AWS Certified Cloud Practitioner

Amazon CloudFront is a global service that delivers your content through a worldwide network of data centers called edge locations or points of presence (POPs). If your content is not already cached in an edge location, CloudFront retrieves it from an origin that you‘ve identified as the source for the definitive version of the content.
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.
An AWS resource can be a Global, Regional, or Zonal service. A Global service means that it covers all of the AWS Regions across the globe, while a regional service means that a resource is only applicable to one specific region at a time. A regional service may or may not have the ability to replicate the same resource in another region. Lastly, a Zonal service can only exist in one Availability Zone.

(IMAGE)
You don‘t need to memorize the scope of all of the AWS services as long as you know the pattern. There are actually only a handful of services that are considered global services such as IAM, STS, Route 53, CloudFront, and WAF. For Zonal services, the examples are EC2 Instances and EBS Volumes which are tied to the Availability Zone where they were launched. Take note that although EBS Volumes are considered a zonal service, the EBS snapshots are considered regional since it is not tied to a specific Availability Zone. Most of the services are regional in scope.
Hence, the correct answers are:
– AWS Identity and Access Management
– Amazon CloudFront
AWS Batch, Amazon RDS, and Amazon DynamoDB are incorrect because these are considered regional services and not global.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resources.html
https://d1.awsstatic.com/whitepapers/architecture/AWS-Reliability-Pillar.pdf
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events
Check out these AWS IAM and Amazon CloudFront Cheat Sheets:
https://tutorialsdojo.com/aws-identity-and-access-management-iam/
https://tutorialsdojo.com/amazon-cloudfront/

In today‘s rapidly evolving business landscape, organizations constantly seek ways to stay ahead of the competition and unlock new growth opportunities. One powerful approach to achieve this is through the cloud-powered digital transformation of business processes, and a framework that facilitates this transformation is the AWS Cloud Adoption Framework (CAF) and its Cloud Transformation Value Chain.

The AWS CAF provides comprehensive guidelines, best practices, and tools to help organizations plan, execute, and manage their cloud adoption journey. It serves as a roadmap for businesses to navigate the complexities of digital transformation and leverage the full potential of cloud computing services offered by AWS. Cloud Transformation Value Chain has four key areas that must be addressed for a successful digital transformation, which are the following:
– Technological transformation involves using the power of cloud computing to optimize and modernize existing IT infrastructure. It enables businesses to quickly adapt to changing market demands, scale resources on demand, and reduce operational complexities.
– Process transformation focuses on reimagining and optimizing business processes to utilize cloud-native capabilities. By embracing cloud-native tools and services, organizations can automate repetitive tasks, improve collaboration and communication, and accelerate time-to-market for new products and services.
– Organizational transformation entails reshaping an organization‘s culture, structure, and skills to support cloud-powered digital transformation. This involves fostering a cloud-first mindset, establishing new roles and responsibilities, and upskilling employees to work effectively in the cloud environment. By embracing a culture of innovation and agility, organizations can enable faster decision-making, promote cross-functional collaboration, and drive continuous improvement.
– Product transformation uses cloud capabilities to innovate and deliver new digital products and services. This transformation enables businesses to enhance customer experiences, explore new revenue streams, and gain a competitive advantage in the market.
Restructuring teams to prioritize product-focused and value stream-oriented approaches emphasizes the importance of organizing teams around specific products or value streams. By doing so, the company can foster collaboration among team members who are responsible for delivering value to customers. This approach encourages cross-functional cooperation and ensures that teams are aligned with the firm‘s strategic objectives.
Adopting agile methodologies, on the other hand, promote iterative development, frequent customer feedback, and continuous improvement. By adopting agile practices, the company can respond quickly to customer needs, adapt to changing market conditions, and continuously deliver value.
Hence the correct answers are:
– Restructure teams to prioritize product-focused and value stream-oriented approaches.
– Adopt agile methodologies for continuous improvement and rapid innovation.
The option that says: Transition and upgrade legacy infrastructure through migration and modernization efforts is incorrect. While transitioning and upgrading legacy infrastructure can be beneficial for optimizing operations and improving product quality, it does not directly address the goal of increasing agility and responsiveness to customer needs. It focuses more on the technical components of infrastructure.
The option that says: Employ a robust data and analytics platform to generate actionable insights is incorrect. Employing a data and analytics platform is indeed valuable for generating actionable insights. However, while it can provide helpful insight, it is not directly tied to optimizing operations and delivery processes or enhancing agility and responsiveness.
The option that says: Introduce new products and revenue models is incorrect. This option focuses more on innovation and expanding the company‘s offerings rather than promoting team collaboration and a customer-centric approach.
References:
https://docs.aws.amazon.com/pdfs/whitepapers/latest/overview-aws-cloud-adoption-framework/overview-aws-cloud-adoption-framework.pdf
https://aws.amazon.com/cloud-adoption-framework/

AWS Fargate – AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon EKS. Compute Savings Plans apply to AWS Fargate usage, which can significantly reduce the cost compared to On-Demand usage.
AWS Lambda – AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute resources. Lambda also supports Compute Savings Plans, so the cost can be optimized based on committed usage.
Incorrect Options:
Amazon RDS – Amazon RDS is a relational database service, not a compute service. Therefore, it doesn‘t support Compute Savings Plans.
Amazon Lightsail – Amazon Lightsail is a virtual private server (VPS) service. While it does provide compute power, it is not covered under Compute Savings Plans.
Amazon SNS – Amazon SNS (Simple Notification Service) is a fully managed messaging service for both application-to-application and application-to-person communication. It‘s not a compute service and therefore does not support Compute Savings Plans.
References:
https://aws.amazon.com/savingsplans/compute-pricing
https://aws.amazon.com/fargate/pricing
https://aws.amazon.com/lambda/pricing

AWS Health provides ongoing visibility into your resource performance and the availability of your AWS services and accounts. You can use AWS Health events to learn how service and resource changes might affect your applications running on AWS. AWS Health provides relevant and timely information to help you manage events in progress. AWS Health also helps you be aware of and to prepare for planned activities. The service delivers alerts and notifications triggered by changes in the health of AWS resources so that you get near-instant event visibility and guidance to help accelerate troubleshooting.

(IMAGE)
AWS Health Dashboard provides a complete health check of all services in all regions. Health events can help you learn how changes to services and resources may affect your AWS-hosted applications.
Hence, the correct answer is AWS Health.
AWS Support Center is incorrect because this is where you can check the support package you are subscribed to, and where you can file cases if you need assistance from the AWS support team. This option is incorrect since it does not provide the information stated in the scenario.
Amazon CloudWatch is incorrect because this collects data across all your AWS resources, applications, and services. Also, AWS does not use this dashboard to notify you of any upcoming changes or system-impactful issues.
Amazon SNS is incorrect because this is simply a messaging service used to deliver push notifications to recipients. This option is incorrect since it is the service used by AWS to notify you of any system-impactful issues.
References:
https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/
https://docs.aws.amazon.com/health/latest/ug/getting-started-phd.html
Check out this AWS Health Cheat Sheet:
https://tutorialsdojo.com/aws-health/

Enhanced Security aligned with your controls – AWS Managed Services (AMS) builds and maintains a growing repository of compliance, operational, and security guardrails that help keep you aligned with your controls. AMS reduces the burden of meeting compliance program requirements (HIPAA, HITRUST, GDPR, SOC, NIST, ISO, PCI, FedRAMP) through automated detection and remediation automation.
Reduced operational costs for maintaining – AWS Managed Services (AMS) helps with financial optimization across your AWS estate, and any savings identified reduces your AMS fee without impacting operational outcomes. The customers have enjoyed up to 30% in operational savings and up to 25% in AWS infrastructure savings. Pay for what you use and take back operational control when you are ready.
Incorrect Options:
Increased high-level control of infrastructure – This option is incorrect. It is not an advantage of AWS managed services. For managed service, AWS takes care of the foundation infrastructure, Operating System, Platform, software, physical network. So you don’t get access to the underlying infrastructure.
Provided free enterprise level support – This option is incorrect. It is not an advantage of AWS managed services. You have to pay for AWS Enterprise support For more details https://aws.amazon.com/premiumsupport/plans/enterprise
Automatically encrypted data at rest – This option is incorrect. It is not an advantage of AWS managed services. AWS doesn’t provide automatic security for customers‘ data at rest. So you should enable encryption for protecting your sensitive data.
References:
https://aws.amazon.com/managed-services

Maintaining Operating System – AWS is responsible for maintaining the underlying infrastructure and the operating system for managed services like Amazon RDS. This responsibility includes ensuring that the operating system is up-to-date with the latest patches and security updates.
Patching database software – Another responsibility of AWS for managed services like Amazon RDS is patching the database software. AWS takes care of applying necessary patches and updates to the database software to ensure security, stability, and performance improvements. This includes both major and minor updates, bug fixes, and security patches.
Incorrect Options:
Encrypting data at rest – AWS provides options and capabilities to encrypt data at rest in Amazon RDS, the choice and implementation to use these options are the responsibility of the customer.
Managing IAM Groups – Management of AWS Identity and Access Management (IAM) groups, including the creation of users, roles, and policies, is the responsibility of the customer.
Managing access policies – Managing access policies is a customer‘s responsibility. Customers define and manage policies to control access to AWS resources.
References:
https://aws.amazon.com/compliance/shared-responsibility-model
https://aws.amazon.com/rds

Amazon Lex is a powerful artificial intelligence service enabling developers to build conversational application interfaces. With Amazon Lex, developers can quickly create intelligent bots that can understand natural language input and respond to user requests in a human-like manner. The service uses advanced natural language processing and machine learning algorithms to interpret user input and generate appropriate responses.

One of the key benefits of Amazon Lex is its ease of use. The service provides a simple-to-use console that lets developers quickly configure and deploy their bots. Developers can use the console to specify the bot‘s intents, sample utterances, and slot types. Furthermore, Amazon Lex integrates seamlessly with other Amazon services, such as AWS Lambda, Amazon DynamoDB, and Amazon S3, enabling developers to build robust, data-driven bots that can perform complex tasks.
Hence the correct answer to the given scenario is: Amazon Lex.
Amazon Personalize is incorrect because this service only focuses on providing personalized recommendations for users based on their preferences and behavior. Moreover, Amazon Personalize does not provide the necessary components for understanding and conversationally responding to user inputs.
Amazon Translate is incorrect because the primary purpose of this service is only for translating text between languages. It does not provide the core functionality required to build the conversational interface.
Amazon Polly is incorrect because it just converts text into lifelike speech. It provides a text-to-speech (TTS) functionality, allowing applications to generate spoken output from text inputs. However, this service does not provide the natural language understanding and dialog management capabilities essential for building a conversational interface.
References:
https://aws.amazon.com/lex
https://docs.aws.amazon.com/lexv2/latest/dg/how-it-works.html
Check out these Amazon Lex Cheat Sheets:
https://tutorialsdojo.com/amazon-lex/

The purpose of automatic scaling is to automatically increase the size of your Auto Scaling group when demand goes up and decrease it when demand goes down. As capacity is increased or decreased, the Amazon EC2 instances being added or removed must be registered or deregistered with a load balancer. This enables your application to automatically distribute incoming web traffic across such a dynamically changing number of instances.

(IMAGE)
Your load balancer acts as a single point of contact for all incoming web traffic to your Auto Scaling group. When an instance is added to your Auto Scaling group, it needs to register with the load balancer, or no traffic is routed to it. When an instance is removed from your Auto Scaling group, it must deregister from the load balancer or traffic continues to be routed to it.
Hence, the correct answers are:
– AWS ELB
– Amazon EC2 Auto Scaling
Amazon CloudWatch and Amazon CloudFront are both incorrect because these are not the primary services to be used to achieve a highly available and scalable application in the Cloud.
Amazon AppStream 2.0 is incorrect because this is just a fully managed application streaming service that you can use to centrally manage your desktop applications.
References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.html
https://aws.amazon.com/autoscaling/
https://aws.amazon.com/elasticloadbalancing/
Check out these Tutorials Dojo Cheat Sheets:
https://tutorialsdojo.com/aws-elastic-load-balancing-elb/
https://tutorialsdojo.com/aws-auto-scaling/

Migrate to Amazon RDS with enabling Multi-AZ DB instance deployments – To achieve higher availability for the MySQL database, it is recommended to migrate to Amazon RDS (Relational Database Service) with Multi-AZ (Availability Zone) DB instance deployments. Amazon RDS is a managed database service that simplifies database administration tasks. Multi-AZ deployment provides automatic synchronous replication of the database to a standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically promotes the standby replica to the primary database, minimizing downtime and ensuring high availability. By migrating to Amazon RDS with Multi-AZ, the company can benefit from automated failover, data durability, and reduced operational overhead for managing the database.
Incorrect Options:
Upgrade EC2 instance size (Increase CPU & RAM) – Increasing the size of the EC2 instance, such as upgrading the CPU and RAM, does not address the requirement for higher availability. It only improves the performance and capacity of the database server but does not provide built-in mechanisms for redundancy and failover.
Enable termination protection to avoid outages – Enabling termination protection on an EC2 instance prevents accidental termination, but it does not improve the availability of the database. Termination protection is designed to prevent instances from being terminated through user error or automation, but it does not protect against instance failures or provide automatic failover.
Add an Application Load Balancer to the EC2 instance – While an Application Load Balancer (ALB) can distribute incoming traffic across multiple EC2 instances, it does not inherently provide high availability for a single database instance. ALBs are typically used for distributing traffic to multiple instances of an application to improve scalability and fault tolerance, but they do not address the specific requirement of higher availability for a database running on a single EC2 instance.
References:
https://aws.amazon.com/rds
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Amazon Inspector – Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It analyzes the behavior of the AWS resources and helps identify potential security issues, vulnerabilities, or deviations from best practices. By running Amazon Inspector, AWS customers can receive a detailed report on the security state of their AWS resources and actionable recommendations to mitigate any identified risks. Therefore, Amazon Inspector is the correct choice.

Incorrect Options:
AWS GuardDuty – GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized activity. It doesn‘t perform vulnerability assessments or security audits, making this option incorrect.
AWS WAF – AWS WAF (Web Application Firewall) protects web applications from common web exploits. It is used for protection rather than performing vulnerability assessments or audits, hence this is not the correct answer.
AWS KMS – AWS Key Management Service (KMS) is used to create and manage cryptographic keys and control their use across a wide range of AWS services and in applications. It doesn‘t perform vulnerability assessments or security audits, making this option incorrect.
References:
https://aws.amazon.com/inspector

Security and Compliance are a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.
The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS-provided security group firewall. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations.
The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment. As shown in the chart below, this differentiation of responsibility is commonly referred to as Security OF the Cloud versus Security IN the Cloud.

(IMAGE)
This customer/AWS shared responsibility model also extends to IT controls. Just as the responsibility to operate the IT environment is shared between AWS and its customers, so is the management, operation, and verification of IT controls shared. AWS can help relieve the customer burden of operating controls by managing those controls associated with the physical infrastructure deployed in the AWS environment that may previously have been managed by the customer. As every customer is deployed differently in AWS, customers can take advantage of shifting management of certain IT controls to AWS which results in a (new) distributed control environment.
Customers can then use the AWS control and compliance documentation available to them to perform their control evaluation and verification procedures as required. Below are examples of controls that are managed by AWS, AWS Customers, and/or both.
Inherited Controls: Controls which a customer fully inherits from AWS.
– Physical and Environmental controls
Shared Controls: Controls that apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services.
Examples include:
– Patch Management: AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest OS and applications.
– Configuration Management: AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.
– Awareness & Training: AWS trains AWS employees, but a customer must train their own employees.
Customer Specific: Controls that are solely the responsibility of the customer based on the application they are deploying within AWS services.
Examples include:
– Service and Communications Protection or Zone Security may require a customer to route or zone data within specific security environments.
The host operating system, which is managed by AWS, is the hypervisor that creates several guest operating systems that can be managed by different customers. Amazon EC2 uses a technology commonly known as virtualization to run multiple operating systems on a single physical machine. Virtualization ensures that each guest operating system receives its fair share of CPU time, memory, and I/O bandwidth to the local disk and to the network using a host operating system, sometimes known as a hypervisor. The hypervisor also isolates the guest operating systems from each other so that one guest cannot modify or otherwise interfere with another one on the same machine.
Hence, the correct answer is: AWS.
Customer is incorrect because their responsibility is to patch the guest operating system of their EC2 instance and not the host operating system.
Both AWS and the customer is incorrect because patching the host operating system of the Amazon EC2 instance is the responsibility of AWS. Take note that if you are using a fully-managed service like Amazon DynamoDB or Redshift, AWS will also be responsible for the underlying guest operating system.
Neither AWS nor the customer is incorrect as this task falls under the responsibilities of AWS.
References:
https://aws.amazon.com/compliance/shared-responsibility-model/
https://d1.awsstatic.com/Marketplace/scenarios/security/SEC_02_TSB_Final.pdf
https://d1.awsstatic.com/whitepapers/Security/Security_Compute_Services_Whitepaper.pdf
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-certified-cloud-practitioner/

You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-in-time snapshots. Snapshots are incremental backups, which means that only the blocks on the device that have changed after your most recent snapshot are saved. This minimizes the time required to create the snapshot and saves on storage costs by not duplicating data. Each snapshot contains all of the information that is needed to restore your data (from the moment when the snapshot was taken) to a new EBS volume.

Hence, the correct answer are:
– You can create point-in-time backups through EBS snapshots
– EBS backups are stored durably in Amazon S3
The option that says: You can take EBS backups by creating Amazon Machine Images (AMIs) is incorrect because EBS backup volumes are not called AMIs. An Amazon Machine Image (AMI) is a backup of an EC2 instance along with all of its EBS volumes. Since only a single volume needs to be backed up, you should create EBS Snapshots instead.
The option that says: Backing up the same EBS volume will create a new back up of the whole volume is incorrect because EBS Snapshots are incremental, which means that only the latest changes are backed up when you run the backup process. It does not back up the whole volume again.
The option that says: Instances will have to be stopped first to start the EBS backup is incorrect because you can actually run the EBS backup while the EC2 instance is running. This may cause some deterioration in EC2 performance, but it should not have a noticeable effect.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Storage.html
Check out this Amazon EBS Cheat Sheet:
https://tutorialsdojo.com/amazon-ebs/

When granting permissions, you decide who is getting them, which Amazon S3 resources they are getting permissions for, and specific actions you want to allow on those resources. Buckets and objects are Amazon S3 resources. By default, only the resource owner can access these resources. The resource owner refers to the AWS account that creates the resource.

(IMAGE)
Bucket policy and user policy are two of the access policy options available for you to grant permission to your Amazon S3 resources. Both use JSON-based access policy language. You add a bucket policy to a bucket to grant other AWS accounts or IAM users access permissions for the bucket and the objects in it. User policies are policies that allow an IAM user access to one of your buckets.
Hence, the correct answers are:
– Bucket policies
– User policies
All the other options are incorrect as these are not the correct features that will grant permissions to your Amazon S3 bucket.
– Routing policies
– Network access control policies
– Object policies
References:
https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html
https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/
Check out this Amazon S3 Cheat Sheet:
https://tutorialsdojo.com/amazon-s3/

Cost Allocation Tags – Cost Allocation Tags help you organize your AWS resources and can assist with managing costs. It is a key-value pairs that you can attach to your AWS resources. Once activated, AWS generates a cost allocation report with usage and costs aggregated by your tags, helping you to track and categorize your AWS costs in a detailed manner.
Incorrect Options:
AWS Budgets – AWS Budgets gives you the ability to set custom cost and usage budgets that alert you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount. However, it doesn‘t categorize or track your costs at a detailed level.
CloudWatch Logs – CloudWatch Logs help you to monitor, store, and access your log files from EC2 instances, and other sources, but it does not assist in tracking or categorizing costs.
AWS Service Catalog – AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS, but it does not track or categorize costs.
References:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

Deploying workloads on Amazon Web Services (AWS) helps streamline time-to-market, increase business efficiency, and enhance user performance for many organizations. But as you capitalize on this strategy, it is important to understand your role in securing your AWS environment.
Based on the AWS Shared Responsibility Model, AWS provides a data center and network architecture built to meet the requirements of the most security-sensitive organizations, while you are responsible for securing services built on top of this infrastructure, notably including network traffic from remote networks.

This customer/AWS shared responsibility model also extends to IT controls. Just as the responsibility to operate the IT environment is shared between AWS and its customers, so is the management, operation and verification of IT controls shared. AWS can help relieve customer burden of operating controls by managing those controls associated with the physical infrastructure deployed in the AWS environment that may previously have been managed by the customer. As every customer is deployed differently in AWS, customers can take advantage of shifting management of certain IT controls to AWS which results in a distributed control environment.
Customers can then use the AWS control and compliance documentation available to them to perform their control evaluation and verification procedures as required. Below are examples of controls that are managed by AWS, AWS Customers and/or both.
Inherited Controls: Controls which a customer fully inherits from AWS.
– Physical and Environmental controls
Shared Controls: Controls which apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services. Examples include:
– Patch Management: AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest OS and applications.
– Configuration Management: AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.
– Awareness & Training: AWS trains AWS employees, but a customer must train their own employees.
Customer Specific: Controls which are solely the responsibility of the customer based on the application they are deploying within AWS services. Examples include:
– Service and Communications Protection or Zone Security which may require a customer to route or zone data within specific security environments.
Hence, the correct answer is: Awareness and training.
The options that say: Client-side data encryption and Server-side data encryption are incorrect because these items fall under the responsibilities of the customer.
The option that says: Physical and environmental controls of the AWS data centers is incorrect because this is the sole responsibility of AWS.
References:
https://aws.amazon.com/compliance/shared-responsibility-model/
https://d1.awsstatic.com/Marketplace/scenarios/security/SEC_02_TSB_Final.pdf
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-certified-cloud-practitioner/

Launch the EC2 instances across multiple Availability Zones in a single AWS Region – High availability in AWS is achieved by distributing resources across multiple, isolated Availability Zones within an AWS Region. Availability Zones are distinct locations that are engineered to be insulated from failures in other Availability Zones. By launching EC2 instances across multiple Availability Zones, you can ensure that a failure in one zone does not affect the overall availability of your application.
Incorrect Options:
Launch the instances as EC2 Reserved Instances in the same AWS Region and the same Availability Zone – Reserved Instances provide a capacity reservation, but placing all instances in the same Availability Zone doesn‘t promote high availability because it doesn‘t protect from a single point of failure.
Launch the instances in multiple AWS Regions but in the same Availability Zone – This option is not technically possible because Availability Zones are distinct to each Region. The phrasing appears to misunderstand the relationship between Regions and Availability Zones in AWS.
Launch the instances as EC2 Spot Instances in the same AWS Region but in different Availability Zones – While distributing instances across different Availability Zones promotes high availability, using Spot Instances may not because they can be interrupted with two minutes notice when AWS needs the capacity back.
References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-availability-zone.html

There are three main models for cloud computing. Each model represents a different part of the cloud computing stack, they are:
– Infrastructure as a Service (IaaS)
– Platform as a Service (PaaS)
– Software as a Service (SaaS)

Infrastructure as a Service, sometimes abbreviated as IaaS, contains the basic building blocks for cloud IT and typically provides access to networking features, computers (virtual or on dedicated hardware), and data storage space. Infrastructure as a Service provides you with the highest level of flexibility and management control over your IT resources and is most similar to existing IT resources that many IT departments and developers are familiar with today. Amazon EC2 is one of the IaaS solutions offered by AWS.
Hence, the correct answer is: Amazon EC2.
AWS CloudFormation is incorrect because this is a service that enables you to turn your infrastructure into code, making it more reusable and modifiable. This service is categorized under automation, not IaaS.
AWS Elastic Beanstalk is incorrect because this is a PaaS solution, not IaaS. It is PaaS since it gives you a platform where you can simply deploy your code, and AWS handles all the necessary infrastructure provisioning for you.
AWS IAM is incorrect because this is just a security service in AWS used for user and account management. It is not IaaS since you are not using any cloud infrastructure with IAM.
References:
https://aws.amazon.com/ec2/
https://aws.amazon.com/types-of-cloud-computing/
Amazon EC2 Overview:
https://www.youtube.com/watch?v=7VsGIHT_jQE
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

High availability – Amazon RDS Multi-AZ deployments are primarily used to provide high availability and failover support for DB instances. In a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a standby in a different Availability Zone for failover support in case of a planned or unplanned outage. This architecture offers enhanced availability and durability of the database instances, making them a natural fit for mission-critical, production database workloads. The usage of RDS Multi-AZ deployments as a high availability solution enables the hosting company to maintain continuous service even if one instance fails, thereby demonstrating the high availability characteristic of the AWS Cloud.
Incorrect Options:
Durability – Amazon RDS Multi-AZ deployments ensure high availability rather than durability. Durability, in terms of data storage, refers to the long-term integrity and preservation of data, which is not the purpose of RDS Multi-AZ deployments.
Elasticity – Amazon RDS Multi-AZ deployments are not for elasticity. Elasticity in the AWS Cloud refers to the ability to quickly scale resources up or down to meet demand, which is not the feature of RDS Multi-AZ deployments.
Scalability – Scalability refers to the ability to increase or decrease the resources or services based on demand. While RDS Multi-AZ does allow for some level of scalability, its primary purpose is to provide high availability and failover support, not to scale resources.
References:
https://aws.amazon.com/rds/features/multi-az/

Amazon WorkSpaces – Amazon WorkSpaces provides a cloud-based virtual desktop infrastructure (VDI) solution. It offers a persistent and fully managed desktop experience in the cloud, acting as a replacement for traditional desktops. With WorkSpaces, users can access their desktops from anywhere using a supported device, including laptops, tablets, and thin clients. WorkSpaces allows organizations to provision and manage virtual desktops for their users, providing a consistent and secure computing environment. It supports various operating systems and offers flexibility in terms of hardware configurations and software applications. Amazon WorkSpaces simplifies desktop management, reduces hardware dependencies, and enables remote access and mobility.
How it works

Incorrect Options:
Amazon AppStream 2.0 – Amazon AppStream 2.0 is a service that enables users to stream desktop applications to their devices, rather than providing a full virtual desktop experience. It is designed for application streaming and does not serve as a direct replacement for traditional desktops.
Amazon WorkLink – Amazon WorkLink is a service that allows users to securely access internal websites and web applications from mobile devices. It focuses on providing secure and simplified access to web content, rather than offering a complete virtual desktop replacement.
AWS Cloud9 – AWS Cloud9 is a cloud-based integrated development environment (IDE) that allows developers to write, run, and debug code from their browsers. While Cloud9 provides a development environment in the cloud, it is not intended as a replacement for traditional desktops, as it primarily serves as a coding and collaboration platform for developers.
References:
https://aws.amazon.com/workspaces

Amazon Detective is an AWS security service that allows you to assess, investigate, and pinpoint the source of suspected security vulnerabilities or suspicious activity in your AWS environment. It builds interactive visualizations and models of the AWS environment using machine learning, statistical analysis, and graph theory, allowing you to quickly and easily identify and investigate security problems. By collecting and analyzing log data from various AWS services, such as VPC Flow Logs, AWS CloudTrail, and Amazon GuardDuty, Amazon Detective allows you to have a comprehensive and centralized view of your AWS environment‘s security posture.

Amazon Detective automates many of the laborious processes associated with incident investigation and provides you with an easy and interactive interface for exploring and visualizing your data. It allows you to concentrate on the most severe security occurrences while immediately identifying and remediating security flaws. With Amazon Detective, you can improve your overall security posture and maintain compliance with security and privacy regulations by quickly identifying and addressing potential security issues.
Hence the correct answer is: Amazon Detective.
Amazon Inspector is incorrect because this service helps you assess and improve the security and compliance of your AWS applications by automatically analyzing application security vulnerabilities and deviations from best practices. Thus, Amazon Inspector is a security service that focuses on application-level security and not on investigating and identifying the root cause of potential security issues or suspicious activities in the AWS environment.
Amazon GuardDuty is incorrect because this threat detection service continuously monitors your AWS accounts and workloads for potential security threats and suspicious activities. It uses machine learning and anomaly detection to identify and alert customers to security issues, such as compromised EC2 instances, unauthorized API calls, and network attacks.
AWS Security Hub is incorrect because this service provides you with a comprehensive view of their security and compliance status across multiple AWS accounts and services. It aggregates and prioritizes security alerts and findings from various AWS services, including Amazon GuardDuty, Amazon Inspector, and AWS Config, and provides centralized visibility into security and compliance issues.
References:
https://docs.aws.amazon.com/detective/latest/userguide/detective-investigation-about.html
https://aws.amazon.com/detective/
Check out this Amazon Detective Cheat Sheet:
https://tutorialsdojo.com/amazon-detective/
Amazon Detective – AWS Cloud Practitioner Exam Topics:
https://youtu.be/2Un8x82sE8U

Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.
The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations. The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment. This differentiation of responsibility is commonly referred to as the Security OF the Cloud versus Security IN the Cloud.

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. Since you have more control over your EC2 instance, you can install any database that you prefer and manage its guest operating system, including the required updates and security patches. You can also choose an AMI with a pre-installed database (such as PostgreSQL or MySQL) in the Amazon EC2 Dashboard to save your time.
Hence, the correct answer is: Amazon EC2.
Amazon Aurora is incorrect because this is a fully-managed service that automates time-consuming administration tasks like hardware provisioning, database setup, patching, and backups without any manual intervention from you.
Amazon DocumentDB is incorrect because this is a fully-managed document database service that supports MongoDB workloads. Just like Amazon Aurora, you don‘t need to handle or manage the guest operating system of this service since it is already managed by AWS.
Amazon DynamoDB is incorrect because just like the other two options above, this is also a fully-managed database service which means that you won‘t be able to manage the underlying guest operating system or apply the required updates and security patches.
References:
https://aws.amazon.com/ec2/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/install-software.html
https://aws.amazon.com/products/databases/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
Amazon EC2 Overview:
https://youtu.be/7VsGIHT_jQE

Can configure DNS settings for health checks and use routing policy to load balancing – Amazon Route 53 is a scalable and highly available Domain Name System (DNS) web service. You can configure DNS health checks to route traffic to healthy endpoints or independently monitor the health of your application and its endpoints. Route 53 also supports a variety of DNS routing policies that can help you configure load balancing behavior.
Can configure DNS failover so that it will route your traffic to a healthy resource – Amazon Route 53 enables you to set up DNS failover in active-passive and active-active configurations. If one resource becomes unavailable, Amazon Route 53 can automatically route your traffic to a backup resource.
Incorrect Options:
Continually scans AWS workloads for software vulnerabilities and unintended network exposure – This feature is provided by AWS Inspector, not Amazon Route 53. AWS Inspector is a service that helps to improve the security and compliance of applications deployed on AWS.
Can provide a direct connection between AWS cloud and on-premises data center – This feature is supported by AWS Direct Connect, not Amazon Route 53. AWS Direct Connect is a network service that provides an alternative to using the internet to utilize AWS cloud services.
Provides protection against Distributed Denial of Service (DDoS) attacks for applications running on AWS – This is the function of AWS Shield, a managed Distributed Denial of Service (DDoS) protection service. Amazon Route 53 doesn‘t provide this service directly.
References:
https://aws.amazon.com/route53
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. Basically, an Edge location is just a site that CloudFront uses to cache copies of your content for faster delivery to users at any location.
When a user requests content that you‘re serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

Regional edge caches are CloudFront locations that are deployed globally, close to your viewers. They‘re located between your origin server and the points of presence (POPs) —global edge locations that serve content directly to viewers. As objects become less popular, individual POPs might remove those objects to make room for more popular content. Regional edge caches have a larger cache than an individual POP, so objects remain in the cache longer at the nearest regional edge cache location. This helps keep more of your content closer to your viewers, reducing the need for CloudFront to go back to your origin server, and improving overall performance for viewers.
Hence, the correct answers are:
– Improves application performance by delivering content closer to your users
– Provides caching which reduces the load on your origin servers
The option that says: Offers an easy-to-use edge computing device that is helpful for data migration is incorrect because this is the description for AWS Snowball Edge. An edge location is not commonly used for data migration and it is not related to edge computing devices.
The option that says: Seamlessly extends AWS to edge devices so they can act locally on the data they generate, while still using the cloud for management, analytics, and durable storage is incorrect because this describes the AWS IoT Greengrass service which is quite different from Edge locations.
The option that says: Provides highly scalable object storage for your static content is incorrect because this refers to Amazon S3 and not Edge location.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowCloudFrontWorks.html
https://wa.aws.amazon.com/wat.concept.edge-location.en.html
Check out this Amazon CloudFront Cheat Sheet:
https://tutorialsdojo.com/amazon-cloudfront/

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don‘t specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC.
For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This section describes the basic things you need to know about security groups for your VPC and their rules.

Hence, the correct answer is Security Group.
Network ACL is incorrect because this is primarily used to protect your subnets by controlling inbound and outbound traffic. They are not used to secure resources at an instance level.
Elastic Network Interface is incorrect because this is just a logical networking component in a VPC that represents a virtual network card. It does not serve as a virtual firewall for your instances.
Amazon VPC is incorrect because this simply lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. A VPC does not serve as a virtual firewall for your instances.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html
Check out these Tutorials Dojo Cheat Sheets:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
https://tutorialsdojo.com/amazon-vpc/
https://tutorialsdojo.com/security-group-vs-nacl/

AWS offers multiple AMI configurations for Amazon EC2 – from community AMIs to AMIs sold by customers in the AWS Marketplace. If you launch an EC2 instance using a Windows AMI with a bundled MS SQL Server Standard, you won‘t need to purchase your own licenses from Microsoft. And since this is an EC2 instance, you can freely resize it to a different instance type or class of your choosing.

(IMAGE)
Amazon EC2 follows a pay-as-you-go model, so there are no long-term commitments when launching an EC2 instance, even if there is an MS SQL Server installed.
Hence, the correct answer is: Use a Windows Server with SQL Server Standard bundled AMI so you won’t need to buy and manage your own license.
The option that says: Launch an EC2 instance and install MS SQL Server. Purchase a Standard MSSQL license from Microsoft and apply it to the database you installed is incorrect since this is not the most convenient method of launching an MS SQL Server in AWS. You typically use this solution if you already have a SQL Server license and you prefer to BYOL (bring your own license).
The option that says: Launch an RDS instance that runs MS SQL Server Standard. Purchase a Standard MSSQL license and store it in the AWS Managed Services (AMS) is incorrect. It is explicitly stated in the scenario that the database instance should only be managed by the company‘s DBA and must be accessible via RDP. You cannot directly establish an RDS connection to an Amazon RDS database. In addition, Amazon RDS costs more than Amazon EC2 because the infrastructure is managed by AWS.
The option that says: Launch an Amazon Aurora database that runs MS SQL Server. Buy a Standard MSSQL license from the AWS License Manager service is incorrect since Amazon Aurora does not support MS SQL Server. Moreover, you cannot directly buy software licenses from the AWS License Manager service. This is just used to easily manage your software licenses from various vendors such as Microsoft, SAP, Oracle, and IBM across AWS and on-premises environments.
References:
https://aws.amazon.com/sql/
https://aws.amazon.com/windows/resources/licensing/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

Reserved Instances provide you with a significant discount compared to On-Demand Instance pricing. RIs can provide a capacity reservation, offering additional confidence in your ability to launch the number of instances you have reserved when you need them. You can purchase a Reserved Instance for a one-year or three-year commitment, with the three-year commitment offering a bigger discount.
With Reserved Instances (RIs), you can choose the type that best fits your application needs such as Standard RIs, Convertible RIs, and Scheduled RIs.
Reserved Instances are recommended for:
– Applications with steady state usage
– Applications that may require reserved capacity
– Customers that can commit to using EC2 over a 1 or 3 year term to reduce their total computing costs

Hence, the correct answer is Reserved Instances.
Both On-Demand and Dedicated Instance Types are incorrect since they are more expensive than Reserved Instances if billed over a whole year or longer.
Spot Instance is incorrect since this is not optimal for servers that need to be continuously running.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
Amazon EC2 Overview:
https://youtu.be/7VsGIHT_jQE

Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property, and provides you with dashboards and alerts that give visibility into how this data is being accessed or moved. The fully managed service continuously monitors data access activity for anomalies, and generates detailed alerts when it detects risk of unauthorized access or inadvertent data leaks.

(IMAGE)
You can use Amazon Macie to protect against security threats by continuously monitoring your data and account credentials. Amazon Macie gives you an automated and low-touch way to discover and classify your business data and detect sensitive information such as personally identifiable information (PII) and credential data. When alerts are generated, you can use Amazon Macie for incident response, using Amazon EventBridge to swiftly take action to protect your data.
Hence, the correct answer is Amazon Macie.
Amazon Rekognition is incorrect. Although it is also a machine learning-based service like Amazon Macie, it is primarily used for image and video analysis. You can‘t use this to protect your sensitive data in AWS.
Amazon GuardDuty is incorrect because this is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.
Amazon Cognito is incorrect because this is primarily used if you want to add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily.
References:
https://aws.amazon.com/macie/
https://docs.aws.amazon.com/macie/latest/userguide/what-is-macie.html
Check out this Amazon Macie Cheat Sheet:
https://tutorialsdojo.com/amazon-macie/
AWS Security Services Overview – Secrets Manager, ACM, Macie:
https://youtu.be/ogVamzF2Dzk

Amazon Rekognition – Amazon Rekognition is the AWS service that allows you to perform face detection and analysis from millions of images and videos in just minutes. It provides powerful computer vision capabilities for analyzing visual content. With Rekognition, you can detect and analyze faces, identify facial attributes, such as emotions and age range, perform face comparison and recognition, and even track faces in videos. Rekognition utilizes deep learning algorithms to deliver accurate and fast results. It is highly scalable, allowing you to process vast amounts of visual data quickly and efficiently. Amazon Rekognition is widely used in various applications, including security systems, content moderation, personalized user experiences, and social media analytics.
Incorrect Options:
Amazon Polly – Amazon Polly is a text-to-speech (TTS) service that converts text into lifelike speech. It does not provide face detection and analysis from images and videos.
Amazon Transcribe – Amazon Transcribe is an automatic speech recognition (ASR) service that converts spoken language into written text. It is not intended for face detection and analysis tasks.
Amazon Kendra – Amazon Kendra is an intelligent search service powered by machine learning. It is designed to provide highly accurate search results by understanding natural language queries and retrieving information from various data sources. It does not specialize in face detection and analysis from images and videos.
References:
https://aws.amazon.com/rekognition

Amazon Cognito Identity Pool provides temporary AWS credentials for users who are guests (unauthenticated) and for users who have been authenticated and received a token. An identity pool is a store of user identity data specific to your account.
Amazon Cognito identity pools enable you to create unique identities and assign permissions for users. Your identity pool can include:
– Users in an Amazon Cognito user pool
– Users who authenticate with external identity providers such as Facebook, Google, or a SAML-based identity provider
– Users authenticated via your own existing authentication process

(IMAGE)
With an identity pool, you can obtain temporary AWS credentials with permissions you define to directly access other AWS services or to access resources through Amazon API Gateway.
Hence, the correct answer is: Amazon Cognito Identity Pool.
Amazon Cognito User Pool is incorrect because a user pool is a user directory in Amazon Cognito. In addition, it doesn‘t enable access to unauthenticated identities. You have to use an Identity Pool instead.
AWS AppSync is incorrect because this is a service that enables cross-device syncing of application-related user data. It‘s also a serverless GraphQL and Pub/Sub API service that makes it easier to build modern web and mobile apps.
AWS Single Sign-On is incorrect because this service lets you centrally manage SSO access to multiple AWS accounts. It also does not allow any “guest“ or unauthenticated access, unlike Amazon Cognito.
References:
https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html
https://docs.aws.amazon.com/cognito/latest/developerguide/getting-started-with-identity-pools.html
Check out this Amazon Cognito Cheat Sheet:
https://tutorialsdojo.com/amazon-cognito/
AWS Identity Services Overview:
https://youtu.be/AIdUw0i8rr0

Security Pillar
Security is one of the key pillars of the AWS Well-Architected Framework. It involves understanding and applying best practices around the protection of information and systems. The security pillar provides strategies to help you protect your data, systems, and assets in the cloud.
Sustainability Pillar
The sustainability pillar focuses on minimizing the environmental impacts of running cloud workloads. Key topics include a shared responsibility model for sustainability, understanding impact, and maximizing utilization to minimize required resources and reduce downstream impacts.
Incorrect Options:
Elasticity – Elasticity, while a fundamental concept in cloud computing and an aspect addressed within the AWS Well-Architected Framework, but isn‘t officially recognized as one of the six pillars of the framework.
Availability – Availability is a crucial aspect of cloud architectures and is a part of the Reliability pillar. It isn‘t a standalone pillar in the AWS Well-Architected Framework.
Scalability – Scalability is a key aspect of Performance Efficiency, but it‘s not a standalone pillar in the AWS Well-Architected Framework.
References:
https://aws.amazon.com/architecture/well-architected

Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0.

Amazon Cognito provides solutions to control access to backend resources from your app. You can define roles and map users to different roles so your app can access only the resources that are authorized for each user.
With a built-in UI and easy configuration for federating identity providers, you can integrate Amazon Cognito to add user sign-in, sign-up, and access control to your app in minutes. You can customize the UI to put your company branding front and center for all user interactions.
Hence, the correct answer is Amazon Cognito.
AWS Single Sign-On (SSO) is incorrect because this is a cloud SSO service that makes it easy to centrally manage SSO access to multiple AWS accounts and business applications. It doesn‘t provide an easy way to add user sign-in, sign-up, and access control to your mobile app, unlike Amazon Cognito.
AWS Identity and Access Management (IAM) is incorrect because this service lets you to manage access to AWS services and resources securely.
AWS Directory Service is incorrect because it enables your directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud.
References:
https://aws.amazon.com/cognito/
https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-integrating-user-pools-with-identity-pools.html
Check out this Amazon Cognito Cheat Sheet:
https://tutorialsdojo.com/amazon-cognito/

Amazon Linux instances are now billed in a per-second duration. With per-second billing, you pay for only what you use. It takes the cost of unused minutes and seconds in an hour off of the bill, so you can focus on improving your applications instead of maximizing usage to the hour. Especially, if you manage instances running for irregular periods of time, such as dev/testing, data processing, analytics, batch processing, and gaming applications, can benefit.

EC2 usage is billed in one-second increments, with a minimum of 60 seconds. Similarly, provisioned storage for EBS volumes will be billed per-second increments, with a 60-second minimum. It is in your best interest to understand the billing structure of your commonly used service to avoid budgeting concerns.
You can also set your billing to hourly if you wish. In this case, even a fraction of an hour of usage will cost you the equivalent of a full hour‘s usage. You will NOT be billed for only an hour if you choose to follow hourly billing.
Hence, the correct answer is: You will be billed for an hour and thirty minutes according to the per-second billing rule.
All other options are incorrect because these are false statements about EC2 Usage pricing.
– You will only be billed for an hour according to the hourly billing rule.
– You will be billed for one hour and thirty minutes according to the hourly billing rule.
– You will be billed for an hour and twenty-nine minutes according to the per second billing rule.
References:
https://aws.amazon.com/ec2/pricing/
https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf
https://aws.amazon.com/about-aws/whats-new/2017/10/announcing-amazon-ec2-per-second-billing/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

The Service Organization Controls (SOC) Reports are used to evaluate the effectiveness of AWS controls that might affect your internal controls over financial reporting (ICOFR). The audit is performed according to the SSAE 18 and ISAE 3402 standards. Many AWS customers use this report as an integral part of their Sarbanes-Oxley (SOX) efforts.
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).

(IMAGE)
All AWS Accounts have access to AWS Artifact. Root users and IAM users with admin permissions can download all audit artifacts available to their account by agreeing to the associated terms and conditions. You will need to grant IAM users with non-admin permissions access to AWS Artifact using IAM permissions. This allows you to grant a user access to AWS Artifact, while restricting access to other services and resources within your AWS Account.
Hence, the correct answer in this scenario is AWS Artifact.
AWS GovCloud is incorrect as this is an isolated AWS Region and not a compliance document repository like AWS Artifact, which is designed to allow U.S. government agencies and customers to move sensitive workloads into the cloud by addressing their specific regulatory and compliance requirements.
AWS Organizations is incorrect because this service helps you centrally govern your environment as you grow and scale your workloads in AWS.
AWS Certificate Manager is incorrect because this is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources. This service does not store certifications or compliance-related documents.
References:
https://aws.amazon.com/artifact/getting-started/
https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html
AWS Audit and Compliance Services Overview
https://www.youtube.com/watch?v=8wfBDOvrRnY
Check out this AWS Artifact Cheat Sheet:
https://tutorialsdojo.com/aws-artifact/

AWS Trusted Advisor – AWS Trusted Advisor provides recommendations to help you adhere to best practices by enhancing your AWS environment. It provides real-time guidance to help you provision your resources following AWS best practices for optimal security, high performance, service fault tolerance, and cost efficiency. Additionally, it monitors your service quotas to ensure you don‘t hit limits. Therefore, for a holistic view of your AWS services, adhering to best practices, and optimizing the use of resources, AWS Trusted Advisor is your go-to service.
Incorrect Options:
Amazon Inspector – Amazon Inspector is a security vulnerability management service. It helps to improve the security and compliance of applications deployed on AWS but does not provide overall recommendations for improving performance, fault tolerance, cost efficiency, and monitoring service quotas.
Amazon CloudWatch – Amazon CloudWatch is a monitoring and observability service but does not provide recommendations for best practices, cost reduction, or fault tolerance.
AWS IAM – AWS Identity and Access Management (IAM) allows you to manage access to AWS services and resources securely. It does not provide recommendations for best practices in improving performance, fault tolerance, or reducing costs.
References:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor

AWS Snowball – AWS Snowball is a data transport solution that accelerates transferring large amounts of data into and out of AWS using storage devices designed to secure and transfer data efficiently. It can move terabytes of data where limited bandwidth or in places with unreliable or no connectivity. The devices used for this service have robust on-board security, including tamper-resistant enclosures, 256-bit encryption, and industry-standard Trusted Platform Modules (TPM), ensuring a high level of security during transit.
Incorrect Options:
AWS VPN – AWS Virtual Private Network (VPN) establishes a secure and private encrypted tunnel from your network or device to AWS. It‘s used primarily for secure communication between your network and AWS, not for large-scale data transfer.
AWS DataSync – AWS DataSync is used to move large amounts of data online between on-premises storage systems and AWS storage services. It‘s more suited to continuous data replication needs and might not be as efficient for one-time, large-volume transfers with limited bandwidth.
AWS Transfer Family – The AWS Transfer Family provides fully managed support for file transfers directly into and out of Amazon S3 using SFTP, FTPS, and FTP. It is not designed for transferring extremely large volumes of data offline.
References:
https://aws.amazon.com/snowball

Use Amazon SQS to transmit any volume of data, at any level of throughput, without losing messages or requiring other services to be available. SQS lets you decouple application components so that they run and fail independently, increasing the overall fault tolerance of the system. Multiple copies of every message are stored redundantly across multiple availability zones so that they are available whenever needed.

Hence, the correct answers:
– If you need to decouple certain parts of your system for better fault tolerance
– If you require a durable storage for your application events or messages
If you need to submit push notifications to your event subscribers is incorrect. If you need to submit push notifications, you should use Amazon SNS instead.
When you have to automate certain tasks in your workflow is incorrect. If you need to automate certain workflows in AWS, you should use Amazon SWF.
When your application requires the use of industry-standard messaging protocols for message delivery is incorrect. If your messaging service requires the use of certain protocols, try using Amazon MQ.
References:
https://aws.amazon.com/sqs/
https://aws.amazon.com/message-queue/benefits/
Check out this Amazon SQS Cheat Sheet:
https://tutorialsdojo.com/amazon-sqs/

Amazon Lightsail – Amazon Lightsail can quickly deploy a Node.js application to the AWS Cloud. It provides a simplified way to launch and manage virtual private servers (VPS) with pre-configured compute, storage, and networking resources. The service supports a variety of applications and platforms, including popular programming languages like Node.js, Python, Java, and more. Lightsail offers a straightforward interface and pre-configured application stacks, including Node.js, making it easy to deploy a Node.js application without the need for extensive infrastructure management or configuration. With Lightsail, developers can quickly get their Node.js application up and running in the AWS Cloud with just a few clicks.

AWS Elastic Beanstalk – AWS Elastic Beanstalk is another service that facilitates the quick deployment of Node.js applications to the AWS Cloud. It is a fully managed service that abstracts away the underlying infrastructure complexities. It allows developers to easily deploy web applications in various programming languages, such as Java, .NET, Python, Node.js, Ruby, and more.
Elastic Beanstalk automatically provisions and manages the necessary resources to run Node.js applications, including EC2 instances, load balancers, and auto-scaling groups. It simplifies the deployment process by providing a platform where developers can easily upload their Node.js application code and let Elastic Beanstalk handle the rest, including environment setup, scaling, and load balancing.
Incorrect Options:
Amazon EC2 – Amazon EC2 (Elastic Compute Cloud) provides virtual servers in the cloud, allowing users to have full control over their computing resources. While it is possible to deploy a Node.js application on EC2 instances, it requires manual setup and configuration of the infrastructure, making it a more involved and complex process compared to the dedicated services like Lightsail and Elastic Beanstalk.
Amazon ECS – Amazon ECS (Elastic Container Service) is a highly scalable container orchestration service. While it is capable of deploying and managing containerized applications, including Node.js applications, it is a more advanced service that requires containerization and additional configuration compared to the simpler and more streamlined options like Lightsail and Elastic Beanstalk.
AWS CloudFormation – AWS CloudFormation is an infrastructure-as-code service that provides developers and businesses an easy way to create a collection of related AWS resources and provision them in an orderly and predictable manner. However, it‘s not specifically designed for deploying Node.js applications quickly as it focuses more on resource provisioning and management.
References:
https://aws.amazon.com/lightsail
https://aws.amazon.com/elasticbeanstalk

There are various best practices that you can follow which can help you build an application in the cloud. The notable ones are:
1. Design for failure
2. Decouple your components
3. Implement elasticity
4. Think parallel

By focusing on concepts and best practices – like designing for failure, decoupling the application components, understanding and implementing elasticity, combining it with parallelization, and integrating security in every aspect of the application architecture – cloud architects can understand the design considerations necessary for building highly scalable cloud applications.
One of the advantages of using the Cloud is that it allows you to focus on services rather than servers or hardware. Since these resources can now be easily provisioned in the Cloud, you can direct your attention to more critical business areas such as your services and products. The option Servers, not services is not considered as one of the AWS Cloud design principles.
Hence, the correct answer is: Servers, not services.
All other options are incorrect since these are all good design principles that one should follow when designing systems in AWS.
– Loose coupling
– Design for failure
– Disposable resources instead of fixed servers
References:
https://www.slideshare.net/AmazonWebServices/best-practices-for-architecting-in-the-cloud-jeff-barr/9-1_Design_for_Failure_and
https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html
Check out this AWS Well-Architected Framework – Design Principles Cheat Sheet:
https://tutorialsdojo.com/aws-well-architected-framework-design-principles/

AWS Step Functions provides serverless orchestration for modern applications. Orchestration centrally manages a workflow by breaking it into multiple steps, adding flow logic, and tracking the inputs and outputs between the steps. As your applications execute, Step Functions maintains application state, tracking exactly which workflow step your application is in, and stores an event log of data that is passed between application components. That means that if networks fail or components hang, your application can pick up right where it left off.
Application development is faster and more intuitive with Step Functions because you can define and manage the workflow of your application independently from its business logic. Making changes to one does not affect the other. You can easily update and modify workflows in one place, without having to struggle with managing, monitoring and maintaining multiple point-to-point integrations. Step Functions frees your functions and containers from excess code, so your applications are faster to write, more resilient, and easier to maintain.

Hence, the correct answer is AWS Step Functions.
Amazon SWF is incorrect because it is just a fully-managed state tracker and task coordinator service. It does not provide serverless orchestration to multiple AWS resources.
AWS Lambda is incorrect because although this service is used for serverless computing, it does not provide a direct way to coordinate multiple AWS services into serverless workflows.
AWS Batch is incorrect because this is primarily used to efficiently run hundreds of thousands of batch computing jobs in AWS.
References:
https://aws.amazon.com/step-functions/features/
https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html
Check out this AWS Step Functions Cheat Sheet:
https://tutorialsdojo.com/aws-step-functions/
Amazon Simple Workflow (SWF) vs AWS Step Functions vs Amazon SQS:
https://tutorialsdojo.com/amazon-simple-workflow-swf-vs-aws-step-functions-vs-amazon-sqs/

Enterprise – The AWS Enterprise Support plan offers a Technical Account Manager (TAM) as part of its support offerings. A TAM is a designated technical expert who works closely with enterprise customers to provide guidance, technical assistance, and strategic advice on their AWS environments. The TAM acts as a trusted advisor, helping organizations optimize their AWS infrastructure, resolve issues, and achieve their business goals. They assist with architectural guidance, proactive planning, and ongoing support to ensure smooth operations and successful implementation of AWS services. The Enterprise Support plan, with the inclusion of a dedicated TAM, is tailored to meet the needs of large-scale enterprise customers with mission-critical workloads and complex environments.

Incorrect Options:
Basic – The Basic support plan is the default level of AWS support that is available to all AWS customers. It provides access to documentation, community forums, and basic customer support through email.
Developer – The Developer support plan is a paid support plan that offers faster response times and additional support channels compared to the Basic plan. However, it does not include a dedicated TAM.
Business – The Business support plan is a paid support plan designed for businesses with production workloads. It provides faster response times, additional support channels, and enhanced support for AWS architecture and best practices. However, it does not include a dedicated TAM.
References:
https://aws.amazon.com/premiumsupport/plans

Reserved Instances provide you with a significant discount compared to On-Demand instance pricing. In addition, when Reserved Instances are assigned to a specific Availability Zone, they provide a capacity reservation, giving you additional confidence in your ability to launch instances when you need them.
You can choose between three payment options when you purchase a Standard or Convertible Reserved Instance:
All Upfront option: You pay for the entire Reserved Instance term with one upfront payment. This option provides you with the largest discount compared to On-Demand instance pricing.
Partial Upfront option: You make a low upfront payment and are then charged a discounted hourly rate for the instance for the duration of the Reserved Instance term.
No Upfront option: Does not require any upfront payment and provides a discounted hourly rate for the duration of the term.

As a general rule, Standard RI provides more savings than Convertible RI, which means that the former is the cost-effective option. The All Upfront option provides you with the largest discount compared with the other types. Opting for a longer compute reservation, such as the 3-year term, gives us a greater discount as opposed to a shorter 1-year renewable term.
Hence, the correct answer is: All upfront payment for a 3-year term purchase.
All other options are incorrect because in order to get large discounts, you need to pay all the upfront costs with a 3-year reservation term.
– Partial upfront payment for a 1-year term purchase.
– All upfront payment for a 1-year term purchase.
– Partial upfront payment for a 3-year term purchase.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
Amazon EC2 Overview:
https://www.youtube.com/watch?v=7VsGIHT_jQE
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

The AWS Cloud Adoption Framework is a set of guidelines designed to help businesses boost their digital transformation using Amazon Web Services. AWS CAF has six essential organizational perspectives for successful cloud transformations: business, people, governance, platform, security, and operations.

The security perspective supports the company data and cloud workloads‘ confidentiality, integrity, and availability. Thus, this perspective focuses on ensuring the migration is done securely, with appropriate security controls to protect the company‘s data and infrastructure. By leveraging AWS CAF, companies can identify and prioritize transformation opportunities, evaluate their cloud readiness, and evolve their transformation roadmap iteratively.
Hence, the correct answer is: Security Perspective.
Governance Perspective is incorrect because it enables you to orchestrate your cloud initiatives, increasing organizational advantages and lowering risks associated with the transition.
Operations Perspective is incorrect because it assists in ensuring that your cloud services are offered at a level that satisfies your company‘s requirements.
Platform Perspective is incorrect because it enables you to create a hybrid cloud platform that is enterprise-grade, scalable, and cloud-native, as well as to update the current workload.
References:
https://aws.amazon.com/professional-services/CAF/
https://docs.aws.amazon.com/whitepapers/latest/aws-caf-governance-perspective/aws-caf-governance-perspective.html
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-cloud-practitioner-clf-c01-exam-guide/

Up to 72% – The possible discount for reserved instances compared to the on-demand price can vary depending on factors such as instance type, term length, and payment option. However, the highest discount that can be achieved with reserved instances is up to 72%. This discount is based on committing to a longer-term contract (such as one or three years) and making an upfront payment. By opting for reserved instances, businesses can save significantly on their cloud computing costs compared to the pay-as-you-go on-demand pricing model. It‘s important to note that the specific discount percentages may vary across different cloud service providers and regions, so it‘s advisable to check the pricing details and terms provided by the respective cloud provider for accurate information.

Incorrect Options:
Up to 54%
Up to 70%
Up to 90%
All of the above options are incorrect.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing
https://aws.amazon.com/ec2/pricing

Amazon S3 Glacier storage classes are designed to be the lowest-cost Amazon S3 storage classes, allowing you to archive large amounts of data at a very low cost. This makes it feasible to retain all the data you want for use cases like data lakes, analytics, IoT, machine learning, compliance, and media asset archiving. You pay only for what you need, with no minimum commitments or up-front fees.
S3 Glacier provides the following storage classes:
– S3 Glacier Instant Retrieval for archiving data that might be needed once per quarter and needs to be restored quickly (milliseconds)
– S3 Glacier Flexible Retrieval for archiving data that might infrequently need to be restored, once or twice per year, within a few hours
– S3 Glacier Deep Archive for archiving long-term backup cycle data that might infrequently need to be restored within 12 hours

(IMAGE)
To keep costs low yet suitable for varying retrieval needs, Amazon S3 Glacier Flexible Retrieval provides three options for access to archives, from a few minutes to several hours, and S3 Glacier Deep Archive provides two access options ranging from 12 to 48 hours.
Hence, the correct answer is: Amazon S3 Glacier Flexible Retrieval.
Amazon S3 is incorrect because this type of storage service costs more than S3 Glacier storage classes.
Amazon EBS is incorrect because this is a type of block storage that is not suitable to be used for database backups. It is also more expensive than S3 Glacier Flexible Retrieval.
Amazon EFS is incorrect because this is a type of POSIX-compliant file storage suitable to be used as a file system and not for storing backups.
References:
https://aws.amazon.com/s3/faqs/
https://docs.aws.amazon.com/amazonglacier/latest/dev/introduction.html
https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/amazon-s3-glacier.html
Check out this Amazon S3 Glacier Cheat Sheet:
https://tutorialsdojo.com/amazon-glacier/
Amazon S3 and S3 Glacier Overview:
https://youtu.be/1ymyeN2tki4

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You pay only for the compute time you consume – there is no charge when your code is not running. With Lambda, you can run code for virtually any type of application or backend service – all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability.
AWS Lambda automatically scales your application by running code in response to each trigger. Your code runs in parallel and processes each trigger individually, scaling precisely with the size of the workload. With AWS Lambda, you are charged for every 1ms your code executes and the number of times your code is triggered.

Hence, the correct answer is: AWS Lambda.
Amazon DynamoDB is incorrect since this is a fast, scalable NoSQL database service of AWS.
Amazon Aurora is also incorrect since this is primarily used as a database service and not a compute service. Although it has a serverless feature (Aurora Serverless), it is still used as a database and not for data processing.
Amazon Athena is incorrect since this service is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL.
References:
https://aws.amazon.com/lambda/
https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
Check out this AWS Lambda Cheat Sheet:
https://tutorialsdojo.com/aws-lambda/
AWS Lambda Overview:
https://youtu.be/bPVX1zHwAnY