AWS Certified Cloud Practitioner (CLF-C02)

B. Budget actions

AWS Budgets Actions allow you to define automated or approval-based responses—such as applying an IAM or SCP policy, or stopping/terminating EC2 or RDS instances—when a budget threshold is exceeded. Budget alerts only send notifications and do not take direct action on resources.

C. AWS Shield Advanced

AWS Shield Standard is automatically included at no cost and protects against common infrastructure-layer DDoS attacks, but 24/7 access to the DDoS Response Team and DDoS cost protection require an AWS Shield Advanced subscription, which is a paid service.

D. IAM permissions boundary

An IAM permissions boundary is an advanced feature that sets the maximum permissions an identity-based policy can grant to a user or role; the effective permissions are the intersection of the boundary and the identity policy. SCPs apply at the AWS Organizations account level, not to individual roles within an account. Group policies and resource-based policies do not function as a permission ceiling for a single role.

B. Weighted routing

Weighted routing lets you assign relative weights to resource records, allowing traffic to be split by percentage between multiple versions of an application, ideal for canary testing or gradual rollouts.

C. AWS Config

AWS Config continuously records resource configuration changes and maintains a configuration history/timeline, letting you view a resource's state at any past point in time. CloudTrail logs API calls (who did what) but does not store configuration snapshots over time.

A. $20

Billed separately: Account A pays 30,000 × $0.023 = $690; Account B pays 40,000 × $0.023 = $920 (both under the 50,000GB tier), totaling $1,610. Combined under consolidated billing, total usage is 70,000GB: 50,000 × $0.023 = $1,150 plus 20,000 × $0.022 = $440, totaling $1,590. The savings is $1,610 − $1,590 = $20.

D. Network ACLs

Network ACLs (NACLs) operate at the subnet level, are stateless, evaluate numbered rules in order, and support both ALLOW and explicit DENY rules, unlike Security Groups which only support ALLOW rules and are stateful.

A. Business Perspective

The Business Perspective of the AWS CAF helps stakeholders such as business managers and finance ensure that cloud investments accelerate digital transformation and align with business strategy and ROI targets.

A. S3 Intelligent-Tiering

S3 Intelligent-Tiering automatically moves objects between frequent, infrequent, and archive access tiers based on changing access patterns, without operational overhead or retrieval fees, making it ideal for unpredictable workloads.

D. AWS Shield Advanced

AWS Shield Advanced provides enhanced DDoS protection, 24/7 access to the AWS DDoS Response Team (DRT), and cost protection against scaling charges resulting from DDoS attacks, whereas Shield Standard offers only basic automatic protection with no DRT access or cost protection.

C. A Region containing multiple Availability Zones

An AWS Region is a geographic area containing multiple isolated Availability Zones (AZs), each consisting of one or more discrete data centers with independent power and networking, interconnected by high-bandwidth, low-latency links.

C. In the KMS key policy of the key owner's account

KMS key policies are resource-based policies attached directly to the key and are the only mechanism that governs access to a KMS key from outside the key owner's account. To grant cross-account access, the key policy must explicitly allow the external account, which can then delegate use of the key to its own IAM principals via IAM policies. A bucket policy alone cannot grant decrypt permission on a KMS key.

C. Replace long-lived access keys with an IAM role that provides temporary credentials, or rotate the keys regularly if a role cannot be used

AWS best practice is to avoid long-lived credentials altogether by using IAM roles that provide short-term temporary credentials via STS; when access keys are unavoidable, they should be rotated regularly and unused ones removed.

D. Amazon Detective

Amazon Detective automatically collects log data from sources like GuardDuty, VPC Flow Logs, and CloudTrail, and builds a graph-based model to help security teams visualize relationships and investigate the root cause of findings. AWS Config tracks resource configuration compliance, AWS Artifact provides compliance documentation, and Trusted Advisor gives account optimization recommendations, none of which perform security investigation visualization.

D. Amazon SQS Standard queue

Amazon SQS Standard queues provide nearly unlimited throughput, at-least-once delivery, and best-effort ordering, making them ideal for decoupling applications when strict message order isn't required.

C. Place the web servers in a public subnet and the database servers in a private subnet

Public subnets have a route to an internet gateway and should host resources like web servers that need direct internet access, while private subnets lack a direct internet gateway route and are appropriate for backend resources like databases that should stay isolated from the public internet.

C. Yes, all customers have access to a core set of checks including some security checks regardless of plan

Trusted Advisor provides a limited set of core checks—covering service limits and certain security checks like S3 bucket permissions and security group rules—free to all customers regardless of support plan. Full access to all checks across cost optimization, performance, fault tolerance, and service limits requires Business or Enterprise Support.

A. It notifies stakeholders proactively before overspending actually occurs

Forecasted alerts use trend data to predict whether spend will exceed the budget by the end of the period, allowing teams to take corrective action proactively rather than after the overage has already occurred.

B. AWS Free Tier

The AWS Free Tier provides limited free usage of many services, including 750 hours/month of t2.micro EC2 usage and 5GB of S3 storage, for 12 months after account creation, as well as some always-free services. This lets new customers explore AWS at no cost within defined limits.

B. Nothing; AWS permits penetration testing on most owned services without prior approval for commonly tested services

AWS has published a policy that allows customers to perform penetration testing against their own AWS resources for a defined list of commonly tested services (including EC2 instances, NAT gateways, and ELBs) without prior approval, as long as testing complies with AWS's Acceptable Use Policy and does not target prohibited activities like DDoS simulation. There is no requirement for AWS Support to personally run the test, third-party vendor approval, or Shield Advanced purchase.

C. Envelope encryption using a data key generated and encrypted by KMS

KMS uses envelope encryption: it generates a unique data key, which is used locally to encrypt the actual data, and then the data key itself is encrypted by the KMS key (CMK) and stored alongside the ciphertext. This avoids sending large amounts of data to KMS directly, since the CMK never leaves KMS and only the small data key is encrypted/decrypted through the service.

A. AWS Network Firewall

AWS Network Firewall is a managed, stateful network firewall service designed for VPC-level traffic filtering, including intrusion prevention and detection. WAF protects web applications at the HTTP layer, Shield defends against DDoS attacks, and security groups are instance-level stateful firewalls without intrusion prevention capabilities.

C. GuardDuty Malware Protection

GuardDuty Malware Protection scans EBS volumes attached to EC2 instances or container workloads when suspicious behavior is detected, checking for malware signatures. S3 Protection monitors S3 data events, EKS Protection analyzes Kubernetes audit logs, and Threat Intelligence Feeds are data sources GuardDuty uses broadly, not a volume-scanning feature.

A. EC2 launch type

The ECS EC2 launch type requires the customer to provision and manage the underlying EC2 instances, giving full control over instance types, host-level agents, and OS configuration, unlike Fargate which abstracts away the infrastructure entirely.

A. Amazon EFS

Amazon EFS is a fully managed, scalable NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones, providing shared file storage.