Quizzes · The core four

Compute

Level 0 questions on Compute. Read the pillar first if it's new to you.

15 questions, from a pool of 57
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 2The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 3Todo.io runs its app on EC2. A security patch for the operating system is released. Whose job is it to install it?

Todo.io's. On EC2, everything from the operating system up is the customer's job.Correct. This is the shared responsibility model: AWS runs the hardware and the hypervisor, you run what is on the instance.AWS's, automatically, for every instance.Not this one. AWS doesn't touch the operating system on your instances.Nobody's. EC2 instances never need patching.Not this one. They need patching like any server.Only the root user's, from the console.Not this one. Patching happens on the instance, by whoever runs it, not through the root user.

Learn it: EC2 (Elastic Compute Cloud)

Question 4Todo.io wants every new app server to start with the same operating system and the same software already installed. What should every launch use?

The same AMI (Amazon Machine Image).Correct. The AMI is the starting disk image: operating system plus whatever you baked in.The same instance type.Not this one. The instance type sets size (CPU and memory), not what is installed.The same security group.Not this one. That decides who can connect, not what runs.The same network interface.Not this one. Each instance gets its own; it carries addresses, not software.

Learn it: EC2 (Elastic Compute Cloud)

Question 5Todo.io's app server keeps running out of memory. What should Todo.io change?

The instance type, to one with more memory.Correct. The instance type sets how much CPU and memory the server has.The AMI.Not this one. The AMI decides the software, not the hardware.The subnet.Not this one. Moving subnets changes the network, not the server's size.The security group.Not this one. Security groups only filter traffic.

Learn it: EC2 (Elastic Compute Cloud)

Question 6A Linux test server runs for about 40 minutes a day and is stopped the rest of the time. How is it billed as an On-Demand instance?

Per second while it runs, with a one-minute minimum each time it starts.Correct. You rent EC2 by the second, so a stopped instance costs nothing for compute (its disk is still billed).A fixed monthly price, running or not.Not this one. That is closer to a Reserved Instance commitment, not On-Demand.Per hour, rounded up, for all instances.Not this one. Linux On-Demand instances are billed per second.Only while its CPU is busy.Not this one. You pay while it runs, busy or idle.

Learn it: EC2 (Elastic Compute Cloud)

Question 7Todo.io stopped and started its web server overnight. Now users can't reach it at the public IP address they had. What happened?

A normal public IP is released when an instance stops; it got a new one on start. An Elastic IP stays fixed.Correct. Inside the VPC the instance only knows its private IP. The public IP is mapped to it, and that mapping changes on stop and start.The security group was reset.Not this one. Security groups don't change when an instance stops.The subnet became private.Not this one. A subnet only changes if someone edits its route table.The internet gateway was removed.Not this one. Stopping an instance doesn't touch the gateway.

Learn it: Public IP address

Question 8Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?

From the instance metadata service at 169.254.169.254, on the instance's host.Correct. The SDK asks for temporary credentials and refreshes them before they expire. Nothing is stored in a file.From a file the team uploads to the instance.Not this one. That would be long-lived keys on disk, which roles exist to avoid.From an S3 bucket.Not this one. Credentials are never fetched from a bucket.From the IAM Identity Center access portal.Not this one. The portal is for people. Software on EC2 uses its instance profile.

Learn it: Temporary credentials · IAM role

Question 9An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?

The download fails: the subnet has no route out. A NAT gateway in a public subnet would give it one.Correct. Private means no route to the internet gateway. A NAT gateway lets it call out while nothing calls in.It works, because security groups allow all outbound traffic by default.Not this one. Security groups allow it, but there is no route for the traffic to take.It works if the instance has a public IP.Not this one. In a private subnet a public IP leads nowhere: there is still no route to the internet gateway.It works through the internet gateway automatically.Not this one. Only subnets whose route table points to the internet gateway use it.

Learn it: NAT gateway · Subnet

Question 10Todo.io's web server is in a public subnet and has a public IP, but users get a timeout on HTTPS (port 443). What should be checked first?

That the instance's security group allows inbound TCP 443.Correct. Security groups deny everything that isn't allowed. A missing inbound rule shows up as a timeout.That there is a NAT gateway.Not this one. NAT is for calling out from private subnets, not for being reached.That there is an outbound rule for the replies.Not this one. Security groups are stateful; replies are allowed automatically.That the instance is in a private subnet.Not this one. A private subnet would make it unreachable from the internet.

Learn it: Security group

Question 11Which of Todo.io's compute choices still leaves Todo.io patching an operating system?

Amazon EC2.Correct. With EC2 you get a server, and the operating system on it is yours to maintain.AWS Lambda.Not this one. Lambda has no server for you to manage.Amazon ECS on Fargate.Not this one. With Fargate, AWS runs and patches the servers under your containers.Amazon API Gateway.Not this one. It is a managed front door with nothing to patch.

Learn it: EC2 (Elastic Compute Cloud) · ECS and Fargate · Lambda

Question 12In Amazon ECS, what is a running copy of a container (or a group of containers that run together) called?

A task.Correct. ECS starts and watches tasks. A service keeps a chosen number of them running.An instance.Not this one. Instances are EC2 servers.A function.Not this one. Functions are Lambda.A pod.Not this one. Pods are the Kubernetes (EKS) name. ECS calls them tasks.

Learn it: ECS and Fargate

Question 13Todo.io has packaged its app as a container. It wants to run it without managing any EC2 servers. What should it use?

Amazon ECS with the Fargate launch type.Correct. With Fargate, AWS runs the servers under your tasks; you only say how much CPU and memory each task needs.Amazon ECS with the EC2 launch type.Not this one. Then the containers run on EC2 instances you manage.One large EC2 instance with Docker installed.Not this one. That is a server to patch and a single point of failure.An SQS queue.Not this one. A queue passes messages; it doesn't run containers.

Learn it: ECS and Fargate

Question 14Code inside Todo.io's ECS task must send messages to SQS. Which role should be allowed sqs:SendMessage?

The task role.Correct. The task role is what your code may do. Its credentials are served inside the task.The task execution role.Not this one. That is what ECS itself needs to start the task: pull the image and ship logs.An instance profile on an EC2 host.Not this one. On Fargate there is no host of yours, and the task role keeps permissions per task.A service-linked role.Not this one. Those belong to AWS services, and you can't add permissions to them.

Learn it: ECS and Fargate · IAM role

Question 15A Fargate task fails to start because ECS can't pull the container image or create its log stream. Which role is missing permissions?

The task execution role.Correct. ECS uses the execution role to pull the image and send logs on your behalf, before your code runs.The task role.Not this one. The task role is only used by your code once the task is running.The root user.Not this one. Root is never involved in starting tasks.The developer's IAM Identity Center role.Not this one. The task starts long after the developer clicked deploy, using its own roles.

Learn it: ECS and Fargate

Question 16What does each Fargate task get in Todo.io's VPC?

Its own network interface, with a private IP address and its own security groups.Correct. So each task can be allowed or blocked on its own, like an EC2 instance.Nothing. Fargate tasks run outside the VPC.Not this one. Fargate tasks run inside your subnets.A share of the host server's IP address.Not this one. On Fargate there is no host of yours; each task has its own ENI.A public IP address, always.Not this one. A public IP is optional, and in a private subnet it would be useless.

Learn it: ECS and Fargate · ENI

Question 17Todo.io runs containers on ECS with Fargate. Who patches the operating system of the servers the tasks run on?

AWS.Correct. With Fargate the servers are AWS's. You still own what is inside your container image.Todo.io.Not this one. Todo.io never sees those servers.Nobody; they are never patched.Not this one. AWS patches them.The container, at start-up.Not this one. Containers don't patch the server they run on.

Learn it: ECS and Fargate

Question 18How does output from Todo.io's containers on Fargate reach CloudWatch Logs?

Through the awslogs log driver set in the task definition, using the task execution role.Correct. Each container's output goes to a log stream in a log group you choose.Through CloudTrail.Not this one. CloudTrail records AWS API calls, not container output.By installing the CloudWatch agent on the host.Not this one. With Fargate you have no host to install anything on.By connecting to each task and copying the files.Not this one. There is no need; the log driver ships output as it happens.

Learn it: ECS and Fargate · CloudWatch Logs

Question 19Todo.io's ECS service is set to keep two tasks running. One task crashes. What happens?

ECS notices and starts a replacement, so two tasks are running again.Correct. An ECS service keeps the number of tasks you asked for, replacing any that stop.Nothing, until someone starts a new task by hand.Not this one. Keeping the desired count is what an ECS service is for.ECS restarts the server under every task.Not this one. It only replaces the task that stopped.ECS emails the team and waits.Not this one. It replaces the task by itself. (You can still set up alarms.)

Learn it: ECS and Fargate

Question 20Todo.io's monthly export takes about 40 minutes. Which compute choice can run it in one go without managing servers?

A task on ECS with Fargate.Correct. Tasks run as long as they need to. Lambda stops at 15 minutes.A Lambda function with a 40-minute timeout.Not this one. The longest a Lambda function can run is 15 minutes.API Gateway.Not this one. It passes requests to backends; it doesn't run jobs.An SQS queue.Not this one. A queue holds the job; something else still has to run it.

Learn it: Lambda · ECS and Fargate

Question 21Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?

A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it.Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.)An outbound rule in the task's security group.Not this one. Security groups allow outbound traffic by default; the problem is the missing route.A public IP on each task, left in the private subnet.Not this one. A public IP is useless without a route to the internet gateway.More permissions on the task role.Not this one. A permission problem returns AccessDenied, not a timeout.

Learn it: NAT gateway · IAM policy

Question 22Todo.io's Lambda function processes large uploads and always stops at exactly 15 minutes, unfinished. What is the right fix?

Split the work into smaller pieces, or run it on a service without that limit, such as ECS on Fargate.Correct. 15 minutes is the most a Lambda function can ever run.Raise the function's timeout to 30 minutes.Not this one. The timeout can't go above 15 minutes.Give the function more memory, which extends the limit.Not this one. More memory makes it faster, but the 15-minute limit stays.Attach the function to a VPC.Not this one. Being in a VPC changes what it can reach, not how long it can run.

Learn it: Lambda

Question 23How is Todo.io billed for a Lambda function?

Per request, and for how long each run takes (by the millisecond, scaled by its memory size).Correct. No requests, no compute charge: you never pay for an idle server.Per hour while the function exists.Not this one. An unused function costs nothing to keep.A flat monthly fee per function.Not this one. There is no flat fee.Per GB of code stored only.Not this one. Requests and run time are what you pay for.

Learn it: Lambda

Question 24Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 25When should Todo.io attach a Lambda function to its VPC?

When it needs to reach something private inside the VPC, such as the RDS database.Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources.Whenever it needs the internet.Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway.To make it run faster.Not this one. Speed comes from memory size, not from the VPC.Always; IAM only works inside a VPC.Not this one. IAM has nothing to do with VPCs.

Learn it: Lambda

Question 26How many execution roles does a Lambda function have?

Exactly one. Its permissions are everything the function's code can do in AWS.Correct. Give that one role only what the function needs.One per caller.Not this one. Who may call the function is set by its resource-based policy, not by extra roles.One per run.Not this one. Every run uses the same role.None. Functions get permissions from the account.Not this one. Nothing gets permissions just by being in an account.

Learn it: Lambda · IAM role

Question 27Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?

Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents).Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role.Lambda can't send logs anywhere.Not this one. It sends them to CloudWatch Logs by default.The CloudWatch agent isn't installed.Not this one. The agent is for EC2. Lambda needs nothing installed.CloudTrail is turned off.Not this one. CloudTrail records API calls; it isn't where function output goes.

Learn it: Lambda · CloudWatch Logs

Question 28Todo.io's worker is a Lambda function that handles messages from an SQS queue. How do the messages reach the function?

Lambda polls the queue for you (an event source mapping) and runs the function with each batch.Correct. SQS never pushes. Lambda does the polling, so you don't write any.SQS pushes each message to the function.Not this one. SQS only hands out messages to whoever asks.The team writes a scheduled job that copies messages to the function.Not this one. The event source mapping already does this.Through API Gateway.Not this one. API Gateway is for HTTP requests, not for queues.

Learn it: Lambda · SQS

Question 29A Lambda function with a 60-second timeout processes an SQS queue whose visibility timeout is 30 seconds. Some messages are processed twice. What is the fix?

Raise the queue's visibility timeout well above the function's timeout; AWS suggests at least six times.Correct. A message becomes visible again after 30 seconds, while the first run is still working on it, so a second run picks it up.Shorten how long the queue keeps messages.Not this one. Retention is how long unread messages wait; it doesn't cause repeats.Add a dead-letter queue.Not this one. A DLQ catches messages that keep failing. These ones succeed, just twice.Lower the function's memory.Not this one. That only makes each run slower, which makes it worse.

Learn it: Lambda · SQS (Simple Queue Service)

Question 30Todo.io moves its API to Lambda. Which of these is still Todo.io's job?

The function's code and the permissions in its execution role.Correct. AWS runs the servers, the operating system and the scaling. What your code does, and what it is allowed to do, stay yours.Patching the operating system.Not this one. With Lambda there is no operating system for you to patch.Adding servers when traffic grows.Not this one. Lambda scales by itself.Replacing failed hardware.Not this one. Hardware is always AWS's job.

Learn it: Lambda

Question 31Every morning at 9:00, thousands of Todo.io users add todos within a few minutes. The app writes each todo straight to its database, which can't keep up, and some saves fail. No todo may be lost. What should Todo.io do?

Have the app send each new todo to an SQS queue, and let a worker save todos from the queue at a pace the database can handle.Correct. A queue decouples the burst from the database. Messages wait safely until the worker gets to them, so nothing is lost and the database is never overrun.Move the app from EC2 to Lambda so it can handle more requests at once.Not this one. The app isn't the bottleneck, the database is. More concurrent app code just sends the database even more writes at once.Write each todo to CloudWatch Logs first, and copy it to the database later.Not this one. CloudWatch Logs stores log lines for people to read. It isn't a work queue: nothing tracks which todos were saved, and nothing retries the ones that fail.Give the database a public IP address so it can accept more connections.Not this one. A public IP changes who can reach the database, not how much work it can do. It also exposes the database to the internet.

Learn it: SQS (Simple Queue Service) · Design Todo.io with the Queue add-on

Question 32Todo.io's worker reads jobs from a standard SQS queue. Very rarely, a todo is counted twice in a user's stats. What is the most likely cause, and the right fix?

Standard queues deliver every message at least once, so sometimes twice. Make the worker idempotent by recording each message id and skipping repeats.Correct. "At least once" is a documented property of standard SQS queues. Workers that might see a message twice must be safe to run twice.The queue lost the message and re-created it. Increase the message retention period.Not this one. Retention is how long unread messages are kept. It doesn't affect duplicates.The message failed and went to the dead-letter queue. Delete the dead-letter queue.Not this one. A DLQ holds messages that kept failing. It doesn't create duplicates, and deleting it loses the evidence.Two workers are running. Run only one worker at a time.Not this one. Even a single worker can receive the same message twice from a standard queue. One worker also throws away the scaling a queue gives you.

Learn it: SQS (Simple Queue Service) · Design Todo.io with the Queue add-on

Question 33What does it mean that an SQS queue decouples Todo.io's app from its worker?

The app drops a message and moves on; it doesn't wait for, or even know about, the worker.Correct. The queue sits between them, so either side can be slow, busy or down without breaking the other.Both must be running at the same time for messages to flow.Not this one. That is exactly what a queue removes.The queue pushes each message straight into the worker.Not this one. Workers ask the queue for messages; SQS never pushes.The app and worker must share a database.Not this one. They only share the queue.

Learn it: SQS (Simple Queue Service)

Question 34Todo.io's worker is down for three days. Messages keep arriving in its standard SQS queue, which uses the default settings. What happens to them?

They wait in the queue. The default retention is 4 days, and it can be raised to 14.Correct. When the worker comes back, it works through the backlog.They are lost after a few minutes.Not this one. Messages stay until they are deleted or their retention runs out.They are sent back to the app.Not this one. Queues never return messages to the sender.They go straight to the dead-letter queue.Not this one. A DLQ only receives messages that were received and failed too many times.

Learn it: SQS (Simple Queue Service)

Question 35Todo.io's worker receives a message, then crashes before deleting it. What happens to the message?

Once the visibility timeout passes, it becomes visible again and is retried.Correct. A received message is only hidden, not removed. Deleting it is the worker's way of saying "done".It is lost, because it was already received.Not this one. Receiving only hides it for a while.It was deleted automatically when it was received.Not this one. Only the worker deletes messages.It goes straight to the dead-letter queue.Not this one. Only after failing maxReceiveCount times.

Learn it: SQS (Simple Queue Service)

Question 36One malformed message makes Todo.io's worker fail every time, so it is retried forever. How should Todo.io deal with messages like this?

Give the queue a redrive policy that moves a message to a dead-letter queue after a set number of receives (maxReceiveCount).Correct. The bad message is set aside in the DLQ for someone to inspect, fix and redrive.Raise the visibility timeout.Not this one. The message would fail just as often, only more slowly.Switch to a FIFO queue.Not this one. FIFO keeps order; it doesn't stop endless retries.Delete the queue and create a new one.Not this one. That loses every other message too.

Learn it: Dead-letter queue (DLQ)

Question 37Todo.io's source queue is a FIFO queue. What kind of queue can be its dead-letter queue?

A FIFO queue.Correct. A DLQ must be the same type as its source queue.A standard queue.Not this one. A FIFO queue needs a FIFO DLQ.Any queue in the account.Not this one. The types must match.A CloudWatch log group.Not this one. A DLQ is always another SQS queue.

Learn it: Dead-letter queue (DLQ)

Question 38Events about each todo must be processed in exactly the order they happened, and only once. Which queue fits?

A FIFO queue.Correct. FIFO queues keep strict order and process each message exactly once.A standard queue.Not this one. Standard queues are faster, but can deliver out of order and occasionally twice.A standard queue with a longer visibility timeout.Not this one. That reduces retries, but promises nothing about order.A dead-letter queue.Not this one. A DLQ is where failed messages go, not a way to keep order.

Learn it: SQS (Simple Queue Service)

Question 39Todo.io's app gets AccessDenied when it calls SendMessage on its queue. What should be fixed?

The app's role needs a policy allowing sqs:SendMessage on the queue's ARN.Correct. Sending to a queue is an AWS API call, approved by IAM.The queue's security group.Not this one. Queues have no security groups.The queue is full and must be emptied.Not this one. A full queue isn't the cause of AccessDenied.The visibility timeout.Not this one. That affects receiving, not sending.

Learn it: SQS (Simple Queue Service) · IAM policy

Question 40Todo.io moves "send a welcome email" out of sign-up and into a queue with a worker. What changes for a user who signs up?

Sign-up answers sooner; the email is sent a moment later in the background.Correct. The slow part no longer sits between the user and their response.Sign-up takes longer, because of the queue.Not this one. Dropping a message in a queue is quick.Sign-up fails whenever the email worker is down.Not this one. The message waits in the queue until the worker is back.The email is guaranteed to arrive before the sign-up page loads.Not this one. It is sent afterwards; that is the point.

Learn it: SQS (Simple Queue Service)

Question 41Todo.io moves its app from an EC2 instance to a Lambda function. On EC2, the app wrote to DynamoDB with a role attached through an instance profile. What gives the function the same access?

An execution role for the function that allows the same DynamoDB actions.Correct. Software gets AWS permissions from an IAM role. On EC2 the role arrives through an instance profile; a Lambda function has exactly one execution role, so the permissions move there.Attach the same instance profile to the function.Not this one. An instance profile is how a role reaches an EC2 instance. A function gets its permissions from its execution role instead.Put an IAM user's access keys in the function's environment variables.Not this one. Stored access keys are exactly what roles replace: they never expire and can leak. Software gets permissions from a role.Nothing: Lambda functions can call DynamoDB in their own account by default.Not this one. A function can do only what its execution role allows. With no DynamoDB permission, the call fails with AccessDenied.

Learn it: Lambda · EC2 (Elastic Compute Cloud) · IAM role

Question 42Todo.io's API gets a few hundred requests a day and sits idle most of the night, yet it runs on an EC2 instance around the clock. Which swap cuts the cost of the idle hours the most?

Move the API to Lambda.Correct. Lambda is billed per request and per millisecond of run time. An idle function costs nothing, so the quiet hours stop costing anything.Move the API to one ECS task on Fargate that runs all day.Not this one. Fargate bills per second for the vCPU and memory a running task asks for. A task that runs all day is paid for all day, busy or not.Move the API to a bigger EC2 instance so each request finishes sooner.Not this one. An On-Demand instance is billed per second while it runs, whatever it's doing. A bigger instance costs more for the same idle hours.Keep the instance, but stop it during the day.Not this one. A stopped instance pays only for its disk, but the API can't answer while it's stopped, and the busy hours are during the day.

Learn it: Lambda · EC2 (Elastic Compute Cloud) · ECS and Fargate

Question 43What does "EC2 (Elastic Compute Cloud)" mean?

Rent a virtual server by the second.Correct. Think of it as: Renting a computer you have to look after yourself.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.

Learn it: EC2 (Elastic Compute Cloud)

Question 44Which term is this? "Rent a virtual server by the second."

EC2 (Elastic Compute Cloud)Correct. Yes. Think of it as: Renting a computer you have to look after yourself.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.

Learn it: EC2 (Elastic Compute Cloud)

Question 45Which AWS term is described by this analogy? "Renting a computer you have to look after yourself."

EC2 (Elastic Compute Cloud)Correct. Yes: Rent a virtual server by the second.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.

Learn it: EC2 (Elastic Compute Cloud)

Question 46What does "ECS and Fargate" mean?

Run containers on AWS. With Fargate, AWS also runs the servers underneath.Correct. Think of it as: Handing over a packed lunchbox and letting someone else heat it up.Rent a virtual server by the second.Not this one. That describes EC2 (Elastic Compute Cloud).Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.

Learn it: ECS and Fargate

Question 47Which term is this? "Run containers on AWS. Pick the serverless option and AWS also runs the servers underneath."

ECS and FargateCorrect. Yes. Think of it as: Handing over a packed lunchbox and letting someone else heat it up.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.

Learn it: ECS and Fargate

Question 48Which AWS term is described by this analogy? "Handing over a packed lunchbox and letting someone else heat it up."

ECS and FargateCorrect. Yes: Run containers on AWS. With Fargate, AWS also runs the servers underneath.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second. Its analogy: Renting a computer you have to look after yourself.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.

Learn it: ECS and Fargate

Question 49What does "Lambda" mean?

Upload a function; AWS runs it only when something calls it.Correct. Think of it as: A taxi. You pay for the ride, not for owning the car.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.Rent a virtual server by the second.Not this one. That describes EC2 (Elastic Compute Cloud).

Learn it: Lambda

Question 50Which term is this? "Upload a function; AWS runs it only when something calls it."

LambdaCorrect. Yes. Think of it as: A taxi. You pay for the ride, not for owning the car.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second.

Learn it: Lambda

Question 51Which AWS term is described by this analogy? "A taxi. You pay for the ride, not for owning the car."

LambdaCorrect. Yes: Upload a function; AWS runs it only when something calls it.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second. Its analogy: Renting a computer you have to look after yourself.

Learn it: Lambda

Question 52What does "SQS (Simple Queue Service)" mean?

A managed queue. One part of your system drops messages in, another takes them out later.Correct. Think of it as: A ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready.A side queue where messages go after failing too many times.Not this one. That describes Dead-letter queue (DLQ).Records how your resources are configured over time and checks them against rules.Not this one. That describes AWS Config.A record of every AWS API call. Who did what, when, from where.Not this one. That describes CloudTrail.

Learn it: SQS (Simple Queue Service)

Question 53Which term is this? "A managed queue. One part of your system drops messages in, another takes them out later."

SQS (Simple Queue Service)Correct. Yes. Think of it as: A ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready.Dead-letter queue (DLQ)Not this one. Dead-letter queue (DLQ) is: A side queue where messages go after failing too many times.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where.

Learn it: SQS (Simple Queue Service)

Question 54Which AWS term is described by this analogy? "A ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready."

SQS (Simple Queue Service)Correct. Yes: A managed queue. One part of your system drops messages in, another takes them out later.Dead-letter queue (DLQ)Not this one. Dead-letter queue (DLQ) is: A side queue where messages go after failing too many times. Its analogy: The "problem orders" tray, so one bad order doesn't block the kitchen.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules. Its analogy: A building inspector with a notebook and a camera.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where. Its analogy: The building's CCTV and visitor book.

Learn it: SQS (Simple Queue Service)

Question 55What does "Dead-letter queue (DLQ)" mean?

A side queue where messages go after failing too many times.Correct. Think of it as: The "problem orders" tray, so one bad order doesn't block the kitchen.A managed queue. One part of your system drops messages in, another takes them out later.Not this one. That describes SQS (Simple Queue Service).Records how your resources are configured over time and checks them against rules.Not this one. That describes AWS Config.A record of every AWS API call. Who did what, when, from where.Not this one. That describes CloudTrail.

Learn it: Dead-letter queue (DLQ)

Question 56Which term is this? "A side queue where messages go after failing too many times."

Dead-letter queue (DLQ)Correct. Yes. Think of it as: The "problem orders" tray, so one bad order doesn't block the kitchen.SQS (Simple Queue Service)Not this one. SQS (Simple Queue Service) is: A managed queue. One part of your system drops messages in, another takes them out later.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where.

Learn it: Dead-letter queue (DLQ)

Question 57Which AWS term is described by this analogy? "The "problem orders" tray, so one bad order doesn't block the kitchen."

Dead-letter queue (DLQ)Correct. Yes: A side queue where messages go after failing too many times.SQS (Simple Queue Service)Not this one. SQS (Simple Queue Service) is: A managed queue. One part of your system drops messages in, another takes them out later. Its analogy: A ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules. Its analogy: A building inspector with a notebook and a camera.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where. Its analogy: The building's CCTV and visitor book.

Learn it: Dead-letter queue (DLQ)

Compute

Score by pillar

Score by domain

Worth another look

Your weak spots

Services

Concepts