Practice Test #4

AWS Cost and Usage Reports are for detailed billing and service usage charges. They do not list IAM users, root user MFA status, password change dates, or access key status. Trap: It sounds report-oriented and can produce detailed CSV-style billing data, but the requested data is identity security posture.

Detailed Billing Reports focus on financial usage and charges, not IAM credential state. They cannot show MFA, password, or access key details for users. Trap: The phrase downloadable report is tempting, but billing reports answer cost questions, not compliance questions about IAM credentials.

AWS Cost Explorer reports visualize and analyze spending trends. They do not provide per-user IAM security fields or root user credential information. Trap: Cost Explorer is easy to use in the console, but it is scoped to costs and usage, not identity audits.

AWS Billing Conductor is used to customize billing and chargeback/showback for AWS accounts. It does not collect on-premises utilization data or create migration TCO cases. Trap: It sounds cost-related, but it is for AWS billing management after workloads are already using AWS.

The AWS Billing Console shows AWS costs, usage, budgets, and bills. It is not a discovery tool for Windows and Linux servers in data centers. Trap: A TCO case involves cost, but the console does not perform the migration assessment described.

Amazon Forecast is a machine learning service for time-series forecasting such as demand or inventory. It does not evaluate server utilization for AWS migration planning. Trap: The word forecast can sound like future cost planning, but this scenario needs an infrastructure migration TCO tool.

Rehost moves the application with minimal change, usually preserving the monolith rather than decomposing it. Trap: Lift-and-shift is a common migration answer, but the scenario asks for a new microservices architecture.

Replatform makes small cloud optimizations while keeping the core architecture largely intact. Trap: Containers can appear in replatforming, but the required service decomposition and domain boundaries go much further.

Repurchase means replacing the application with a different product or SaaS offering, not rebuilding it into custom services. Trap: It can reduce operational work, but the question describes a target custom architecture.

Avoiding overprovisioning is a capacity and cost benefit when demand is uncertain, but the prompt is mainly about quickly creating and comparing several pipeline versions. Trap: It sounds useful because the team does not want long-term infrastructure, but it does not directly address rapid experimentation with different services.

Additional Regions help with global reach, latency, and resilience. The scenario does not ask for geographic expansion. Trap: Global infrastructure is an AWS advantage, but it is not the capability that lets the team prototype three pipeline versions in 10 days.

Paying only for consumed resources reduces financial risk, but the question asks what most directly builds agility into processes and architecture. Trap: Pay-as-you-go helps prototypes financially, yet service breadth and managed services are the stronger match for fast innovation.

S3 Versioning keeps previous object versions for recovery, but it does not reduce latency or accelerate uploads from distant offices. Trap: It is an S3 capability, but the scenario is about transfer performance rather than object rollback.

S3 ACLs are for object and bucket access permissions; they do not change network routing, latency, or upload throughput. Trap: Security wording can make access controls tempting, but encryption in transit is handled by HTTPS, not ACLs.

S3 Intelligent-Tiering optimizes storage cost as access patterns change, but it does not speed up data transfer into S3. Trap: The large daily volume may suggest cost optimization, but the requirement is to minimize transfer time.

Amazon DocumentDB stores JSON-like documents and is useful for flexible document models, but it is not purpose-built for multi-hop graph traversal across connected entities. Trap: Customer and purchase records can look like documents, but the exam focus is traversing relationships between them.

Amazon Timestream is for time-series data such as metrics, telemetry, and timestamped events. It does not provide graph relationship traversal for account networks. Trap: Purchases happen over time, but the requirement is relationship discovery, not time-window analysis.

Amazon DynamoDB is a key-value and document database optimized for known access patterns. Deep 4-6 hop relationship traversal would require repeated queries and application-side logic. Trap: DynamoDB scales very well, but scale alone does not make it the best fit for graph queries.

AWS Shield protects against DDoS attacks. It does not continuously analyze CloudTrail, VPC Flow Logs, and DNS logs for account-wide suspicious behavior. Trap: Shield is a security service, but its focus is DDoS availability protection.

AWS Firewall Manager centrally manages firewall and protection policies across accounts, but it is not the threat detection service that analyzes these logs. Trap: Firewall Manager fits multi-account policy management, not 24x7 log-based detection.

Amazon Inspector scans workloads for vulnerabilities and unintended exposure. It does not provide the continuous behavioral threat detection described in the prompt. Trap: Inspector can produce security findings, but those findings are about vulnerabilities rather than suspicious activity in logs.

AWS Config can show that a bucket policy configuration changed, but it is not the primary service for per-API caller identity and source IP across the account. Trap: The word policy change sounds like configuration history, but the question asks who invoked each API call.

Amazon Rekognition analyzes images and video; it does not record or query AWS account API activity. Trap: The company is e-commerce, but there is no image analysis requirement here.

Amazon SNS can deliver notifications, but it does not create an audit trail of API calls, identities, actions, or source IP addresses. Trap: SNS might be used to alert on events, but another service must detect and log those events first.

Broad administrative access increases security and operational risk and is not a Reliability pillar design principle. Trap: Service quota increases can be part of planning, but granting everyone admin access is not how AWS recommends achieving reliability.

Putting critical components in one Availability Zone creates a single point of failure and violates the stated AZ-loss requirement. Trap: Single-AZ designs can look simpler, but simplicity does not satisfy resilience requirements.

Quota planning is useful, but increasing secondary-Region quotas before designing failover and scaling does not answer the AZ failure and surge requirements. Trap: A secondary Region sounds resilient, but the question asks for core Reliability design principles for this workload.