Sample questions

Design Cost-Optimized Architectures

1. Log files in S3 are accessed frequently for the first 30 days, then rarely, and are kept for years. Which approach minimizes storage cost over the data's lifetime with the least ongoing effort?

• AKeep every object in S3 Standard for the entire retention period.
• BManually copy objects to cheaper classes when someone remembers to.
• CA lifecycle policy that transitions objects to cheaper classes over time.
• DDelete the logs after 30 days to avoid paying for long-term storage.

A lifecycle policy automatically transitions aging objects to lower-cost classes (for example, Standard-IA then Glacier), minimizing cost with no manual work. Keeping everything in Standard is expensive, manual copying is unreliable, and deleting violates the retention requirement.

Design Cost-Optimized Architectures

2. Long-term EBS snapshot retention is driving up storage cost. Which TWO actions reduce snapshot cost while retaining what is needed? (Select TWO.)

• AMove rarely restored snapshots to the EBS Snapshot Archive tier.
• BUse a lifecycle policy to delete snapshots past their retention period.
• CConvert every old snapshot into a full EBS volume for faster access.
• DCopy all snapshots to another Region to keep extra copies available.
• EIncrease the size of the source volumes to consolidate the snapshots.

Archiving rarely restored snapshots and deleting those past retention with a lifecycle policy both lower snapshot cost. Converting to volumes, replicating everywhere, and enlarging source volumes all increase cost.

Design High-Performing Architectures

3. A self-managed transactional database needs consistent, very high random IOPS with low latency on its EBS volume. Which EBS volume type best fits?

• AThroughput Optimized HDD (st1), designed for large sequential workloads.
• BCold HDD (sc1), designed for infrequently accessed cold data storage.
• CProvisioned IOPS SSD (io2), designed for high, consistent random IOPS.
• DA general-purpose gp2 volume left at its default baseline performance.

Provisioned IOPS SSD (io2) delivers high, consistent random IOPS with low latency for demanding transactional databases. HDD types (st1, sc1) are for sequential or cold data, and a default gp2 volume may not sustain the required IOPS.

Design Cost-Optimized Architectures

4. A company must retain compliance records for seven years, expects to almost never access them, and can tolerate hours for retrieval. Which storage option minimizes cost?

• AS3 Glacier Deep Archive, the lowest-cost class for rare, long-term data.
• BS3 Standard, which keeps the records instantly accessible at higher cost.
• CS3 Standard-IA, intended for infrequent but immediate access needs.
• DAn EBS volume kept attached to an instance for the full seven years.

S3 Glacier Deep Archive offers the lowest storage cost for rarely accessed, long-term data where hours-long retrieval is acceptable. Standard and Standard-IA cost more for instant access, and a seven-year attached EBS volume is far more expensive.

Design Cost-Optimized Architectures

5. A dataset has unpredictable, changing access patterns, and the team wants to reduce cost automatically without analyzing usage or paying retrieval fees. Which storage class fits best?

• AS3 Standard, which charges the same regardless of how often data is used.
• BS3 Glacier Flexible Retrieval, which adds retrieval time and fees per access.
• CS3 One Zone-IA, which lowers cost by removing multi-AZ redundancy.
• DS3 Intelligent-Tiering, which auto-optimizes cost as access patterns change.

S3 Intelligent-Tiering automatically moves objects between access tiers based on usage, optimizing cost with no retrieval fees for unknown patterns. Standard does not tier, Glacier adds retrieval cost and delay, and One Zone-IA trades away redundancy.

Design Secure Architectures

6. A company wants a single place to aggregate security findings from GuardDuty, Inspector, and Macie and to check accounts against standards such as CIS and AWS Foundational Security Best Practices. Which service provides this?

• AAmazon Detective, which builds graphs to investigate specific findings.
• BAWS Security Hub, which aggregates findings and runs compliance standards.
• CAWS Config, which records resource configuration changes across accounts.
• DAmazon CloudWatch, which stores metrics, logs, and alarms for the account.

Security Hub centralizes findings from multiple security services and continuously checks accounts against security standards. Detective is for investigation, Config records configuration, and CloudWatch handles metrics and logs.