Practice Test #2

Keeping EC2 services available is related to service operation and resilience, but the question asks specifically about securing the underlying global infrastructure. Trap: Availability sounds like an AWS-owned concern, but the phrase security of the cloud is about infrastructure protection.

IAM password policies are configured and enforced by the customer, so they are security in the cloud. Trap: Password rotation is security-related, but it is not protection of AWS data centers or hardware.

Third-party firewall partners protect customer traffic and workloads, which are customer-side controls. Trap: Network firewalling sounds infrastructure-related, but here it applies to customer workloads rather than AWS global infrastructure.

Amazon Inspector finds software vulnerabilities in supported workloads such as EC2, container images, and Lambda functions. It does not provide an account-wide log of management API calls. Trap: It is a security service, but the scenario asks for API audit activity, not vulnerability findings.

AWS WAF filters and monitors HTTP or HTTPS requests to protected web applications. It does not record AWS control plane calls like IAM user creation or S3 bucket policy updates. Trap: WAF can produce web request logs, but those are application traffic logs rather than AWS account API activity logs.

AWS Config records resource configuration changes and evaluates compliance rules. It can show that a resource changed, but CloudTrail is the service built to answer who invoked a specific API. Trap: Configuration history sounds compliance-related, but the clue is about API invocation history.

Scalability means a system can handle more load, but the question is more specific: capacity must be added and removed automatically based on metrics. Trap: The traffic growth sounds scalable, but the bidirectional automated scaling clues make elasticity the better answer.

Sustainability is about reducing environmental impact and improving resource efficiency. The scenario asks for dynamic capacity management, not sustainability practices. Trap: Scaling down unused resources can help efficiency, but that is a side effect rather than the tested concept.

Operational excellence focuses on running and improving workloads through processes, monitoring, and automation. It is not the specific cloud concept for automatic capacity adjustment. Trap: Auto Scaling is operational automation, but the exam concept described by scale out and scale in is elasticity.

AWS CloudFormation is infrastructure as code for provisioning resources; it does not execute the data-processing function. Trap: CloudFormation can create Lambda functions, but it is not the compute runtime.

AWS Elastic Beanstalk deploys applications onto managed environments that typically use resources such as EC2 instances and load balancers, so it is not scale-to-zero pay-per-request compute. Trap: It reduces deployment work, but it is not the serverless function service described here.

Elastic Load Balancing distributes traffic across targets; it does not run code for each new record. Trap: A load balancer can be part of an application architecture, but it is not a compute option.

Disaster recovery game days validate runbooks and team readiness, but they do not create automatic failover or keep the REST API serving during an instance or AZ failure. Trap: Game days are a good reliability practice, but the requirement is a working automated design.

Moving primary components to us-west-2 contradicts the stated eu-west-1 Region and does not answer the Multi-AZ automatic failover requirement. Trap: A different Region may sound more resilient, but the scenario asks for availability within eu-west-1 across AZs.

A single large EC2 instance is a single point of failure and cannot survive the loss of its instance or Availability Zone. Trap: It may reduce operational complexity, but it reduces availability and violates the two-AZ requirement.

Retiring the colocation environment does reduce data center operations, but the question emphasizes that the bill varies with EC2 and S3 usage. Trap: The on-premises retirement clue is real, but it is not the primary advantage being demonstrated.

Speed and agility are about provisioning and experimenting faster. The scenario gives billing units and finance observations, not deployment speed. Trap: Cloud migration can improve agility, but no clue describes faster delivery here.

Going global in minutes means deploying to Regions around the world. The scenario does not mention global users, Regions, or latency. Trap: It is a standard AWS Cloud value proposition, but it does not match the billing clues.

AWS Control Tower manages multi-account governance and guardrails. It does not inspect or block HTTP/HTTPS requests to a website or API. Trap: Governance tools can sound security-related, but this is request-level web filtering.

Amazon Fraud Detector scores fraud risk from application events. It is not an edge web firewall and would require application integration. Trap: Blocking risky users sounds similar, but the need is deterministic country blocking without code changes.

Amazon Pinpoint is for customer engagement messages and analytics. It does not sit in the request path or block traffic by country. Trap: Pinpoint can segment audiences, but it is not an access-control service.

Amazon Aurora is a relational database for transactional and structured database workloads; storing raw 400 GB/day logs there would add unnecessary compute and database cost. Trap: Ad hoc queries can sound like SQL, but the question asks for the most cost-effective storage service for retained logs.

Amazon EFS provides shared file storage for compute workloads, but it is not the lowest-cost choice for large-scale log retention. Trap: Logs may be files, but file-system semantics are not required for this archive-style workload.

Amazon EBS is block storage attached to EC2 instances and would require volume management for tens of terabytes of retained logs. Trap: EBS stores data, but it is designed for instance-attached workloads, not a scalable, low-cost log data lake.

Dedicated Hosts provide physical EC2 servers dedicated to a customer, but they are still located in AWS Availability Zones. They do not run inside the company's colocation facility. Trap: Dedicated hardware sounds local, but Dedicated Hosts are an AWS Region option, not an on-premises extension.

Availability Zones are isolated locations within an AWS Region. They improve regional high availability but do not place AWS infrastructure inside a customer's colocation facility. Trap: AZs are part of AWS regional design, but the clue asks for workloads inside the company's own facility.

AWS Wavelength places AWS compute and storage at telecom edge locations for low-latency 5G applications. It is not the service for installing AWS infrastructure in a customer's colocation site for data residency. Trap: Wavelength is an edge service, but its target use case is telecom latency, not customer-facility residency with EC2 and EBS.