Hermes Wiki

Question 936

A company enforces MFA for all IAM users but a developer complains that programmatic access via CLI stopped working after MFA was enabled. What is the correct way to allow CLI access for an MFA-protected IAM user?

❌ A. Disable MFA for CLI-only users
✅ B. Use sts:GetSessionToken with the MFA device to obtain temporary credentials
❌ C. Store the MFA code in the access key
❌ D. Attach an admin policy to bypass MFA

Question 937

A company wants developers to be able to assume a role in the production AWS account from their own developer accounts without creating long-lived credentials in production. What should be configured?

❌ A. IAM users in the production account shared with developers
✅ B. Cross-account IAM role with a trust policy allowing the developer account to assume it
❌ C. Root account access keys shared via Secrets Manager
❌ D. VPC peering between accounts

Question 938

A security team wants to ensure that S3 buckets across 200 AWS accounts in an AWS Organization can never be made public, even by account administrators. What should they implement?

❌ A. S3 Bucket Policies in each account
❌ B. IAM permission boundaries
✅ C. S3 Block Public Access enabled via an SCP at the organization root
❌ D. Amazon Macie

Question 939

An application on EC2 needs to encrypt/decrypt data using a customer managed KMS key, but the security team wants to guarantee the plaintext key material never leaves a dedicated hardware security module under the customer's exclusive control. Which service satisfies this?

❌ A. AWS KMS with AWS managed keys
✅ B. AWS CloudHSM
❌ C. AWS Secrets Manager
❌ D. S3 Server-Side Encryption with S3-managed keys (SSE-S3)

Question 940

A company wants to grant a Lambda function permission to read from a specific DynamoDB table, following least privilege. What should be created?

❌ A. An IAM user with AdministratorAccess attached to the Lambda
✅ B. An IAM role with a policy scoped to the specific table ARN, attached to the Lambda function
❌ C. A resource-based policy on the Lambda function only
❌ D. Embed AWS access keys as Lambda environment variables

Question 941

A company needs to rotate database credentials automatically every 30 days without any application downtime or manual intervention. Which service should be used?

❌ A. AWS Systems Manager Parameter Store (standard tier)
✅ B. AWS Secrets Manager with automatic rotation configured
❌ C. IAM Access Analyzer
❌ D. Store credentials in an encrypted S3 object

Question 942

A company's on-premises Active Directory must be used as the identity source for federated single sign-on into the AWS Management Console for hundreds of employees. Which combination is best?

❌ A. Create individual IAM users for every employee
✅ B. AWS IAM Identity Center integrated with AD via AD Connector or SAML federation
❌ C. Amazon Cognito user pools
❌ D. Root account sharing

Question 943

A mobile application needs to let users sign in with Google or Facebook and then obtain temporary AWS credentials to upload photos directly to S3. Which service provides this?

❌ A. AWS IAM Identity Center
✅ B. Amazon Cognito Identity Pools (Federated Identities)
❌ C. AWS Directory Service
❌ D. AWS STS AssumeRole with SAML only

Question 944

A company wants to centrally enforce that no IAM principal in any member account of their AWS Organization can disable CloudTrail logging. Which feature should be used?

❌ A. IAM policy attached to each user
✅ B. A Service Control Policy (SCP) denying the cloudtrail:StopLogging action org-wide
❌ C. AWS Config rules only
❌ D. GuardDuty findings

Question 945

A three-tier web application has a public-facing ALB, an application tier, and a database tier. What is the most secure network design for the database tier?

❌ A. Place the database in a public subnet with a security group
✅ B. Place the database in a private subnet with a security group allowing only the app tier's security group
❌ C. Place the database in the same subnet as the ALB
❌ D. Use a NAT Gateway to expose the database publicly

Question 946

A company wants continuous, automated detection of malicious activity such as unusual API calls or potentially compromised EC2 instances across their AWS accounts, using ML and threat intelligence feeds. Which service should be enabled?

❌ A. AWS Config
✅ B. Amazon GuardDuty
❌ C. AWS Trusted Advisor
❌ D. Amazon Inspector

Question 947

A company needs to scan its S3 buckets to automatically discover and classify sensitive data such as PII and credit card numbers. Which service should be used?

✅ A. Amazon Macie
❌ B. AWS Shield
❌ C. Amazon Inspector
❌ D. AWS Firewall Manager

Question 948

A web application behind CloudFront and ALB is repeatedly targeted by SQL injection and cross-site scripting attacks. Which service should be deployed to filter this malicious traffic at the edge?

❌ A. AWS Shield Standard
❌ B. Security Groups only
✅ C. AWS WAF with managed rule groups
❌ D. Network ACLs

Question 949

A company is concerned about a large-scale DDoS attack against their internet-facing application and wants advanced, always-on DDoS protection with cost protection guarantees and 24/7 access to the DDoS Response Team (DRT). Which should they subscribe to?

❌ A. AWS Shield Standard
✅ B. AWS Shield Advanced
❌ C. AWS WAF
❌ D. Amazon GuardDuty

Question 950

A company must ensure that EC2 instances launched in a specific VPC always encrypt their EBS volumes by default, without depending on developers remembering to check a box. What setting should be enabled?

❌ A. S3 default encryption
✅ B. EBS encryption by default at the account/region level
❌ C. KMS key rotation
❌ D. EC2 Instance Store encryption

Question 951

A company stores highly sensitive documents in S3 and must guarantee that even AWS cannot read the plaintext content, with the customer retaining full control of the encryption keys and being able to revoke access instantly. Which encryption option should be used?

❌ A. SSE-S3
❌ B. SSE-KMS with an AWS managed key
✅ C. SSE-C or client-side encryption with customer-managed keys outside AWS
❌ D. Default S3 encryption

Question 952

A company wants to allow a third-party SaaS vendor to access specific resources in their VPC (like an ALB) without exposing the VPC to the public internet or requiring VPC peering. Which service is designed for this exact use case?

❌ A. AWS Direct Connect
✅ B. AWS PrivateLink (VPC Endpoint Service)
❌ C. VPC Peering
❌ D. Transit Gateway

Question 953

A company needs to enforce that all data in transit between microservices running on ECS communicate over encrypted channels with mutual TLS authentication, without modifying application code. What should they implement?

❌ A. AWS Certificate Manager only
✅ B. AWS App Mesh or a service mesh with mTLS enabled
❌ C. Security Groups
❌ D. NAT Gateway

Question 954

A company wants a centralized place to define and enforce consistent AWS WAF rules, Shield Advanced protections, and security group policies across dozens of accounts and resources in an AWS Organization. Which service should be used?

❌ A. AWS Config
✅ B. AWS Firewall Manager
❌ C. IAM Access Analyzer
❌ D. AWS Trusted Advisor

Question 955

A company's compliance team requires an automated way to continuously evaluate whether AWS resource configurations (like whether S3 buckets are encrypted) comply with internal policies, and to flag non-compliant resources. Which service should be used?

✅ A. AWS Config with Config Rules
❌ B. Amazon Inspector
❌ C. AWS Systems Manager Session Manager
❌ D. AWS CloudTrail

Question 956

A company runs a stateful application on EC2 that stores session data locally, causing issues when the Auto Scaling group terminates instances during scale-in. What is the best fix to make the application resilient and stateless?

❌ A. Increase instance size
✅ B. Store session state in Amazon ElastiCache or DynamoDB instead of local disk
❌ C. Disable Auto Scaling
❌ D. Use Spot Instances

Question 957

A company's Auto Scaling group launches new EC2 instances but the ALB continues to route traffic to them before the application has finished initializing, causing errors. What should be configured?

❌ A. Increase the ASG cooldown period only
✅ B. Configure an ALB health check with an appropriate grace period / health check grace period on the ASG
❌ C. Disable health checks
❌ D. Use a Classic Load Balancer instead

Question 958

A company needs a fully managed way to decouple two microservices so that a sudden burst of requests to the producer does not overwhelm the consumer, with automatic retry and at-least-once delivery. Which service should be used?

❌ A. Amazon SNS only
✅ B. Amazon SQS Standard Queue
❌ C. AWS Direct Connect
❌ D. Amazon Kinesis Data Streams

Question 959

A global application needs to route users to the AWS region with the lowest network latency, with automatic failover if a region becomes unhealthy. Which Route 53 routing policy should be used?

❌ A. Weighted routing
✅ B. Latency-based routing with health checks
❌ C. Geolocation routing
❌ D. Simple routing

Question 960

A company wants zero data loss (RPO near-zero) for their production Aurora database in case of an entire region failure, with the ability to promote a secondary region within minutes. Which feature should be used?

❌ A. Aurora Read Replicas within the same region
✅ B. Aurora Global Database
❌ C. RDS automated backups only
❌ D. Manual DB snapshots copied nightly

Question 961

An application uses a single NAT Gateway in one Availability Zone. During an AZ outage, instances in other AZs lose internet access. What should be changed to improve resilience?

❌ A. Replace with a NAT instance
✅ B. Deploy a NAT Gateway in each Availability Zone and route traffic to the NAT Gateway in the same AZ
❌ C. Remove the NAT Gateway entirely
❌ D. Use a single larger NAT Gateway

Question 962

A company wants their DynamoDB table to remain available with low-latency reads for users across multiple AWS regions, with data automatically replicated across regions. Which feature should be enabled?

❌ A. DynamoDB Accelerator (DAX)
✅ B. DynamoDB Global Tables
❌ C. DynamoDB Streams
❌ D. On-demand backups

Question 963

A company runs a critical batch processing workload on EC2 using Spot Instances to save costs, but needs the workload to gracefully handle Spot interruptions with only 2 minutes of notice. What should the application do?

❌ A. Ignore interruption notices
✅ B. Listen for the Spot Instance interruption notice via the instance metadata service and checkpoint/save work before termination
❌ C. Use On-Demand pricing instead
❌ D. Disable Auto Scaling

Question 964

A company wants an automated way to test whether their multi-AZ architecture can actually withstand the failure of a random EC2 instance or an entire AZ, proactively rather than waiting for a real outage. What practice/service should they use?

❌ A. AWS Trusted Advisor
✅ B. Chaos engineering using AWS Fault Injection Service (FIS)
❌ C. Amazon Inspector
❌ D. CloudWatch Alarms only

Question 965

A company's application relies on synchronous calls between multiple microservices, and a failure in one downstream service causes cascading failures across the entire system. Which pattern should be introduced to prevent cascading failures?

❌ A. Increase timeout values
✅ B. Implement the circuit breaker pattern with exponential backoff and retries
❌ C. Remove all timeouts
❌ D. Use only synchronous calls

Question 966

A company backs up on-premises data to AWS and needs the backup and restore process to have an RTO of several hours and lowest possible cost, since this is a non-critical archival workload. Which DR strategy fits best?

❌ A. Multi-Site Active-Active
✅ B. Backup and Restore
❌ C. Pilot Light
❌ D. Warm Standby

Question 967

An application's EC2 instances in an Auto Scaling Group need to automatically replace instances that fail application-level health checks (not just EC2 status checks), where health is determined by a custom /health endpoint behind an ALB. What must be configured?

❌ A. Only EC2 status check based health checks
✅ B. ELB health checks enabled on the ASG, pointing to the ALB target group health check
❌ C. CloudWatch Logs only
❌ D. Manual instance replacement

Question 968

A company wants to ensure their relational database automatically fails over to a standby in a different AZ within about 60-120 seconds if the primary fails, with no data loss for committed transactions. Which RDS feature should be enabled?

❌ A. Read Replicas
✅ B. Multi-AZ deployment (synchronous replication)
❌ C. Automated backups
❌ D. RDS Proxy

Question 969

A serverless application built with API Gateway and Lambda experiences occasional throttling during traffic spikes, causing failed requests. Which combination of features should be used to build resilience?

❌ A. Increase Lambda memory only
✅ B. Enable API Gateway usage plans with throttling limits appropriately sized, and use SQS as a buffer between API Gateway and Lambda for asynchronous processing
❌ C. Remove API Gateway entirely
❌ D. Use a single Lambda function with no concurrency limit

Question 970

A company wants to decouple order-placement and order-fulfillment microservices, ensuring that if the fulfillment service is down for an hour, no order messages are lost, and failed messages are automatically moved aside for investigation after 3 failed processing attempts. What should be configured?

❌ A. SNS topic with no DLQ
✅ B. SQS queue with a redrive policy pointing to a Dead-Letter Queue (DLQ) after maxReceiveCount of 3
❌ C. Kinesis Data Streams with 24 hour retention
❌ D. Direct Lambda-to-Lambda invocation

Question 971

A company's static website hosted on S3 experiences downtime when the S3 bucket's region has an outage. They want to improve availability using a second bucket in another region. What should be configured?

❌ A. S3 Same-Region Replication only
✅ B. S3 Cross-Region Replication combined with Route 53 failover routing between the two bucket endpoints
❌ C. A single S3 bucket with versioning
❌ D. CloudFront alone without a second origin

Question 972

A gaming company needs an in-memory data store to cache leaderboard data with sub-millisecond read latency and support for complex data structures like sorted sets. Which service should be used?

❌ A. Amazon RDS
✅ B. Amazon ElastiCache for Redis
❌ C. Amazon S3
❌ D. DynamoDB Accelerator

Question 973

A company runs a high-performance computing (HPC) workload that requires tightly coupled, low-latency inter-node communication between EC2 instances for parallel processing. Which EC2 feature should be used?

✅ A. Placement Groups (Cluster strategy)
❌ B. Spread placement group
❌ C. Dedicated Hosts
❌ D. Multiple Availability Zones

Question 974

A media company needs a shared file system for a rendering farm of Linux EC2 instances that requires very high throughput and sub-millisecond latencies for read-heavy workloads, backed by S3 as the data repository. Which storage service fits best?

❌ A. Amazon EFS
✅ B. Amazon FSx for Lustre
❌ C. Amazon EBS Multi-Attach
❌ D. Amazon S3 Standard

Question 975

An application needs to ingest and process millions of clickstream events per second in real time, with multiple consumer applications reading the same stream independently and replaying data if needed. Which service should be used?

❌ A. Amazon SQS
✅ B. Amazon Kinesis Data Streams
❌ C. Amazon SNS
❌ D. AWS Batch

Question 976

A read-heavy relational workload on Aurora MySQL is experiencing high read latency during peak hours despite already having read replicas. The application also needs microsecond-level caching for frequently repeated identical queries. Which feature should be added?

❌ A. Aurora Global Database
❌ B. Amazon RDS Proxy
✅ C. Add ElastiCache in front of the database as a caching layer
❌ D. Multi-AZ deployment

Question 977

A company wants to choose the EC2 instance family best suited for a memory-intensive in-memory database workload (like SAP HANA) that needs a very high memory-to-vCPU ratio. Which instance family should be selected?

❌ A. C-family (Compute Optimized)
✅ B. R-family (Memory Optimized)
❌ C. T-family (Burstable)
❌ D. G-family (GPU)

Question 978

A data engineering team needs to run complex ETL jobs on massive datasets stored in S3 using Apache Spark, without managing any servers. Which service should be used?

✅ A. AWS Glue
❌ B. Amazon EMR only with self-managed clusters
❌ C. AWS Data Pipeline
❌ D. Amazon Athena

Question 979

An analytics team wants to run ad-hoc SQL queries directly against data stored in S3 in Parquet format without setting up any database infrastructure. Which service should be used?

❌ A. Amazon RDS
✅ B. Amazon Athena
❌ C. Amazon DynamoDB
❌ D. AWS Glue

Question 980

An application requires single-digit millisecond read/write latency at any scale with a flexible schema, for a workload with unpredictable, highly variable traffic patterns. Which database and capacity mode should be selected?

❌ A. Amazon RDS with Provisioned IOPS
✅ B. DynamoDB with on-demand capacity mode
❌ C. Amazon Redshift
❌ D. Amazon Aurora Serverless v1

Question 981

A company's EBS-backed EC2 instances performing large sequential I/O for a big data workload (like Hadoop HDFS) need high throughput at the lowest cost, rather than high IOPS. Which EBS volume type should be selected?

❌ A. Provisioned IOPS SSD (io2)
✅ B. Throughput Optimized HDD (st1)
❌ C. General Purpose SSD (gp3)
❌ D. Cold HDD (sc1)

Question 982

A video streaming company wants to reduce latency for users worldwide by caching content at edge locations close to users, while also being able to run custom lightweight code (like header manipulation) at those edge locations. Which service combination should be used?

❌ A. S3 Transfer Acceleration only
✅ B. Amazon CloudFront with Lambda@Edge or CloudFront Functions
❌ C. AWS Global Accelerator only
❌ D. Route 53 latency routing only

Question 983

A company runs a non-HTTP TCP-based gaming application that needs improved global network performance and static anycast IP addresses, routing users to the optimal AWS endpoint based on health and geographic proximity. Which service should be used?

❌ A. Amazon CloudFront
✅ B. AWS Global Accelerator
❌ C. Amazon Route 53 latency routing
❌ D. AWS Direct Connect

Question 984

A data warehouse team needs to run complex analytical queries (OLAP) across petabytes of structured data with columnar storage and massively parallel processing. Which service should be used?

❌ A. Amazon RDS
✅ B. Amazon Redshift
❌ C. Amazon DynamoDB
❌ D. Amazon Neptune

Question 985

A company wants to increase network throughput between EC2 instances for a high-performance computing cluster beyond what standard networking provides, using OS-bypass technology. Which feature should be enabled?

✅ A. Enhanced Networking with Elastic Fabric Adapter (EFA)
❌ B. Standard ENA networking only
❌ C. NAT Gateway
❌ D. VPC Peering

Question 986

A company's application performs many small, random read/write operations against a relational database and needs the best balance of price and performance for general-purpose workloads. Which EBS volume type is the default recommended choice?

❌ A. Provisioned IOPS SSD (io2)
✅ B. General Purpose SSD (gp3)
❌ C. Throughput Optimized HDD (st1)
❌ D. Cold HDD (sc1)

Question 987

A company has a predictable, steady-state EC2 workload running 24/7 for the next 3 years and wants the maximum possible discount compared to On-Demand pricing, with willingness to commit to a specific instance family and region. Which purchasing option offers the deepest discount?

✅ A. Standard Reserved Instances (3-year, all upfront)
❌ B. Compute Savings Plans
❌ C. Spot Instances
❌ D. On-Demand Instances

Question 988

A company runs fault-tolerant, flexible batch processing jobs that can be interrupted and resumed, and wants to minimize compute costs by up to 90% compared to On-Demand. Which purchasing option should be used?

❌ A. Reserved Instances
✅ B. Spot Instances
❌ C. Dedicated Hosts
❌ D. Savings Plans

Question 989

A company wants to automatically transition S3 objects to cheaper storage tiers as they age: frequently accessed for 30 days, then infrequently accessed, then archived after a year, without manual intervention or needing to know the exact access pattern in advance. Which S3 feature should be used?

❌ A. S3 Cross-Region Replication
✅ B. S3 Intelligent-Tiering or a Lifecycle policy transitioning through S3 Standard-IA and Glacier
❌ C. S3 Transfer Acceleration
❌ D. S3 Versioning

Question 990

A company transfers large amounts of data nightly from an on-premises data center to AWS and wants to avoid the variable, sometimes high cost of internet-based data transfer while also improving consistency. Which service reduces data transfer costs for this dedicated, high-volume, recurring use case?

✅ A. AWS Direct Connect
❌ B. VPN over the internet
❌ C. AWS Snowball for every transfer
❌ D. S3 Transfer Acceleration

Question 991

A company wants to eliminate NAT Gateway data processing charges for traffic from EC2 instances to Amazon S3, since S3 is a major cost driver in their monthly bill for private subnet resources. What should they configure?

❌ A. A NAT Instance instead
✅ B. A Gateway VPC Endpoint for S3
❌ C. An Interface VPC Endpoint for S3 only
❌ D. A second NAT Gateway

Question 992

A company's Amazon Redshift cluster is only used for reporting during business hours on weekdays, sitting idle overnight and on weekends. What is the most cost-effective way to reduce costs?

❌ A. Keep the cluster running 24/7 with Reserved Nodes
✅ B. Pause the cluster during off-hours (or use Redshift Serverless) and resume when needed
❌ C. Upgrade to a larger cluster
❌ D. Enable Multi-AZ for the cluster

Question 993

A company wants visibility into underutilized EC2 instances, idle load balancers, and unattached EBS volumes to identify cost-saving opportunities across their account. Which service provides these automated recommendations?

❌ A. AWS Budgets
✅ B. AWS Trusted Advisor cost optimization checks
❌ C. AWS Config
❌ D. Amazon CloudWatch

Question 994

A company wants to receive an alert via email when their AWS spending is forecasted to exceed a set monthly threshold, before the month even ends. Which service should be used?

❌ A. AWS Cost Explorer
✅ B. AWS Budgets with a forecasted alert
❌ C. AWS Trusted Advisor
❌ D. Cost and Usage Report

Question 995

A company has dev/test EC2 environments that are only needed during business hours (8am-6pm, Mon-Fri) and are idle the rest of the time. What is the most cost-effective way to reduce EC2 costs for these environments?

❌ A. Purchase Reserved Instances for the dev/test environments
✅ B. Use AWS Instance Scheduler (or Lambda + EventBridge) to automatically stop and start instances outside business hours
❌ C. Use Spot Instances only
❌ D. Leave instances running continuously

Question 996

A company wants to reduce the cost of infrequently accessed log data currently stored in S3 Standard, which is queried maybe once a quarter for compliance audits and can tolerate retrieval times of up to 12 hours. Which storage class minimizes cost?

❌ A. S3 Standard-IA
✅ B. S3 Glacier Deep Archive
❌ C. S3 One Zone-IA
❌ D. S3 Intelligent-Tiering

Question 997

A company running a fleet of Amazon Aurora databases across dev, test, and staging environments wants to reduce costs since these environments have unpredictable, intermittent usage and sit idle much of the time, while still needing to scale up automatically when used. Which option is most cost-effective?

❌ A. Aurora Provisioned with large instances
✅ B. Aurora Serverless v2
❌ C. Reserved Instances for all environments
❌ D. Multi-AZ Aurora Provisioned

Question 998

A company wants to right-size its EC2 fleet by identifying instances that are consistently over-provisioned (low CPU/memory utilization) and receiving specific instance type downsize recommendations. Which service should be used?

✅ A. AWS Compute Optimizer
❌ B. AWS Config
❌ C. Amazon CloudWatch Logs
❌ D. AWS Trusted Advisor security checks

Question 999

A company operates in a single AWS account today but plans to expand to 20+ accounts for different teams. They want a single, consolidated bill and the ability to share Reserved Instance and Savings Plans discounts automatically across all accounts. Which feature should they use?

❌ A. Separate billing per account with no sharing
✅ B. AWS Organizations with Consolidated Billing
❌ C. Manual monthly true-ups between accounts
❌ D. AWS Budgets only

Question 1000

A company wants to reduce data transfer costs between EC2 instances and an RDS database that are currently in different Availability Zones, without changing the architecture's high-availability properties. What should they verify/change?

✅ A. Keep Multi-AZ standby for HA, but ensure application servers and read traffic use resources in the same AZ where possible to minimize cross-AZ transfer
❌ B. Use a NAT Gateway between them
❌ C. Enable S3 Transfer Acceleration
❌ D. Use Direct Connect