3.5 - Cost optimization and security hardening

1. An existing account has long-lived IAM access keys embedded in EC2 application code. What is the best improvement to remove standing credentials?

• Rotate the access keys every 30 days with a scheduled Lambda
• Store the keys in AWS Secrets Manager and fetch them at startup
• Attach an IAM role to the EC2 instances and delete the keys (correct answer)
• Encrypt the keys with KMS before baking them into the AMI

An instance profile (IAM role) gives EC2 temporary, auto-rotated credentials via the metadata service, eliminating long-lived keys entirely. Rotating, storing in Secrets Manager, or encrypting still keeps static keys that can leak; the role removes them.

2. A CFO wants to reduce EC2 spend on a stable, long-running production fleet without changing the application. Which TWO actions deliver savings with the least risk? (Choose TWO.)

• Delete the Auto Scaling group so no new instances can ever be launched again
• Use AWS Compute Optimizer recommendations to right-size over-provisioned instances (correct answer)
• Switch every single instance over to Spot so that the whole production tier permanently runs at the lowest possible price
• Purchase Compute Savings Plans to cover the steady baseline of usage (correct answer)

Compute Optimizer flags over-provisioned instances so you right-size safely, and Savings Plans discount the steady baseline in exchange for a commitment. Deleting the ASG removes elasticity, and moving an entire production tier to interruptible Spot risks outages when capacity is reclaimed.

3. An S3 bucket stores terabytes of objects whose access pattern is unpredictable, some read daily and others untouched for months. The team wants automatic cost savings without writing lifecycle rules or risking retrieval delays for hot data. What should they choose?

• Move everything to S3 Glacier Deep Archive to pay the lowest possible storage price
• Enable the S3 Intelligent-Tiering storage class on the bucket (correct answer)
• Write a lifecycle policy that deletes any object older than ninety days
• Replicate the bucket to a second Region to spread out the storage cost

Intelligent-Tiering automatically moves objects between access tiers based on usage, saving on cold data while keeping hot data instantly available, with no lifecycle rules to maintain. Deep Archive adds retrieval delay for daily-read data, deleting old objects loses data, and cross-Region replication increases cost.

4. A company runs a steady baseline of EC2 across several instance families and expects to keep changing types as it modernizes. Finance wants the deepest commitment discount while keeping flexibility to change instance family and Region. Which purchase fits best?

• Standard Reserved Instances locked to one instance family in one Region
• On-Demand Capacity Reservations kept permanently held open in each and every Availability Zone that is currently used
• A Compute Savings Plan committing to an hourly spend across families and Regions (correct answer)
• Spot Instances requested with a maximum price for the entire baseline fleet

A Compute Savings Plan commits to an hourly dollar amount and applies across instance families, sizes, Regions, and even Fargate/Lambda, giving deep discounts with maximum flexibility as the fleet evolves. Standard RIs lock family and Region, Capacity Reservations reserve capacity without a discount, and Spot is interruptible and unsuitable for a steady baseline.

5. An account has accumulated unattached EBS volumes, idle load balancers, and orphaned Elastic IPs after years of experiments, quietly adding to the monthly bill. The team wants a low-effort way to surface these cost-saving opportunities regularly. What should they use?

• A recurring monthly meeting in which each and every team manually reviews the full resource inventory line by line
• AWS Trusted Advisor cost-optimization checks to flag idle and unused resources (correct answer)
• A default lifecycle policy that terminates any resource older than one year
• A billing alarm set to the exact current monthly amount to detect any change

Trusted Advisor cost-optimization checks automatically identify idle load balancers, unattached volumes, and unassociated Elastic IPs, giving a repeatable low-effort list to act on. Manual reviews are slow and error-prone, a blanket age-based termination could delete needed resources, and a single billing alarm neither finds nor names the waste.

6. A team wants to trim storage costs on a mature system without hurting performance for active data. Logs in S3 are rarely read after 30 days, and many gp2 EBS volumes are over-provisioned. Which TWO actions save money safely? (Choose TWO.)

• Add an S3 lifecycle rule transitioning logs to a colder tier after 30 days (correct answer)
• Delete every single one of the EBS snapshots to remove all of their accumulated storage charges from the monthly bill entirely
• Migrate over-provisioned gp2 volumes to gp3 and tune IOPS and throughput separately (correct answer)
• Move all active application data into S3 Glacier to pay less per gigabyte stored

An S3 lifecycle rule transitions rarely-read logs to a cheaper tier after 30 days, and gp3 lets you pay for a right-sized baseline while provisioning IOPS/throughput independently, both cutting cost without harming active data. Deleting all snapshots destroys backups, and moving active data to Glacier adds retrieval latency and fees.