Practice Test #2

Amazon Kinesis is used for real-time streaming data ingestion and processing (e.g., clickstreams, telemetry, live event data pipelines). It helps build real-time analytics and event-driven architectures, but it is not a CDN and does not cache or serve large media files from edge locations to viewers. Kinesis would be relevant for processing sports events metadata, not for delivering images and video with sub-100 ms startup latency.

Amazon SQS is a fully managed message queue that decouples producers and consumers, buffers workloads, and improves reliability in distributed systems. It is not designed to deliver content to end users and provides no edge caching or global media distribution capabilities. SQS might be used behind the scenes to coordinate video processing jobs or notifications, but it cannot meet the requirement to cache and serve media close to viewers worldwide.

Amazon Route 53 is a highly available DNS service that can route users to endpoints using policies like latency-based routing, geolocation, and health checks. While it helps direct users to the best endpoint and can reduce DNS lookup time, it does not cache or deliver the actual media content at edge locations. Route 53 is often used alongside CloudFront, but it cannot replace a CDN for global caching and low-latency delivery.

Incorrect for cost-effectiveness. The ability to launch in multiple Regions quickly is an agility and resiliency feature, not primarily a cost advantage. Multi-Region architectures can actually increase cost due to duplicated resources, data transfer, and operational complexity. While speed of deployment is valuable, the question asks specifically about cost-effectiveness versus on-prem hardware economics.

Incorrect for cost-effectiveness. Faster experimentation and agility are key cloud benefits, but they are not the best cost-focused statements here. The scenario’s strongest cost drivers are variable compute demand and limited runway, which map more directly to variable pricing (OpEx) and avoiding overprovisioning. Agility can indirectly reduce costs, but it’s not the primary economic comparison in this question.

Incorrect for cost-effectiveness. AWS does not universally “handle patching” for all infrastructure; patching responsibility depends on the service (e.g., AWS patches underlying hosts for managed services, but customers patch EC2 guest OS). This is more about operational responsibility and security posture than direct cost-effectiveness. It also doesn’t address the core financial comparison of CapEx vs pay-as-you-go.

Amazon GuardDuty is a managed threat detection service that analyzes logs (e.g., VPC Flow Logs, DNS logs, CloudTrail) to identify suspicious activity and potential compromise. It helps with security operations and incident response, not with retrieving official AWS compliance audit reports like SOC 2 Type II or ISO 27001. GuardDuty findings may support your security posture, but they are not auditor-issued compliance documents.

AWS Security Hub aggregates, normalizes, and prioritizes security findings from AWS services and partner tools, and it can run security standards checks (e.g., CIS AWS Foundations Benchmark, PCI DSS). While it supports continuous compliance monitoring, it does not provide downloadable, official AWS SOC/ISO compliance reports for the AWS infrastructure. It’s about your account’s security posture, not AWS’s third-party audit artifacts.

AWS Shield is a managed DDoS protection service (Standard and Advanced) that helps protect applications running on AWS from distributed denial-of-service attacks. It focuses on availability and attack mitigation, not compliance reporting. Shield does not provide SOC 2 Type II or ISO 27001 documents; those are obtained through AWS Artifact.

This option is incorrect because 'security of the cloud' specifically refers to AWS protecting the underlying global infrastructure that runs AWS services, such as data centers, hardware, and foundational networking. Although AWS is responsible for the availability and operation of the EC2 service itself, the phrase in this option describes service uptime rather than infrastructure security. Customers are still responsible for designing resilient workloads, monitoring instance health, and configuring features such as Auto Scaling and Multi-AZ deployments, so this does not match the definition being tested.

Enforcing IAM password policies (including 90-day rotation) is a customer responsibility and falls under “security in the cloud.” IAM configuration, credential management, MFA, least privilege, and account governance are controlled by the customer. AWS provides the IAM service and its availability, but customers decide and implement the policies and operational processes for their identities.

Using third-party AWS Network Firewall partners (or even AWS Network Firewall itself) is about protecting customer workloads and VPC traffic flows—customer responsibility “in the cloud.” It does not describe AWS’s responsibility to protect the global infrastructure (data centers, physical hardware, and core networking). Network firewalls are configuration choices customers make to secure their own environments.

Incorrect. AWS provides the VPC construct and the capability to use network ACLs and security groups, but customers are responsible for configuring them according to least privilege. AWS does not know your application’s required ports, sources, or segmentation needs. This falls under “security in the cloud,” meaning customer configuration and ongoing governance.

Incorrect. Client-side encryption on mobile or desktop apps happens on customer-managed endpoints and within customer application code. AWS can provide encryption libraries, KMS, and best-practice guidance, but AWS is not responsible for implementing encryption in your client applications. This is entirely within the customer’s control and responsibility.

Incorrect. Creating and managing IAM users, groups, roles, policies, and MFA enforcement is a customer responsibility. AWS operates the IAM service and ensures its availability and durability, but the customer must define identities, permissions, and authentication requirements. Misconfigurations here are a common cause of security incidents and are explicitly “security in the cloud.”

Incorrect. Large upfront hardware purchases are a hallmark of traditional on-premises or co-located deployments (CapEx). One of the primary AWS Cloud benefits is shifting to variable, pay-as-you-go pricing (OpEx) and avoiding overprovisioning for peak demand. For a startup with uncertain growth and weekend spikes, upfront purchases increase risk and reduce flexibility.

Incorrect. Complete, direct control of badge access and camera surveillance is an on-premises/co-location benefit. In AWS, physical security of data centers is handled by AWS as part of the shared responsibility model. Customers retain control over logical security (IAM, security groups, encryption), but not direct control over facility access systems.

Incorrect. Customers choose Regions and Availability Zones for latency, compliance, and resiliency, but they do not select the exact physical buildings hosting servers. This option describes a co-location/on-premises scenario. AWS abstracts the underlying facilities while providing high availability constructs (multi-AZ, multi-Region) for architecture design.

Incorrect. AWS KMS is used to create and manage encryption keys and control cryptographic operations. It does not manage IAM user authentication credentials like console passwords. KMS might protect secrets or encrypt data, but it cannot be used to change an IAM user’s password or enforce password rotation policies.

Incorrect. AWS Resource Access Manager (RAM) is for sharing AWS resources (such as subnets, Transit Gateways, or license configurations) across AWS accounts or within an organization. It has no functionality for IAM user credential management and cannot be used to change or rotate IAM user passwords.

Incorrect. AWS Secrets Manager stores and rotates secrets like database passwords, API keys, and other application credentials, often via Lambda-based rotation. It does not integrate with IAM to change an IAM user’s console password. IAM user password rotation is handled through IAM policies, password policy, and IAM interfaces (console/CLI/API).

Amazon Detective is a security analytics service that helps investigate potential security issues by analyzing AWS logs (e.g., VPC Flow Logs, CloudTrail) and building entity behavior graphs. It is used for incident investigation and threat detection, not for estimating AWS costs. It would not help a finance team model EC2, ALB, or internet egress charges for a proposed migration.

AWS Budgets is used to set cost and usage budgets and receive alerts when actual or forecasted spending exceeds thresholds. It’s valuable after workloads run (or once Cost Explorer has data) to control spend, but it is not the best tool to create an itemized pre-deployment estimate for a new architecture. For migration planning estimates, Pricing Calculator is the correct choice.

AWS Resource Explorer helps you search and discover AWS resources across regions and accounts (inventory and governance use cases). It does not provide pricing or cost estimation capabilities. Because the question is about forecasting monthly costs for a proposed stack, a resource discovery tool is not relevant.

AWS Certificate Manager (ACM) manages SSL/TLS certificates for securing network communications (encryption in transit), such as HTTPS for load balancers, CloudFront, and API endpoints. While certificates contain public/private keys, ACM is not used to centrally manage data-at-rest encryption keys for S3 objects, EBS volumes, or RDS storage. Therefore it does not satisfy the requirement for encrypting stored data across these services.

AWS Identity and Access Management (IAM) is used to manage users, roles, and permissions, including controlling who can use KMS keys or access encrypted resources. However, IAM does not create, store, rotate, or perform cryptographic operations with encryption keys for data at rest. It is an access control service, not a centralized key management service, so it cannot meet the stated requirement by itself.

AWS Security Hub aggregates, normalizes, and prioritizes security findings from AWS services (like GuardDuty, Inspector) and partner tools, and it helps with security posture management against standards. It does not provide key creation or key lifecycle management for encryption at rest. While it can report on encryption-related controls, it cannot be used as the single service to create and manage encryption keys.