Question 1 An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?
Choose one answer Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0
Question 2 Why does Todo.io keep its apps out of the management account of its organization?
Choose one answer Learn it: AWS Organizations · SCP (service control policy) · Set up AWS: Day 0
Question 3 Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?
Choose one answer Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower
Question 4 Todo.io hires five engineers who need access to both the Dev and Prod accounts, with less access in Prod. What is the recommended way to set this up?
Choose one answer Learn it: IAM Identity Center · Permission set · Set up AWS: Day 0
Question 5 Todo.io runs six AWS accounts and wants a single bill, with usage across all six counted together for volume pricing. What gives them that?
Choose one answer Learn it: AWS Organizations
Question 6 Todo.io attaches an SCP to its Workloads OU. The Prod and Dev accounts sit in that OU, and a Sandbox OU sits inside it. Which accounts does the SCP apply to?
Choose one answer Learn it: AWS Organizations · SCP
Question 7 Todo.io wants to stop anyone, including the root user, from deleting the audit bucket in its Prod account. Prod is a member account. Can an SCP do that?
Choose one answer Learn it: SCP (service control policy) · Root user
Question 8 An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?
Choose one answer Learn it: SCP (service control policy) · Service-linked role
Question 9 Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?
Choose one answer An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions. Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule. An IAM policy on every user and role that only allows those Regions. Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added. An AWS Config rule that flags resources in other Regions. Not this one. Config reports after the fact. The requirement says it may only run there. Deleting the default VPC in every other Region. Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.
Learn it: SCP (service control policy) · Controls (guardrails) · Region
Question 10 Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?
Choose one answer From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account. Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys. Sign in to the new account as root with the management account's password. Not this one. Each account has its own root user and email address. The management account's password doesn't open it. Use the IAM user that Organizations creates for the administrator. Not this one. Organizations creates a role, not an IAM user. Wait for the new account to accept an invitation. Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.
Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role
Question 11 Why does Todo.io put Prod and Dev in separate AWS accounts rather than in one account?
Choose one answer Learn it: AWS account
Question 12 Todo.io wants every production account, including ones it adds next year, to get the same guardrails automatically. What should it do?
Choose one answer Learn it: AWS Organizations · SCP
Question 13 Todo.io wants a multi-account setup with central logging, single sign-on and guardrails, built the AWS-recommended way, with the least work. What should it use?
Choose one answer Learn it: AWS Control Tower · Set up AWS: Day 0 with Control Tower · Landing zone
Question 14 A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?
Choose one answer Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them. Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you. Control Tower replaces Organizations with its own account system. Not this one. Control Tower runs on top of Organizations. Control Tower is only a dashboard; it changes nothing. Not this one. It creates accounts, applies controls and sets up logging and sign-in. Control Tower runs separately inside each member account. Not this one. It runs from the management account and governs the accounts below it.
Learn it: AWS Control Tower
Question 15 Todo.io needs a new account for its data team. It must arrive with logging on, guardrails applied and sign-in through Identity Center already set up. What creates it?
Choose one answer Learn it: Account Factory
Question 16 Why does a Control Tower landing zone keep every account's logs in a separate Log Archive account?
Choose one answer Someone who breaks into a workload account can't erase the evidence of what they did. Correct. Nobody runs apps in the Log Archive account, and workload accounts can't delete what is stored there. Storage is cheaper in a separate account. Not this one. The price of storage doesn't depend on which account holds it. CloudTrail can only write to another account. Not this one. CloudTrail can write to a bucket in the same account. Separating them is a security choice. Logs in workload accounts are deleted after 90 days. Not this one. Logs in S3 are kept as long as you choose, in any account.
Learn it: Landing zone · Set up AWS: Day 0 with Control Tower
Question 17 Todo.io wants to be told whenever an S3 bucket in any account becomes public. Teams must still be able to make the change. Which kind of Control Tower control fits?
Choose one answer A detective control. Correct. Detective controls are AWS Config rules. They spot something after it happens and report it, without blocking it. "Be told" is the clue. A preventive control. Not this one. Preventive controls are SCPs. They would block the change, which the requirement doesn't want. A proactive control. Not this one. Proactive controls check CloudFormation templates before resources are created. Buckets changed in the console would be missed. A mandatory control. Not this one. "Mandatory" says a control is always on, not what kind it is.
Learn it: Controls (guardrails)
Question 18 Todo.io deploys everything with CloudFormation. It wants each resource checked against its rules before CloudFormation creates it. Which kind of Control Tower control fits?
Choose one answer A proactive control. Correct. Proactive controls are CloudFormation hooks: they check a resource before it is created. A detective control. Not this one. Detective controls check after the resource exists. A preventive control. Not this one. Preventive controls are SCPs that block API calls. They don't look at what a template is about to create. An elective control. Not this one. "Elective" means optional. It doesn't say when the check happens.
Learn it: Controls (guardrails)
Question 19 A teammate edits one of Control Tower's SCPs by hand in the Organizations console. What does Control Tower do?
Choose one answer It reports drift, so the landing zone can be repaired to match its intended setup. Correct. Control Tower notices changes made outside it. Fixing the drift puts its managed resources back as they should be. Nothing. Changes made in the Organizations console are invisible to it. Not this one. Control Tower watches the resources it manages, wherever they are changed. It deletes the account that was changed. Not this one. It never deletes accounts on its own. It blocks the edit before it happens. Not this one. The edit goes through. Control Tower reports it afterwards.
Learn it: AWS Control Tower
Question 20 Todo.io had three accounts before it set up Control Tower. Can they be governed by it?
Choose one answer Yes. Existing accounts in the organization can be enrolled. Correct. Enrolling an account applies the landing zone's logging, guardrails and sign-in to it. No. They have to be closed and recreated with Account Factory. Not this one. Enrollment exists so that doesn't have to happen. Only by moving their workloads into the management account. Not this one. Workloads should never move into the management account. Only their root users can be governed. Not this one. Enrollment governs the whole account.
Learn it: AWS Control Tower
Question 21 Which statement about Control Tower's controls is true?
Choose one answer Some are mandatory and always on. Others are strongly recommended or elective, and you choose where to turn them on. Correct. Mandatory controls protect the landing zone itself, such as its logging. The rest you enable per OU. Every control is a preventive SCP. Not this one. Controls are preventive (SCPs), detective (Config rules) or proactive (CloudFormation hooks). Every control is optional. Not this one. Mandatory controls can't be turned off. Controls only apply to the management account. Not this one. Controls are applied to OUs, so they reach the accounts in them.
Learn it: Controls (guardrails)
Question 22 An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?
Choose one answer Temporary credentials for a role that Identity Center created from their permission set. Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak. The password of an IAM user in Prod. Not this one. Identity Center doesn't create IAM users in the accounts. Permanent access keys for Prod. Not this one. Nothing here is permanent. That's the point. The Prod root user's credentials. Not this one. Root is never handed out by Identity Center.
Learn it: IAM Identity Center · Temporary credentials
Question 23 Todo.io assigns the ReadOnlyAccess permission set to an engineer in its Audit account. What does Identity Center create in the Audit account?
Choose one answer Learn it: Permission set
Question 24 Todo.io already manages its staff in Okta. It wants people to sign in to AWS with the same accounts, and leavers to lose AWS access when they are removed from Okta. What should it do?
Choose one answer Connect Okta to IAM Identity Center as its identity source. Correct. Identity Center can use an external directory instead of its own. One place to add and remove people. Create an IAM user in each account for every Okta user. Not this one. That duplicates every person, and removing someone from Okta wouldn't remove their IAM users. Use Amazon Cognito. Not this one. Cognito is for an app's own customers (Level 2), not for staff signing in to AWS. Share one AWS sign-in among everyone who is in Okta. Not this one. Shared sign-ins hide who did what, and can't be taken from one leaver.
Learn it: IAM Identity Center
Question 25 An engineer leaves Todo.io. They had access to all six accounts through IAM Identity Center. What is the quickest way to remove their access everywhere?
Choose one answer Disable or delete their user once: in Identity Center, or in the company directory it is connected to. Correct. One identity, one place to remove it. Sessions already open run out when their temporary credentials expire. Delete their IAM user in each of the six accounts. Not this one. They don't have IAM users; Identity Center gives them roles. Change the root password of every account. Not this one. They never had root, so this changes nothing for them. Delete the permission sets they used. Not this one. That removes access for everyone else who uses those permission sets too.
Learn it: IAM Identity Center
Question 26 An engineer needs full access in Dev but must only be able to look, not change, in Prod. How should Todo.io set this up in IAM Identity Center?
Choose one answer Assign an administrator permission set in Dev and a read-only permission set in Prod. Correct. Assignments are per account, so each account gets exactly the access it needs: least privilege. Assign the administrator permission set in both accounts and trust the engineer to be careful in Prod. Not this one. Least privilege means not relying on care. Give only what the job needs. Assign the administrator permission set in both, and add an SCP to Prod that denies all changes. Not this one. That SCP would stop everyone in Prod making changes, including deployments. Create an IAM user in Prod with read-only access as well. Not this one. Two identities for one person is harder to manage and to remove.
Learn it: Permission set
Question 27 Todo.io expects 50,000 people to sign up to manage their todos. Should those customers be created in IAM Identity Center?
Choose one answer No. Identity Center and IAM are for people and software that manage or call AWS. App customers belong to the app. Correct. Customer sign-up and login is the app's job; Amazon Cognito does it in Level 2. Yes. Identity Center is built for large numbers of users. Not this one. It's built for staff who sign in to AWS accounts, not for an app's customers. Yes, as IAM users, so each customer has their own permissions. Not this one. Customers should never be IAM principals. Yes, with one permission set per customer. Not this one. Customers don't sign in to AWS accounts at all.
Learn it: IAM Identity Center · IAM
Question 28 Roles named AWSReservedSSO_AdministratorAccess_… appear in Todo.io's Prod account. Where did they come from?
Choose one answer IAM Identity Center created them when a permission set was assigned in Prod. Correct. Identity Center was formerly called AWS SSO, hence the name. Change them through the permission set, not by hand. An attacker created them. Not this one. The AWSReservedSSO_ prefix is reserved for Identity Center. RDS created them as service-linked roles. Not this one. Service-linked roles are named AWSServiceRoleFor… Account Factory creates them in every account. Not this one. Account Factory sets up sign-in, but these roles come from permission set assignments.
Learn it: IAM Identity Center
Question 29 Todo.io wants every member of staff to use MFA when they sign in to AWS. Staff sign in through IAM Identity Center. Where should MFA be required?
Choose one answer Learn it: MFA (multi-factor authentication)
Question 30 What does an engineer see after signing in to the IAM Identity Center access portal?
Choose one answer The accounts they are assigned to, and the permission sets they can use in each. Correct. They pick an account and a permission set, and land in the console as that role. Every account in the organization, with administrator access to each. Not this one. They see only what has been assigned to them. Only the management account. Not this one. Staff rarely need the management account at all. A list of IAM users to sign in as. Not this one. There are no IAM users; access is through roles.
Learn it: IAM Identity Center
Question 31 In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?
Choose one answer Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region
Question 32 Todo.io's founder signs in as the root user every day to manage everything. Which change best follows AWS security best practice?
Choose one answer Learn it: Root user · Set up AWS: Day 0
Question 33 Todo.io creates a new IAM role and attaches no policies to it. What can something using the role do?
Choose one answer Learn it: IAM (Identity and Access Management) · IAM policy
Question 34 Todo.io created an IAM role while the console was set to us-east-1. Can an app running in eu-west-1 use the role?
Choose one answer Yes. IAM is global, so roles aren't tied to a Region. Correct. A few services, IAM among them, are global. Most others, like RDS, are regional. No. The role only exists in us-east-1. Not this one. That's true of most services, but not of IAM. Only after the role is copied to eu-west-1. Not this one. There is nothing to copy; the same role works in every Region. Only if the app signs in through IAM Identity Center. Not this one. Apps use roles directly. Identity Center is for people.
Learn it: IAM (Identity and Access Management) · Region
Question 35 A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?
Choose one answer Learn it: IAM role · Lambda
Question 36 Which statement describes a resource-based policy?
Choose one answer It is attached to a resource, such as a Lambda function or an S3 bucket, and says who may use that resource. Correct. It names the principal: "API Gateway may invoke this function". The opposite of an identity policy, which is attached to the caller. It is attached to a user, group or role, and says what they may do. Not this one. That is an identity-based policy. It sets the most any identity in an account may do. Not this one. That is an SCP. It decides which Region a resource is created in. Not this one. Policies allow or deny requests. The Region is chosen when you create the resource.
Learn it: IAM policy
Question 37 A developer may create Lambda functions, but gets AccessDenied when choosing an existing execution role for a new function. What is missing?
Choose one answer Learn it: iam:PassRole
Question 38 Which part of an IAM role decides who is allowed to assume it?
Choose one answer Its trust policy. Correct. The trust policy names who may wear the role, such as ec2.amazonaws.com. The permissions policy says what the wearer can do. Its permissions policy. Not this one. That says what the role can do once assumed, not who may assume it. An SCP on the account. Not this one. An SCP caps what the role can do. It doesn't name who may assume it. The role's ARN. Not this one. The ARN is only the role's name.
Learn it: IAM role
Question 39 Todo.io's report job only reads items from the Todos table. Which policy follows the principle of least privilege?
Choose one answer Allow dynamodb:GetItem and dynamodb:Query on the Todos table's ARN. Correct. Only the actions the job uses, only on the one table it reads. Allow dynamodb:* on every resource. Not this one. That lets the job delete every table in the account. Attach AdministratorAccess. Not this one. That lets the job do anything in the account. Allow every action on the Todos table's ARN. Not this one. Right table, but it could also delete it.
Learn it: IAM policy
Question 40 In the ARN arn:aws:dynamodb:us-east-1:111122223333:table/Todos, what is 111122223333?
Choose one answer Learn it: ARN (Amazon Resource Name)
Question 41 A teammate says a subnet is public because the instances in it have public IP addresses. What actually makes a subnet public?
Choose one answer Learn it: Subnet · Internet gateway
Question 42 Only Todo.io's app servers may connect to the MySQL database on port 3306. The app servers come and go during the day, so their private IP addresses keep changing. How should the database's security group allow them in?
Choose one answer Learn it: Security group
Question 43 A security group on Todo.io's app server allows inbound HTTPS (TCP 443) from anywhere. Someone deletes all of its outbound rules. What happens to the replies the server sends to users' HTTPS requests?
Choose one answer Learn it: Security group
Question 44 A brand-new AWS account wants to launch an EC2 instance right away, without designing a network. Where can it go?
Choose one answer Learn it: VPC (Virtual Private Cloud)
Question 45 Todo.io's app servers all sit in one subnet. Which Availability Zones does that subnet cover?
Choose one answer Learn it: Subnet · Region
Question 46 How many internet gateways can be attached to one VPC?
Choose one answer Learn it: Internet gateway
Question 47 Todo.io wants to block one abusive IP address from reaching its web server, while still allowing everyone else. Can it add that block to the server's security group?
Choose one answer Learn it: Security group
Question 48 What does a security group attach to?
Choose one answer Learn it: ENI (Elastic Network Interface) · Security group
Question 49 Where should Todo.io place its MySQL database inside the VPC?
Choose one answer In a private subnet, with a security group that only lets the app servers in. Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app. In a public subnet, with a public IP, so the app can find it. Not this one. The app reaches it by private IP. A public IP only adds exposure. In a public subnet with no security group. Not this one. Every network interface has a security group, and a database should never face the internet. Outside the VPC, on the internet. Not this one. RDS databases always run inside a VPC.
Learn it: Subnet · Security group
Question 50 Servers in Todo.io's private subnets must download updates from the internet, but must not be reachable from it. Where does the NAT gateway go?
Choose one answer Learn it: NAT gateway
Question 51 Todo.io's backend runs on Lambda. Browsers need an HTTPS address to send requests to. What should sit in front of the function?
Choose one answer Learn it: API Gateway
Question 52 A buggy client starts sending thousands of requests a second to Todo.io's API. Which API Gateway feature protects the backend?
Choose one answer Throttling: a rate limit that rejects excess requests before they reach the backend. Correct. Extra requests get HTTP 429 (Too Many Requests) and never reach Lambda or the database. Logging every request to CloudTrail. Not this one. CloudTrail records AWS API calls; it doesn't stop anything. A WebSocket API. Not this one. That keeps connections open; it doesn't limit how many requests arrive. A longer Lambda timeout. Not this one. That makes each request last longer, which is worse under a flood.
Learn it: API Gateway
Question 53 Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?
Choose one answer A resource-based policy on the function. Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource. The function's execution role. Not this one. The execution role says what the function may do, not who may call it. An SCP on the account. Not this one. SCPs only cap permissions; they never grant them. A security group on the function. Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.
Learn it: API Gateway · IAM policy · Lambda
Question 54 When a todo changes, Todo.io wants every open browser tab to update at once, without the browser asking again and again. What fits?
Choose one answer Learn it: WebSocket (API Gateway WebSocket API)
Question 55 Which routes does every API Gateway WebSocket API have built in?
Choose one answer $connect, $disconnect and $default.Correct. They run when a browser connects, when it disconnects, and for any message no other route matches. Each can call Lambda or an HTTP backend. GET, POST, PUT and DELETE. Not this one. Those are HTTP methods, used by REST APIs. /login and /logout.Not this one. Those would be routes you design yourself. $open, $close and $message.Not this one. The names are $connect, $disconnect and $default.
Learn it: WebSocket (API Gateway WebSocket API)
Question 56 Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?
Choose one answer Allow execute-api:ManageConnections in the function's execution role. Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other. Open port 443 in the function's security group. Not this one. AccessDenied is an IAM answer. A network problem would time out instead. Enable CORS on the API. Not this one. CORS is about browsers calling across websites. This call comes from Lambda. Give the browser an IAM role. Not this one. The browser is the receiver here, and app users are never IAM principals.
Learn it: WebSocket (API Gateway WebSocket API) · IAM policy
Question 57 Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?
Choose one answer API Gateway → Lambda → DynamoDB. Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers. EC2 → RDS. Not this one. Both run on servers you size, and EC2 you also patch. API Gateway → EC2 → RDS. Not this one. EC2 still means servers to manage. SQS → CloudWatch Logs. Not this one. That is a queue and a log store; neither serves an API.
Learn it: API Gateway · Lambda
Question 58 Which of these does API Gateway handle for Todo.io?
Choose one answer The HTTPS endpoint, throttling and authorisation, before requests reach the backend. Correct. It is the front door; your code behind it does the actual work. Storing the todos. Not this one. Data lives in a database such as DynamoDB or RDS. Running the business logic. Not this one. That runs in the backend, usually Lambda. Patching the backend's servers. Not this one. With Lambda there are none; with EC2 that is still your job.
Learn it: API Gateway
Question 59 Where does Todo.io's public API Gateway endpoint run, relative to its VPC?
Choose one answer Outside the VPC, as a managed AWS service with its own public endpoint. Correct. Like DynamoDB and SQS, it is a public AWS service. It doesn't need your subnets or a NAT gateway. Inside one of the VPC's public subnets. Not this one. API Gateway doesn't run in your subnets. Inside a private subnet, reached through a NAT gateway. Not this one. NAT is for things inside the VPC calling out, not for a public front door. On an EC2 instance that Todo.io launches. Not this one. It is fully managed; there is no instance to launch.
Learn it: API Gateway · VPC (Virtual Private Cloud)
Question 60 Hundreds of browsers hold WebSocket connections open to Todo.io. How does the backend send a message to one of them?
Choose one answer By its connection id, which API Gateway gave that connection when it opened. Correct. The backend POSTs to @connections/{id}. Todo.io stores each user's connection ids when they connect. By the browser's IP address. Not this one. The backend never talks to browsers directly; API Gateway holds the connections. By the user's IAM ARN. Not this one. App users aren't IAM principals. By an SQS queue URL. Not this one. Queues aren't connected to browsers.
Learn it: WebSocket (API Gateway WebSocket API)
Question 61 Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?
Choose one answer Learn it: NAT gateway · Lambda · IAM policy · ENI
Question 62 The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?
Choose one answer Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2
Question 63 Todo.io runs its app on EC2. A security patch for the operating system is released. Whose job is it to install it?
Choose one answer Learn it: EC2 (Elastic Compute Cloud)
Question 64 Todo.io wants every new app server to start with the same operating system and the same software already installed. What should every launch use?
Choose one answer The same AMI (Amazon Machine Image). Correct. The AMI is the starting disk image: operating system plus whatever you baked in. The same instance type. Not this one. The instance type sets size (CPU and memory), not what is installed. The same security group. Not this one. That decides who can connect, not what runs. The same network interface. Not this one. Each instance gets its own; it carries addresses, not software.
Learn it: EC2 (Elastic Compute Cloud)
Question 65 Todo.io's app server keeps running out of memory. What should Todo.io change?
Choose one answer The instance type, to one with more memory. Correct. The instance type sets how much CPU and memory the server has. The AMI. Not this one. The AMI decides the software, not the hardware. The subnet. Not this one. Moving subnets changes the network, not the server's size. The security group. Not this one. Security groups only filter traffic.
Learn it: EC2 (Elastic Compute Cloud)
Question 66 A Linux test server runs for about 40 minutes a day and is stopped the rest of the time. How is it billed as an On-Demand instance?
Choose one answer Learn it: EC2 (Elastic Compute Cloud)
Question 67 Todo.io stopped and started its web server overnight. Now users can't reach it at the public IP address they had. What happened?
Choose one answer Learn it: Public IP address
Question 68 Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?
Choose one answer Learn it: Temporary credentials · IAM role
Question 69 An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?
Choose one answer Learn it: NAT gateway · Subnet
Question 70 Todo.io's web server is in a public subnet and has a public IP, but users get a timeout on HTTPS (port 443). What should be checked first?
Choose one answer That the instance's security group allows inbound TCP 443. Correct. Security groups deny everything that isn't allowed. A missing inbound rule shows up as a timeout. That there is a NAT gateway. Not this one. NAT is for calling out from private subnets, not for being reached. That there is an outbound rule for the replies. Not this one. Security groups are stateful; replies are allowed automatically. That the instance is in a private subnet. Not this one. A private subnet would make it unreachable from the internet.
Learn it: Security group
Question 71 Which of Todo.io's compute choices still leaves Todo.io patching an operating system?
Choose one answer Amazon EC2. Correct. With EC2 you get a server, and the operating system on it is yours to maintain. AWS Lambda. Not this one. Lambda has no server for you to manage. Amazon ECS on Fargate. Not this one. With Fargate, AWS runs and patches the servers under your containers. Amazon API Gateway. Not this one. It is a managed front door with nothing to patch.
Learn it: EC2 (Elastic Compute Cloud) · ECS and Fargate · Lambda
Question 72 In Amazon ECS, what is a running copy of a container (or a group of containers that run together) called?
Choose one answer Learn it: ECS and Fargate
Question 73 Todo.io has packaged its app as a container. It wants to run it without managing any EC2 servers. What should it use?
Choose one answer Amazon ECS with the Fargate launch type. Correct. With Fargate, AWS runs the servers under your tasks; you only say how much CPU and memory each task needs. Amazon ECS with the EC2 launch type. Not this one. Then the containers run on EC2 instances you manage. One large EC2 instance with Docker installed. Not this one. That is a server to patch and a single point of failure. An SQS queue. Not this one. A queue passes messages; it doesn't run containers.
Learn it: ECS and Fargate
Question 74 Code inside Todo.io's ECS task must send messages to SQS. Which role should be allowed sqs:SendMessage?
Choose one answer The task role. Correct. The task role is what your code may do. Its credentials are served inside the task. The task execution role. Not this one. That is what ECS itself needs to start the task: pull the image and ship logs. An instance profile on an EC2 host. Not this one. On Fargate there is no host of yours, and the task role keeps permissions per task. A service-linked role. Not this one. Those belong to AWS services, and you can't add permissions to them.
Learn it: ECS and Fargate · IAM role
Question 75 A Fargate task fails to start because ECS can't pull the container image or create its log stream. Which role is missing permissions?
Choose one answer The task execution role. Correct. ECS uses the execution role to pull the image and send logs on your behalf, before your code runs. The task role. Not this one. The task role is only used by your code once the task is running. The root user. Not this one. Root is never involved in starting tasks. The developer's IAM Identity Center role. Not this one. The task starts long after the developer clicked deploy, using its own roles.
Learn it: ECS and Fargate
Question 76 What does each Fargate task get in Todo.io's VPC?
Choose one answer Learn it: ECS and Fargate · ENI
Question 77 Todo.io runs containers on ECS with Fargate. Who patches the operating system of the servers the tasks run on?
Choose one answer AWS. Correct. With Fargate the servers are AWS's. You still own what is inside your container image. Todo.io. Not this one. Todo.io never sees those servers. Nobody; they are never patched. Not this one. AWS patches them. The container, at start-up. Not this one. Containers don't patch the server they run on.
Learn it: ECS and Fargate
Question 78 How does output from Todo.io's containers on Fargate reach CloudWatch Logs?
Choose one answer Through the awslogs log driver set in the task definition, using the task execution role. Correct. Each container's output goes to a log stream in a log group you choose. Through CloudTrail. Not this one. CloudTrail records AWS API calls, not container output. By installing the CloudWatch agent on the host. Not this one. With Fargate you have no host to install anything on. By connecting to each task and copying the files. Not this one. There is no need; the log driver ships output as it happens.
Learn it: ECS and Fargate · CloudWatch Logs
Question 79 Todo.io's ECS service is set to keep two tasks running. One task crashes. What happens?
Choose one answer ECS notices and starts a replacement, so two tasks are running again. Correct. An ECS service keeps the number of tasks you asked for, replacing any that stop. Nothing, until someone starts a new task by hand. Not this one. Keeping the desired count is what an ECS service is for. ECS restarts the server under every task. Not this one. It only replaces the task that stopped. ECS emails the team and waits. Not this one. It replaces the task by itself. (You can still set up alarms.)
Learn it: ECS and Fargate
Question 80 Todo.io's monthly export takes about 40 minutes. Which compute choice can run it in one go without managing servers?
Choose one answer A task on ECS with Fargate. Correct. Tasks run as long as they need to. Lambda stops at 15 minutes. A Lambda function with a 40-minute timeout. Not this one. The longest a Lambda function can run is 15 minutes. API Gateway. Not this one. It passes requests to backends; it doesn't run jobs. An SQS queue. Not this one. A queue holds the job; something else still has to run it.
Learn it: Lambda · ECS and Fargate
Question 81 Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?
Choose one answer A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it. Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.) An outbound rule in the task's security group. Not this one. Security groups allow outbound traffic by default; the problem is the missing route. A public IP on each task, left in the private subnet. Not this one. A public IP is useless without a route to the internet gateway. More permissions on the task role. Not this one. A permission problem returns AccessDenied, not a timeout.
Learn it: NAT gateway · IAM policy
Question 82 Todo.io's Lambda function processes large uploads and always stops at exactly 15 minutes, unfinished. What is the right fix?
Choose one answer Learn it: Lambda
Question 83 How is Todo.io billed for a Lambda function?
Choose one answer Per request, and for how long each run takes (by the millisecond, scaled by its memory size). Correct. No requests, no compute charge: you never pay for an idle server. Per hour while the function exists. Not this one. An unused function costs nothing to keep. A flat monthly fee per function. Not this one. There is no flat fee. Per GB of code stored only. Not this one. Requests and run time are what you pay for.
Learn it: Lambda
Question 84 Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?
Choose one answer Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB. Correct. With no VPC there are no subnets or security groups involved; IAM decides. No. It needs a NAT gateway first. Not this one. NAT is only needed once a function is attached to a VPC. No. Every function must be in a VPC to reach AWS services. Not this one. The default, outside a VPC, already reaches them. Only if the function has a public IP. Not this one. Lambda functions don't get IP addresses you manage.
Learn it: Lambda · DynamoDB
Question 85 When should Todo.io attach a Lambda function to its VPC?
Choose one answer When it needs to reach something private inside the VPC, such as the RDS database. Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources. Whenever it needs the internet. Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway. To make it run faster. Not this one. Speed comes from memory size, not from the VPC. Always; IAM only works inside a VPC. Not this one. IAM has nothing to do with VPCs.
Learn it: Lambda
Question 86 How many execution roles does a Lambda function have?
Choose one answer Exactly one. Its permissions are everything the function's code can do in AWS. Correct. Give that one role only what the function needs. One per caller. Not this one. Who may call the function is set by its resource-based policy, not by extra roles. One per run. Not this one. Every run uses the same role. None. Functions get permissions from the account. Not this one. Nothing gets permissions just by being in an account.
Learn it: Lambda · IAM role
Question 87 Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?
Choose one answer Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents). Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role. Lambda can't send logs anywhere. Not this one. It sends them to CloudWatch Logs by default. The CloudWatch agent isn't installed. Not this one. The agent is for EC2. Lambda needs nothing installed. CloudTrail is turned off. Not this one. CloudTrail records API calls; it isn't where function output goes.
Learn it: Lambda · CloudWatch Logs
Question 88 Todo.io's worker is a Lambda function that handles messages from an SQS queue. How do the messages reach the function?
Choose one answer Lambda polls the queue for you (an event source mapping) and runs the function with each batch. Correct. SQS never pushes. Lambda does the polling, so you don't write any. SQS pushes each message to the function. Not this one. SQS only hands out messages to whoever asks. The team writes a scheduled job that copies messages to the function. Not this one. The event source mapping already does this. Through API Gateway. Not this one. API Gateway is for HTTP requests, not for queues.
Learn it: Lambda · SQS
Question 89 A Lambda function with a 60-second timeout processes an SQS queue whose visibility timeout is 30 seconds. Some messages are processed twice. What is the fix?
Choose one answer Raise the queue's visibility timeout well above the function's timeout; AWS suggests at least six times. Correct. A message becomes visible again after 30 seconds, while the first run is still working on it, so a second run picks it up. Shorten how long the queue keeps messages. Not this one. Retention is how long unread messages wait; it doesn't cause repeats. Add a dead-letter queue. Not this one. A DLQ catches messages that keep failing. These ones succeed, just twice. Lower the function's memory. Not this one. That only makes each run slower, which makes it worse.
Learn it: Lambda · SQS (Simple Queue Service)
Question 90 Todo.io moves its API to Lambda. Which of these is still Todo.io's job?
Choose one answer The function's code and the permissions in its execution role. Correct. AWS runs the servers, the operating system and the scaling. What your code does, and what it is allowed to do, stay yours. Patching the operating system. Not this one. With Lambda there is no operating system for you to patch. Adding servers when traffic grows. Not this one. Lambda scales by itself. Replacing failed hardware. Not this one. Hardware is always AWS's job.
Learn it: Lambda
Question 91 Every morning at 9:00, thousands of Todo.io users add todos within a few minutes. The app writes each todo straight to its database, which can't keep up, and some saves fail. No todo may be lost. What should Todo.io do?
Choose one answer Learn it: SQS (Simple Queue Service) · Design Todo.io with the Queue add-on
Question 92 A teammate created Todo.io's RDS database while the console was set to eu-west-1. The app runs in us-east-1 and can't find the database. Why?
Choose one answer Learn it: Region · Set up AWS: Wrong Region
Question 93 Todo.io's worker reads jobs from a standard SQS queue. Very rarely, a todo is counted twice in a user's stats. What is the most likely cause, and the right fix?
Choose one answer Learn it: SQS (Simple Queue Service) · Design Todo.io with the Queue add-on
Question 94 What does Amazon RDS do for Todo.io that running MySQL on its own EC2 instance would not?
Choose one answer Learn it: RDS (Relational Database Service)
Question 95 Todo.io's app can't connect to its RDS MySQL database: the connection times out. The password is correct. What is the most likely cause?
Choose one answer The database's security group doesn't allow inbound TCP 3306 from the app. Correct. A silent timeout is what a security group does with traffic it doesn't allow. The app's IAM role lacks permission to run SQL. Not this one. Connections to MySQL on RDS use a database username and password, and a wrong one is refused, not timed out. CloudTrail is blocking the connection. Not this one. CloudTrail only records; it never blocks. The database needs a public IP. Not this one. The app is in the same VPC and uses the private IP.
Learn it: Security group · RDS (Relational Database Service)
Question 96 In Todo.io's Level 0 setup, how does the app prove who it is to its RDS MySQL database?
Choose one answer With a database username and password, over a normal connection on port 3306. Correct. RDS is connected to like any MySQL server. Keeping that password out of code is a Level 1 topic. Every SQL query is an HTTPS call signed with IAM, like DynamoDB. Not this one. That is how DynamoDB works, not MySQL. It doesn't; anything inside the VPC may connect. Not this one. The security group decides who may reach it, and the database still checks credentials. With the root user's access keys. Not this one. Root keys should never exist, and MySQL doesn't use them.
Learn it: RDS (Relational Database Service)
Question 97 Todo.io is creating a single-AZ RDS database, but its DB subnet group must include subnets in at least two Availability Zones. Why?
Choose one answer So a standby in another Availability Zone can be added later without rebuilding. Correct. RDS insists on two AZs up front, even if you only use one today. Because the data is split across both AZs. Not this one. A single-AZ database keeps its data in one AZ. Because it is cheaper. Not this one. The subnet group costs nothing either way. So the database gets a public IP. Not this one. Public access is a separate setting, and a bad idea here.
Learn it: RDS (Relational Database Service) · Subnet
Question 98 Someone ran DELETE FROM todos on Todo.io's RDS database. Will CloudTrail show who did it?
Choose one answer No. CloudTrail records AWS API calls, not the SQL run inside a database. The database's own logs would show it. Correct. CloudTrail would show CreateDBInstance or DeleteDBInstance, never what happens inside. Yes. CloudTrail records every SQL statement. Not this one. It never sees inside the database. Yes, but only with AWS Config turned on. Not this one. Config records resource settings, not queries. Yes, in CloudWatch metrics. Not this one. Metrics are numbers, such as connections or CPU, not who ran what.
Learn it: RDS (Relational Database Service) · CloudTrail
Question 99 After Todo.io created its first RDS database, a role named AWSServiceRoleForRDS appeared. What is it?
Choose one answer A service-linked role that RDS uses to manage things like network interfaces for your databases. Correct. The service owns it: you can't change its permissions, and it only trusts RDS. A role someone created by mistake, which should be deleted. Not this one. RDS needs it. You can only delete it once RDS no longer uses it. The role the app uses to connect to the database. Not this one. The app connects with a database username and password. A role from IAM Identity Center. Not this one. Those are named AWSReservedSSO_…
Learn it: Service-linked role
Question 100 A developer can create RDS databases, but creating one with an Enhanced Monitoring role fails with AccessDenied. What is missing?
Choose one answer Learn it: iam:PassRole
Question 101 Todo.io needs reports that join users, todos and tags with SQL. Which service fits?
Choose one answer Amazon RDS, a relational database. Correct. Joins across related tables are what relational databases are built for. Amazon DynamoDB. Not this one. DynamoDB finds items by key and has no SQL joins. Amazon S3. Not this one. S3 stores files, not related tables. Amazon SQS. Not this one. SQS holds messages waiting to be processed.
Learn it: RDS (Relational Database Service) · DynamoDB
Question 102 Unlike DynamoDB, where does an Amazon RDS database run?
Choose one answer Inside your VPC, in your subnets, with security groups deciding who can connect. Correct. DynamoDB is reached through a public AWS endpoint instead. Outside the VPC, behind a public AWS endpoint. Not this one. That describes DynamoDB. Only in your own data centre. Not this one. RDS runs in AWS. Inside the Lambda function that uses it. Not this one. Databases run on their own; functions connect to them.
Learn it: RDS (Relational Database Service) · VPC (Virtual Private Cloud)
Question 103 How does Todo.io's app read and write DynamoDB?
Choose one answer Learn it: DynamoDB
Question 104 Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?
Choose one answer The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN. Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it. The table's security group. Not this one. DynamoDB has no security groups. The database password. Not this one. DynamoDB has no passwords; requests are signed with IAM credentials. The table is full and must be resized. Not this one. A full-table problem wouldn't be AccessDenied.
Learn it: DynamoDB · IAM policy
Question 105 Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?
Choose one answer Out through the internet gateway to DynamoDB's public AWS endpoint. Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet. Straight to the table inside the VPC. Not this one. Tables don't live in your VPC. Through the RDS database. Not this one. RDS and DynamoDB are unrelated. Through an SQS queue. Not this one. Queues pass messages between your own components.
Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway
Question 106 Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?
Choose one answer A VPC gateway endpoint for DynamoDB. Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing. A NAT gateway. Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint. A public IP on every instance. Not this one. That puts more traffic on the internet, not less. Move the table into the VPC. Not this one. DynamoDB tables can't be placed in a VPC.
Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway
Question 107 How should Todo.io design a DynamoDB table so that reads are fast?
Choose one answer Around how it will read the data, so each read finds items by their key. Correct. DynamoDB finds items by key. Plan your keys from your queries, not the other way round. Like a relational schema, and join tables when reading. Not this one. DynamoDB has no joins. Any way at all, then scan the whole table each time. Not this one. Scans read everything, which is slow and expensive as tables grow. One item per table. Not this one. A table holds many items.
Learn it: DynamoDB
Question 108 A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?
Choose one answer None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides. Correct. Security groups only exist on network interfaces in a VPC. The VPC's default security group. Not this one. The function isn't in the VPC. The DynamoDB table's security group. Not this one. Tables have no security groups. The NAT gateway's security group. Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.
Learn it: DynamoDB · Security group
Question 109 Todo.io needs to store login sessions: millions of them, always looked up by session id, never joined to anything. Which service fits best?
Choose one answer Amazon DynamoDB. Correct. Lookups by key at any scale, with no server to run. Amazon RDS for MySQL. Not this one. It works, but you size and run a database server for something a key-value table does better. Amazon S3. Not this one. S3 stores files; it isn't built for fast small lookups. Amazon SQS. Not this one. A queue hands each message to one consumer once; it isn't a store you look things up in.
Learn it: DynamoDB
Question 110 With DynamoDB, which of these does Todo.io manage?
Choose one answer Its tables, their keys, and who may access them. Correct. There are no servers. Data design and access are yours. The size of the database server. Not this one. There is no server to size. Operating system patches. Not this one. AWS runs everything underneath. A DB subnet group. Not this one. That is RDS. DynamoDB doesn't live in your subnets.
Learn it: DynamoDB
Question 111 Todo.io created its Todos table in us-east-1. An app in eu-west-1 calls DynamoDB in eu-west-1 and gets ResourceNotFoundException. Why?
Choose one answer Tables are regional: Todos only exists in us-east-1. Correct. Call the us-east-1 endpoint, or copy the data across Regions (later levels). IAM blocks calls between Regions. Not this one. IAM is global, and this is "not found", not "denied". DynamoDB tables only exist in us-east-1. Not this one. You can create tables in any Region; this one was created in us-east-1. The table is still copying to eu-west-1. Not this one. Nothing is copied between Regions unless you set it up.
Learn it: Region · DynamoDB
Question 112 A policy should cover only the Todos table, in us-east-1, in account 111122223333. Which Resource is right?
Choose one answer arn:aws:dynamodb:us-east-1:111122223333:table/TodosCorrect. Service, Region, account ID, then table/ and its name. arn:aws:s3:::TodosNot this one. That is the ARN of an S3 bucket named Todos. TodosNot this one. Policies name resources by ARN, not by bare name. arn:aws:dynamodb:::TodosNot this one. DynamoDB ARNs include the Region and account, and the table/ prefix.
Learn it: ARN (Amazon Resource Name)
Question 113 Todo.io creates a bucket named todoio-pictures in eu-west-1. Which statement is true?
Choose one answer No one else in any AWS account can use that name, and the bucket's data lives in eu-west-1. Correct. Bucket names are globally unique, but every bucket lives in one Region. The name only has to be unique within Todo.io's account. Not this one. Names are unique across all of AWS. The bucket exists in every Region. Not this one. It lives in the Region you created it in. The name only has to be unique within eu-west-1. Not this one. Names are unique across every Region.
Learn it: S3 (Simple Storage Service)
Question 114 What kind of storage is Amazon S3?
Choose one answer Learn it: S3 (Simple Storage Service)
Question 115 Is Amazon S3 inside Todo.io's VPC?
Choose one answer No. S3 is a public AWS service; traffic reaches it through the internet gateway, a NAT gateway or a gateway endpoint. Correct. Like DynamoDB and SQS, S3 sits outside every customer VPC. Yes. Each subnet has its own copy of every bucket. Not this one. Buckets live in a Region, not in subnets. Only in private subnets. Not this one. S3 isn't in any of your subnets. Only Lambda can reach S3. Not this one. Anything with permission and a network path can.
Learn it: VPC (Virtual Private Cloud) · S3
Question 116 Todo.io creates a new S3 bucket and changes no settings. Can someone on the internet read its objects?
Choose one answer No. New buckets are private, with Block Public Access turned on. Correct. Making anything public takes deliberate steps, which Level 1 covers. Yes, anyone with the URL. Not this one. Nothing in a new bucket is public. They can list the objects but not read them. Not this one. They can do neither. Only from us-east-1. Not this one. Where the reader is doesn't matter; the bucket is private.
Learn it: S3 (Simple Storage Service)
Question 117 Todo.io's pictures grow by about 1 TB a month. What must Todo.io do about S3 capacity?
Choose one answer Nothing. S3 grows as you add objects, and you pay for what you store. Correct. There is no size to choose and no disk to fill. Choose a bucket size and enlarge it each month. Not this one. Buckets have no size setting. Create a new bucket for every terabyte. Not this one. One bucket can hold any amount of data. Ask AWS for more capacity each month. Not this one. Storage isn't something you request.
Learn it: S3 (Simple Storage Service)
Question 118 In S3, what is an object's key?
Choose one answer Its full name inside the bucket, such as pictures/u-123/avatar.png. Correct. Bucket plus key identifies one object. The slashes are just part of the name. The encryption key that protects it. Not this one. Encryption keys are a separate topic (Level 1). The access key used to upload it. Not this one. Access keys are credentials, not object names. The Region the object is stored in. Not this one. The Region belongs to the bucket.
Learn it: S3 (Simple Storage Service)
Question 119 Todo.io's auditors ask who downloaded a file from an S3 bucket last week. CloudTrail is on with its default settings. Will it have that?
Choose one answer No. Object reads are data events, which CloudTrail doesn't log by default. They have to be turned on. Correct. By default CloudTrail logs management events, such as creating a bucket, not every object read. Yes. CloudTrail logs every object read by default. Not this one. Only management events are logged by default. Yes, in CloudWatch Logs. Not this one. CloudWatch Logs holds what applications print, not who read an object. No. S3 object reads can never be recorded. Not this one. They can, once CloudTrail data events are turned on.
Learn it: CloudTrail
Question 120 A teammate asks what controls who can read objects in an S3 bucket. Which answer is right?
Choose one answer IAM policies on the caller, and the bucket policy on the bucket itself (a resource-based policy). Correct. The bucket policy names who may use the bucket. Block Public Access can override any rule that would make it public. A security group on the bucket. Not this one. Buckets have no security groups. The subnet the bucket is in. Not this one. Buckets aren't in subnets. IAM Identity Center. Not this one. Identity Center gives people roles in accounts; it doesn't set bucket permissions.
Learn it: S3 (Simple Storage Service) · IAM policy
Question 121 Which of Todo.io's data belongs in S3?
Choose one answer Profile pictures and other uploaded files. Correct. Whole files read and written as one piece are what object storage is for. Todo rows that reports join with users and tags. Not this one. Related rows and joins belong in a relational database such as RDS. Jobs waiting for a worker. Not this one. Work waiting to be done belongs in a queue such as SQS. Login sessions looked up by id thousands of times a second. Not this one. Fast lookups by key belong in DynamoDB.
Learn it: S3 (Simple Storage Service)
Question 122 What is the ARN of an S3 bucket named todoio-pictures?
Choose one answer arn:aws:s3:::todoio-picturesCorrect. Bucket names are globally unique, so S3 bucket ARNs leave out the Region and the account ID. arn:aws:s3:eu-west-1:111122223333:todoio-picturesNot this one. Most ARNs have a Region and account; S3 bucket ARNs don't. s3://todoio-picturesNot this one. That is the address the CLI uses, not an ARN. arn:aws:s3:::bucket/todoio-picturesNot this one. There is no bucket/ prefix.
Learn it: ARN (Amazon Resource Name) · S3
Question 123 What does it mean that an SQS queue decouples Todo.io's app from its worker?
Choose one answer Learn it: SQS (Simple Queue Service)
Question 124 Todo.io's worker is down for three days. Messages keep arriving in its standard SQS queue, which uses the default settings. What happens to them?
Choose one answer They wait in the queue. The default retention is 4 days, and it can be raised to 14. Correct. When the worker comes back, it works through the backlog. They are lost after a few minutes. Not this one. Messages stay until they are deleted or their retention runs out. They are sent back to the app. Not this one. Queues never return messages to the sender. They go straight to the dead-letter queue. Not this one. A DLQ only receives messages that were received and failed too many times.
Learn it: SQS (Simple Queue Service)
Question 125 Todo.io's worker receives a message, then crashes before deleting it. What happens to the message?
Choose one answer Once the visibility timeout passes, it becomes visible again and is retried. Correct. A received message is only hidden, not removed. Deleting it is the worker's way of saying "done". It is lost, because it was already received. Not this one. Receiving only hides it for a while. It was deleted automatically when it was received. Not this one. Only the worker deletes messages. It goes straight to the dead-letter queue. Not this one. Only after failing maxReceiveCount times.
Learn it: SQS (Simple Queue Service)
Question 126 One malformed message makes Todo.io's worker fail every time, so it is retried forever. How should Todo.io deal with messages like this?
Choose one answer Learn it: Dead-letter queue (DLQ)
Question 127 Todo.io's source queue is a FIFO queue. What kind of queue can be its dead-letter queue?
Choose one answer A FIFO queue. Correct. A DLQ must be the same type as its source queue. A standard queue. Not this one. A FIFO queue needs a FIFO DLQ. Any queue in the account. Not this one. The types must match. A CloudWatch log group. Not this one. A DLQ is always another SQS queue.
Learn it: Dead-letter queue (DLQ)
Question 128 Events about each todo must be processed in exactly the order they happened, and only once. Which queue fits?
Choose one answer A FIFO queue. Correct. FIFO queues keep strict order and process each message exactly once. A standard queue. Not this one. Standard queues are faster, but can deliver out of order and occasionally twice. A standard queue with a longer visibility timeout. Not this one. That reduces retries, but promises nothing about order. A dead-letter queue. Not this one. A DLQ is where failed messages go, not a way to keep order.
Learn it: SQS (Simple Queue Service)
Question 129 Todo.io's app gets AccessDenied when it calls SendMessage on its queue. What should be fixed?
Choose one answer The app's role needs a policy allowing sqs:SendMessage on the queue's ARN. Correct. Sending to a queue is an AWS API call, approved by IAM. The queue's security group. Not this one. Queues have no security groups. The queue is full and must be emptied. Not this one. A full queue isn't the cause of AccessDenied. The visibility timeout. Not this one. That affects receiving, not sending.
Learn it: SQS (Simple Queue Service) · IAM policy
Question 130 Todo.io moves "send a welcome email" out of sign-up and into a queue with a worker. What changes for a user who signs up?
Choose one answer Sign-up answers sooner; the email is sent a moment later in the background. Correct. The slow part no longer sits between the user and their response. Sign-up takes longer, because of the queue. Not this one. Dropping a message in a queue is quick. Sign-up fails whenever the email worker is down. Not this one. The message waits in the queue until the worker is back. The email is guaranteed to arrive before the sign-up page loads. Not this one. It is sent afterwards; that is the point.
Learn it: SQS (Simple Queue Service)
Question 131 Todo.io's staging database was deleted at 3 a.m. last night. Which service shows who deleted it, and from which IP address?
Choose one answer Learn it: CloudTrail · Set up AWS: Create the database
Question 132 Todo.io never created a CloudTrail trail. Can it still see who changed a security group yesterday?
Choose one answer Yes. CloudTrail Event history keeps 90 days of management events in each Region, with no setup. Correct. A trail is for keeping events longer, or in one place. No. Nothing is recorded until a trail exists. Not this one. Event history is always on. Only if AWS Config is turned on. Not this one. Config records settings; CloudTrail records who made the call. Only for changes made by the root user. Not this one. Every caller is recorded.
Learn it: CloudTrail
Question 133 Todo.io must keep a record of every AWS API call for seven years. What does it need?
Choose one answer A CloudTrail trail that delivers events to an S3 bucket, kept for seven years. Correct. A trail saves events to S3 for as long as you choose. Event history alone stops at 90 days. Set Event history to keep seven years. Not this one. Event history is fixed at 90 days. CloudWatch metrics. Not this one. Metrics are numbers over time, not a record of API calls. AWS Config. Not this one. Config records how resources are set up, not every API call.
Learn it: CloudTrail
Question 134 Todo.io wants one trail that records every account and every Region in its organization. What should it create?
Choose one answer An organization trail, from the management account. Correct. One trail covers every account and Region, including accounts added later. A trail in each account, one by one. Not this one. That works, but every new account needs one, and each account could switch its own off. An IAM Identity Center permission set. Not this one. Permission sets give people access; they don't record anything. An SCP. Not this one. SCPs limit what can be done; they record nothing.
Learn it: CloudTrail
Question 135 Someone tried to delete Todo.io's audit bucket, and IAM denied it. Does CloudTrail record the attempt?
Choose one answer Yes. CloudTrail records failed calls too, with the error. Correct. Denied attempts are often the most interesting events in an investigation. No. Only successful calls are recorded. Not this one. Failed calls are recorded too. Only if the attempt was made in the console. Not this one. Console, CLI and SDK calls are all recorded. Only if the caller used MFA. Not this one. Every call is recorded, with or without MFA.
Learn it: CloudTrail
Question 136 One teammate changes a setting in the console, another with the CLI, and the app with the SDK. Which does CloudTrail record?
Choose one answer All three. They all end up as the same signed AWS API call. Correct. That is why CloudTrail can see everything done to AWS, however it was done. Only the console change. Not this one. The console just makes API calls for you. Only the CLI change. Not this one. The CLI is one of three ways to make the same call. The console and CLI changes, but not the app's. Not this one. SDK calls are API calls too.
Learn it: CloudTrail · Set up AWS: Create the database
Question 137 A bucket policy changed overnight. Which service tells Todo.io who changed it?
Choose one answer AWS CloudTrail. Correct. It records the PutBucketPolicy call: who made it, when and from where. AWS Config. Not this one. Config shows what the policy looked like before and after, not who made the call. Amazon CloudWatch Logs. Not this one. Logs hold what applications print. IAM Identity Center. Not this one. Identity Center handles sign-in; it doesn't record API calls.
Learn it: CloudTrail · AWS Config
Question 138 An administrator in Todo.io's Dev account tries to turn off the organization trail. What happens?
Choose one answer They can't. Member accounts can see an organization trail but can't change or stop it. Correct. Only the management account (or a delegated administrator) controls the organization trail. It stops for every account in the organization. Not this one. Member accounts can't touch it. It stops, but only for the Dev account. Not this one. Member accounts can't switch it off for themselves either. Only the Dev account's root user can stop it. Not this one. Root in a member account can't change it either.
Learn it: CloudTrail
Question 139 What does AWS CloudTrail record?
Choose one answer AWS API calls: who made them, what they did, when, and from where. Correct. "Who did what to AWS" is CloudTrail's answer. What applications print. Not this one. That is CloudWatch Logs. CPU and memory use over time. Not this one. That is CloudWatch metrics. How each resource is configured, over time. Not this one. That is AWS Config.
Learn it: CloudTrail
Question 140 Todo.io looks in CloudTrail Event history in us-east-1 for a call made in eu-west-1, and can't find it. Why?
Choose one answer Event history is kept per Region; switch the console to eu-west-1 to see it. Correct. A multi-Region trail collects every Region in one place. Calls made in eu-west-1 aren't recorded. Not this one. They are recorded, in eu-west-1. Event history only records global services. Not this one. It records management events from regional services too. Events are deleted after one day. Not this one. Event history keeps 90 days.
Learn it: CloudTrail · Region
Question 141 A user reports an error. Todo.io's engineers want to read what the app printed while handling that request. Where do they look?
Choose one answer Learn it: CloudWatch Logs
Question 142 In CloudWatch Logs, what holds the logs for one app or one Lambda function?
Choose one answer A log group, with log streams inside it. Correct. You set retention and permissions on the log group. A bucket. Not this one. Buckets are S3. A trail. Not this one. Trails are CloudTrail. An organizational unit. Not this one. OUs group AWS accounts.
Learn it: CloudWatch Logs
Question 143 Todo.io's logs are kept forever by default, and the bill keeps growing. It only needs 30 days. What should it do?
Choose one answer Set each log group's retention to 30 days. Correct. CloudWatch Logs then deletes older events for you. Delete old log lines by hand each month. Not this one. Retention does it automatically. Change CloudTrail's retention. Not this one. CloudTrail is a different service. Attach an SCP that limits logs. Not this one. SCPs limit API calls; they don't expire data.
Learn it: CloudWatch Logs
Question 144 Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?
Choose one answer Install the CloudWatch agent on the instance, and allow the instance's role to write logs. Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server. Nothing; EC2 sends every file automatically. Not this one. It sends nothing until the agent is set up. Turn on CloudTrail. Not this one. CloudTrail records API calls, not files on an instance. Open an inbound port on the instance. Not this one. The agent sends logs out; nothing needs to come in.
Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs
Question 145 Todo.io wants to be alerted when its app logs more than 10 ERROR lines in a minute. What should it set up?
Choose one answer A metric filter on the log group that counts ERROR lines, and a CloudWatch alarm on that metric. Correct. Logs become a number you can alarm on. A CloudTrail trail. Not this one. CloudTrail doesn't read app output. An AWS Config rule. Not this one. Config checks resource settings, not log lines. Someone reading the logs every morning. Not this one. That finds problems hours late.
Learn it: CloudWatch Logs
Question 146 An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?
Choose one answer Out through the internet gateway to CloudWatch Logs' public AWS endpoint. Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC. They stay inside the VPC; CloudWatch Logs runs in every subnet. Not this one. It runs outside every customer VPC. Through the RDS database. Not this one. Logs don't pass through databases. Through an SQS queue. Not this one. The agent sends straight to CloudWatch Logs.
Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs
Question 147 Can Todo.io's CloudWatch Logs show who deleted the staging database?
Choose one answer No. Deleting a database is an AWS API call, which CloudTrail records. CloudWatch Logs holds what apps print. Correct. Don't mix them up: CloudTrail is who did what to AWS; CloudWatch Logs is what your software said. Yes, always. Not this one. Only if something happened to print it, and AWS API calls are not printed there. Only if the CloudWatch agent is installed. Not this one. The agent ships files from an instance; it doesn't see API calls. Only in CloudWatch metrics. Not this one. Metrics are numbers, not who did what.
Learn it: CloudWatch Logs · CloudTrail
Question 148 Todo.io wants every log line from the last hour that mentions user u-123. What is the quickest way?
Choose one answer Search (or query with Logs Insights) the app's log group for the last hour. Correct. CloudWatch Logs can filter and query log events directly. Look up events in CloudTrail Event history. Not this one. CloudTrail has API calls, not app log lines. Check AWS Config. Not this one. Config has resource settings. Download every log file and search on a laptop. Not this one. It works, but it is slow and unnecessary.
Learn it: CloudWatch Logs
Question 149 Todo.io's app logs each user's password when they sign in, to help with debugging. What should Todo.io do?
Choose one answer Stop logging passwords: anyone allowed to read the log group could read them. Correct. Logs are read by many people and kept for a long time. Secrets never belong in them. Nothing; log groups are encrypted, so it is safe. Not this one. Encryption protects the stored data, not what authorised readers see. Nothing; only the root user can read logs. Not this one. Anyone whose policy allows reading the log group can. Shorten retention to one day and carry on. Not this one. For a whole day, the passwords are still exposed.
Learn it: CloudWatch Logs
Question 150 Inside a CloudWatch Logs log group, what is a log stream?
Choose one answer The sequence of log events from one source, such as one container or one Lambda instance. Correct. A log group holds many streams, one per source. Another name for a log group. Not this one. Streams sit inside a group. A CloudTrail trail. Not this one. Trails are CloudTrail. A real-time data stream for analytics. Not this one. That is a different service (Kinesis, Level 4).
Learn it: CloudWatch Logs
Question 151 Todo.io wants to see how a security group's rules looked last Tuesday, and every change since. Which service shows that?
Choose one answer Learn it: AWS Config
Question 152 A Config rule checks that no S3 bucket is public. A teammate makes a bucket public. Does the rule stop it?
Choose one answer No. Config reports the bucket as noncompliant after the change; it doesn't block it. Correct. Config is detective. You can attach a remediation that fixes it afterwards, but blocking needs a preventive control such as an SCP. Yes. Config rules block changes that break them. Not this one. Config evaluates after the fact. Yes, by deleting the bucket. Not this one. Config never deletes resources on its own. Only if CloudTrail is turned off. Not this one. CloudTrail has nothing to do with it.
Learn it: AWS Config · Control Tower controls
Question 153 What does an AWS Config rule mark each resource it checks as?
Choose one answer Compliant or noncompliant. Correct. The result shows on the Config (and Control Tower) dashboards. Allowed or denied. Not this one. That is how IAM answers requests. Public or private. Not this one. That is one thing a rule might check, not what it marks. Healthy or unhealthy. Not this one. That is how load balancers describe targets (Level 2).
Learn it: AWS Config
Question 154 AWS Config shows that a bucket became public at 14:02. Where should Todo.io look to find out who did it?
Choose one answer CloudTrail, for the call that changed the bucket around 14:02. Correct. Config says what changed and when; CloudTrail says who made the call. AWS Config again; it records the caller. Not this one. Config records the resource's settings, not the caller. CloudWatch Logs. Not this one. App output won't show who called S3. The bucket's object list. Not this one. Objects don't record who changed the bucket's settings.
Learn it: AWS Config · CloudTrail
Question 155 What are Control Tower's detective controls built from?
Choose one answer AWS Config rules. Correct. They spot problems after they happen and report them. Service control policies. Not this one. SCPs are the preventive controls. CloudFormation hooks. Not this one. Hooks are the proactive controls. IAM policies in each account. Not this one. Controls are applied across OUs, not written into each account's IAM.
Learn it: AWS Config · Controls (guardrails)
Question 156 Todo.io's auditors want ongoing evidence that every EBS volume is encrypted. What provides it?
Choose one answer An AWS Config rule that checks volume encryption, with its compliance history. Correct. Config keeps checking and keeps the record auditors need. CloudTrail Event history. Not this one. It shows calls, not whether every volume is encrypted right now. An SCP. Not this one. An SCP could block unencrypted volumes, but it produces no evidence about existing ones. A spreadsheet updated by hand. Not this one. Out of date the moment anything changes.
Learn it: AWS Config
Question 157 Which requirement points to AWS Config rather than an SCP?
Choose one answer "Report on any resource that isn't tagged with its owner." Correct. "Report on", "find out when" and "show evidence" are detective words: Config. "It must never be possible to disable CloudTrail." Not this one. "Must never" asks for a preventive control: an SCP. "Block any request outside approved Regions." Not this one. Blocking is preventive. "Prevent anyone from leaving the organization." Not this one. Preventing is preventive.
Learn it: Controls (guardrails)
Question 158 What does AWS Config record?
Choose one answer Each resource's configuration, and how it changes over time. Correct. A timeline of what each resource looked like. Only who made each API call. Not this one. That is CloudTrail. Application log lines. Not this one. That is CloudWatch Logs. Every network packet. Not this one. Config doesn't see traffic.
Learn it: AWS Config
Question 159 Todo.io turned on AWS Config in us-east-1 only. Resources in eu-west-1 aren't being recorded. Why?
Choose one answer Config records per Region; it has to be turned on in every Region Todo.io uses. Correct. Control Tower does this for you in the Regions it governs. Config is global, so this must be a bug. Not this one. Config is regional. Config doesn't work in eu-west-1. Not this one. It works in every commercial Region. Config needs CloudTrail to be on first. Not this one. They are separate services.
Learn it: AWS Config · Region
Question 160 Todo.io wants one view of compliance across all its accounts and Regions. What gives that?
Choose one answer A Config aggregator (for example in the Audit account) that collects results from every account and Region. Correct. One place to see what is noncompliant anywhere. Signing in to each account and Region in turn. Not this one. It works, but it is slow and easy to miss something. CloudTrail Event history. Not this one. It shows API calls, not compliance. IAM Identity Center. Not this one. It handles sign-in, not compliance.
Learn it: AWS Config