Final assessment

Twelve questions across the whole course. Score 70% or more to pass and unlock your certificate. You can retake it as often as you like.

Finish every lesson to earn the certificate — you can take the assessment any time.

A company in Brazil serves users across South America, but a contract requires all customer data to stay in the EU. Which Region choice follows the lesson’s order of priorities?

sa-east-1, because it is closest to the users.
us-east-1, because it usually gets new services first.
Whichever Region is cheapest worldwide.
An EU Region that offers every service needed, accepting the extra latency and using a CDN for static content.

Lantern’s RDS for PostgreSQL instance needs a minor engine security patch. Who applies it and when?

AWS applies it during the maintenance window that Lantern chose, or Lantern can apply it sooner.
Lantern must SSH into the database host and install it.
Nobody; managed databases never need patches.
AWS applies it instantly at any time without notice.

Your shell has AWS_PROFILE=lantern-dev set, and you run aws s3 ls --profile lantern-prod. Which account does the command use?

lantern-dev, because environment variables always win.
Neither; the CLI refuses conflicting settings.
lantern-prod, because a command-line option overrides the environment variable.
Whichever profile is named default in ~/.aws/config.

Sam’s group policy allows s3:GetObject on arn:aws:s3:::lantern-posters/*. The bucket policy denies all S3 actions when aws:SecureTransport is false. Sam requests a poster with a plain HTTP URL. What happens?

It succeeds, because the identity-based allow matches.
It is denied, because the request did not use TLS and the bucket policy’s explicit deny applies.
It succeeds, because bucket policies only apply to anonymous users.
It is denied, because Sam lacks s3:ListBucket.

Lantern’s report function only reads the lantern-events-archive DynamoDB table in eu-west-1. Which policy statement is least privilege?

dynamodb:* on *
dynamodb:GetItem, dynamodb:Query and dynamodb:Scan on *
dynamodb:* on the table’s ARN
dynamodb:GetItem and dynamodb:Query on arn:aws:dynamodb:eu-west-1:111122223333:table/lantern-events-archive

Which of these idle Lantern resources keeps adding to the bill every hour even when no traffic flows?

A NAT gateway left in a public subnet after the migration.
A Lambda function that nobody invokes.
A gateway endpoint for S3.
An IAM role with no attached policies.

Versioning is on for the posters bucket, and someone runs aws s3 rm s3://lantern-posters/posters/2026/festival.jpg. How do you get the poster back?

You can’t; rm permanently deletes objects.
Restore it from S3 Glacier, where deleted objects go.
Delete the delete marker, or copy the previous version back as the current one.
Ask AWS Support to undelete it.

The treasurer wants a monthly table of the most-RSVPed events, filterable by city and category, with new filters added whenever someone asks. RSVPs live in DynamoDB. What is the most practical approach?

Scan the RSVP table each month and filter in code.
Load the monthly RSVP counts into the RDS for PostgreSQL database alongside events, and answer the questions with SQL.
Add a new DynamoDB global secondary index for every filter the treasurer invents.
Move all RSVPs into S3 Express One Zone.

A security group allows inbound TCP 443 from anywhere and has had all its outbound rules removed. A visitor sends an HTTPS request to the instance. What happens to the response?

It is dropped, because there is no outbound rule.
It is sent only if the subnet’s network ACL also has an inbound rule for 443.
It is sent only after AWS adds a default outbound rule back.
It is sent, because security groups are stateful and allow replies to permitted inbound traffic.

After a deploy, a new hashed file assets/index-9c2e1f.css is uploaded and index.html is updated with a no-cache header. Which path needs a CloudFront invalidation?

Only /index.html, if CloudFront might still hold an old copy; the new CSS file has never been cached.
/*, to be safe on every deploy.
Only /assets/index-9c2e1f.css
No invalidation is ever possible for S3 origins.

Lantern must put AWS WAF in front of its RSVP API to block abusive traffic at the API itself. Which API Gateway type supports that directly?

An HTTP API
A Lambda function URL
A REST API
A WebSocket API

Lantern’s monthly bill doubled. Which first step shows where the increase came from?

Delete the newest resources until the forecast drops.
Open AWS Cost Explorer and group costs by service, and by the project tag, comparing this month with last month.
Lower the AWS Budgets limit so the alert fires sooner.
Raise reserved concurrency on every Lambda function.

12 questions unanswered