Latest exam question analyses
Every time a question is re-reviewed — answer verified, explanation rewritten, official references checked — it appears here. 5,367 analyses published so far, newest first.
-
312-50v12
Choosing a Vulnerability Assessment Solution for an External View
This analysis identifies the correct vulnerability assessment solution for an organization needing an external attacker perspective, inference-based testing, and continuously updated databases. It establishes that a service-based solution offered by an auditing firm is the most appropriate choice.
-
312-50v12
What Follows a Completed TCP Handshake During Scanning?
This CEH 312-50v12 question tests what an ethical hacker does immediately after completing a TCP three-way handshake (SYN → SYN/ACK → ACK) with an open port during a network scan. The page establishes that the correct next action is a vulnerability scan of the discovered open port (B), not closing the connection or sending transport-layer data flags.
-
312-50v12
First Step to Mitigate DDoS Attack
When facing a suspected Distributed Denial of Service (DDoS) attack, the primary objective is to mitigate traffic volume before it overwhelms local infrastructure. This question establishes that engaging the ISP is the most effective initial mitigation strategy for large-scale attacks.
-
312-50v12
Identifying RST Hijacking via Spoofed Reset Packets
This question tests the identification of session hijacking techniques, specifically focusing on TCP connection termination. The correct answer is C because the attacker injected a spoofed RST packet to reset the victim's connection.
-
312-50v13
Phishing vs In-Memory Exploits for Fileless Malware Delivery
This question tests the distinction between delivery vectors and execution mechanisms in fileless malware attacks. The correct answer is D (Phishing), as it identifies the specific social engineering technique used to trick users into initiating the exploit.
-
312-50v13
Time-Based and Boolean-Based SQL Injection Techniques
This page explains how ethical hackers use Time-Based and Boolean-based SQL injection to infer database truth values through response delays or UI changes.
-
312-50v13
Container Technology Architecture Tiers
This question tests the five-tier container technology architecture, specifically identifying the role of testing and accreditation systems in image verification. It establishes that verifying, validating, and signing images occurs in Tier-2 before they are sent to registries.
-
312-50v13
What is the CVSS v3.1 Medium Severity Range?
In the Common Vulnerability Scoring System (CVSS) v3.1, medium severity vulnerabilities are assigned specific numerical scores. This page establishes the correct range for the medium severity rating.
-
SOA-C03
Enforce EC2 CostCenter Tag via Organizations
Using AWS Organizations to enforce tag compliance prevents noncompliant EC2 launches centrally. This page explains why an Organizations policy is the least administrative effort solution for enforcing CostCenter tag values.
-
SOA-C03
How Do You Cache S3 Video Files at CloudFront Edge Locations?
Moving video files to Amazon S3 while keeping CloudFront caching requires adding S3 as an origin and creating a cache behavior that matches the video URL path pattern. This page confirms option B and explains why header forwarding, signed URLs, and origin groups do not provide path-based origin routing.
-
SOA-C03
How to Alert on Savings Plans Utilization Below 90%?
Savings Plans utilization alerts are configured through an AWS Budgets Savings Plans budget, not a standalone Savings Plans alert or a CloudWatch alarm action to SQS. The page confirms that an AWS Budgets budget with an Amazon SNS email subscription is the correct solution when daily utilization falls below 90%.
-
SOA-C03
How to Block EC2 Launches in Unauthorized Regions Across an Organization?
An AWS Organizations service control policy attached at the root is the most operationally efficient way to deny ec2:RunInstances in unauthorized Regions across every current and future account. This page explains why the root-level SCP answer (D) beats per-account IAM policies, permissions boundaries, and EventBridge/Lambda remediation.
-
CLF-C02
Who Is Responsible for WorkSpaces Infrastructure Security?
Amazon WorkSpaces divides duties between AWS and the customer under the shared responsibility model. This page establishes that AWS owns the environmental safety and physical security of the infrastructure hosting WorkSpaces, while the customer manages user-level controls.
-
CLF-C02
Which Benefit Does AWS Enterprise Support Add Over Business Support?
AWS Enterprise Support versus Business Support is tested by separating features already included in Business from the Enterprise-only designated TAM. The page establishes that the correct additional benefit is the designated Technical Account Manager (TAM), not full Trusted Advisor checks or 24x7 contact channels.
-
CLF-C02
Which AWS Service Lets You Grant Permissions to Users as a Group?
AWS Identity and Access Management (IAM) is the service that lets a company organize users into IAM groups and attach permissions to the group rather than to each user individually. This page confirms why option B is the answer and why the similarly named Security groups and Resource groups do not apply.
-
CLF-C02
Who Patches the OS When Databases Run on Amazon EC2?
This question tests where the shared responsibility line falls when a database is self-hosted on Amazon EC2 rather than run on a managed service such as Amazon RDS. It establishes that among the listed tasks, operating system patching is the one that sits on the AWS side of the line.
-
MLA-C01
How to Access FSx for ONTAP Training Data in SageMaker?
Amazon FSx for NetApp ONTAP volumes can be mounted directly to a SageMaker instance in the same VPC, giving ML code NFS access to 6 TB of image training data without copying it into Amazon S3. The correct answer is A because the mount option is the one that actually makes the FSx data available to SageMaker compute.
-
MLA-C01
How to Fix SageMaker XGBoost Overfitting with Least Effort?
A SageMaker AI XGBoost regressor that fits training data well but fails on real-world validation is overfitting. This page establishes that increasing lambda, the L2 regularization hyperparameter, is the lowest-effort way to close that validation gap.
-
MLA-C01
Which SageMaker option mitigates forecast degradation over time?
This MLA-C01 question tests how to detect and mitigate post-deployment forecast degradation for a SageMaker AI endpoint. It establishes that SageMaker Clarify monitoring is the best available option here (D), not Debugger, X-Ray, or one-off Ground Truth labeling.
-
MLA-C01
How to Fix Image Classification When One Class Is Rare?
This MLA-C01 scenario tests how to handle severe class imbalance in an image classification model that performs poorly on an underrepresented class. The correct approach combines F1-score optimization with image augmentation of the minority class, not SMOTE on raw pixels.
-
AIF-C01
Which SageMaker Feature Evaluates Model Bias and Drift in Production?
Amazon SageMaker Model Monitor is the production monitoring service for detecting drift in deployed models and, through Clarify integration, bias drift. This page establishes why Model Monitor is the best fit for the customer-segmentation model and why Clarify alone is insufficient.
-
AIF-C01
Which service reports unused Amazon Comprehend endpoints after 15 days?
Amazon Comprehend endpoints incur charges while active, and AWS Trusted Advisor includes a dedicated underutilized-endpoints check that flags endpoints not used for more than 15 days. This page confirms why Trusted Advisor, not CloudWatch, meets the automated reporting requirement.
-
AIF-C01
Which AWS Services Analyze Sentiment in Written Customer Reviews?
Written customer reviews require text-based sentiment analysis rather than image or speech processing. Amazon Comprehend provides built-in sentiment detection and Amazon Bedrock can apply foundation models to the same reviews, making B and D the correct pair.
-
AIF-C01
How to Extract Insights from Contact Center Call Audio?
Amazon Transcribe is the AWS service that converts contact center call recordings from speech to text, enabling downstream analysis and key information extraction from audio. This page explains why transcription is the required first step and why text-only NLP services are not sufficient here.
-
SAA-C03
How Should RDS Sale Data Reach Multiple Targets?
This SAA-C03 scenario asks how to propagate an Amazon RDS listing removal to multiple downstream systems. The page establishes that AWS Lambda triggered by the database update is the correct answer (A), because RDS event notifications do not fire on row-level data changes.
-
SAA-C03
Which S3 encryption, replication, and serverless SQL design has least overhead?
This SAA-C03 question tests the least-overhead way to encrypt, cross-Region replicate, and SQL-query data in Amazon S3. It establishes that configuring CRR on the existing bucket with SSE-S3 and querying through Amazon Athena (C) avoids new-bucket migration and KMS key management.
-
SAA-C03
How to Minimize S3 Data Transfer Costs for a Cross-Region Marketing Firm?
Amazon S3 Requester Pays shifts request and data transfer charges to the account that accesses the bucket, so the survey company can avoid paying cross-region transfer costs when the marketing firm retrieves data.
-
SAA-C03
Which S3 Storage Solution Meets Call Transcript Retrieval Requirements?
This question tests cost-effective Amazon S3 storage tiering for call transcripts that need fast random retrieval for one year and infrequent access afterward. The page establishes that keeping files in S3 Standard with search metadata and transitioning them to S3 Glacier Instant Retrieval after 12 months (C) best balances speed and cost.
-
DEA-C01
How to Process Multi-Region EFS Data in One Region with Least Effort?
Amazon EFS replication can copy each Regional file system into the data science team's Region so Lambda functions mount local replicas and process the data while meeting residency with minimal operational effort. This page establishes why EFS replication is the least-effort answer over DataSync, cross-Region mounts, or multi-Region Lambda deployments.
-
DEA-C01
How Can Lambda Connect Privately to an RDS Instance with Least Overhead?
Connecting an AWS Lambda function to a private Amazon RDS instance requires VPC placement plus a security-group rule that references the Lambda's own group rather than CIDR ranges. This page establishes why options C and D form the private, lowest-overhead solution for the DEA-C01 scenario.
-
DEA-C01
How Should MWAA DAGs Orchestrate Daily and Archived S3 Transformations?
This DEA-C01 scenario asks which two tasks an Amazon MWAA DAG should schedule to handle daily 300 GB transformations and a one-time terabyte-scale archive job in an S3 data lake at the lowest cost. The page establishes that AWS Glue crawlers (A) plus Amazon EMR (D) form the cost-effective combination, with a full breakdown of why Athena, Redshift and SageMaker fall short.
-
DEA-C01
How to enforce custom data quality validation rules in AWS Glue ETL?
AWS Glue Data Quality rulesets let you codify custom validation checks for ETL datasets, so order data is tested for accuracy and consistency before it is trusted. This page confirms that option B is the right fit when requirements call for specific, business-defined rules rather than generic transforms or metadata cataloging.
-
DOP-C02
Deploying CDK Security Controls Across AWS Accounts
This question evaluates the ability to deploy standardized security controls across a multi-account AWS environment using AWS Control Tower and CloudFormation Customizations.
-
DOP-C02
Restrict CodeConnections Provider and HA Regions
This guide explains how to restrict AWS CodeConnections to a specific Git provider using SCPs and ensure high availability across Regions by creating regional connections and using CloudFormation Git sync.
-
DOP-C02
Automating Dedicated License Allocation at Scale
This solution establishes that Amazon DynamoDB is the most effective service for automating dedicated license allocation at scale while supporting a dashboard to track availability. It highlights why DynamoDB's dynamic state tracking surpasses static CloudFormation Mappings or opaque SQS queues.
-
DOP-C02
Least Overhead for Custom EC2 Metrics
Determines the optimal method for collecting custom performance metrics from Amazon EC2 instances with minimal operational overhead using the CloudWatch Agent.
-
ANS-C01
Resolving Inter-Region Asymmetric Routing with Transit Gateway Appliance Mode
This question addresses inter-Region communication failures in a hub-and-spoke architecture due to asymmetric routing through inspection VPCs. The correct solution involves enabling appliance mode on transit gateway attachments to ensure bidirectional traffic symmetry.
-
ANS-C01
ACM Integration with ALB and Route 53
Securing a public-facing web application on AWS requires a public SSL/TLS certificate from ACM deployed on an Application Load Balancer, with Route 53 routing traffic via an Alias A record. This configuration ensures public clients trust the certificate and connect efficiently to the ALB.
-
ANS-C01
Troubleshooting AWS Cloud WAN Inter-segment Communication
This question addresses the default isolation behavior of AWS Cloud WAN segments and how to enable routing between them using core network policy updates.
-
ANS-C01
AWS Route 53 DNS Firewall for Malicious Domain Blocking
Route 53 DNS Firewall provides a scalable, managed solution to block traffic to malicious domains with minimal operational overhead compared to self-managed firewalls.
-
SAP-C02
How to Collect Migration Evaluator Assessment and VM Dependencies with Least Overhead?
Migrating numerous on-premises VMs requires both a Migration Evaluator assessment report and AWS Application Discovery Service data for dependency visualization. This page establishes that option D provides both through the Migration Evaluator Collector and per-VM Discovery Agents with the least manual integration.
-
SAP-C02
How to Replicate Aurora MySQL Cross-Region for DR at Lowest Cost?
Aurora Global Database is the valid cross-Region disaster recovery solution for an Aurora MySQL cluster with a one-hour RPO. The page explains why the lower-cost-sounding DMS-to-S3 and hourly backup options do not provide a directly restorable Aurora database.
-
SAP-C02
Which S3 storage solution archives private documents at the lowest cost?
This SAP-C02 scenario asks for the lowest-cost way to serve archived documents privately to employees through a VPC-attached client VPN. S3 One Zone-IA is the correct answer because the archive is a copy, requests are low, and one-zone durability is acceptable when speed and availability are not concerns.
-
SAP-C02
How Do You Detect Unsolicited Inbound Traffic in NAT Gateway Flow Logs?
VPC Flow Logs for a NAT gateway are analyzed in Amazon CloudWatch Logs, not CloudTrail, to determine whether inbound traffic from 198.51.100.2 was solicited. The page establishes that option D is correct because it queries the reverse flow from the 203.0 VPC CIDR back to the public IP to see whether the instance initiated the connection.
-
DVA-C02
Preventing Cross-Environment Lambda Invocations via Resource Policies
This question addresses how to prevent unintended cross-environment Lambda invocations caused by shared S3 triggers within a single AWS account. It establishes that applying resource-based policies is the direct and secure method to scope access.
-
DVA-C02
How to Canary-Test Optimized Lambda Code Through API Gateway?
This DVA-C02 scenario tests AWS Lambda versioning with an API Gateway REST API canary release so optimized code reaches only a small slice of production traffic without changing the URL. The page establishes that option A is correct and that an alias cannot be defined on $LATEST.
-
DVA-C02
Which AWS Services Give ACID Transactions for Item Trades?
A gaming platform that swaps items between two user records in a single rollback-capable unit needs a data store with real multi-item ACID transactions. Amazon DynamoDB TransactWriteItems/TransactGetItems and Aurora MySQL's native transaction blocks both satisfy this, which makes C and D the correct pair.
-
DVA-C02
Caching RDS Read Records Without Schema Changes
When read-only historical records from an Amazon RDS database with custom views and queries slow down under load, the fastest fix that leaves the schema untouched is a managed caching layer. Amazon ElastiCache (Redis OSS) fronts those queries, absorbing read traffic while keeping management overhead near zero.
-
AIP-C01
Extracting Searchable Video Metadata with AWS AI Services
This scenario requires extracting synchronized, multi-modal metadata from a video library to create a searchable index. The optimal solution uses specialized AWS AI services like Amazon Transcribe, Rekognition, and Comprehend within a pipeline, storing unified metadata in Amazon DynamoDB with time-based partitioning.
-
AIP-C01
Fixing AccessDenied on Bedrock Automated Model Evaluation Jobs
Amazon Bedrock automated model evaluation jobs require an IAM service role carrying both an inline permissions policy (Bedrock model invocation plus S3 access) and a trust policy that lets the Bedrock evaluation service assume the role.
-
AIP-C01
Bedrock Geographic Inference Profiles for EU Data Sovereignty
This Amazon Bedrock question tests how to satisfy EU data residency while sustaining 1,000 transactions per second with sub-500 ms latency and cross-Region resilience. The solution that works combines provisioned throughput for U.S. traffic, a Europe-specific (eu.) geographic inference profile for EU traffic, auto scaling, and EventBridge/Lambda-based failover.
-
AIP-C01
Least-Overhead Agentic Solution for Freight Optimization
This scenario asks which agentic GenAI architecture delivers real-time multi-system retrieval, a human-in-the-loop approval gate, and modular growth with the least operational overhead. The analysis shows a coordinated multi-agent system built on the Strands Agents SDK and Amazon Bedrock AgentCore, with MCP messaging and AWS Step Functions for approval, satisfies every constraint.
-
200-301
What Network Node Function is Centralized on an SDN Controller?
In a Software-Defined Networking (SDN) architecture, the control plane is decoupled from the data plane and centralized on the controller. This page establishes that creating the IP routing table is the specific function centralized on the controller.
-
200-301
Which command configures an LLDP delay time of 5 seconds?
Identify the correct Cisco IOS command to configure the LLDP reinitialization delay time. This guide clarifies why the 'lldp reinit' command is used to set the delay instead of the holdtime or timer.
-
200-301
LLDP Configuration on Single Interface in Multivendor Network
This CCNA 200-301 question tests configuring an industry-standard neighbor discovery protocol (LLDP) on just one interface of a multivendor network carrying new VoIP traffic, while leaving the protocol off everywhere else.
-
200-301
Step After EAP Success in EAP-TLS Session
This question covers the EAP-TLS wireless authentication sequence, specifically what happens right after the authenticator relays the EAP success message when session resumption (and thus PMKID/fast reconnection caching) is disabled. The page establishes that the immediate next step is the 802.11 four-way handshake, which derives and installs the PTK used to encrypt the session.
-
350-601
ACI Microsegmentation Network-Based Attribute
In Cisco ACI, microsegmenting endpoints within the same IP subnet requires using a MAC-based network attribute. This page establishes that MAC addresses provide the subnet independence necessary for intra-subnet microsegmentation enforcement.
-
350-701
Endpoint-Based Security for Password-Protected Archives
This question examines the unique capabilities of endpoint security compared to network controls, specifically focusing on the inability of network devices to inspect password-protected archives. It establishes that endpoint protection is required when sensitive data resides in encrypted containers that only the endpoint can decrypt.
-
350-701
Cisco Secure Web Appliance Deployment Modes
This page explains the differences between Standard, Hybrid, and Cloud Web Security Connector modes for Cisco Secure Web Appliance (WSA), establishing that on-site proxy and Layer 4 traffic monitoring are unavailable in Connector mode.
-
350-701
Completing Cloud Event Configuration on FMC
This question addresses the final step to enable forwarding of Cisco Secure Firewall Threat Defense (FTD) events from the Management Center (FMC) to the cloud. It establishes that enabling the cloud event connector is the specific configuration action required after initial device and license setup.