When an applicable IAM policy explicitly denies an allowed action, what happens?
A Access remains allowed
B The boundary is ignored
C The latest rule wins
D The request is denied
Answer: D. The request is denied. An applicable explicit Deny overrides an Allow statement.
Immediately after a successful S3 PUT, what should a GET return?
A The prior object
B The newly written object
C A partial object
D A cached error
Answer: B. The newly written object. Amazon S3 provides strong read-after-write consistency for object PUT and DELETE operations.
Under AWS shared responsibility, who protects provider data centers?
A AWS
B The customer
C The account owner
D The application team
Answer: A. AWS. AWS is responsible for security of the cloud, including its facilities and underlying infrastructure.
For an EC2 instance, who patches the guest operating system?
A AWS support
B The hardware vendor
C The customer
D The network provider
Answer: C. The customer. With EC2, customers manage the guest operating system and installed applications.
How can a service atomically record a database update and its event?
A Two independent writes
B A cache refresh
C A batch upload
D Transactional outbox
Answer: D. Transactional outbox. A transactional outbox writes the event record in the same database transaction as the business change.
When a multistep workflow needs compensating actions after failure, which pattern fits?
A Saga pattern
B Cache aside
C Blue-green release
D Circuit breaker
Answer: A. Saga pattern. A saga coordinates local transactions and uses compensating transactions when a later step fails.
During throttling, how can clients avoid synchronized retry bursts?
A Immediate retries
B Backoff with jitter
C Fixed-rate polling
D Longer timeouts
Answer: B. Backoff with jitter. Exponential backoff with jitter spreads retries and reduces contention on a recovering service.
What pattern stops calls to a repeatedly failing dependency?
A Bulkhead
B Load shedding
C Circuit breaker
D Service discovery
Answer: C. Circuit breaker. A circuit breaker temporarily blocks calls after repeated failures, limiting cascading impact.
Which control enforces request-rate limits on an API?
A Object versioning
B Route propagation
C Key rotation
D Throttling
Answer: D. Throttling. API throttling limits request rates to protect APIs and downstream services.
Given overlapping /16 and /24 routes, which route matches 10.4.2.7?
A The /24 route
B The /16 route
C Both routes equally
D The default route
Answer: A. The /24 route. VPC route tables choose the most specific matching route using longest-prefix match.
In S3 compliance mode, who can delete a protected version before expiry?
A Bucket owner
B Account root
C No user
D An IAM admin
Answer: C. No user. Compliance-mode retention prevents deletion or overwrite by any user, including the account root user.
For strict message ordering, which SQS queue type is appropriate?
A Standard queue
B FIFO queue
C Dead-letter queue
D Delay queue
Answer: B. FIFO queue. FIFO queues preserve message order and support deduplication features.
In an interface VPC endpoint, how does traffic reach the service privately?
A Public IP route
B Internet gateway
C NAT address
D Endpoint network interface
Answer: D. Endpoint network interface. Interface endpoints use endpoint network interfaces with private IP addresses.
For an IAM role, what limits an identity policy’s allowed actions?
A Permissions boundary
B Resource tag
C VPC policy
D CloudTrail trail
Answer: A. Permissions boundary. A permissions boundary sets the maximum permissions available to a user or role; effective allowed actions are constrained by both policies.
Which CloudTrail event type records S3 object-level API activity?
A Management events
B Network events
C Data events
D Insight events
Answer: C. Data events. S3 object-level operations are data events, which trails do not log by default.
Under S3 governance retention, what can permit an authorized bypass?
A A bucket rename
B Special bypass authorization
C A lifecycle rule
D A replication rule
Answer: B. Special bypass authorization. Governance retention can be bypassed by a principal with the required bypass permission.
Why do general purpose S3 buckets appear to contain folders?
A Prefixes imply hierarchy
B Each folder is a disk
C Buckets store directories
D Keys map to filesystems
Answer: A. Prefixes imply hierarchy. S3 uses a flat object-key structure; prefixes and delimiters create a folder-like view.
In a 30-day month, what downtime fits 99.9% availability?
A 4.32 minutes
B 7.2 minutes
C 72 minutes
D 43.2 minutes
Answer: D. 43.2 minutes. A 0.1% downtime budget over 720 hours is 0.72 hours, or 43.2 minutes.
How does RDS Proxy help connection-heavy applications?
A It duplicates databases
B It pools connections
C It encrypts queries
D It serves backups
Answer: B. It pools connections. RDS Proxy pools and reuses database connections, helping applications scale connection demand.
How can a private S3 object be shared temporarily without changing its bucket policy?
A Public ACL
B IAM user
C Presigned URL
D Object tag
Answer: C. Presigned URL. A presigned URL grants time-limited access using the permissions of its creator.
Which destination keeps Lambda records beyond an execution environment’s lifetime?
A Persistent external store
B Global variable
C Local /tmp only
D Container memory
Answer: A. Persistent external store. Lambda local storage is temporary; durable records belong in an external persistent service.
Why should per-request data not remain in Lambda global variables?
A They force new hosts
B They disable retries
C They stop logging
D Environments can be reused
Answer: D. Environments can be reused. Lambda may reuse an execution environment, so globals can carry state into a later invocation.
What detects when deployed resources differ from their CloudFormation template?
A Change set
B Stack policy
C Drift detection
D Resource tag
Answer: C. Drift detection. CloudFormation drift detection compares supported resources with their expected template configuration.
Compared with the first EBS snapshot, what do later snapshots capture?
A Every volume block
B Changed and new blocks
C Only deleted blocks
D The full disk image
Answer: B. Changed and new blocks. The first snapshot is full; later snapshots of the same volume are incremental.
Within an AWS member account, what does an SCP provide?
A A user login
B A direct permission grant
C A resource policy
D A maximum-permission guardrail
Answer: D. A maximum-permission guardrail. An SCP limits maximum available permissions; it does not grant permissions by itself.