During an upload spike, what buffers work for later processing?
A Cache invalidation
B Read replica
C Message queue
D Shared disk
Answer: C. Message queue. A queue separates request intake from slower background processing and absorbs bursts.
Because queues may redeliver messages, what keeps repeated processing safe?
A Exactly-once storage
B Ordered polling
C Message batching
D Idempotent operation
Answer: D. Idempotent operation. An idempotent operation can be repeated without creating an adverse duplicate effect.
For a recovery plan, which target caps acceptable downtime?
A Recovery time objective
B Recovery point objective
C Service quota
D Availability target
Answer: A. Recovery time objective. RTO defines the target time for restoring a workload after disruption.
Which recovery objective limits acceptable data loss?
A Recovery time objective
B Recovery point objective
C Error budget
D Retention period
Answer: B. Recovery point objective. RPO defines the maximum acceptable amount of data loss, usually measured in time.
How does a release run full old and new environments before switching?
A Canary release
B Rolling update
C Blue-green deployment
D In-place patch
Answer: C. Blue-green deployment. Blue-green deployment runs two production environments and shifts traffic after validation.
In a gradual rollout, what sends a small traffic share to new code first?
A Canary deployment
B Blue-green deployment
C All-at-once release
D Database failover
Answer: A. Canary deployment. A canary deployment tests a new version with a small portion of traffic before wider rollout.
When investigating who called an AWS API, which log service helps?
A AWS Config
B CloudWatch
C AWS X-Ray
D CloudTrail
Answer: D. CloudTrail. CloudTrail records account activity, including many API actions and their request details.
What service records changes to supported AWS resource configurations?
A CloudTrail
B AWS Config
C AWS KMS
D CloudFront
Answer: B. AWS Config. AWS Config records configuration items when supported resources are created, changed, or deleted.
Where are threshold-based AWS metric alarms configured?
A AWS Config
B CloudTrail
C CloudWatch
D AWS Backup
Answer: C. CloudWatch. CloudWatch metric alarms watch metric values and can respond when configured thresholds are met.
How can a VPC reach an AWS service through private IPs?
A Internet gateway
B NAT gateway
C Public subnet
D VPC endpoint
Answer: D. VPC endpoint. A VPC endpoint provides private connectivity from a VPC to supported services.
Which option provides a dedicated network connection from on-premises?
A Direct Connect
B Site-to-site VPN
C VPC peering
D Internet gateway
Answer: A. Direct Connect. AWS Direct Connect establishes dedicated network connectivity between on-premises locations and AWS.
Which connection creates encrypted tunnels over the public internet?
A Direct Connect
B Transit Gateway
C Site-to-site VPN
D VPC peering
Answer: C. Site-to-site VPN. AWS Site-to-Site VPN uses IPsec tunnels over the internet for private network connectivity.
How can two VPCs connect without transitive routing?
A Transit Gateway
B VPC peering
C NAT gateway
D PrivateLink
Answer: B. VPC peering. VPC peering directly connects two VPCs but does not provide transitive routing through a third VPC.
What AWS hub connects routes among many VPCs?
A Internet gateway
B VPC peering
C NAT gateway
D Transit Gateway
Answer: D. Transit Gateway. Transit Gateway acts as a central network hub for connecting VPCs and other networks.
Which gateway supports outbound-only internet access for IPv6?
A Egress-only internet gateway
B NAT gateway
C Internet gateway
D Virtual private gateway
Answer: A. Egress-only internet gateway. An egress-only internet gateway lets IPv6 workloads initiate outbound connections while blocking inbound initiation.
For read-heavy database traffic, which replica helps scale queries?
A Standby replica
B Read replica
C Storage snapshot
D Failover target
Answer: B. Read replica. RDS read replicas can serve read-only traffic and help scale read-heavy workloads.
How does a standard Multi-AZ RDS standby primarily help?
A Read scaling
B Query caching
C Automatic failover
D Data compression
Answer: C. Automatic failover. A Multi-AZ standby provides failover support; a standard single-standby deployment does not serve read traffic.
Why use envelope encryption for stored secrets?
A One key handles all data
B Keys stay in plaintext
C It removes authorization
D A data key encrypts values
Answer: D. A data key encrypts values. Envelope encryption uses a data key for the secret value and protects that key with a KMS key.
Which AWS service can rotate stored application secrets?
A AWS Config
B Secrets Manager
C CloudTrail
D Amazon VPC
Answer: B. Secrets Manager. Secrets Manager supports managing and rotating secrets used by applications.
Where can repeatedly failing queue messages be isolated?
A Dead-letter queue
B Route table
C Read replica
D Edge cache
Answer: A. Dead-letter queue. A dead-letter queue stores messages that could not be processed successfully under the queue’s redrive policy.
What CloudFormation preview lists proposed stack changes?
A Stack policy
B Drift report
C Change set
D Resource tag
Answer: C. Change set. A CloudFormation change set shows proposed changes before they are applied to a stack.
Which S3 feature can enforce write-once retention?
A Versioning
B Lifecycle rule
C Replication
D Object Lock
Answer: D. Object Lock. S3 Object Lock can prevent deletion or overwrite for a configured retention period.
When is a received SQS message available again after processing stalls?
A Immediately
B After visibility timeout
C After a new queue
D At next deployment
Answer: B. After visibility timeout. The visibility timeout hides a received message temporarily; if it is not deleted, it can become visible again.
What disaster-recovery pattern keeps a scaled-down copy ready?
A Warm standby
B Backup only
C Cold archive
D Active-active cache
Answer: A. Warm standby. Warm standby keeps a smaller but functioning environment ready to scale up during recovery.
For regional read access, what can serve replicated RDS data nearby?
A Writer failover
B Cross-Region read replica
C Local cache only
D Standby instance
Answer: B. Cross-Region read replica. A cross-Region read replica can serve read-only queries in another Region, though replicated data may lag.