Multiple choice practice

AWS MCQ questions

Take a short practice test with instant feedback, then revise every question with its answer and the reason behind it.

AWS tutorial Interview questions

Questions: 53
From lessons: 33
Your last test: —

Practice test

AWS practice testMultiple choice Question 1 of 10

What does an Auto Scaling group do?

Score so far: 0/0

All questions with answers

Which service provides resizable virtual servers?
- AS3
- BEC2
- CRDS
- DLambda
Show answer
Answer: B. EC2
Elastic Compute Cloud.
Which service stores objects in buckets?
- AEBS
- BS3
- CEFS
- DGlacier only
Show answer
Answer: B. S3
Simple Storage Service.
Which service manages users, roles and permissions?
- ACognito
- BIAM
- CKMS
- DGuardDuty
Show answer
Answer: B. IAM
Identity and Access Management.
Which account should not be used for daily work?
- AAn IAM user in the Admin group
- BThe root user
- CA federated SSO user
- DA read-only role
Show answer
Answer: B. The root user
Protect root with MFA and use it only for account-level tasks.
Which service runs code without servers, billed per invocation?
- AEC2
- BLambda
- CLightsail
- DBatch
Show answer
Answer: B. Lambda
Lambda scales automatically per request.
What is Lambda’s maximum execution time?
- A5 minutes
- B15 minutes
- C1 hour
- DUnlimited
Show answer
Answer: B. 15 minutes
Longer work belongs in ECS, Batch or Step Functions.
Which managed NoSQL database offers single-digit millisecond latency?
- ARDS
- BDynamoDB
- CRedshift
- DAurora
Show answer
Answer: B. DynamoDB
DynamoDB is a key–value and document database.
Which service is AWS’s DNS?
- ACloudFront
- BRoute 53
- CDirect Connect
- DVPC
Show answer
Answer: B. Route 53
Route 53 also does health checks and routing policies.
Which acts as a stateful firewall for EC2 instances?
- ANetwork ACL
- BSecurity group
- CRoute table
- DInternet gateway
Show answer
Answer: B. Security group
Security groups are stateful; NACLs are stateless and apply to subnets.
What gives instances in a private subnet outbound internet access?
- AAn internet gateway attached directly
- BA NAT gateway
- CA security group
- DRoute 53
Show answer
Answer: B. A NAT gateway
The NAT gateway sits in a public subnet.
Which load balancer routes by URL path and host?
- AClassic Load Balancer
- BApplication Load Balancer
- CNetwork Load Balancer
- DGateway Load Balancer
Show answer
Answer: B. Application Load Balancer
ALB works at layer 7 with HTTP rules.
What does an Auto Scaling group do?
- AResizes S3 buckets
- BKeeps a desired number of EC2 instances and scales on policies
- CScales DynamoDB only
- DBalances DNS traffic
Show answer
Answer: B. Keeps a desired number of EC2 instances and scales on policies
It replaces unhealthy instances and scales with demand.
Which service stores Docker images?
- AECS
- BECR
- CEKS
- DCodeCommit
Show answer
Answer: B. ECR
Elastic Container Registry.
Which service builds code and runs tests from buildspec.yml?
- ACodeDeploy
- BCodeBuild
- CCodePipeline
- DCloudFormation
Show answer
Answer: B. CodeBuild
CodePipeline orchestrates stages; CodeBuild does the building.
Which service provisions infrastructure from templates?
- ACloudFormation
- BCloudTrail
- CConfig
- DOpsWorks
Show answer
Answer: A. CloudFormation
CloudFormation creates stacks from YAML or JSON templates.
Which service records API calls made in your account?
- ACloudWatch
- BCloudTrail
- CX-Ray
- DInspector
Show answer
Answer: B. CloudTrail
CloudTrail is an audit log of who did what.
What is wrong with this bucket policy?
JSON Illustrative
```
1{
2  "Effect": "Allow",
3  "Principal": "*",
4  "Action": "s3:GetObject",
5  "Resource": "arn:aws:s3:::shop-uploads/*"
6}
```
- ANothing
- BIt makes every object in the bucket publicly readable
- CEffect must be Deny
- DPrincipal must be a user
Show answer
Answer: B. It makes every object in the bucket publicly readable
Keep buckets private and serve through CloudFront with origin access control.
Which pricing option gives the biggest discount for interruptible workloads?
- AOn-Demand
- BReserved Instances
- CSpot Instances
- DDedicated Hosts
Show answer
Answer: C. Spot Instances
Spot can be reclaimed with two minutes’ notice.
Which tool shows and forecasts your AWS spending?
- ACost Explorer
- BTrusted Advisor only
- CCloudTrail
- DSystems Manager
Show answer
Answer: A. Cost Explorer
Combine it with AWS Budgets for alerts.
Which feature lets CloudFront read from a private S3 bucket?
- ABucket public access
- BOrigin Access Control
- CS3 Transfer Acceleration
- DPresigned URLs only
Show answer
Answer: B. Origin Access Control
OAC signs requests from CloudFront to S3.
Which command shows the identity your CLI is using?
- Aaws whoami
- Baws sts get-caller-identity
- Caws iam me
- Daws configure list-users
Show answer
Answer: B. aws sts get-caller-identity
STS GetCallerIdentity returns the account, user/role and ARN.
From the lesson: Introduction to AWS
You should use the root user for everyday work.
- ATrue
- BFalse
Show answer
Answer: B. False
Root should be protected with MFA and used only for a few account-level tasks.
From the lesson: Introduction to AWS
What is an Availability Zone?
- AA CDN cache
- BAn isolated data centre location within a Region
- CA billing account
- DA VPC subnet
Show answer
Answer: B. An isolated data centre location within a Region
AZs are isolated locations inside a Region.
From the lesson: AWS Global Infrastructure
If one policy allows s3:DeleteObject and another explicitly denies it, what happens?
- AAllowed
- BDenied
- CDepends on order
- DError
Show answer
Answer: B. Denied
An explicit Deny always overrides an Allow.
From the lesson: IAM
How should a Lambda function get permission to call S3?
- AAccess keys in environment variables
- BAn execution role
- CThe root user
- DA public bucket
Show answer
Answer: B. An execution role
Lambda assumes its execution role and receives temporary credentials.
From the lesson: IAM