main for studying currently

What is the main financial benefit of replacing CapEx with OpEx in the cloud?

You pay for resources as you use them instead of buying infrastructure upfront.

Which cloud advantage avoids predicting infrastructure demand in advance?

Elasticity: scale capacity up or down as demand changes.

What is a hybrid cloud deployment?

A deployment that connects cloud resources with on-premises infrastructure.

Which Well-Architected pillar focuses on runbooks, automation, and monitoring?

Operational Excellence.

Which Well-Architected pillar focuses on least privilege and encryption?

Security.

Which Well-Architected pillar focuses on recovery and reducing downtime?

Reliability.

Which Well-Architected pillar focuses on efficient resource use?

Performance Efficiency.

Which Well-Architected pillar focuses on avoiding unnecessary spending?

Cost Optimization.

Which Well-Architected pillar focuses on reducing environmental impact?

Sustainability.

What does it mean to decouple application components?

Let components communicate without depending directly on each other's availability, often through SQS or events.

What is an AWS Region?

A geographic area containing multiple isolated Availability Zones.

What is an Availability Zone?

One or more distinct data centers within a Region, with independent infrastructure.

Why deploy an application across multiple Availability Zones?

To improve availability if one AZ fails.

What is an edge location used for?

Caching and delivering content closer to users, especially with CloudFront.

When would you use AWS Local Zones?

When applications need compute and storage near users in a particular metropolitan area.

When would you use AWS Wavelength?

For low-latency applications inside a telecom provider's 5G network.

What is AWS Outposts?

AWS-managed infrastructure installed on premises to run supported AWS services locally.

What are four factors for selecting an AWS Region?

Compliance or data residency, proximity to users, service availability, and pricing.

In the shared responsibility model, what does AWS secure?

Security of the cloud: physical facilities, hardware, and underlying infrastructure.

In the shared responsibility model, what does the customer secure?

Security in the cloud: data, identities, application configuration, and responsibilities specific to the service.

Who patches the guest operating system on an EC2 instance?

The customer.

Who patches the underlying physical host of EC2?

AWS.

Who manages IAM access and permissions?

The customer.

How does customer responsibility generally change from EC2 to managed services?

The customer manages fewer infrastructure components, but still controls data, identities, and relevant configurations.

What is the principle of least privilege?

Grant only the permissions needed to perform a task.

What is an IAM user?

A long-term identity in an AWS account for a person or application.

What is an IAM group?

A collection of IAM users to which permissions can be assigned together.

What is an IAM role?

An assumable identity that supplies temporary credentials to people or workloads.

What is an IAM policy?

A JSON document defining allowed or denied actions on resources.

How should an EC2 instance obtain permissions to access S3?

Attach an IAM role to the instance instead of storing long-term access keys.

What should you do to secure the root user?

Enable MFA, protect its credentials, and reserve it for tasks that require root access.

What is IAM Identity Center used for?

Centralized workforce access to multiple AWS accounts and applications.

What is the difference between Cognito User Pools and Identity Pools?

User Pools authenticate app users; Identity Pools grant temporary AWS credentials to authenticated identities.

What does AWS KMS manage?

Encryption keys used by AWS services and applications.

When would you use AWS CloudHSM?

When compliance or control requirements call for dedicated hardware security modules and direct key control.

What does AWS Certificate Manager provide?

Provisioning and management of TLS certificates for supported AWS integrations.

Which service stores and automatically rotates secrets?

AWS Secrets Manager.

Which service stores application configuration values and can store SecureString secrets?

AWS Systems Manager Parameter Store.

Which service detects suspicious activity such as compromised credentials and unusual API calls?

Amazon GuardDuty.

Which service continuously scans EC2, Lambda, and container images for vulnerabilities?

Amazon Inspector.

Which service discovers sensitive data such as personal information in S3?

Amazon Macie.

Which service helps investigate security findings using related events and activity?

Amazon Detective.

Which service filters HTTP requests for SQL injection, XSS, and abusive traffic?

AWS WAF.

Which service provides DDoS protection?

AWS Shield.

Which service centrally manages security rules across AWS accounts?

AWS Firewall Manager.

Which service aggregates security findings and compliance checks?

AWS Security Hub.

Where can you download AWS compliance reports and agreements?

AWS Artifact.

Which service collects evidence for audits?

AWS Audit Manager.

What is AWS Organizations used for?

Managing multiple accounts with consolidated billing, organizational units, and service control policies.

What does a service control policy (SCP) do?

Sets the maximum permissions available to accounts within an AWS Organization; it does not grant permissions by itself.

What does AWS Control Tower help set up?

A governed multi-account landing zone with guardrails.

Which tool finds resources shared with external entities?

IAM Access Analyzer.

What is Amazon EC2?

Resizable virtual servers with control over the guest operating system.

What is AWS Lambda?

Event-driven code execution without managing servers; each invocation has a maximum duration of 15 minutes.

What is AWS Fargate?

Serverless compute for running containers with ECS or EKS without managing EC2 hosts.

What is AWS Elastic Beanstalk?

A service that deploys applications and handles provisioning, scaling, and health monitoring.

Which service is suited to a simple virtual private server or WordPress site?

Amazon Lightsail.

Which service runs large numbers of batch jobs?

AWS Batch.

Which EC2 instance family fits balanced workloads?

General purpose instances, such as M or T families.

Which EC2 instance family fits CPU-intensive tasks?

Compute optimized C family.

Which EC2 instance family fits large in-memory databases?

Memory optimized families such as R.

Which EC2 instance family fits high disk throughput or I/O?

Storage optimized families.

Which EC2 instance family fits GPU-based machine learning or graphics?

Accelerated computing instances.

What does EC2 Auto Scaling change?

The number of EC2 instances based on demand or a schedule.

What is the difference between ECS and EKS?

ECS is AWS-native container orchestration; EKS provides managed Kubernetes.

What is Amazon ECR?

A managed repository for container images.

What is Amazon S3?

Scalable object storage organized into buckets and objects.

Which S3 class is best for frequently accessed objects?

S3 Standard.

Which S3 class adapts to unknown or changing access patterns?

S3 Intelligent-Tiering.

Which S3 class is for infrequently accessed objects requiring immediate retrieval across multiple AZs?

S3 Standard-IA.

Which S3 class is for recreatable infrequently accessed objects stored in one AZ?

S3 One Zone-IA.

Which S3 archival class offers millisecond retrieval?

S3 Glacier Instant Retrieval.

Which S3 archival class supports minutes-to-hours retrieval?

S3 Glacier Flexible Retrieval.

Which S3 class fits the lowest-cost long-term archive with the slowest retrieval?

S3 Glacier Deep Archive.

What does S3 versioning protect against?

Accidental overwrite or deletion by retaining previous object versions.

What does an S3 lifecycle policy do?

Automatically transitions or expires objects according to rules.

What is an S3 presigned URL?

A time-limited link granting access to a private object.

What is Amazon EBS?

Persistent block storage typically attached to an EC2 instance.

What happens to instance store data when its instance stops or terminates?

It is lost; instance store is ephemeral.

What is Amazon EFS?

A managed shared NFS file system that can be mounted by multiple Linux instances.

Which service offers a managed Windows file system using SMB?

Amazon FSx for Windows File Server.

Which service connects on-premises file, volume, or tape workloads to AWS storage?

AWS Storage Gateway.

Which service centrally manages backups across supported AWS services?

AWS Backup.

What is Amazon RDS?

A managed relational database service supporting engines such as PostgreSQL and MySQL.

What is Amazon Aurora?

An AWS-built relational database compatible with MySQL or PostgreSQL.

What is Amazon DynamoDB?

A managed NoSQL key-value and document database.

Which managed database supports MongoDB-compatible document workloads?

Amazon DocumentDB.

Which managed database is designed for highly connected graph data?

Amazon Neptune.

Which service adds in-memory caching for applications?

Amazon ElastiCache.

Which service is an AWS data warehouse for analytics?

Amazon Redshift.

What problem does an RDS Multi-AZ deployment solve?

High availability through automatic failover to a standby in another AZ.

What problem do RDS read replicas solve?

Scaling read traffic using asynchronous replicas.

What is an Amazon VPC?

A logically isolated virtual network in AWS.

What makes a subnet public?

Its route table has a route to an internet gateway.

What does an internet gateway enable?

Internet connectivity for resources in a VPC that have suitable routing and addresses.

Why use a NAT gateway?

Allow private-subnet resources to initiate outbound internet connections without permitting unsolicited inbound internet traffic.

What is the difference between a security group and a network ACL?

Security groups are stateful and use allow rules at the resource interface; NACLs are stateless and support allow and deny rules at the subnet.

What is a VPC endpoint?

A private way to reach supported AWS services without traversing the public internet.

What is a limitation of VPC peering?

It is not transitive.

Which service connects many VPCs and on-premises networks through a hub?

AWS Transit Gateway.