WorksheetsACT2_CONSOLIDATED_AWS_VALIDATED_2025
Total questions: 71
Worksheet time: 36mins
Name
Class
Date
1.
(G4) A developer is building a web application that serves static content (HTML, CSS, JS) directly from an Amazon S3 bucket. The developer wants to ensure users around the world experience low latency and wants to prevent direct access to the S3 bucket URL. What should the developer do to meet these requirements?
a)
Enable static website hosting on S3 and share the bucket URL directly
b)
Create a CloudFront distribution with the S3 bucket as the origin and restrict bucket access to only the CloudFront origin identity.
c)
Set the S3 bucket policy to public-read so everyone can access the content
d)
Use AWS Global Accelerator to access the S3 bucket content globally
2.
(G4) A solutions architect is designing a backup solution. The company requires that objects stored in Amazon S3 are archived automatically after 30 days and deleted 1 year after creation to reduce storage costs. What is the MOST cost-effective way to meet these requirements?
a)
Use S3 Intelligent-Tiering with automatic archival
b)
Configure an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 30 days and delete after 365 days.
c)
Use S3 Versioning and manually delete old versions with a script
d)
Set up an S3 EventBridge rule to trigger a Lambda function that moves and deletes objects
3.
(G4) A DevOps team is building a CI/CD pipeline using AWS CodePipeline. Build artifacts must be stored in Amazon S3 with strong data integrity and version control. The team also wants to ensure that older versions are retained and protected against accidental deletions. What should the team do to meet these requirements?
a)
Store artifacts in an S3 bucket with versioning and MFA Delete enabled
b)
Use an S3 Standard bucket with server-side encryption only
c)
Configure the bucket for public access with object locks
d)
Store artifacts in CodeBuild logs and export them as needed
4.
(G4) A developer is uploading large media files (>5 GB) to Amazon S3 through a web application. Users frequently experience failed uploads due to network interruptions. How can the developer ensure reliable and resumable uploads?
a)
Use the AWS CLI to upload files in parts
b)
Use S3 Transfer Acceleration
c)
Implement S3 Multipart Upload using the AWS SDK.
d)
Split the file manually and upload each chunk separately
5.
(G4) A company stores log data in Amazon S3. Analysts run Amazon Athena queries on the data, but query costs are increasing. How can a Solutions Architect reduce the cost of queries without impacting data availability?
a)
Enable S3 Object Lock on the log files
b)
Compress the logs and convert them to columnar format (e.g., Parquet).
c)
Use S3 Intelligent-Tiering to reduce storage cost
d)
Archive the logs in Glacier Deep Archive
6.
(G4) A DevOps engineer needs to automate deployments of static assets to Amazon S3. They must ensure only updated files are uploaded to reduce deployment time. What is the MOST efficient solution?
a)
Use aws s3 sync in a deployment script
b)
Upload files manually via the console
c)
Re-upload all files during every deployment
d)
Use CodeDeploy with manual scripts for each file
7.
(G4) A developer wants to give temporary access to a private S3 object for authenticated users of a web application. What is the best way to achieve this?
a)
Make the object public
b)
Use signed URLs generated by the backend using AWS SDK.
c)
Share the object key and ask users to use the AWS CLI
d)
Enable bucket logging for the object
8.
(G4) A company must ensure that deleted objects in an S3 bucket can be recovered. What should a Solutions Architect do to meet this requirement?
a)
Enable server-side encryption
b)
Enable S3 versioning.
c)
Enable object replication
d)
Use S3 Transfer Acceleration
9.
(G4) A company wants to enforce that all objects uploaded to an S3 bucket are encrypted using SSE-KMS. How can this be enforced automatically?
a)
Enable default encryption with SSE-S3
b)
Use a bucket policy that denies uploads not using SSE-KMS.
c)
Use a lifecycle rule to delete unencrypted objects
d)
Use S3 replication to copy only encrypted objects
10.
(G4) A customer wants to host a static website using Amazon S3. The website should return a custom 404 error page when a page is not found. What should the architect do?
a)
Enable static website hosting and specify the 404 page in the configuration
b)
Use CloudFront with Lambda@Edge to return the custom 404
c)
Host the site on EC2 and return the 404 page manually
d)
Enable versioning and set a default version for the 404
11.
(G7) Sarah's photo-sharing startup "SnapCloud" stores user photos in S3 and uses Lambda functions to process images. They've enabled server access logging, but after just two weeks, their 5MB bucket has grown to 50MB. Users are complaining about slow image processing performance. Question: What is the MOST likely cause of the unexpected storage growth?
a)
Cross-Region Replication is automatically enabled
b)
The bucket is storing its own access log files.
c)
Bucket encryption is consuming additional space
d)
Image thumbnails are being automatically generated
12.
(G7) "GameForge Studios" stores game assets in S3 in the ap-southeast-3 region and processes 11,000 GET requests per second during peak gaming hours. After enabling KMS encryption for compliance, players are experiencing significant lag and timeouts when downloading game content. Question: What is the MOST likely cause of the performance degradation?
a)
S3 cannot handle that many requests per second
b)
Network bandwidth limitations
c)
KMS throttling due to API request limits.
d)
S3 encryption overhead
13.
(G7) WeatherTech Inc. collects weather data from 500 weather stations across six continents. Each station generates 500GB of data daily and has high-speed internet. They need to aggregate all data into a single S3 bucket in us-east-1 for their ML models, minimizing operational complexity. Question: What is the MOST operationally efficient solution to aggregate the data quickly?
a)
Use S3 Cross-Region Replication from regional buckets
b)
Configure AWS DataSync to transfer data from each location
c)
Enable S3 Transfer Acceleration on the destination bucket.
d)
Set up AWS Direct Connect to each weather station
14.
(G7) SecureBank needs to replicate critical financial transaction logs from their primary S3 bucket in us-east-1 to a backup bucket in eu-west-1 for disaster recovery. The logs contain sensitive PII that must be encrypted with customer-managed KMS keys, and replication must complete within 15 minutes for regulatory compliance. Question: What configuration is required to meet these requirements?
a)
Enable Cross-Region Replication with S3-managed encryption
b)
Configure Cross-Region Replication with KMS encryption and S3 RTC.
c)
Use AWS Backup for cross-region S3 backup
d)
Set up AWS DataSync with encryption
15.
(G7) TechCorp has 50 AWS accounts under AWS Organizations. Their central IT team maintains project reports in an S3 bucket in the management account. They need to ensure that only users from accounts within their organization can access these reports, while external accounts are completely blocked. Question: What is the LEAST operationally complex solution?
a)
Configure IAM policies for each account
b)
Add a bucket policy with an aws:PrincipalOrgID condition.
c)
Enable AWS SSO with S3 permissions
d)
Use S3 Access Points for each account
16.
(G7) DevSecure Corp runs a CI/CD pipeline where CodeBuild projects need to deploy artifacts to multiple S3 buckets across different environments (dev, staging, prod). Security requires that each environment's CodeBuild can only access its designated S3 bucket, and all data must be encrypted at rest with environment-specific KMS keys. Question: What is the MOST secure approach to implement this requirement?
a)
Use a single IAM role with broad S3 permissions
b)
Create environment-specific IAM roles for CodeBuild with least privilege S3 and KMS.permissions
c)
Store S3 credentials in AWS Systems Manager Parameter Store
d)
Use S3 bucket policies to control access
17.
(G7) WebScale Inc. hosts a global static website using S3 and CloudFront. During their latest product launch, they experienced intermittent 503 errors and slow load times in certain regions. Their DevOps team needs to implement a solution that ensures high availability and optimal performance worldwide with automated failover capabilities. Question: What architecture provides the highest availability and best performance for their global static website?
a)
Single S3 bucket with CloudFront distribution
b)
Multi-region S3 buckets with CloudFront origin groups and health checks.
c)
S3 with Route 53 failover routing
d)
S3 with Application Load Balancer
18.
(G8) Una empresa genera 5 TB/día de logs en S3. Consulta los últimos 15 días a menudo, el resto de forma esporádica, pero debe conservar 7 años. Quiere reducir coste sin perder tiempos de recuperación razonables para auditorías trimestrales. ¿Qué combinación de clases y políticas de ciclo de vida recomiendas?
a)
Mantener todo en S3 Standard
b)
0–15 días en S3 Standard, 16–90 días a S3 Standard-IA, >90 días a S3 Glacier Deep Archive
c)
0–30 días en S3 Intelligent-Tiering, 31–365 días a S3 Glacier Flexible Retrieval, >365 días a S3 Glacier Deep Archive.
d)
0–15 días en S3 Standard, 16–180 días a S3 One Zone-IA, >180 días a S3 Glacier Instant Retrieval
19.
(G8) Un data lake en S3 debe ser accesible solo desde subredes privadas en una VPC. El equipo activó S3 Block Public Access en cuenta y bucket. ¿Cómo habilitas acceso seguro a los analistas sin exponer el bucket a Internet?
a)
Crear un endpoint S3 Gateway en la VPC y una bucket policy que permita acceso solo si aws:SourceVpce coincide.
b)
Crear un ALB con target S3
c)
Generar URLs firmadas y compartirlas
d)
Abrir el bucket a 0.0.0.0/0 y confiar en IAM
20.
(G8) Un único bucket aloja varios dominios de datos. Equipo A y B deben acceder a prefijos distintos. No quieres gestionar políticas complejas por bucket ni preasignar roles por ARN de usuario externo. ¿Qué opción simplifica y aísla acceso por aplicación?
a)
ACLs de objeto
b)
S3 Access Points con políticas por punto y restricción de prefijo.
c)
Política de bucket con NotResource
d)
Usar solo políticas IAM con condiciones por s3:prefix
21.
(G8) Usuarios globales suben archivos de 5 GB al bucket en us-east-1 y reportan latencia alta desde APAC. ¿Qué mejoras aplicarías con mínimo cambio en clientes?
a)
Activar S3 Transfer Acceleration y mantener PUT de clientes.
b)
Crear buckets por región y replicación bidireccional
c)
Migrar a S3 on Outposts
d)
Forzar multipart upload a 5 MB por parte
22.
(G8) Debes impedir borrados o sobrescrituras de registros durante 7 años por normativa, incluso por administradores. ¿Qué configuración usa S3?
a)
Versionado y MFA Delete
b)
S3 Object Lock en modo Compliance con períodos de retención y legal hold cuando aplique.
c)
S3 Object Lock en modo Governance y confiar en permisos
d)
Glacier Deep Archive sin más
23.
(G8) Un flujo manda notificaciones a SQS cada vez que llega un objeto .csv para disparar ETL. A veces el consumidor no recibe algunos mensajes por picos. Quieres durabilidad y reintentos sin perder eventos.
a)
Notificar a Lambda directamente
b)
Notificar a SNS y que SNS reenvíe a SQS
c)
Notificar a SQS estándar con una DLQ y habilitar reintentos del consumidor; usar S3 event filtering por sufijo .csv.
d)
Notificar a SQS FIFO sin DLQ
24.
(G8) Un bucket con millones de objetos usa SSE-KMS. La factura de KMS sube por llamadas de descifrado en cargas analíticas masivas. Quieres mantener KMS pero reducir coste sin cambiar ACLs.
a)
Cambiar a SSE-S3
b)
Activar S3 Bucket Keys en el bucket con SSE-KMS.
c)
Habilitar replicación y cifrar en destino con SSE-S3
d)
Usar claves KMS multi-Region
25.
(G8) Seguridad necesita un inventario diario de todos los objetos, su clase de almacenamiento, cifrado y estado de replicación para control y remediación. Debe exportarse en formato consultable.
a)
S3 Inventory diario a CSV o Parquet en otro bucket; analizar con Athena.
b)
aws s3 ls diario con cron en una instancia
c)
CloudTrail Lake
d)
EventBridge con regla diaria
26.
(G8) Un equipo de ciencia de datos carga datasets que a veces consulta de forma intensa y otras veces no los toca durante meses. No quieren gestionar reglas manuales.
a)
S3 Intelligent-Tiering con monitoreo de tamaño y exclusión de objetos pequeños cuando no convenga.
b)
Standard-IA para todo
c)
One Zone-IA para todo
d)
Glacier Instant Retrieval para todo
27.
(G5) A company needs to store encrypted backups of critical databases in Amazon S3. Compliance regulations require that encryption keys be managed within AWS, but each department must have a unique key. Additionally, audit logs of all key usage must be maintained. Which solution meets these requirements?
a)
Enable default encryption with SSE-S3 on all departmental buckets
b)
Use SSE-KMS with customer-managed CMKs for each department and enable CloudTrail logging.
c)
Use client-side encryption with department-specific keys stored in Secrets Manager
d)
Use SSE-C with keys generated on premises and manually rotated quarterly
28.
(G5) A startup uses Amazon S3 for hosting static assets of a global web application. They notice slow performance for users in Asia and South America. The company wants to improve download speed and reduce costs without creating regional S3 buckets. What is the BEST solution?
a)
Use S3 Transfer Acceleration for faster downloads
b)
Configure CloudFront with the S3 bucket as the origin.
c)
Replicate S3 data to Asia and South America using CRR
d)
Enable S3 Multi-Region Access Points
29.
(G5) A DevOps engineer must design a CI/CD pipeline that stores build artifacts in Amazon S3. Requirements include automatic cleanup of artifacts older than 30 days and encryption at rest. What is the MOST efficient configuration?
a)
Use EBS volumes for artifacts and manually clean up
b)
Store artifacts in S3 and enable lifecycle expiration after 30 days.
c)
Store artifacts in S3 and configure a Lambda function to delete them daily
d)
Use S3 with versioning and replicate artifacts to Glacier Deep Archive
30.
(G5) A company wants to migrate 400 TB of archived data to S3 Glacier Deep Archive. The migration must complete within 2 weeks without saturating its 200 Mbps internet connection. Which option meets the timeline most cost-effectively?
a)
Use AWS DataSync to upload data directly over the internet
b)
Use AWS Snowball Edge devices to import data to S3, then apply lifecycle policies to Glacier Deep Archive.
c)
Set up AWS Direct Connect and copy data to S3 Glacier
d)
Compress the data locally and upload manually via multipart uploads
31.
(G5) A developer needs to process images uploaded to S3 by running a Lambda function that resizes and stores them in another S3 bucket. The function must only trigger when objects are uploaded under the /raw/ prefix. How should this be configured?
a)
Enable event notifications on the entire bucket
b)
Create an S3 Event Notification for all object creation events and filter by prefix /raw/.
c)
Create an SQS queue subscribed to the S3 event for all uploads
d)
Use AWS Batch to poll S3 for new objects
32.
(G5) A Solutions Architect must ensure that all objects uploaded by users are tagged with the department name for cost allocation. Uploads without this tag must be rejected. What is the MOST efficient solution?
a)
Use AWS Lambda to check tags after upload
b)
Enforce a bucket policy that requires the tag condition in the PutObject request.
c)
Use S3 Access Points to restrict untagged uploads
d)
Apply tags automatically with S3 Batch Operations
33.
(G5) A DevOps engineer notices that S3 request costs have spiked after enabling real-time monitoring for application logs stored in S3. The logs are read frequently but rarely modified. How can costs be reduced without affecting performance?
a)
Move logs to S3 Standard-IA
b)
Move logs to S3 Intelligent-Tiering.
c)
Store logs in EBS for faster access
d)
Enable S3 Requester Pays
34.
(G5) A Developer Associate wants to use S3 to host multiple environments (dev, test, prod) of static web assets. Each environment should have isolated access policies and version control. Which architecture is MOST appropriate?
a)
Use a single bucket with folders for each environment
b)
Use separate S3 buckets for each environment with versioning enabled.
c)
Use one bucket and rely on IAM conditions to separate access
d)
Use S3 Access Points for each environment within one bucket
35.
(G9) A development team is building an application that automatically creates thumbnail images for user-uploaded photos. The photos are uploaded directly to an S3 bucket named source-images-bucket. The solution must be serverless and process images as soon as they are uploaded. Which combination of steps is MOST efficient?
a)
Configure an S3 Event Notification on source-images-bucket for PutObject events to trigger an AWS Step Functions state machine
b)
Configure an S3 Event Notification on source-images-bucket for PutObject events to trigger an AWS Lambda function.
c)
Create a CloudWatch Events rule on a schedule to trigger a Lambda function that lists the bucket's contents
d)
Configure S3 Object Lambda with a Lambda function to modify the image as it is being downloaded
36.
(G9) A company needs to allow its users to upload sensitive reports directly to a private S3 bucket via a web application, without granting them any IAM credentials. The application's backend runs on Amazon EC2. Which method should a developer implement to achieve this securely?
a)
Create an IAM user with s3:PutObject permission and embed the credentials in the web application's client-side code
b)
Generate an S3 pre-signed URL using the EC2 instance's IAM role in the backend and provide this URL to the client-side application.
c)
Configure the S3 bucket policy to allow public write access from the company's IP address range
d)
Use AWS Cognito Identity Pools to create temporary IAM credentials for unauthenticated users
37.
(G9) A Lambda function processes files in an S3 bucket in us-east-1. For compliance reasons, all data must also be stored in eu-west-1. The files in the destination bucket must be identical to the source and the solution must be managed by AWS. How can this be achieved?
a)
Create a second Lambda function in eu-west-1 that is triggered by a daily CloudWatch Event to copy all new objects
b)
Enable S3 Cross-Region Replication (CRR) with the existing bucket as the source and a new bucket in eu-west-1 as the destination.
c)
Use AWS DataSync to create a replication task that runs every hour to sync the two buckets
d)
Configure S3 Versioning on both buckets and use S3 Batch Operations to copy the objects
38.
(G9) A DevOps team manages a static website hosted on Amazon S3 and distributed via CloudFront. They need to implement a blue/green deployment strategy to minimize downtime and allow for instant rollbacks. What is the MOST efficient method?
a)
Use two S3 buckets (blue-bucket and green-bucket) and use an Application Load Balancer to switch traffic between them
b)
Use two S3 buckets and update the CloudFront distribution's origin to point to the new bucket after deployment is complete.
c)
Use a single S3 bucket with versioning and use S3 Batch Operations to toggle between object versions
d)
Use AWS CodeDeploy to manage the deployment of the static content to a single S3 bucket
39.
(G9) Your security team needs to investigate who deleted a critical configuration file from a highly sensitive S3 bucket. The DevOps team must provide a definitive audit trail. Which action is REQUIRED to enable this investigation?
a)
Ensure AWS CloudTrail data events are logged for the S3 bucket.
b)
Ensure AWS Config is enabled and recording S3 resources
c)
Ensure S3 Server Access Logging is enabled for the bucket
d)
Ensure S3 Object Lock is enabled on the bucket
40.
(G9) A company has thousands of S3 buckets. The DevOps team needs to create a fully automated report delivered weekly that lists all S3 objects across all buckets that have not been accessed in over 90 days and are still stored in the S3 Standard storage class. What is the LEAST operationally complex solution?
a)
Write a Python script using Boto3 to list all buckets, then list all objects in each bucket and use the HEAD object operation to check the LastModified date
b)
Configure S3 Analytics Storage Class Analysis for all buckets and export the results to an S3 bucket for reporting
c)
Enable S3 Inventory for all buckets to generate a comma-separated values (CSV) manifest of objects and their metadata, then query this data with Amazon Athena.
d)
Use AWS Trusted Advisor to generate a cost optimization report and filter for S3 recommendations
41.
(G9) A data engineering team reports that their Amazon Athena queries against a large dataset in S3 (organized in Hive-style partitioning, e.g., year=2024/month=03/day=01/) are slower than expected. The objects are large ~5 GB Parquet files. As a DevOps Engineer, what is the FIRST and MOST impactful change you would recommend to improve query performance?
a)
Enable S3 Transfer Acceleration on the bucket to speed up data access
b)
Implement S3 Intelligent-Tiering to move less accessed data to a cheaper storage class
c)
Split the large ~5 GB Parquet files into smaller files, ideally between 128 MB and 1 GB.
d)
Convert the data from Parquet format to CSV format
42.
(G3) A company wants to automatically move infrequently accessed objects to a lower-cost storage class but retain them for at least 90 days before deletion. Which configuration meets this requirement?
a)
A. Use S3 Intelligent-Tiering with a 90-day transition rule
b)
B. Create a lifecycle policy to transition to S3 Glacier after 30 days and expire after 90 days.
c)
C. Use S3 Standard-IA and configure a lifecycle rule to delete objects after 90 days
d)
D. Store data directly in S3 One Zone-IA and enable versioning
43.
(G3) A Solutions Architect enables Cross-Region Replication between two S3 buckets. Later, they notice that some objects are not replicated. What is the most probable reason?
a)
A. The destination bucket has encryption disabled
b)
B. The IAM role used by CRR doesn’t have the s3:PutReplicationConfiguration permission
c)
C. The objects were uploaded before CRR was enabled.
d)
D. S3 versioning is enabled only on the source bucket
44.
(G3) A company wants to log all access requests to their S3 bucket for auditing purposes. Which setup is valid?
a)
A. Enable CloudTrail for S3 Data Events only
b)
B. Enable S3 Access Logs on the same bucket
c)
C. Enable S3 Server Access Logging and store logs in a separate bucket.
d)
D. Use CloudWatch Logs to capture S3 events directly
45.
(G3) A company must ensure all S3 objects are encrypted at rest using AWS-managed keys (SSE-S3). Which is the simplest approach?
a)
A. Enable bucket versioning
b)
B. Configure the bucket default encryption to use SSE-S3.
c)
C. Use a bucket policy to deny unencrypted uploads only
d)
D. Manually specify x-amz-server-side-encryption in every PUT request
46.
(G3) After uploading a new object and immediately listing the bucket contents, a developer doesn’t see the file listed. Why might this happen?
a)
A. S3 provides eventual consistency for all operations
b)
B. The bucket has versioning disabled
c)
C. The upload used multipart upload
d)
D. The list operation can be eventually consistent while PUT is strongly consistent.
47.
(G3) An analytics job reads millions of small files from S3 and performs poorly. What is the most effective optimization?
a)
A. Use S3 Transfer Acceleration
b)
B. Enable S3 Requester Pays
c)
C. Combine small files into larger objects (object consolidation).
d)
D. Store data in S3 Glacier Deep Archive
48.
(G6) A developer is building an application that stores uploaded user images in an Amazon S3 bucket. The application must ensure that: · Each upload triggers a thumbnail generation Lambda function. · Duplicate uploads are not overwritten. · Users can retrieve their files directly through a pre-signed URL. Which of the following configurations meets these requirements with minimal effort?
a)
Enable S3 Versioning, configure an S3 event notification for ObjectCreated:* event to trigger the Lambda function, and use pre-signed URLs for upload and retrieval.
b)
Enable S3 Versioning and S3 Transfer Acceleration; use API Gateway to trigger the Lambda function
c)
Enable S3 Object Lock in Governance mode and use API Gateway for uploads
d)
Use S3 Access Points with Transfer Acceleration enabled and trigger Lambda with EventBridge
49.
(G6) A company stores all its application logs in an S3 bucket. The logs are accessed frequently for the first 30 days, but after that, they are rarely used. The company must minimize storage costs while maintaining instant access when needed. Which S3 storage class configuration should the architect recommend?
a)
S3 Glacier Deep Archive
b)
S3 Standard-Infrequent Access (S3 Standard-IA) with a Lifecycle policy
c)
S3 One Zone-IA
d)
S3 Intelligent-Tiering.
50.
(G6) A company needs to store access logs generated by several applications in an Amazon S3 bucket. The logs must be retained for 90 days and automatically deleted afterward. Which configuration meets these requirements most efficiently?
a)
Configure a bucket policy to deny access to objects after 90 days
b)
Implement a Lambda function to delete old objects weekly
c)
Use an S3 Lifecycle Policy to automatically delete objects after 90 days.
d)
Manually move the logs to S3 Glacier and delete them later
51.
(G6) A company wants to host a static website using Amazon S3. The site must be accessible only through Amazon CloudFront, not directly via the S3 bucket URL. Which configuration should be implemented to meet this requirement?
a)
Make the bucket public and link it to the CloudFront domain
b)
Create an Origin Access Control (OAC) or Origin Access Identity (OAI) and block public access to the bucket.
c)
Configure CORS on the bucket to only allow requests from CloudFront
d)
Use presigned URLs to serve each file of the site
52.
(G6) 4. Una empresa almacena recursos estáticos para una aplicación web global en un bucket de Amazon S3. Observan que los usuarios en Europa experimentan una mayor latencia al acceder a los objetos. Necesita mejorar el rendimiento y reducir la latencia globalmente, a la vez que minimiza la sobrecarga operativa. ¿Qué solución cumple con los requisitos de forma más rentable?
a)
A. Replique el bucket S3 a varias regiones de AWS y enrute a los usuarios a través del enrutamiento de latencia de Route 53
b)
B. Habilite la aceleración de transferencia de Amazon S3 en el bucket
c)
C. Configure una distribución de Amazon CloudFront con el bucket S3 como origen.
d)
D. Utilice AWS Global Accelerator para dirigir el tráfico a la región de AWS más cercana
53.
(G6) 6. Has creado un bucket de Amazon S3 para almacenar imágenes estáticas del sitio web de tu empresa. El sitio web está alojado en Amazon EC2 y quieres que las imágenes sean visibles públicamente cuando los usuarios visiten el sitio, pero no quieres que todo el bucket sea público. ¿Qué configuración permite a los usuarios acceder solo a los archivos de imagen públicamente, manteniendo el resto de los datos privados?
a)
A. Habilite “Bloquear todo el acceso público” en el bucket S3
b)
B. Agregue una política de depósito que otorgue acceso de lectura público (s3:GetObject) solo a los objetos en la carpeta /images/.
c)
C. Adjunte una política de IAM con permisos s3:* para todos los usuarios
d)
D. Cree un punto de acceso S3 con acceso público sin restricciones
54.
(G6) 8. Una organización científica necesita compartir un conjunto de datos de varios terabytes almacenados en Amazon S3 con investigadores externos. El acceso debe ser solo lectura, el contenido debe servirse con baja latencia global, y los datos deben protegerse contra eliminación accidental o modificaciones. ¿Cuál es la arquitectura más adecuada?
a)
Habilitar S3 Versioning y compartir los datos mediante un S3 pre-signed URL
b)
Activar S3 Object Lock en modo Compliance y distribuir los datos a través de Amazon CloudFront con el bucket S3 como origen.
c)
Usar S3 Replication hacia múltiples regiones y habilitar Transfer Acceleration para acceso global
d)
Crear una política de bucket pública con permisos GetObject y usar un dominio de Route 53 para acceso directo
55.
(G6) 9. A company wants to migrate its file storage web application to AWS. Currently, users upload files to a web server that stores them locally, causing scalability issues. The company decides to use Amazon S3 for file storage and distribute content globally using Amazon CloudFront. However, users must only be able to access their own files, not others’. What is the best solution to ensure that each user can access only their own files in Amazon S3 through CloudFront while maintaining security and performance?
a)
Configure a public S3 bucket and use bucket policies to restrict access based on IP addresses
b)
Use a CloudFront distribution with a private S3 bucket as the origin and sign access URLs using CloudFront Signed URLs
c)
Allow direct S3 access through pre-signed URLs generated by the application for each file.
d)
Configure IAM user policies that grant access to specific folder paths in the S3 bucket
56.
(G6) 10. A DevOps team manages a CI/CD pipeline using AWS CodePipeline. The process builds source code, stores build artifacts in Amazon S3, and deploys the application to Amazon EC2 instances through AWS CodeDeploy. Recently, the pipeline started failing intermittently because the S3 bucket used to store artifacts was accidentally deleted by another team member during resource cleanup. What is the best way to prevent this issue and protect critical build artifacts?
a)
Enable versioning and MFA Delete on the S3 bucket that stores the artifacts.
b)
Configure bucket policies to block all public access
c)
Use a separate S3 bucket for each pipeline execution
d)
Enable Amazon S3 Transfer Acceleration to improve upload speed
57.
(G1) A developer needs to store user-uploaded images in Amazon S3. The application runs on AWS Lambda and must guarantee that each object name is unique while supporting high parallel upload traffic. Which approach is most efficient and scalable?
a)
Include a random UUID in each object key when uploading to S3.
b)
Use sequential integer filenames (e.g., image1, image2, …)
c)
Store images in a single prefix and rely on S3 versioning to avoid key conflicts
d)
Use Amazon EFS to store the uploads instead of S3
58.
(G1) A company is building a multi-tier application on AWS. The security team requires that no application server should ever have direct internet access, but the servers still need to download patches and updates from the internet. Which solution meets this requirement MOST securely and cost-effectively?
a)
Place the servers in a public subnet with a Security Group that blocks inbound traffic
b)
Place the servers in a private subnet and use a NAT Gateway in a public subnet
c)
Place the servers in a private subnet and use an Internet Gateway
d)
Place the servers in a private subnet and use a VPC Endpoint for S3
59.
(G1) An organization needs to migrate 500 TB of backup archives from an on-premises data center to Amazon S3. The archives are critical but are only accessed once every 5 years for compliance audits. The migration must be completed within 4 weeks, and the solution must be the most cost-effective for long-term storage.
a)
Use an AWS Storage Gateway (File Gateway) to synchronize the archives to an S3 bucket configured with the S3 Glacier Flexible Retrieval storage class
b)
Use AWS Snowball Edge Storage Optimized devices to physically transfer the data, and configure the destination S3 bucket with an S3 Lifecycle Policy to immediately transition objects to S3 Glacier Deep Archive.
c)
Establish a 10 Gbps AWS Direct Connect link to stream the data, and use an S3 Lifecycle Policy to transition the data to S3 Standard-IA after 30 days
d)
Use AWS DataSync over the public internet to transfer the data to an S3 bucket configured with S3 One Zone-IA
60.
(G1) A developer is building an application that uploads images to an S3 bucket. Occasionally, the uploads fail due to network issues. The developer wants the upload process to automatically resume from where it left off without restarting the entire upload. What should the developer use?
a)
S3 Multipart Upload.
b)
S3 Transfer Acceleration
c)
S3 Cross-Region Replication
d)
S3 Versioning
61.
(G1) A company hosts a global application using multiple AWS Regions. They want to route users to the closest Region for low latency and automatically fail over if a Region becomes unavailable. Which Amazon Route 53 routing policy should they use?
a)
Simple routing
b)
Weighted routing
c)
Geolocation routing
d)
Latency-based routing with health checks
62.
(G1) A CI/CD pipeline stores deployment artifacts (ZIP files and Docker images) in Amazon S3. Security mandates that artifacts be encrypted with customer-managed keys (CMKs) and that access logging and audit trails exist for every object access. Which design best satisfies these controls?
a)
Enable default encryption with SSE-S3 and CloudTrail data events for the bucket
b)
Enable default encryption with SSE-KMS using a CMK, enable CloudTrail data events, and activate S3 Server Access Logging.
c)
Use S3 Glacier for encryption and auditing
d)
Store artifacts in AWS CodeCommit repositories instead of S3
63.
(G1) A global enterprise wants to migrate hundreds of on-premises applications to AWS. They need centralized governance, security policies, and account provisioning to ensure each workload is isolated but still compliant with company standards. Which AWS service or feature best meets this requirement?
a)
AWS Config
b)
AWS Control Tower.
c)
AWS Organizations with Consolidated Billing
d)
AWS Trusted Advisor
64.
(G2) A media company must retain raw footage and project archives for regulatory and historical purposes. The data it must be stored for 7–10 years. Finance has mandated the lowest possible storage cost. Engineering confirms that if a retrieval request happens (e.g., legal discovery), teams can wait several hours before the files are available. Small occasional restores are acceptable with multi-hour wait times; immediate access is not required. Question: Which S3 storage class is the best fit?
a)
S3 Standard
b)
S3 Standard-IA
c)
S3 Glacier
d)
S3 Glacier Deep Archive.
65.
(G2) A global analytics platform ingests IoT data continuously into S3, then triggers downstream ETL and ad hoc reads within seconds to minutes. Operations want clear guarantees on what readers will see immediately after writes, including when objects are created, overwritten, or deleted, because jobs that depend on list and get operations must behave deterministically across Regions. Question: After uploading, overwriting, or deleting an object, what read consistency does S3 provide?
a)
Eventual for new; strong for overwrite/delete
b)
Read-after-write for new; eventual for overwrite/delete
c)
Strong (read-after-write) for new, overwrite, and delete.
d)
Eventual in all cases
66.
(G2) A team needs to create an S3 bucket that will be publicly readable via standard S3 endpoints. They must ensure the name will work globally and not collide with any other account or Region. Question: Which statement best describes S3’s bucket naming and namespace model?
a)
Bucket names only need to be unique within an AWS account in a Region
b)
Bucket names are unique per Region but can repeat across Regions
c)
Bucket names are globally unique; S3 uses a universal namespace.
d)
Buckets can share the same name if stored in different Availability Zones
67.
(G2) A healthcare provider stores PHI and financial reports in S3. Compliance states that encryption keys must be generated, rotated, and stored on-premises under existing HSM controls. The security team wants S3 to perform server-side encryption/decryption to simplify client logic, but no keys may be stored in AWS services. Audit requires proof that AWS never retains plaintext keys. Question: Which S3 encryption option meets this requirement?
a)
SSE-S3 (AWS-managed keys)
b)
SSE-KMS (keys in AWS KMS)
c)
SSE-C (customer-provided keys).
d)
Client-side only with CloudHSM required
68.
(G2) A fintech firm must protect against accidental deletions while controlling cost. Business rules: if an object is deleted, it must be instantly restorable for 30 days (zero wait). After day 30, the object must be retained for another 150 days at low cost, and the firm accepts ≤24-hour retrieval for this period. After 180 days total, the object should be deleted automatically without manual intervention. Question: What’s the best configuration?
a)
Cross-Region Replication to another Region + S3 Standard-IA
b)
Enable Versioning; add a lifecycle to transition non-current versions to Glacier after 30 days and expire at 180 days.
c)
Enable MFA Delete; move current objects to S3 One Zone-IA
d)
Store a second copy on EFS and delete manually at 180 days
69.
(G2) A product analytics team keeps reference datasets that are rarely accessed but must still load within milliseconds when requested. They accept lower availability than S3 Standard but not hours-long restore times. Question: Which storage class fits best?
a)
S3 Glacier Deep Archive
b)
S3 Glacier
c)
S3 Standard-IA.
d)
S3 One Zone-IA
70.
(G2) Finance asks how S3 billing will change after enabling cross-region replication and occasional Glacier restores. Question: Which cost dimensions can appear on the S3 bill?
a)
Only storage (GB-month) and PUT requests
b)
Only GET requests and data transferred into S3
c)
Storage per Region, PUT/GET requests, Glacier retrieval fees, Transfer Acceleration, and CRR
d)
Only storage and egress to the internet
71.
(G2) Security is reviewing an S3 bucket that will host internal documents. They require secure access, fine-grained permissions, and optional object encryption. Question: Which combination reflects S3’s built-in security controls?
a)
Security Groups only, no encryption options
b)
VPC-only access and mandatory client-side encryption
c)
ACLs and bucket policies/IAM for permissions, SSL for transport, and SSE-S3/SSE-C/KMS for encryption.
d)
KMS required and MFA always enforced for reads
100 %
