Practice Test #3

Amazon GuardDuty detects suspicious activity and threats in AWS accounts; it does not provide official SOC or ISO reports. Trap: It is a security service, but the scenario asks for compliance documents, not threat findings.

AWS Security Hub aggregates security findings and checks security standards for the customer's environment, but it is not the repository for AWS audit reports. Trap: The word compliance can make Security Hub tempting, but this is about downloading official AWS reports.

AWS Shield protects applications from DDoS attacks; it does not publish or manage audit documents. Trap: Shield is security-related, but it solves availability protection, not audit evidence retrieval.

Read replicas are used primarily to scale read traffic or support some disaster recovery patterns. They do not match the requested synchronous standby and automatic AZ failover pattern. Trap: A replica sounds like a standby, but RDS read replicas are typically asynchronous and can lag behind the primary.

Blue/green deployment is for safer planned changes, such as database upgrades or deployment cutovers. It is not the RDS feature for continuous synchronous HA during an AZ outage. Trap: It can reduce downtime during planned updates, but the scenario is about unplanned infrastructure failure.

Reserved Instances are a pricing commitment for cost savings. They do not create standby databases, replication, or automatic failover. Trap: The term reserved can sound like reserved capacity, but it does not solve database availability.

Amazon AppFlow moves data between SaaS applications and AWS services. It does not install application revisions, run deployment hooks, or roll back server releases. Trap: The word automated can sound like workflow integration, but AppFlow is for data flows, not application deployments.

AWS PrivateLink provides private connectivity to services through VPC endpoints. It does not package, deploy, validate, or roll back application versions. Trap: PrivateLink can be part of a secure architecture, but the question is about release management.

Amazon EKS Distro is a Kubernetes distribution. It is not a deployment automation service for EC2 and on-premises server fleets. Trap: Kubernetes tools can deploy containers, but this question names EC2 and on-premises servers with CodeDeploy-style rollback features.

Reserved Instances can reduce cost for steady predictable EC2 usage, but they require a 1-year or 3-year commitment. Trap: The weekday schedule looks predictable, but the scenario says there is no need for long-term commitments and emphasizes interruption tolerance.

On-Demand Instances provide flexibility but are the price baseline, so they cannot deliver a 60% reduction versus On-Demand. Trap: No commitment sounds attractive, but the savings requirement is the deciding factor.

Dedicated Hosts are for physical host isolation or licensing needs, not for the lowest-cost shared EC2 capacity. Trap: Dedicated capacity can sound reliable, but the question explicitly says dedicated tenancy is not needed.

Amazon Connect is a cloud contact center service for voice and chat customer interactions. It does not analyze photos or videos for labels, faces, or moderation. Trap: Social platforms may have support workflows, but this requirement is computer vision.

Amazon Lightsail is simplified hosting for applications, instances, containers, and databases. It is not a managed ML vision service. Trap: You could host an app on Lightsail, but the question asks for the AWS service that performs the media analysis.

Amazon Personalize builds recommendations using user and item interaction data. It does not detect labels, inappropriate content, or faces in images and videos. Trap: A social app may personalize feeds, but recommendation ML is not visual content analysis.

Security groups are stateful controls attached to ENIs or instances and do not support explicit deny rules. They do not meet the stateless subnet-boundary requirement. Trap: Security groups are common firewalls, but the clues point to subnet-level ordered rules.

Traffic Mirroring copies traffic for inspection or monitoring. It does not enforce allow or deny firewall rules at the subnet boundary. Trap: Mirroring can help analyze packets, but it is not a blocking control.

An internet gateway enables internet connectivity for a VPC. It is not a rule-based subnet firewall and cannot block a specific SSH source CIDR. Trap: The question mentions inbound traffic, but the key requirement is filtering, not internet routing.

Developer Support is cheaper, but it does not provide the full set of Trusted Advisor checks across all listed categories. Trap: The startup's low monthly spend can make Developer Support look appealing, but the required Trusted Advisor coverage is too broad.

Enterprise On-Ramp can provide enhanced support, but it is a higher-cost tier than Business and is unnecessary for full Trusted Advisor checks. Trap: It sounds like a middle path to Enterprise, but the question asks for the lowest-cost plan that already meets the requirement.

Enterprise Support includes full Trusted Advisor, but it is not the lowest-cost plan and is associated with dedicated TAM engagement. Trap: It satisfies the Trusted Advisor feature, but overshoots the cost and TAM constraints.

Amazon RDS is a managed relational database service, not a NoSQL key-value/document database. It also requires more capacity and connection planning for this kind of very high-throughput gaming access pattern. Trap: RDS is managed, but the prompt clearly asks for fully managed NoSQL.

Amazon S3 is object storage, not an operational NoSQL database for leaderboards and session tracking. It does not provide DynamoDB-style item operations and conditional writes for this use case. Trap: S3 scales massively, but scale alone does not make it a low-latency database.

Amazon Redshift is a data warehouse for analytics, not a transactional NoSQL database. It is not built for per-request leaderboard updates at single-digit millisecond latency. Trap: Redshift can analyze game data later, but it is not the live session database.

AWS CloudTrail records API calls and account activity, not continuous EBS performance metrics. Trap: CloudTrail is useful for auditing who changed resources, but this question asks for throughput and write-operation alarms.

AWS Health Dashboard reports AWS service health events and account-impacting issues, not custom EC2 or EBS metric thresholds. Trap: The word alerted may sound like health notifications, but the threshold is specific to one workload's disk metrics.

AWS Trusted Advisor gives best-practice recommendations and checks, not real-time alarms on EBS write throughput or operations. Trap: Trusted Advisor includes performance guidance, but it is not the metric alarm service.