts

A retailer experiences sharp, unpredictable spikes in orders during flash sales. Which cloud capability most directly lets it handle these spikes without permanently over-provisioning?

  1. Relying on vertical scaling of a single large instance
  2. Using elastic scaling that adds and removes instances with demand Correct answer.
  3. Scheduling manual server additions before each sale
  4. Purchasing dedicated hosts sized for peak load

Explanation

Elastic scaling matches capacity to observed demand, so the retailer can add instances during a flash sale and release them afterward. This avoids paying continuously for peak-sized infrastructure.

Question 34Cloud Concepts

A team compares a monolithic application with a microservices architecture on AWS. Which outcome is most directly associated with adopting microservices?

  1. A single shared database that all services update directly
  2. Independent deployment and scaling of each service Correct answer.
  3. Elimination of the need for monitoring
  4. Guaranteed reduction in total infrastructure cost

Explanation

Microservices divide an application into loosely coupled services that can be developed, deployed, and scaled independently, often using managed messaging and compute services. This independence is the defining architectural benefit, though it adds operational complexity rather than removing it.

Question 35Cloud Concepts

An application writes files to a shared location that must be reachable from many instances at once. Which design choice best supports loose coupling?

  1. Copying files between instances on a schedule
  2. Storing files on the local disk of each instance
  3. Embedding file paths in application code on each server
  4. Using an object storage service as the shared store Correct answer.

Explanation

An object storage service provides durable, highly available shared storage that any instance can access through an API, so instances do not depend on each other's local disks. This decouples the compute tier from where data lives.

Question 36Cloud Concepts

A workload must keep running through the loss of a single Availability Zone without manual intervention. Which approach meets this requirement?

  1. Deploying instances across multiple Availability Zones behind a load balancer Correct answer.
  2. Deploying a single large instance with a static IP address
  3. Deploying all instances into one Availability Zone with backups
  4. Deploying instances in one Region with no redundancy

Explanation

Spreading instances across multiple Availability Zones and routing traffic through a load balancer lets healthy instances in other zones absorb traffic when one zone fails. This provides high availability without operator action.

Question 37Cloud Concepts

A financial firm must retain records for seven years with almost no retrieval, at the lowest storage cost. Which storage tier characteristic matters most?

  1. Automatic replication across multiple Regions for active use
  2. Lowest storage price with acceptable retrieval latency Correct answer.
  3. Highest possible throughput for frequent reads
  4. Support for mounting as a local file system

Explanation

Archival storage tiers trade retrieval speed for very low per-gigabyte cost, which suits long-term retention of data that is rarely read. The design decision is driven by access frequency and acceptable retrieval time.

Question 38Cloud Concepts

A company wants to move an existing on-premises application to AWS with minimal changes before modernizing later. Which migration strategy does this describe?

  1. Retire
  2. Rehost Correct answer.
  3. Repurchase
  4. Refactor

Explanation

Rehosting, often called lift and shift, moves an application to the cloud with little or no code change, which is fast but does not exploit cloud-native features. Refactoring re-architects the application, repurchasing replaces it with a SaaS product, and retiring decommissions it.

Question 39Cloud Concepts

Which practice best aligns with the operational excellence pillar when a team deploys application changes?

  1. Automating deployments and treating infrastructure as code Correct answer.
  2. Making configuration changes manually in the console
  3. Freezing all changes after the first release
  4. Relying on individual engineers to remember runbooks

Explanation

Automating deployments and defining infrastructure as code makes changes repeatable, reviewable, and reversible, which supports the operational excellence pillar. Manual console changes and undocumented steps increase error and drift.

Question 40Cloud Concepts

A team wants to reduce cost for a steady-state production database that will run continuously for three years. Which purchasing approach is most appropriate?

  1. Dedicated Hosts billed hourly
  2. On-Demand Instances
  3. Spot Instances
  4. Savings Plans or Reserved Instances Correct answer.

Explanation

Savings Plans and Reserved Instances offer discounts in exchange for a one- or three-year commitment, which suits predictable, long-running workloads. Spot capacity can be reclaimed and On-Demand pricing carries no commitment discount.

Question 41Cloud Concepts

An architect is told the workload must survive the loss of an entire Region. Which design element is essential?

  1. Replicating data and running compute in a second Region Correct answer.
  2. Increasing the size of instances in the primary Region
  3. Taking nightly snapshots stored in the same Region
  4. Adding more Availability Zones inside the primary Region

Explanation

Surviving a Regional failure requires resources and data copies in another Region, along with a way to route traffic there. Additional Availability Zones or larger instances within the same Region cannot help if that Region is unavailable.

Question 42Cloud Concepts

A startup expects highly variable, unpredictable demand in its first year. Which approach best matches cost to usage?

  1. Buying dedicated hardware for the projected peak
  2. Committing to a three-year Reserved Instance purchase
  3. Using On-Demand and serverless options that scale with actual use Correct answer.
  4. Pre-purchasing fixed capacity for two years

Explanation

When demand is unpredictable, On-Demand and serverless pricing charge for actual consumption without long commitments, which avoids paying for unused capacity. Long commitments pay off only when usage is stable and known.

Question 43Cloud Concepts

Which statement correctly distinguishes a security consideration owned by the customer from one owned by AWS?

  1. AWS is responsible for the customer's application code vulnerabilities
  2. The customer maintains the physical security of data center buildings
  3. AWS decides which users may access the customer's data
  4. The customer configures identity and access policies in their account Correct answer.

Explanation

Under the shared responsibility model, the customer manages identity and access policies, data, and application configuration in their account, while AWS manages the underlying infrastructure. The customer never inherits responsibility for physical facility security.

Question 44Cloud Concepts

A company wants its engineers to experiment with new services cheaply and fail fast. Which cloud advantage best supports this culture?

  1. Long procurement cycles for new hardware
  2. Centralized hardware purchasing approval
  3. Low-cost, reversible provisioning of experimental resources Correct answer.
  4. Mandatory multi-year capacity commitments

Explanation

Because cloud resources can be provisioned and torn down quickly at low cost, teams can test ideas and discard failures without large sunk investments. This supports experimentation and rapid iteration.

Question 45Cloud Concepts

An application uses a message queue between an order service and an inventory service. What is the main resilience benefit of this design?

  1. A failure in the inventory service does not immediately fail order intake Correct answer.
  2. The two services must run in the same Availability Zone
  3. The queue removes the need to monitor either service
  4. Messages are processed strictly in the order they are sent

Explanation

A queue buffers messages so the producer can keep accepting orders even when the consumer is slow or temporarily unavailable, and the consumer catches up later. This asynchronous decoupling improves resilience without requiring the services to share a failure domain.

Question 46Cloud Concepts

A team must choose between a relational database and a NoSQL key-value store for a workload with flexible, rapidly changing item attributes and very high request volume. Which reasoning is soundest?

  1. Choose relational because schema flexibility is its main strength
  2. Choose the key-value store because it enforces strict multi-table joins
  3. Choose the key-value store because its flexible schema and horizontal scaling fit variable attributes Correct answer.
  4. Choose relational because it always scales to any request volume

Explanation

Key-value stores accept items with varying attributes and scale horizontally across partitions, which suits high-volume access with evolving schemas. Relational databases excel at joins and transactions but require a defined schema and scale differently.

Question 47Cloud Concepts

A company wants to reduce its environmental footprint while scaling workloads. Which cloud practice most directly supports this goal?

  1. Replicating all data to every Region by default
  2. Leaving idle instances running to avoid restart delays
  3. Right-sizing and turning off unused resources Correct answer.
  4. Purchasing the largest instance types available

Explanation

Eliminating idle and oversized resources reduces the energy and cost associated with unused capacity, which supports sustainability alongside cost optimization. Larger footprints from unnecessary replication or over-sized instances work against the goal.

Question 48Cloud Concepts

An architect must design a workload that tolerates the failure of a single compute instance without user-visible downtime. Which combination is most appropriate?

  1. A single instance with a larger instance type and manual restart
  2. One instance with a nightly snapshot and no health checks
  3. Multiple instances across Availability Zones behind a load balancer with health checks Correct answer.
  4. A single instance pinned to one Availability Zone with a static address

Explanation

Running several instances across zones behind a load balancer with health checks lets traffic shift away from a failed instance automatically. This removes the instance as a single point of failure and avoids user-visible downtime.

Question 49Security and Compliance

Under the AWS shared responsibility model, which activity is the customer's responsibility when running an Amazon EC2 instance with a standard Amazon Machine Image?

  1. Maintaining the physical hypervisor and host firmware
  2. Patching the guest operating system and configuring security groups Correct answer.
  3. Managing disk disposal at the physical data center
  4. Securing the underlying network infrastructure of the Availability Zone

Explanation

AWS operates the shared responsibility model by securing the cloud itself, which includes physical hosts, hypervisors, and network fabric. The customer is responsible for security in the cloud, meaning guest OS patching, security group configuration, and data handling on EC2 instances.

Question 50Security and Compliance

A company wants to centrally manage encryption keys used to protect data in Amazon S3 and Amazon EBS while retaining control over key rotation and access policies. Which AWS service should it use?

  1. AWS Secrets Manager
  2. AWS Key Management Service Correct answer.
  3. Amazon GuardDuty
  4. AWS Certificate Manager

Explanation

AWS Key Management Service provides centralized creation, rotation, and policy control of encryption keys integrated with many AWS services. It is the service designed for customer-managed key control across S3, EBS, and other data stores.