AWS Cloud Practitioner High Priority

Which AWS service or tool is described here? Publishes messages and notifications to multiple subscribers.

Amazon Simple Notification Service (Amazon SNS) — Publishes messages and notifications to multiple subscribers.

Which AWS service or tool is described here? Decouples applications by storing messages in queues for asynchronous processing.

Amazon Simple Queue Service (Amazon SQS) — Decouples applications by storing messages in queues for asynchronous processing.

Which AWS service or tool is described here? Sets cost or usage budgets and sends threshold alerts.

AWS Budgets — Sets cost or usage budgets and sends threshold alerts.

Which AWS service or tool is described here? Visualizes and forecasts AWS costs and usage trends.

AWS Cost Explorer — Visualizes and forecasts AWS costs and usage trends.

Which AWS service or tool is described here? Provides resizable virtual servers with configurable instance types.

Amazon EC2 — Provides resizable virtual servers with configurable instance types.

Which AWS service or tool is described here? Orchestrates and runs containers with AWS-native tooling.

Amazon Elastic Container Service (Amazon ECS) — Orchestrates and runs containers with AWS-native tooling.

Which AWS service or tool is described here? Provides guidance, case-based assistance, and support plans for AWS customers.

AWS Support — Provides guidance, case-based assistance, and support plans for AWS customers.

Which AWS service or tool is described here? AWS-built relational database compatible with MySQL and PostgreSQL.

Amazon Aurora — AWS-built relational database compatible with MySQL and PostgreSQL.

Which AWS service or tool is described here? Fully managed serverless NoSQL key-value/document database.

Amazon DynamoDB — Fully managed serverless NoSQL key-value/document database.

Which AWS service or tool is described here? Managed relational database service for several database engines.

Amazon RDS — Managed relational database service for several database engines.

Which AWS service or tool is described here? Command-line interface for interacting with AWS services.

AWS CLI — Command-line interface for interacting with AWS services.

Which AWS service or tool is described here? Adjusts provisioned capacity in response to demand or schedules.

AWS Auto Scaling — Adjusts provisioned capacity in response to demand or schedules.

Which AWS service or tool is described here? Provisions and manages AWS infrastructure using templates (IaC).

AWS CloudFormation — Provisions and manages AWS infrastructure using templates (IaC).

Which AWS service or tool is described here? Records AWS account/API events for audit investigations.

AWS CloudTrail — Records AWS account/API events for audit investigations.

Which AWS service or tool is described here? Collects metrics, logs, and alarms for operational monitoring.

Amazon CloudWatch — Collects metrics, logs, and alarms for operational monitoring.

Which AWS service or tool is described here? Analyzes resource metrics and recommends right-sized configurations.

AWS Compute Optimizer — Analyzes resource metrics and recommends right-sized configurations.

Which AWS service or tool is described here? Records resource configurations and evaluates compliance rules.

AWS Config — Records resource configurations and evaluates compliance rules.

Which AWS service or tool is described here? Web interface for managing AWS resources and services.

AWS Management Console — Web interface for managing AWS resources and services.

Which AWS service or tool is described here? Centrally manages accounts, policies, and consolidated billing.

AWS Organizations — Centrally manages accounts, policies, and consolidated billing.

Which AWS service or tool is described here? Provides checks and guidance across cost, security, and service best practices.

AWS Trusted Advisor — Provides checks and guidance across cost, security, and service best practices.

Which AWS service or tool is described here? Helps assess workloads against AWS Well-Architected best practices.

AWS Well-Architected Tool — Helps assess workloads against AWS Well-Architected best practices.

Which AWS service or tool is described here? Migrates or replicates databases with minimal downtime.

AWS Database Migration Service (AWS DMS) — Migrates or replicates databases with minimal downtime.

Which AWS service or tool is described here? Creates and manages APIs for backend services and Lambda functions.

Amazon API Gateway — Creates and manages APIs for backend services and Lambda functions.

Which AWS service or tool is described here? Content delivery network that caches content near users.

Amazon CloudFront — Content delivery network that caches content near users.

Which AWS service or tool is described here? Provides dedicated private connectivity from on-premises networks to AWS.

AWS Direct Connect — Provides dedicated private connectivity from on-premises networks to AWS.

Which AWS service or tool is described here? DNS service for domain routing, health checks, and traffic policies.

Amazon Route 53 — DNS service for domain routing, health checks, and traffic policies.

Which AWS service or tool is described here? Provides an isolated virtual network with subnets and routing in AWS.

Amazon VPC — Provides an isolated virtual network with subnets and routing in AWS.

Which AWS service or tool is described here? Creates encrypted tunnels between on-premises networks and AWS over the internet.

AWS Site-to-Site VPN — Creates encrypted tunnels between on-premises networks and AWS over the internet.

Which AWS service or tool is described here? Provides on-demand AWS compliance reports and agreements.

AWS Artifact — Provides on-demand AWS compliance reports and agreements.

Which AWS service or tool is described here? Detects suspicious activity and threats in AWS accounts and workloads.

Amazon GuardDuty — Detects suspicious activity and threats in AWS accounts and workloads.

Which AWS service or tool is described here? Controls access to AWS resources using identities, roles, and policies.

AWS Identity and Access Management (IAM) — Controls access to AWS resources using identities, roles, and policies.

Which AWS service or tool is described here? Centrally provides single sign-on access to AWS accounts and applications.

AWS IAM Identity Center — Centrally provides single sign-on access to AWS accounts and applications.

Which AWS service or tool is described here? Creates and controls encryption keys used across AWS services.

AWS Key Management Service (AWS KMS) — Creates and controls encryption keys used across AWS services.

Which AWS service or tool is described here? Stores, retrieves, and rotates application secrets and credentials.

AWS Secrets Manager — Stores, retrieves, and rotates application secrets and credentials.

Which AWS service or tool is described here? Protects applications against distributed denial-of-service attacks.

AWS Shield — Protects applications against distributed denial-of-service attacks.

Which AWS service or tool is described here? Filters malicious HTTP(S) requests to protect web applications.

AWS WAF — Filters malicious HTTP(S) requests to protect web applications.

Which AWS service or tool is described here? Runs containers without managing the underlying EC2 servers.

AWS Fargate — Runs containers without managing the underlying EC2 servers.

Which AWS service or tool is described here? Runs code in response to events without provisioning servers.

AWS Lambda — Runs code in response to events without provisioning servers.

Which AWS service or tool is described here? Provides block storage volumes for Amazon EC2.

Amazon Elastic Block Store (Amazon EBS) — Provides block storage volumes for Amazon EC2.

Which AWS service or tool is described here? Managed shared file storage used by Linux-based workloads.

Amazon Elastic File System (Amazon EFS) — Managed shared file storage used by Linux-based workloads.

Which AWS service or tool is described here? Scalable object storage for files, backups, static assets, and data lakes.

Amazon S3 — Scalable object storage for files, backups, static assets, and data lakes.

Which AWS service or tool is described here? Low-cost S3 archival storage classes with retrieval trade-offs.

Amazon S3 Glacier — Low-cost S3 archival storage classes with retrieval trade-offs.

Name six major benefits of cloud computing.

Agility; elasticity; scalability; global reach; high availability; shifting fixed infrastructure costs toward variable usage-based costs.

What are the six AWS Well-Architected Framework pillars?

Operational Excellence; Security; Reliability; Performance Efficiency; Cost Optimization; Sustainability.

Which Well-Architected pillar includes performing operations as code and making frequent small reversible changes?

Operational Excellence — effective operations, continuous improvement, learning from failures.

Which Well-Architected pillar focuses on recovery from failure and testing recovery procedures?

Reliability — maintain correct service operation and recover from disruptions.

What does the Well-Architected Cost Optimization pillar focus on?

Delivering business value while avoiding unnecessary costs through measurement, resource selection, and rightsizing.

Name three general AWS Well-Architected design principles (not pillar-specific ones).

Stop guessing capacity needs; test systems at production scale; drive architectures using data. Other general principles: automate experimentation, allow evolutionary architectures, improve through game days.

What is rightsizing in AWS?

Matching compute and other resource configurations to actual workload requirements to improve efficiency and manage cost.

In the AWS shared responsibility model, who secures what?

AWS secures the infrastructure OF the cloud; customers secure what they run IN the cloud, including their data, identities, access, and relevant configurations. Responsibilities depend on the service.

Distinguish an IAM user, IAM role, and IAM policy.

User: identity for a person or workload. Role: assumable identity with temporary permissions. Policy: JSON document defining allowed or denied actions. Apply least privilege.

How do encryption at rest, encryption in transit, AWS KMS, and Secrets Manager differ?

At rest protects stored data; in transit protects data moving over a network (e.g., TLS); KMS manages encryption keys; Secrets Manager stores and can rotate secrets.

Distinguish CloudTrail, CloudWatch, and AWS Config.

CloudTrail: account/API activity audit trail. CloudWatch: monitoring metrics, logs, and alarms. Config: resource configuration history and compliance evaluation.

Which services detect threats, assess vulnerabilities, find sensitive S3 data, and provide AWS audit documents?

GuardDuty: threats; Inspector: vulnerabilities; Macie: sensitive S3 data; Artifact: compliance reports and agreements.

What is the key difference between security groups and network ACLs?

Security groups: stateful, attached to resource network interfaces, allow rules only. Network ACLs: stateless, attached to subnets, allow and deny rules.

How do AWS Regions, Availability Zones, and edge locations differ?

Region: separate geographic area. Availability Zone: isolated data center grouping within a Region for resilience. Edge location: location closer to users for content delivery or edge services.

Compare EC2, Lambda, ECS, EKS, and Fargate.

EC2: virtual servers; Lambda: event-driven functions without server management; ECS: AWS-native container orchestration; EKS: Kubernetes orchestration; Fargate: serverless compute capacity for containers.

When should you choose S3, EBS, or EFS?

S3: object storage; EBS: block volumes used by EC2; EFS: shared managed file storage for Linux-based workloads. Glacier classes are S3 archival options.

When would you choose RDS/Aurora versus DynamoDB versus ElastiCache?

RDS/Aurora: relational SQL databases; DynamoDB: NoSQL key-value/document database; ElastiCache: low-latency in-memory caching.

How do AWS Site-to-Site VPN and Direct Connect differ?

Site-to-Site VPN: encrypted tunnel over the internet, often quicker to establish. Direct Connect: dedicated private network connection, usually involving provisioning.

Distinguish Route 53, CloudFront, API Gateway, and Global Accelerator.

Route 53: DNS; CloudFront: content delivery network; API Gateway: manage APIs; Global Accelerator: improves global application availability and network performance.

What is the distinction between SNS, SQS, and EventBridge?

SNS: publish notifications to subscribers; SQS: queue messages for asynchronous processing; EventBridge: route events using rules to targets.

How does Compute Optimizer differ from Auto Scaling?

Compute Optimizer recommends appropriately sized resources from utilization metrics; Auto Scaling adjusts provisioned capacity with demand.

What is the main difference among On-Demand, Savings Plans, and Spot pricing?

On-Demand: pay for usage without long commitment; Savings Plans: discount in exchange for 1- or 3-year usage commitment; Spot: use spare EC2 capacity at discounts with interruption risk.

Distinguish AWS Budgets, Cost Explorer, Pricing Calculator, and Cost Anomaly Detection.

Budgets: threshold alerts; Cost Explorer: analyze trends; Pricing Calculator: estimate planned costs; Cost Anomaly Detection: detect unusual spend.

A company needs a service to identify overprovisioned EC2 instances and recommend better instance types. Which service?

AWS Compute Optimizer — analyzes performance and utilization metrics and makes rightsizing recommendations.

A company wants to add or remove EC2 instances automatically as traffic changes. Which capability?

AWS Auto Scaling — changes capacity to match demand; this is different from rightsizing recommendations.

A company needs to audit who called an AWS API or modified resources in its account. Which service?

AWS CloudTrail — records AWS account and API activity.

A company wants an alarm when CPU usage exceeds a threshold. Which service?

Amazon CloudWatch — metrics, logs, dashboards, alarms.

A company needs a quick encrypted connection from its office network to an AWS VPC over the internet. Which service?

AWS Site-to-Site VPN — uses encrypted tunnels over the internet.

A company wants a dedicated private circuit to AWS from its data center. Which service?

AWS Direct Connect — dedicated private connectivity, not an internet VPN tunnel.

A company needs rules allowing traffic to specific EC2 ports on a network interface. What control?

Security group — stateful controls on resource network interfaces.

A company needs allow and deny rules for traffic entering and leaving a VPC subnet. What control?

Network ACL — stateless controls at the subnet boundary.

A company wants lower AWS compute prices in exchange for a one- or three-year spending commitment. What offering?

Savings Plans — commitment-based discounts for eligible compute usage.

A company needs to protect a public web application against malicious HTTP requests. Which AWS service?

AWS WAF — filters HTTP(S) web requests using rules.

What is the contrast: SNS vs SQS?

SNS fans out published messages to subscribers; SQS holds messages in a queue for asynchronous consumers.

What is the contrast: CloudWatch vs CloudTrail?

CloudWatch monitors metrics/logs and alarms; CloudTrail records AWS API and account events for auditing.

What is the contrast: S3 vs EBS vs EFS?

S3 is object storage; EBS is block storage attached to EC2; EFS is shared managed file storage.

What is the contrast: RDS vs DynamoDB?

RDS is managed relational databases; DynamoDB is fully managed NoSQL key-value/document storage.

What is the contrast: Route 53 vs CloudFront?

Route 53 handles DNS and routing policies; CloudFront caches/distributes content near users.

What is the contrast: AWS Budgets vs Cost Explorer?

Budgets tracks thresholds and sends alerts; Cost Explorer analyzes and forecasts cost and usage trends.

What is the contrast: IAM vs IAM Identity Center?

IAM manages access to AWS resources with identities, roles, and policies; IAM Identity Center centralizes workforce sign-in/access across accounts and apps.

What is the contrast: GuardDuty vs Inspector?

GuardDuty detects suspicious activity/threats; Inspector scans supported workloads for vulnerabilities and exposure.