Pair your devices with a code and playback position follows you: pause on this device, hit resume on the other. Position is saved to the site every minute and on pause.
Open this panel on your other device and enter the same code.
15 questions, four options each, one correct answer, no partial credit.
⚠️ Exam-styled questions written from the task statements and AWS documentation. Not the AWS Official Practice Question Set and not calibrated against real exam items. The real exam rarely asks a fundamentals question directly — these test the facts that its scenario questions lean on.
1. Which of the following is one of NIST's five essential characteristics of cloud computing?
2. A team must run a legacy application whose vendor licence requires a non-virtualized environment. They want to stay on EC2. What should they use?
3. A company's production account and a partner's account must place latency-sensitive instances in the same physical Availability Zone. Both accounts are several years old. What should the teams compare?
us-east-1ause1-az14. A disaster-recovery plan fails over to a Region that AWS launched in 2023. The Region has never been used by this account. What must be done before the failover can work?
5. A mobile gaming company needs its game servers inside a telecommunications carrier's 5G network for ultra-low latency to phones. Which AWS infrastructure fits?
6. An EC2 instance in us-east-1a fails. An engineer tries to attach its data volume to a new instance
in us-east-1b and cannot. Why?
7. Which statement about AWS's "global" services is correct, according to the AWS Fault Isolation Boundaries whitepaper?
8. A DR runbook creates new IAM roles and updates Route 53 weighted records during a Regional failover. What is the design flaw?
9. A company stores reproducible thumbnails in S3 One Zone-IA to cut cost. An architect states "S3 is Regional, so these survive an AZ failure." What's wrong?
10. Under the Shared Responsibility Model, who is responsible for patching the guest operating system of an EC2 instance?
11. A security team requires RDS instances to be on the latest OS patch level. The RDS console shows an OS update with status available and no apply date. What will happen if nobody acts?
12. A team deploys Lambda functions as container images. Who is responsible for getting runtime security patches into those functions?
13. A subnet was created without any change to its route table. Later, the team adds a route
0.0.0.0/0 → igw-… to the table associated with it. What changed?
14. A VPC was created as 10.0.0.0/16 and is running out of addresses. What is the supported way to
add capacity?
10.0.0.0/1515. A company enables DNSSEC signing on its Route 53 public hosted zone. Which statement is correct?
1 — C. NIST SP 800-145's five are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. A, B and D are three of AWS's six advantages — a different list from a different author.
2 — B. Bare metal is for "Applications that require a non-virtualized environment for licensing or support." A is still virtualized. C and D change location, not virtualization.
3 — C. For accounts created before November 2025 in the oldest Regions, AZ names are
"independently map[ped]" per account — us-east-1a "might not be the same physical location". An AZ ID
"is the same physical location in every AWS account."
4 — B. "To use a Region introduced after March 20, 2019, you must enable the Region before you can access it." D confuses opt-in Regions with a separate partition.
5 — C. Wavelength "deploys standard AWS compute and storage services to the edge of communications service providers' (CSP) networks." A Local Zone is near a metro area's users, not inside a carrier network.
6 — B. "The volume and instance must be in the same Availability Zone." EBS is zonal (A is false). Moving the data to another AZ goes through a snapshot.
7 — B. "their control plane is hosted in a single AWS Region, while their data plane is globally distributed." A is the misconception the whitepaper exists to correct. D contradicts "AWS does not provide a synchronous Cross-Region replication feature."
8 — B. IAM's control plane is in us-east-1; Route 53's control plane is in us-east-1. The whitepaper
lists "Creating or updating IAM resources… during a failover" and "changing a weighted record set's
weights, to perform failover" as anti-patterns. Pre-create the roles; fail over with data-plane
mechanisms (health checks, ARC routing controls).
9 — B. "The S3 One Zone-IA storage class stores data redundantly across multiple devices within a single Availability Zone." The other classes use "a minimum of three Availability Zones" — A is the over-generalisation. For reproducible thumbnails One Zone-IA may still be the right choice; the architect's claim is what's wrong.
10 — B. "The customer assumes responsibility and management of the guest operating system (including updates and security patches)." AWS owns the host OS.
11 — C. "An optional update can be applied at any time… RDS does not apply these updates automatically." A describes a mandatory update after its apply date.
12 — B. For container images, Lambda's responsibility is to "Publish new container images containing the latest patches"; the customer's is to "Redeploy functions regularly using the latest container base image." D applies to managed runtimes, not container images.
13 — B. "The subnet type is determined by how you configure routing"; a public subnet "has a direct route to an internet gateway." D is wrong — public IPv4 assignment is a separate subnet attribute. C is impossible: a subnet "cannot span zones."
14 — B. "You cannot increase or decrease the size of an existing CIDR block", but "you can associate additional IPv4 CIDR blocks with the VPC" that "must not overlap." D is impossible — /16 is the maximum.
15 — C. "You are responsible for KSK management… ZSK management is performed by Route 53"; the KMS key "must be in the US East (N. Virginia) Region" and asymmetric ECC_NIST_P256. A: the docs describe validating origin and integrity, not encryption. D: the chain of trust needs a DS record in the parent zone.
| Score | Read this as |
|---|---|
| 14–15 | Fundamentals are solid. Move to SAA0. |
| 11–13 | Good. Re-read the lesson behind each miss. |
| 8–10 | Redo lessons 3 and 4 — they carry the most weight into Domains 1 and 2 — then the lab. |
| < 8 | Work the module in order, do the lab, then retest. |
Miss patterns: