AWS Certified Cloud Practitioner

The Service Organization Controls (SOC) Reports are used to evaluate the effectiveness of AWS controls that might affect your internal controls over financial reporting (ICOFR). The audit is performed according to the SSAE 18 and ISAE 3402 standards. Many AWS customers use this report as an integral part of their Sarbanes-Oxley (SOX) efforts.
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).

(IMAGE)
All AWS Accounts have access to AWS Artifact. Root users and IAM users with admin permissions can download all audit artifacts available to their account by agreeing to the associated terms and conditions. You will need to grant IAM users with non-admin permissions access to AWS Artifact using IAM permissions. This allows you to grant a user access to AWS Artifact, while restricting access to other services and resources within your AWS Account.
Hence, the correct answer in this scenario is AWS Artifact.
AWS GovCloud is incorrect as this is an isolated AWS Region and not a compliance document repository like AWS Artifact, which is designed to allow U.S. government agencies and customers to move sensitive workloads into the cloud by addressing their specific regulatory and compliance requirements.
AWS Organizations is incorrect because this service helps you centrally govern your environment as you grow and scale your workloads in AWS.
AWS Certificate Manager is incorrect because this is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources. This service does not store certifications or compliance-related documents.
References:
https://aws.amazon.com/artifact/getting-started/
https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html
AWS Audit and Compliance Services Overview
https://www.youtube.com/watch?v=8wfBDOvrRnY
Check out this AWS Artifact Cheat Sheet:
https://tutorialsdojo.com/aws-artifact/

Up to 72% – The possible discount for reserved instances compared to the on-demand price can vary depending on factors such as instance type, term length, and payment option. However, the highest discount that can be achieved with reserved instances is up to 72%. This discount is based on committing to a longer-term contract (such as one or three years) and making an upfront payment. By opting for reserved instances, businesses can save significantly on their cloud computing costs compared to the pay-as-you-go on-demand pricing model. It‘s important to note that the specific discount percentages may vary across different cloud service providers and regions, so it‘s advisable to check the pricing details and terms provided by the respective cloud provider for accurate information.

Incorrect Options:
Up to 54%
Up to 70%
Up to 90%
All of the above options are incorrect.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing
https://aws.amazon.com/ec2/pricing

Cost Allocation Tags – Cost Allocation Tags help you organize your AWS resources and can assist with managing costs. It is a key-value pairs that you can attach to your AWS resources. Once activated, AWS generates a cost allocation report with usage and costs aggregated by your tags, helping you to track and categorize your AWS costs in a detailed manner.
Incorrect Options:
AWS Budgets – AWS Budgets gives you the ability to set custom cost and usage budgets that alert you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount. However, it doesn‘t categorize or track your costs at a detailed level.
CloudWatch Logs – CloudWatch Logs help you to monitor, store, and access your log files from EC2 instances, and other sources, but it does not assist in tracking or categorizing costs.
AWS Service Catalog – AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS, but it does not track or categorize costs.
References:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

Amazon Rekognition – Amazon Rekognition is the AWS service that allows you to perform face detection and analysis from millions of images and videos in just minutes. It provides powerful computer vision capabilities for analyzing visual content. With Rekognition, you can detect and analyze faces, identify facial attributes, such as emotions and age range, perform face comparison and recognition, and even track faces in videos. Rekognition utilizes deep learning algorithms to deliver accurate and fast results. It is highly scalable, allowing you to process vast amounts of visual data quickly and efficiently. Amazon Rekognition is widely used in various applications, including security systems, content moderation, personalized user experiences, and social media analytics.
Incorrect Options:
Amazon Polly – Amazon Polly is a text-to-speech (TTS) service that converts text into lifelike speech. It does not provide face detection and analysis from images and videos.
Amazon Transcribe – Amazon Transcribe is an automatic speech recognition (ASR) service that converts spoken language into written text. It is not intended for face detection and analysis tasks.
Amazon Kendra – Amazon Kendra is an intelligent search service powered by machine learning. It is designed to provide highly accurate search results by understanding natural language queries and retrieving information from various data sources. It does not specialize in face detection and analysis from images and videos.
References:
https://aws.amazon.com/rekognition

A VPC spans all the Availability Zones in the region. After creating a VPC, you can add one or more subnets in each Availability Zone. Each subnet must reside entirely within one Availability Zone and cannot span zones. Availability Zones are distinct locations that are engineered to be isolated from failures in other Availability Zones. By launching instances in separate Availability Zones, you can protect your applications from the failure of a single location.

If a subnet‘s traffic is routed to an Internet gateway, the subnet is known as a public subnet. If you want your instance in a public subnet to communicate with the Internet over IPv4, it must have a public IPv4 address or an Elastic IP address (IPv4).
Hence, the correct answer is: Availability zone.
Both AWS Regions and Edge locations are incorrect because subnets are not directly correlated with these two.
Server is incorrect because subnets are part of a VPC within the AWS global network. Subnets are not bound by servers in any way.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
https://aws.amazon.com/about-aws/global-infrastructure/
Amazon VPC Overview:
https://youtu.be/oIDHKeNxvQQ
Check out this Amazon VPC Cheat Sheet:
https://tutorialsdojo.com/amazon-vpc/

Migrate to Amazon RDS with enabling Multi-AZ DB instance deployments – To achieve higher availability for the MySQL database, it is recommended to migrate to Amazon RDS (Relational Database Service) with Multi-AZ (Availability Zone) DB instance deployments. Amazon RDS is a managed database service that simplifies database administration tasks. Multi-AZ deployment provides automatic synchronous replication of the database to a standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically promotes the standby replica to the primary database, minimizing downtime and ensuring high availability. By migrating to Amazon RDS with Multi-AZ, the company can benefit from automated failover, data durability, and reduced operational overhead for managing the database.
Incorrect Options:
Upgrade EC2 instance size (Increase CPU & RAM) – Increasing the size of the EC2 instance, such as upgrading the CPU and RAM, does not address the requirement for higher availability. It only improves the performance and capacity of the database server but does not provide built-in mechanisms for redundancy and failover.
Enable termination protection to avoid outages – Enabling termination protection on an EC2 instance prevents accidental termination, but it does not improve the availability of the database. Termination protection is designed to prevent instances from being terminated through user error or automation, but it does not protect against instance failures or provide automatic failover.
Add an Application Load Balancer to the EC2 instance – While an Application Load Balancer (ALB) can distribute incoming traffic across multiple EC2 instances, it does not inherently provide high availability for a single database instance. ALBs are typically used for distributing traffic to multiple instances of an application to improve scalability and fault tolerance, but they do not address the specific requirement of higher availability for a database running on a single EC2 instance.
References:
https://aws.amazon.com/rds
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Cloud security at AWS is the highest priority. As an AWS customer, you will benefit from a data center and network architecture built to meet the requirements of the most security-sensitive organizations. An advantage of the AWS cloud is that it allows customers to scale and innovate while maintaining a secure environment. Customers pay only for the services they use, meaning that you can have the security you need, but without the upfront expenses, and at a lower cost than in an on-premises environment.

(IMAGE)
AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval to a few services only.
Permitted Services – You‘re welcome to conduct security assessments against AWS resources that you own if they make use of the services listed below. Take note that AWS is constantly updating this list:
– Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
– Amazon RDS
– Amazon CloudFront
– Amazon Aurora
– Amazon API Gateways
– AWS Lambda and Lambda Edge functions
– Amazon Lightsail resources
– Amazon Elastic Beanstalk environments
Prohibited Activities – The following activities are prohibited at this time:
– DNS zone walking via Amazon Route 53 Hosted Zones
– Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS
– Port flooding
– Protocol flooding
– Request flooding (login request flooding, API request flooding)
Hence, the correct answers are:
– Amazon RDS
– Amazon Aurora
All other options are incorrect since they are not included in the list shown above.
– Amazon S3
– AWS Identity and Access Management (IAM)
– AWS Security Token Service (STS)
References:
https://aws.amazon.com/security/
https://aws.amazon.com/security/penetration-testing/
https://aws.amazon.com/premiumsupport/knowledge-center/penetration-testing/
Amazon Aurora Overview:
https://youtu.be/iwS1h7rLNBQ
Check out these Amazon RDS and Aurora Cheat Sheets:
https://tutorialsdojo.com/amazon-relational-database-service-amazon-rds/
https://tutorialsdojo.com/amazon-aurora/

On-Demand Instances do not require any long-term commitment from the user and offer the ability to pay for computing capacity per-second basis. As a user, you have complete control over the instance‘s lifecycle, including the ability to launch, stop, hibernate, start, reboot, or terminate it according to your requirements. The billing for On-Demand Instances starts from a minimum of 60 seconds.

You will be charged for each instance-hour consumed for every instance, starting from when it is launched and ending when it is stopped or terminated. For Linux, Windows, Windows with SQL Enterprise, Windows with SQL Standard, and Windows with SQL Web Instances, partial instance-hours consumed will be billed per second, while for all other instance types, they will be billed as a full hour.
Hence, the correct answer is: On-Demand Instances only.
Dedicated Hosts is incorrect because it provides physical servers dedicated to a single customer and offers long-term commitments in terms of hours or months. They are not a suitable option for a company that requires a cloud computing solution with no long-term commitment.
Reserved Instances is incorrect because it requires customers to make a long-term commitment (typically 1-3 years) to a specific instance type in exchange for a significant discount on the hourly usage rate.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html
https://aws.amazon.com/ec2/pricing/on-demand/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

Reserved Instances provide you with a significant discount compared to On-Demand instance pricing. In addition, when Reserved Instances are assigned to a specific Availability Zone, they provide a capacity reservation, giving you additional confidence in your ability to launch instances when you need them.
Standard Reserved Instances provide you with a significant discount compared to On-Demand instance pricing and can be purchased for a 1-year or 3-year term. The average discount off On-Demand instances varies based on your term and chosen payment options (up to 40% for 1-year and 60% for a 3-year term). Customers have the flexibility to change the Availability Zone, the instance size, and networking type of their Standard Reserved Instances.
Convertible Reserved Instances provide you with a significant discount compared to On-Demand Instances and can be purchased for a 1-year or 3-year term. Purchase Convertible Reserved Instances if you need additional flexibility, such as the ability to use different instance families, operating systems, or tenancies over the Reserved Instance term.

(IMAGE)
Hence, the correct answer is: Amazon EC2 Standard Reserved Instances.
The Amazon EC2 Spot Instances option is incorrect. Although this is the most cost-effective type, this instance can be interrupted by Amazon EC2 for capacity requirements making it not suitable for non-interruptible workloads.
The Amazon EC2 Convertible Reserved Instances option is incorrect because this type of reserved instances on average offers less pricing discount than Standard Reserved Instances.
The Amazon EC2 On-Demand Instancesoption is incorrect. Although it is suitable to run non-interruptible workloads for a period of three years, it entails a higher running cost compared to Reserved or Spot instances. In fact, this is actually the most expensive type of EC2 instance and not the cheapest one.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html
Amazon EC2 Overview:
https://www.youtube.com/watch?v=7VsGIHT_jQE
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

Amazon Pinpoint is AWS’s Digital User Engagement Service that enables AWS customers to effectively communicate with their end-users and measure user engagement across multiple channels including email, Text Messaging (SMS) and Mobile Push Notifications.
Amazon Pinpoint also provides tools that enable audience management and segmentation, campaign management, scheduling, template management, A/B testing, analytics and data integration. It captures data to track deliverability as well as usage and messaging analytics covering a range of dimensions including user, channels and custom attributes.
Amazon Pinpoint is built on a service-based architecture. Developers can extend their applications and backend services in various ways, including: sending messages directly from their applications via the Amazon Pinpoint channels (Email, SMS and Mobile Push), accessing segmentation data to alter their application behavior for segments of users, create and run campaigns directly from their applications, and access deliverability and analytics data to improve the user engagement of their applications. The system empowers customers to send the right message, to the right audience, at the right time and on the most effective channel.

Hence, the correct answer is: Amazon Pinpoint.
Amazon Simple Notification Service is incorrect because this is a fully managed pub/sub messaging service that enables you to decouple microservices, distributed systems, and serverless applications.
Amazon Simple Email Service is incorrect because this is a cloud-based email sending service designed to help digital marketers and application developers send marketing, notification, and transactional emails.
Amazon SNS Mobile Push is incorrect because this is a feature of Amazon SNS that pushes notification messages to both mobile devices and desktops. This is not considered as a fully-fledged digital user engagement service, unlike Amazon Pinpoint.
References:
https://aws.amazon.com/pinpoint/
http://docs.aws.amazon.com/pinpoint/latest/userguide/welcome.html

Reserved Instances provide you with a significant discount compared to On-Demand Instance pricing. RIs can provide a capacity reservation, offering additional confidence in your ability to launch the number of instances you have reserved when you need them. You can purchase a Reserved Instance for a one-year or three-year commitment, with the three-year commitment offering a bigger discount.
With Reserved Instances (RIs), you can choose the type that best fits your application needs such as Standard RIs, Convertible RIs, and Scheduled RIs.
Reserved Instances are recommended for:
– Applications with steady state usage
– Applications that may require reserved capacity
– Customers that can commit to using EC2 over a 1 or 3 year term to reduce their total computing costs

Hence, the correct answer is Reserved Instances.
Both On-Demand and Dedicated Instance Types are incorrect since they are more expensive than Reserved Instances if billed over a whole year or longer.
Spot Instance is incorrect since this is not optimal for servers that need to be continuously running.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
Amazon EC2 Overview:
https://youtu.be/7VsGIHT_jQE

Enterprise environments are often a mix of cloud, on-premises data centers, and edge locations. Hybrid cloud architectures help organizations integrate their on-premises and cloud operations to support a broad spectrum of use cases using a common set of cloud services, tools, and APIs across on-premises and cloud environments.
Customers can seamlessly integrate their on-premises and cloud storage, networking, identity management, and security policies to enable use cases such as data center extension to the cloud, backup, and disaster recovery to the cloud, and hybrid data processing.

AWS offers services that integrate application deployment and management across on-premises and cloud environments for a robust hybrid architecture. Below are the following services that you can use to manage or deploy applications to your servers running on-premises:
OpsWorks – AWS OpsWorks is a configuration management service that helps customers configure and operate applications, both on-premises and in the AWS Cloud, using Chef and Puppet.
CodeDeploy – AWS CodeDeploy automates code deployments to any instance, including Amazon EC2 instances and instances running on-premises. AWS CodeDeploy makes it easier to rapidly release new features, avoids downtime during application deployment, and handles the complexity of updating applications.
Hence, the correct answer in this scenario is AWS OpsWorks.
Both AWS CloudFormation and AWS Elastic Beanstalk are incorrect because these services can only deploy applications to your AWS resources and not to the servers located in your on-premises data center.
AWS Systems Manager is incorrect because although you can remotely operate and deploy packages/scripts to your on-premises servers with this one, this service is still not suitable to be used for deploying your web application. It also doesn‘t have a feature to easily rollback your deployments unlike OpsWorks. This service is primarily used to automate maintenance and deployment tasks on Amazon EC2 and on-premises instances, or automatically apply patches, updates, and configuration changes across any resource group.
References:
https://aws.amazon.com/hybrid/use-cases/
https://docs.aws.amazon.com/opsworks/latest/userguide/registered-instances-register-registering-register.html
https://d0.awsstatic.com/whitepapers/overview-of-deployment-options-on-aws.pdf
Check out these AWS OpsWorks and CodeDeploy Cheat Sheets:
https://tutorialsdojo.com/aws-opsworks/
https://tutorialsdojo.com/aws-codedeploy/
Elastic Beanstalk vs CloudFormation vs OpsWorks vs CodeDeploy:
https://tutorialsdojo.com/elastic-beanstalk-vs-cloudformation-vs-opsworks-vs-codedeploy/

Amazon Chime is a high-quality communications service that transforms online meetings with an easy-to-use app that works seamlessly across all your devices. With Amazon Chime, you can schedule and attend online meetings and video conferences, and chat, call, and collaborate, inside and outside your organization, all with a single app. Now you can work productively from wherever you are. Amazon Chime is also integrated with Microsoft Outlook Calendar and Google Calendar for easy scheduling of meetings.

Amazon Connect is an easy-to-use omnichannel cloud contact center that helps companies provide superior customer service across voice, chat, and tasks at a lower cost than traditional contact center systems. You can create different channels and integrations with other AWS services such as Amazon Lex and Amazon Polly to create multiple types of actions and responses for customers who contact you.

Hence, the correct answers are:
– Amazon Chime
– Amazon Connect
AWS Transfer Family is incorrect because this tool is used for recurring business-to-business file transfers to Amazon S3 and Amazon EFS using SFTP, FTPS, and FTP protocols.
AWS Marketplace is incorrect because this is a sales channel for ISVs and Consulting Partners to sell their solutions to AWS customers.
Amazon Workspaces is incorrect because this is a fully managed desktop virtualization service for Windows and Linux, and is not related to business communications or customer service.
References:
https://aws.amazon.com/connect/
https://aws.amazon.com/chime/
Check out our AWS Cheat Sheets:
https://tutorialsdojo.com/aws-cheat-sheets/

Amazon Personalize – Amazon Personalize should be used to provide product recommendations to users based on their history. It leverages machine learning algorithms and data analysis to create personalized recommendations tailored to individual users. With Personalize, eCommerce companies can utilize historical user data, such as browsing behavior, purchase history, and preferences, to generate accurate and relevant recommendations. The service automatically handles the data processing, model training, and recommendation generation, making it easier for companies to implement personalized recommendation systems without extensive machine learning expertise.
Incorrect Options:
Amazon SageMaker – Amazon SageMaker is a fully managed service that enables developers and data scientists to build, train, and deploy machine learning models. SageMaker is a versatile service for building and deploying models and it does not provide product recommendations based on user history.
Amazon Rekognition – Amazon Rekognition is a service for image and video analysis, primarily used for tasks such as object detection, facial recognition, and content moderation. It cannot generate personalized product recommendations based on user history.
Amazon Polly – Amazon Polly is a service that converts text into lifelike speech. It is used for creating speech-enabled applications and adding voice capabilities to systems. It cannot generate personalized product recommendations based on user history.
References:
https://aws.amazon.com/personalize

AWS Fargate – AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon EKS. Compute Savings Plans apply to AWS Fargate usage, which can significantly reduce the cost compared to On-Demand usage.
AWS Lambda – AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute resources. Lambda also supports Compute Savings Plans, so the cost can be optimized based on committed usage.
Incorrect Options:
Amazon RDS – Amazon RDS is a relational database service, not a compute service. Therefore, it doesn‘t support Compute Savings Plans.
Amazon Lightsail – Amazon Lightsail is a virtual private server (VPS) service. While it does provide compute power, it is not covered under Compute Savings Plans.
Amazon SNS – Amazon SNS (Simple Notification Service) is a fully managed messaging service for both application-to-application and application-to-person communication. It‘s not a compute service and therefore does not support Compute Savings Plans.
References:
https://aws.amazon.com/savingsplans/compute-pricing
https://aws.amazon.com/fargate/pricing
https://aws.amazon.com/lambda/pricing

Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.
The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations. The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment. This differentiation of responsibility is commonly referred to as the Security OF the Cloud versus Security IN the Cloud.

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. Since you have more control over your EC2 instance, you can install any database that you prefer and manage its guest operating system, including the required updates and security patches. You can also choose an AMI with a pre-installed database (such as PostgreSQL or MySQL) in the Amazon EC2 Dashboard to save your time.
Hence, the correct answer is: Amazon EC2.
Amazon Aurora is incorrect because this is a fully-managed service that automates time-consuming administration tasks like hardware provisioning, database setup, patching, and backups without any manual intervention from you.
Amazon DocumentDB is incorrect because this is a fully-managed document database service that supports MongoDB workloads. Just like Amazon Aurora, you don‘t need to handle or manage the guest operating system of this service since it is already managed by AWS.
Amazon DynamoDB is incorrect because just like the other two options above, this is also a fully-managed database service which means that you won‘t be able to manage the underlying guest operating system or apply the required updates and security patches.
References:
https://aws.amazon.com/ec2/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/install-software.html
https://aws.amazon.com/products/databases/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
Amazon EC2 Overview:
https://youtu.be/7VsGIHT_jQE

AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.
You can simply upload your code and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health monitoring. At the same time, you retain full control over the AWS resources powering your application and can access the underlying resources at any time.

Elastic Beanstalk is the fastest and simplest way to deploy your application on AWS. You simply use the AWS Management Console, a Git repository, or an integrated development environment (IDE) such as Eclipse or Visual Studio to upload your application, and Elastic Beanstalk automatically handles the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring. Within minutes, your application will be ready to use without any infrastructure or resource configuration work on your part.
Hence, the correct answer is: AWS Elastic Beanstalk.
Amazon EBS is incorrect because this is a storage volume for EC2 instances and services that use EC2 as a backend.
Amazon ECS is incorrect since this is a compute service for Docker / containerized applications and you have to manually provision the infrastructure yourself.
Amazon EKS is incorrect because this is a Kubernetes solution of AWS and you have to manually provision the infrastructure yourself.
References:
https://aws.amazon.com/elasticbeanstalk/
https://aws.amazon.com/elasticbeanstalk/developer-resources/
AWS Elastic Beanstalk Overview:
https://youtu.be/rx7e7Fej1Oo
Check out this AWS Elastic Beanstalk Cheat Sheet:
https://tutorialsdojo.com/aws-elastic-beanstalk/

Consolidated Billing enables you to see a combined view of AWS costs incurred by all accounts in your department or company, as well as obtain a detailed cost report for each individual AWS account associated with your paying account. Consolidated Billing may also lower your overall costs since the rolled-up usage across all of your accounts could help you reach lower-priced volume tiers more quickly.

For billing purposes, AWS treats all the accounts in the organization as if they were one account. Some services, such as Amazon EC2 and Amazon S3, have volume pricing tiers across certain usage dimensions that give you lower prices the more you use the service. With consolidated billing, AWS combines the usage from all accounts to determine which volume pricing tiers to apply, giving you a lower overall price whenever possible. AWS then allocates each linked account a portion of the overall volume discount based on the account‘s usage.
Hence, the correct answer is: Amazon S3.
AWS CloudTrail, Amazon CloudFront, and Amazon SNS are not supported under the Consolidated Billing volume discount feature since they do not have volume pricing tiers of their own in the first place.
References:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/useconsolidatedbilling-discounts.html
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html
Check out this AWS Organizations Cheat Sheet:
https://tutorialsdojo.com/aws-organizations/

AWS Snowball – AWS Snowball is a data transport solution that accelerates transferring large amounts of data into and out of AWS using storage devices designed to secure and transfer data efficiently. It can move terabytes of data where limited bandwidth or in places with unreliable or no connectivity. The devices used for this service have robust on-board security, including tamper-resistant enclosures, 256-bit encryption, and industry-standard Trusted Platform Modules (TPM), ensuring a high level of security during transit.
Incorrect Options:
AWS VPN – AWS Virtual Private Network (VPN) establishes a secure and private encrypted tunnel from your network or device to AWS. It‘s used primarily for secure communication between your network and AWS, not for large-scale data transfer.
AWS DataSync – AWS DataSync is used to move large amounts of data online between on-premises storage systems and AWS storage services. It‘s more suited to continuous data replication needs and might not be as efficient for one-time, large-volume transfers with limited bandwidth.
AWS Transfer Family – The AWS Transfer Family provides fully managed support for file transfers directly into and out of Amazon S3 using SFTP, FTPS, and FTP. It is not designed for transferring extremely large volumes of data offline.
References:
https://aws.amazon.com/snowball

AWS Snowcone – AWS Snowcone is a portable, rugged, and secure device for edge computing and data transfer. It is the smallest member of the AWS Snow Family of devices, and it‘s capable of storing up to 8 terabytes of data. The company can use Snowcone to move their data to AWS, which is practical and cost-effective for the amount of data they want to transfer.
Incorrect Options:
AWS Snowball – AWS Snowball is a data transport solution that accelerates moving terabytes to petabytes of data into and out of AWS using storage devices designed to be secure for physical transport. However, for an 8 terabyte data transfer, it might be overkill and less cost-effective.
AWS Snowmobile – AWS Snowmobile is an Exabyte-scale data transfer service used to move extremely large amounts of data to AWS. It‘s used to transfer data amounts much larger than 8 terabytes, in the order of petabytes or exabytes, and it‘s not the most cost-effective solution for this use case.
AWS Storage Gateway – AWS Storage Gateway is a hybrid cloud storage service that connects an on-premises software appliance with cloud-based storage. However, for a large one-time data transfer of 8 terabytes, Snowcone would be a more cost-effective solution.
References:
https://aws.amazon.com/snowcone

Amazon Linux instances are now billed in a per-second duration. With per-second billing, you pay for only what you use. It takes the cost of unused minutes and seconds in an hour off of the bill, so you can focus on improving your applications instead of maximizing usage to the hour. Especially, if you manage instances running for irregular periods of time, such as dev/testing, data processing, analytics, batch processing, and gaming applications, can benefit.

EC2 usage is billed in one-second increments, with a minimum of 60 seconds. Similarly, provisioned storage for EBS volumes will be billed per-second increments, with a 60-second minimum. It is in your best interest to understand the billing structure of your commonly used service to avoid budgeting concerns.
You can also set your billing to hourly if you wish. In this case, even a fraction of an hour of usage will cost you the equivalent of a full hour‘s usage. You will NOT be billed for only an hour if you choose to follow hourly billing.
Hence, the correct answer is: You will be billed for an hour and thirty minutes according to the per-second billing rule.
All other options are incorrect because these are false statements about EC2 Usage pricing.
– You will only be billed for an hour according to the hourly billing rule.
– You will be billed for one hour and thirty minutes according to the hourly billing rule.
– You will be billed for an hour and twenty-nine minutes according to the per second billing rule.
References:
https://aws.amazon.com/ec2/pricing/
https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf
https://aws.amazon.com/about-aws/whats-new/2017/10/announcing-amazon-ec2-per-second-billing/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

AWS offers multiple AMI configurations for Amazon EC2 – from community AMIs to AMIs sold by customers in the AWS Marketplace. If you launch an EC2 instance using a Windows AMI with a bundled MS SQL Server Standard, you won‘t need to purchase your own licenses from Microsoft. And since this is an EC2 instance, you can freely resize it to a different instance type or class of your choosing.

(IMAGE)
Amazon EC2 follows a pay-as-you-go model, so there are no long-term commitments when launching an EC2 instance, even if there is an MS SQL Server installed.
Hence, the correct answer is: Use a Windows Server with SQL Server Standard bundled AMI so you won’t need to buy and manage your own license.
The option that says: Launch an EC2 instance and install MS SQL Server. Purchase a Standard MSSQL license from Microsoft and apply it to the database you installed is incorrect since this is not the most convenient method of launching an MS SQL Server in AWS. You typically use this solution if you already have a SQL Server license and you prefer to BYOL (bring your own license).
The option that says: Launch an RDS instance that runs MS SQL Server Standard. Purchase a Standard MSSQL license and store it in the AWS Managed Services (AMS) is incorrect. It is explicitly stated in the scenario that the database instance should only be managed by the company‘s DBA and must be accessible via RDP. You cannot directly establish an RDS connection to an Amazon RDS database. In addition, Amazon RDS costs more than Amazon EC2 because the infrastructure is managed by AWS.
The option that says: Launch an Amazon Aurora database that runs MS SQL Server. Buy a Standard MSSQL license from the AWS License Manager service is incorrect since Amazon Aurora does not support MS SQL Server. Moreover, you cannot directly buy software licenses from the AWS License Manager service. This is just used to easily manage your software licenses from various vendors such as Microsoft, SAP, Oracle, and IBM across AWS and on-premises environments.
References:
https://aws.amazon.com/sql/
https://aws.amazon.com/windows/resources/licensing/
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

The purpose of automatic scaling is to automatically increase the size of your Auto Scaling group when demand goes up and decrease it when demand goes down. As capacity is increased or decreased, the Amazon EC2 instances being added or removed must be registered or deregistered with a load balancer. This enables your application to automatically distribute incoming web traffic across such a dynamically changing number of instances.

(IMAGE)
Your load balancer acts as a single point of contact for all incoming web traffic to your Auto Scaling group. When an instance is added to your Auto Scaling group, it needs to register with the load balancer, or no traffic is routed to it. When an instance is removed from your Auto Scaling group, it must deregister from the load balancer or traffic continues to be routed to it.
Hence, the correct answers are:
– AWS ELB
– Amazon EC2 Auto Scaling
Amazon CloudWatch and Amazon CloudFront are both incorrect because these are not the primary services to be used to achieve a highly available and scalable application in the Cloud.
Amazon AppStream 2.0 is incorrect because this is just a fully managed application streaming service that you can use to centrally manage your desktop applications.
References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.html
https://aws.amazon.com/autoscaling/
https://aws.amazon.com/elasticloadbalancing/
Check out these Tutorials Dojo Cheat Sheets:
https://tutorialsdojo.com/aws-elastic-load-balancing-elb/
https://tutorialsdojo.com/aws-auto-scaling/

In today‘s rapidly evolving business landscape, organizations constantly seek ways to stay ahead of the competition and unlock new growth opportunities. One powerful approach to achieve this is through the cloud-powered digital transformation of business processes, and a framework that facilitates this transformation is the AWS Cloud Adoption Framework (CAF) and its Cloud Transformation Value Chain.

The AWS CAF provides comprehensive guidelines, best practices, and tools to help organizations plan, execute, and manage their cloud adoption journey. It serves as a roadmap for businesses to navigate the complexities of digital transformation and leverage the full potential of cloud computing services offered by AWS. Cloud Transformation Value Chain has four key areas that must be addressed for a successful digital transformation, which are the following:
– Technological transformation involves using the power of cloud computing to optimize and modernize existing IT infrastructure. It enables businesses to quickly adapt to changing market demands, scale resources on demand, and reduce operational complexities.
– Process transformation focuses on reimagining and optimizing business processes to utilize cloud-native capabilities. By embracing cloud-native tools and services, organizations can automate repetitive tasks, improve collaboration and communication, and accelerate time-to-market for new products and services.
– Organizational transformation entails reshaping an organization‘s culture, structure, and skills to support cloud-powered digital transformation. This involves fostering a cloud-first mindset, establishing new roles and responsibilities, and upskilling employees to work effectively in the cloud environment. By embracing a culture of innovation and agility, organizations can enable faster decision-making, promote cross-functional collaboration, and drive continuous improvement.
– Product transformation uses cloud capabilities to innovate and deliver new digital products and services. This transformation enables businesses to enhance customer experiences, explore new revenue streams, and gain a competitive advantage in the market.
Restructuring teams to prioritize product-focused and value stream-oriented approaches emphasizes the importance of organizing teams around specific products or value streams. By doing so, the company can foster collaboration among team members who are responsible for delivering value to customers. This approach encourages cross-functional cooperation and ensures that teams are aligned with the firm‘s strategic objectives.
Adopting agile methodologies, on the other hand, promote iterative development, frequent customer feedback, and continuous improvement. By adopting agile practices, the company can respond quickly to customer needs, adapt to changing market conditions, and continuously deliver value.
Hence the correct answers are:
– Restructure teams to prioritize product-focused and value stream-oriented approaches.
– Adopt agile methodologies for continuous improvement and rapid innovation.
The option that says: Transition and upgrade legacy infrastructure through migration and modernization efforts is incorrect. While transitioning and upgrading legacy infrastructure can be beneficial for optimizing operations and improving product quality, it does not directly address the goal of increasing agility and responsiveness to customer needs. It focuses more on the technical components of infrastructure.
The option that says: Employ a robust data and analytics platform to generate actionable insights is incorrect. Employing a data and analytics platform is indeed valuable for generating actionable insights. However, while it can provide helpful insight, it is not directly tied to optimizing operations and delivery processes or enhancing agility and responsiveness.
The option that says: Introduce new products and revenue models is incorrect. This option focuses more on innovation and expanding the company‘s offerings rather than promoting team collaboration and a customer-centric approach.
References:
https://docs.aws.amazon.com/pdfs/whitepapers/latest/overview-aws-cloud-adoption-framework/overview-aws-cloud-adoption-framework.pdf
https://aws.amazon.com/cloud-adoption-framework/

There will not be charged to you for this data transfer
AWS does not charge for data transfer between an EC2 instance and an S3 bucket within the same region. The data transfer in this case, where data is moved from the EC2 instance to the S3 bucket, is considered “inbound“ for S3, which is free of charge.
Incorrect Options:
The inbound charge will be applicable for data transfer – In AWS, all inbound data transfer is free, including the transfer from an EC2 instance to an S3 bucket within the same region.
The inbound and outbound data transfer charge will be applicable for S3 bucket – This is incorrect as AWS does not charge for data transfer between an EC2 instance and an S3 bucket in the same region. Furthermore, inbound data transfers to S3 are always free.
The outbound charge will be applicable for data transfer – Outbound data transfers from S3 are indeed charged, but in this scenario, we are moving data into S3, which is an inbound data transfer and thus free of charge.
References:
https://aws.amazon.com/s3/pricing

When granting permissions, you decide who is getting them, which Amazon S3 resources they are getting permissions for, and specific actions you want to allow on those resources. Buckets and objects are Amazon S3 resources. By default, only the resource owner can access these resources. The resource owner refers to the AWS account that creates the resource.

(IMAGE)
Bucket policy and user policy are two of the access policy options available for you to grant permission to your Amazon S3 resources. Both use JSON-based access policy language. You add a bucket policy to a bucket to grant other AWS accounts or IAM users access permissions for the bucket and the objects in it. User policies are policies that allow an IAM user access to one of your buckets.
Hence, the correct answers are:
– Bucket policies
– User policies
All the other options are incorrect as these are not the correct features that will grant permissions to your Amazon S3 bucket.
– Routing policies
– Network access control policies
– Object policies
References:
https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html
https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/
Check out this Amazon S3 Cheat Sheet:
https://tutorialsdojo.com/amazon-s3/

Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0.

Amazon Cognito provides solutions to control access to backend resources from your app. You can define roles and map users to different roles so your app can access only the resources that are authorized for each user.
With a built-in UI and easy configuration for federating identity providers, you can integrate Amazon Cognito to add user sign-in, sign-up, and access control to your app in minutes. You can customize the UI to put your company branding front and center for all user interactions.
Hence, the correct answer is Amazon Cognito.
AWS Single Sign-On (SSO) is incorrect because this is a cloud SSO service that makes it easy to centrally manage SSO access to multiple AWS accounts and business applications. It doesn‘t provide an easy way to add user sign-in, sign-up, and access control to your mobile app, unlike Amazon Cognito.
AWS Identity and Access Management (IAM) is incorrect because this service lets you to manage access to AWS services and resources securely.
AWS Directory Service is incorrect because it enables your directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud.
References:
https://aws.amazon.com/cognito/
https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-integrating-user-pools-with-identity-pools.html
Check out this Amazon Cognito Cheat Sheet:
https://tutorialsdojo.com/amazon-cognito/

AWS Batch is a regional service that simplifies running batch jobs across multiple Availability Zones within a region. You can create AWS Batch compute environments within a new or existing VPC. After a compute environment is up and associated with a job queue, you can define job definitions that specify which Docker container images to run your jobs.

Amazon EFS is a regional service storing data within and across multiple Availability Zones (AZs) for high availability and durability. Amazon EC2 instances can access your file system across AZs, regions, and VPCs, while on-premises servers can access using AWS Direct Connect or AWS VPN.
An AWS resource can be a Global, Regional, or Zonal service. A Global service means that it covers all of the AWS Regions across the globe, while a regional service means that a resource is only applicable to one specific region at a time. A regional service may or may not have the ability to replicate the same resource in another region. Lastly, a Zonal service can only exist in one Availability Zone.
You don‘t need to memorize the scope of all of the AWS services as long as you know the pattern. There are actually only a handful of services that are considered global services, such as IAM, STS, Route 53, CloudFront, and WAF. For Zonal services, the examples are EC2 Instances and EBS Volumes which are tied to the Availability Zone, where they were launched. Take note that although EBS Volumes are considered a zonal service, the EBS snapshots are considered regional since it is not tied to a specific Availability Zone. The rest of the services are regional in scope.
Hence, the correct answers are:
– Amazon EFS
– AWS Batch
AWS Security Token Service and Amazon Route 53 are both incorrect because these are considered global services.
Amazon EC2 is incorrect because this is considered as a zonal service since it is tied to a particular Availability Zone where it was launched.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resources.html
https://d1.awsstatic.com/whitepapers/architecture/AWS-Reliability-Pillar.pdf
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events
Check out these Amazon EFS and AWS Batch Cheat Sheets:
https://tutorialsdojo.com/amazon-efs/
https://tutorialsdojo.com/aws-batch/

Maintaining Operating System – AWS is responsible for maintaining the underlying infrastructure and the operating system for managed services like Amazon RDS. This responsibility includes ensuring that the operating system is up-to-date with the latest patches and security updates.
Patching database software – Another responsibility of AWS for managed services like Amazon RDS is patching the database software. AWS takes care of applying necessary patches and updates to the database software to ensure security, stability, and performance improvements. This includes both major and minor updates, bug fixes, and security patches.
Incorrect Options:
Encrypting data at rest – AWS provides options and capabilities to encrypt data at rest in Amazon RDS, the choice and implementation to use these options are the responsibility of the customer.
Managing IAM Groups – Management of AWS Identity and Access Management (IAM) groups, including the creation of users, roles, and policies, is the responsibility of the customer.
Managing access policies – Managing access policies is a customer‘s responsibility. Customers define and manage policies to control access to AWS resources.
References:
https://aws.amazon.com/compliance/shared-responsibility-model
https://aws.amazon.com/rds

You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-in-time snapshots. Snapshots are incremental backups, which means that only the blocks on the device that have changed after your most recent snapshot are saved. This minimizes the time required to create the snapshot and saves on storage costs by not duplicating data. Each snapshot contains all of the information that is needed to restore your data (from the moment when the snapshot was taken) to a new EBS volume.

Hence, the correct answer are:
– You can create point-in-time backups through EBS snapshots
– EBS backups are stored durably in Amazon S3
The option that says: You can take EBS backups by creating Amazon Machine Images (AMIs) is incorrect because EBS backup volumes are not called AMIs. An Amazon Machine Image (AMI) is a backup of an EC2 instance along with all of its EBS volumes. Since only a single volume needs to be backed up, you should create EBS Snapshots instead.
The option that says: Backing up the same EBS volume will create a new back up of the whole volume is incorrect because EBS Snapshots are incremental, which means that only the latest changes are backed up when you run the backup process. It does not back up the whole volume again.
The option that says: Instances will have to be stopped first to start the EBS backup is incorrect because you can actually run the EBS backup while the EC2 instance is running. This may cause some deterioration in EC2 performance, but it should not have a noticeable effect.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Storage.html
Check out this Amazon EBS Cheat Sheet:
https://tutorialsdojo.com/amazon-ebs/

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don‘t specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC.
For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This section describes the basic things you need to know about security groups for your VPC and their rules.

Hence, the correct answer is Security Group.
Network ACL is incorrect because this is primarily used to protect your subnets by controlling inbound and outbound traffic. They are not used to secure resources at an instance level.
Elastic Network Interface is incorrect because this is just a logical networking component in a VPC that represents a virtual network card. It does not serve as a virtual firewall for your instances.
Amazon VPC is incorrect because this simply lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. A VPC does not serve as a virtual firewall for your instances.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html
Check out these Tutorials Dojo Cheat Sheets:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/
https://tutorialsdojo.com/amazon-vpc/
https://tutorialsdojo.com/security-group-vs-nacl/

AWS Direct Connect – AWS Direct Connect is the correct service to establish a dedicated, private network connection between AWS and your on-premises data server. It allows you to establish a direct physical connection with AWS, bypassing the public internet.
With AWS Direct Connect, you can establish a private, high-bandwidth, low-latency connection to AWS, which provides a more reliable and consistent network performance compared to internet-based connections. This dedicated connection can be used for various purposes, such as transferring large data sets, running latency-sensitive applications, or extending your on-premises network into the AWS Cloud. By using AWS Direct Connect, you can ensure secure and efficient communication between your on-premises infrastructure and AWS services.
Incorrect Options:
Amazon Route 53 – Amazon Route 53 is a scalable domain name system (DNS) web service that routes traffic to resources in AWS or on-premises based on the DNS queries. It cannot establish a dedicated, private network connection between AWS and your on-premises data server.
Amazon CloudFront – Amazon CloudFront is a content delivery network (CDN) service that caches and delivers content from edge locations to improve the performance and scalability of web applications. It is not designed for establishing a private network connection between AWS and on-premises data servers.
Amazon API Gateway – Amazon API Gateway is a fully managed service that makes it easy to create, publish, and manage APIs for your applications. It can integrate with AWS services and provide access to them through APIs, it does not provide the functionality of establishing a dedicated, private network connection between AWS and on-premises data servers.
References:
https://aws.amazon.com/directconnect

AWS Health provides ongoing visibility into your resource performance and the availability of your AWS services and accounts. You can use AWS Health events to learn how service and resource changes might affect your applications running on AWS. AWS Health provides relevant and timely information to help you manage events in progress. AWS Health also helps you be aware of and to prepare for planned activities. The service delivers alerts and notifications triggered by changes in the health of AWS resources so that you get near-instant event visibility and guidance to help accelerate troubleshooting.

(IMAGE)
AWS Health Dashboard provides a complete health check of all services in all regions. Health events can help you learn how changes to services and resources may affect your AWS-hosted applications.
Hence, the correct answer is AWS Health.
AWS Support Center is incorrect because this is where you can check the support package you are subscribed to, and where you can file cases if you need assistance from the AWS support team. This option is incorrect since it does not provide the information stated in the scenario.
Amazon CloudWatch is incorrect because this collects data across all your AWS resources, applications, and services. Also, AWS does not use this dashboard to notify you of any upcoming changes or system-impactful issues.
Amazon SNS is incorrect because this is simply a messaging service used to deliver push notifications to recipients. This option is incorrect since it is the service used by AWS to notify you of any system-impactful issues.
References:
https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/
https://docs.aws.amazon.com/health/latest/ug/getting-started-phd.html
Check out this AWS Health Cheat Sheet:
https://tutorialsdojo.com/aws-health/

To provide discounted pricing for AWS resources – The AWS Savings Plans provide discounted pricing for AWS resources by allowing customers to commit to a certain amount of usage in exchange for lower prices. Customers can choose from different types of Savings Plans depending on their usage patterns and preferences. The service is designed to help customers save money on their AWS bills by providing predictable and flexible pricing options.
Incorrect Options:
To provide detailed cost allocation reports for AWS resources – This is the purpose of the AWS Cost Explorer and AWS Cost and Usage Reports services. These services provide detailed reports and analysis of AWS usage and costs, including cost allocation by service, region, and tag. It is not the purpose of AWS Savings Plans.
To provide cost optimization recommendations for AWS resources – This is the purpose of the AWS Trusted Advisor service, which provides recommendations for optimizing AWS resources based on best practices and usage patterns. It is not the purpose of AWS Savings Plans.
To set cost and usage budgets for AWS resources – This is the purpose of the AWS Budgets service, which allows customers to set custom cost and usage budgets for their AWS resources and receive alerts when their usage exceeds those budgets. It is not the purpose of AWS Savings Plans.
References:
https://aws.amazon.com/savingsplans

AWS maintains service limits for each account to help guarantee the availability of AWS resources, as well as to minimize billing risks for new customers. Some service limits are raised automatically over time as you use AWS, though most AWS services require that you request limit increases manually.

(IMAGE)
By default, there is an imposed limit in launching EC2 instances in your VPC. These increases are not granted immediately, so it may take a couple of days for your increase to become effective. On-Demand Instance limits are managed in terms of the number of virtual central processing units (vCPUs) that your running On-Demand Instances are using, regardless of the instance type. Then for each Region, you can purchase 20 regional Reserved Instances per month plus an additional 20 zonal Reserved Instances per month for each Availability Zone.
To request a limit increase:
1. Open the AWS Support Center page, sign in if necessary, and choose: Create case.
2. For the “Regarding“ field, choose: Service Limit Increase.
3. Complete the form. If this request is urgent, choose Phone as the method of contact instead of Web.
4. Choose Submit.
Hence, the correct answer is: Create a case in the AWS Support Center page and request a service limit increase.
The option that says: Enable Enhanced Networking is incorrect because this has nothing to do with service limits.
The option that says: Use AWS Trusted Advisor to increase the default service limits for EC2 instances is incorrect because you can‘t use AWS Trusted Advisor to increase your service limit. You have to raise a request to the AWS Support Center instead.
The option that says: Do nothing. You can directly launch 100 t3a.large EC2 instances at the same time since AWS will automatically increase your service limit for you is incorrect because AWS doesn‘t do this for you. It is your responsibility to raise a request to increase your service limit as this is not automatically done by AWS.
References:
https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html
https://aws.amazon.com/premiumsupport/knowledge-center/manage-service-limits/
https://aws.amazon.com/ec2/faqs/#how-many-instances-ec2
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-certified-cloud-practitioner/

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You pay only for the compute time you consume – there is no charge when your code is not running. With Lambda, you can run code for virtually any type of application or backend service – all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability.
AWS Lambda automatically scales your application by running code in response to each trigger. Your code runs in parallel and processes each trigger individually, scaling precisely with the size of the workload. With AWS Lambda, you are charged for every 1ms your code executes and the number of times your code is triggered.

Hence, the correct answer is: AWS Lambda.
Amazon DynamoDB is incorrect since this is a fast, scalable NoSQL database service of AWS.
Amazon Aurora is also incorrect since this is primarily used as a database service and not a compute service. Although it has a serverless feature (Aurora Serverless), it is still used as a database and not for data processing.
Amazon Athena is incorrect since this service is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL.
References:
https://aws.amazon.com/lambda/
https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
Check out this AWS Lambda Cheat Sheet:
https://tutorialsdojo.com/aws-lambda/
AWS Lambda Overview:
https://youtu.be/bPVX1zHwAnY

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. Basically, an Edge location is just a site that CloudFront uses to cache copies of your content for faster delivery to users at any location.
When a user requests content that you‘re serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

Regional edge caches are CloudFront locations that are deployed globally, close to your viewers. They‘re located between your origin server and the points of presence (POPs) —global edge locations that serve content directly to viewers. As objects become less popular, individual POPs might remove those objects to make room for more popular content. Regional edge caches have a larger cache than an individual POP, so objects remain in the cache longer at the nearest regional edge cache location. This helps keep more of your content closer to your viewers, reducing the need for CloudFront to go back to your origin server, and improving overall performance for viewers.
Hence, the correct answers are:
– Improves application performance by delivering content closer to your users
– Provides caching which reduces the load on your origin servers
The option that says: Offers an easy-to-use edge computing device that is helpful for data migration is incorrect because this is the description for AWS Snowball Edge. An edge location is not commonly used for data migration and it is not related to edge computing devices.
The option that says: Seamlessly extends AWS to edge devices so they can act locally on the data they generate, while still using the cloud for management, analytics, and durable storage is incorrect because this describes the AWS IoT Greengrass service which is quite different from Edge locations.
The option that says: Provides highly scalable object storage for your static content is incorrect because this refers to Amazon S3 and not Edge location.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowCloudFrontWorks.html
https://wa.aws.amazon.com/wat.concept.edge-location.en.html
Check out this Amazon CloudFront Cheat Sheet:
https://tutorialsdojo.com/amazon-cloudfront/

You manage access in AWS by creating IAM Policies and attaching them to IAM identities (users, groups of users, or roles) or AWS resources. A policy is an object in AWS that, when associated with an identity or resource, defines its permissions. AWS evaluates these policies when a principal uses an IAM entity (user or role) to make a request. Permissions in the policies determine whether the request is allowed or denied.

IAM Policy specifies and regulates Amazon resource permissions. It provides users and groups fine-grained control over the activities they can do on which AWS resources and is formatted as JSON documents, making it easy to read and write. Moreover, IAM Policy also supports versioning, enabling you to keep track of policy changes over time and revert versions if necessary. Access control is enforced via IAM Policy, which defines which users or groups can perform specific actions on resources and can be integrated with other Amazon services, such as AWS CloudTrail, to log and audit all API calls made to AWS resources. IAM Policy, therefore, offers a robust management tool for controlling access to Amazon resources and securing your AWS environment.
Hence the correct answer is: IAM Policy.
IAM User is incorrect because it represents a person or service that uses AWS resources and is in charge of authenticating and identifying AWS users.
IAM Group is incorrect because IAM Group is a collection of IAM users. It aids in simplifying the management of permissions for a group of IAM users.
IAM Role is incorrect because it refers to an IAM identity with specific permissions. Like an IAM user, an IAM role is an AWS identity with permission policies governing what the identity can and cannot do in AWS.On the other hand, an IAM Role is intended to be assumable by anyone who needs it.
References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_access-management.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
Check out this AWS IAM Cheat Sheet:
https://tutorialsdojo.com/aws-identity-and-access-management-iam/

Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

You can launch your AWS resources, such as Amazon EC2 instances, into your VPC. You can specify an IP address range for the VPC, add subnets, associate security groups, and configure route tables.
A subnet is a range of IP addresses in your VPC. You can launch AWS resources into a specified subnet. Use a public subnet for resources that must be connected to the internet, and a private subnet for resources that won‘t be connected to the internet. To protect the AWS resources in each subnet, you can use multiple layers of security, including security groups and network access control lists (ACL).
Hence, the correct answer is Amazon VPC.
Internet gateway is incorrect because this is just a VPC component that enables your servers in the public subnet to communicate with the public Internet. It does not isolate a virtual network space for you to launch resources in.
Amazon EC2 is incorrect because this is simply a compute service where you can host your applications and other databases; essentially, a server. It does not isolate a virtual network space for you to launch resources in.
AWS Elastic Beanstalk is incorrect because this service is just a platform where you can easily deploy applications and the service handles the infrastructure provisioning process for you. It does not isolate a virtual network space for you to launch resources in.
References:
https://aws.amazon.com/vpc/
https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
Check out this Amazon VPC Cheat Sheet:
https://tutorialsdojo.com/amazon-vpc/
Amazon VPC Overview Video Tutorial:
https://youtu.be/oIDHKeNxvQQ

Reserved Instances provide you with a significant discount compared to On-Demand instance pricing. In addition, when Reserved Instances are assigned to a specific Availability Zone, they provide a capacity reservation, giving you additional confidence in your ability to launch instances when you need them.
You can choose between three payment options when you purchase a Standard or Convertible Reserved Instance:
All Upfront option: You pay for the entire Reserved Instance term with one upfront payment. This option provides you with the largest discount compared to On-Demand instance pricing.
Partial Upfront option: You make a low upfront payment and are then charged a discounted hourly rate for the instance for the duration of the Reserved Instance term.
No Upfront option: Does not require any upfront payment and provides a discounted hourly rate for the duration of the term.

As a general rule, Standard RI provides more savings than Convertible RI, which means that the former is the cost-effective option. The All Upfront option provides you with the largest discount compared with the other types. Opting for a longer compute reservation, such as the 3-year term, gives us a greater discount as opposed to a shorter 1-year renewable term.
Hence, the correct answer is: All upfront payment for a 3-year term purchase.
All other options are incorrect because in order to get large discounts, you need to pay all the upfront costs with a 3-year reservation term.
– Partial upfront payment for a 1-year term purchase.
– All upfront payment for a 1-year term purchase.
– Partial upfront payment for a 3-year term purchase.
References:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
Amazon EC2 Overview:
https://www.youtube.com/watch?v=7VsGIHT_jQE
Check out this Amazon EC2 Cheat Sheet:
https://tutorialsdojo.com/amazon-elastic-compute-cloud-amazon-ec2/

Amazon S3 Glacier storage classes are designed to be the lowest-cost Amazon S3 storage classes, allowing you to archive large amounts of data at a very low cost. This makes it feasible to retain all the data you want for use cases like data lakes, analytics, IoT, machine learning, compliance, and media asset archiving. You pay only for what you need, with no minimum commitments or up-front fees.
S3 Glacier provides the following storage classes:
– S3 Glacier Instant Retrieval for archiving data that might be needed once per quarter and needs to be restored quickly (milliseconds)
– S3 Glacier Flexible Retrieval for archiving data that might infrequently need to be restored, once or twice per year, within a few hours
– S3 Glacier Deep Archive for archiving long-term backup cycle data that might infrequently need to be restored within 12 hours

(IMAGE)
To keep costs low yet suitable for varying retrieval needs, Amazon S3 Glacier Flexible Retrieval provides three options for access to archives, from a few minutes to several hours, and S3 Glacier Deep Archive provides two access options ranging from 12 to 48 hours.
Hence, the correct answer is: Amazon S3 Glacier Flexible Retrieval.
Amazon S3 is incorrect because this type of storage service costs more than S3 Glacier storage classes.
Amazon EBS is incorrect because this is a type of block storage that is not suitable to be used for database backups. It is also more expensive than S3 Glacier Flexible Retrieval.
Amazon EFS is incorrect because this is a type of POSIX-compliant file storage suitable to be used as a file system and not for storing backups.
References:
https://aws.amazon.com/s3/faqs/
https://docs.aws.amazon.com/amazonglacier/latest/dev/introduction.html
https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/amazon-s3-glacier.html
Check out this Amazon S3 Glacier Cheat Sheet:
https://tutorialsdojo.com/amazon-glacier/
Amazon S3 and S3 Glacier Overview:
https://youtu.be/1ymyeN2tki4

The AWS Cloud infrastructure is built around AWS Regions and Availability Zones. An AWS Region is a physical location in the world where we have multiple Availability Zones. Availability Zones consist of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities.
These Availability Zones offer you the ability to operate production applications and databases that are more highly available, fault-tolerant, and scalable than would be possible from a single data center. The AWS Cloud operates in over 60 Availability Zones within over 20 geographic Regions around the world, with announced plans for more Availability Zones and Regions.

Each Amazon Region is designed to be completely isolated from the other Amazon Regions. This achieves the greatest possible fault tolerance and stability. Each Availability Zone is isolated, but the Availability Zones in a Region are connected through low-latency links. AWS provides you with the flexibility to place instances and store data within multiple geographic regions as well as across multiple Availability Zones within each AWS Region.
Each Availability Zone is designed as an independent failure zone. This means that Availability Zones are physically separated within a typical metropolitan region and are located in lower-risk flood plains (specific flood zone categorization varies by AWS Region). In addition to discrete uninterruptable power supply (UPS) and onsite backup generation facilities, they are each fed via different grids from independent utilities to further reduce single points of failure. Availability Zones are all redundantly connected to multiple tier-1 transit providers.
Hence, the correct answer is: Availability Zone.
Edge location is incorrect because this is just a site that CloudFront uses to cache copies of your content for faster delivery to users at any location.
AWS Region is incorrect because this consists of multiple Availability Zones (AZ).
VPC is incorrect because it is just a service that lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define.
References:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/global-infrastructure.html
https://aws.amazon.com/about-aws/global-infrastructure/
Check out this AWS Global Infrastructure Cheat Sheet:
https://tutorialsdojo.com/aws-global-infrastructure/
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-certified-cloud-practitioner/
AWS Global Infrastructure Video Tutorial:
https://youtu.be/rno8iNfKChM

AWS Organization – AWS Organizations is the service that allows you to manage billing and security policies centrally in your AWS Cloud accounts. It provides a way to centrally manage and govern multiple AWS accounts within your organization. With AWS Organizations, you can create groups of accounts, called organizational units (OUs), and apply policies to those OUs. This enables you to manage permissions, apply security policies, and control costs across all your accounts from a single, centralized location.
By using AWS Organizations, the CEO can gain a consolidated view of billing across all accounts, set up security policies that are enforced across the organization, and simplify the overall management of AWS resources.
Incorrect Options:
AWS IAM – AWS IAM (Identity and Access Management) is not the correct service for centrally managing billing and security policies. IAM is used for managing user access and permissions within individual AWS accounts, it does not provide centralized management capabilities across multiple accounts.
AWS Config – AWS Config is a service that allows you to assess, audit, and evaluate the configurations of your AWS resources. It helps you maintain compliance, monitor resource changes, and troubleshoot operational issues. However, it does not have the primary functionality of centrally managing billing and security policies across multiple accounts.
AWS Billing – AWS Billing is a service that provides you with information about your AWS usage and charges. It enables you to view, analyze, and manage your billing and cost data. While it helps with understanding and controlling costs. It does not provide the capability to centrally manage security policies across multiple accounts.
References:
https://aws.amazon.com/organizations

Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property, and provides you with dashboards and alerts that give visibility into how this data is being accessed or moved. The fully managed service continuously monitors data access activity for anomalies, and generates detailed alerts when it detects risk of unauthorized access or inadvertent data leaks.

(IMAGE)
You can use Amazon Macie to protect against security threats by continuously monitoring your data and account credentials. Amazon Macie gives you an automated and low-touch way to discover and classify your business data and detect sensitive information such as personally identifiable information (PII) and credential data. When alerts are generated, you can use Amazon Macie for incident response, using Amazon EventBridge to swiftly take action to protect your data.
Hence, the correct answer is Amazon Macie.
Amazon Rekognition is incorrect. Although it is also a machine learning-based service like Amazon Macie, it is primarily used for image and video analysis. You can‘t use this to protect your sensitive data in AWS.
Amazon GuardDuty is incorrect because this is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.
Amazon Cognito is incorrect because this is primarily used if you want to add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily.
References:
https://aws.amazon.com/macie/
https://docs.aws.amazon.com/macie/latest/userguide/what-is-macie.html
Check out this Amazon Macie Cheat Sheet:
https://tutorialsdojo.com/amazon-macie/
AWS Security Services Overview – Secrets Manager, ACM, Macie:
https://youtu.be/ogVamzF2Dzk

Deploying workloads on Amazon Web Services (AWS) helps streamline time-to-market, increase business efficiency, and enhance user performance for many organizations. But as you capitalize on this strategy, it is important to understand your role in securing your AWS environment.
Based on the AWS Shared Responsibility Model, AWS provides a data center and network architecture built to meet the requirements of the most security-sensitive organizations, while you are responsible for securing services built on top of this infrastructure, notably including network traffic from remote networks.

This customer/AWS shared responsibility model also extends to IT controls. Just as the responsibility to operate the IT environment is shared between AWS and its customers, so is the management, operation and verification of IT controls shared. AWS can help relieve customer burden of operating controls by managing those controls associated with the physical infrastructure deployed in the AWS environment that may previously have been managed by the customer. As every customer is deployed differently in AWS, customers can take advantage of shifting management of certain IT controls to AWS which results in a distributed control environment.
Customers can then use the AWS control and compliance documentation available to them to perform their control evaluation and verification procedures as required. Below are examples of controls that are managed by AWS, AWS Customers and/or both.
Inherited Controls: Controls which a customer fully inherits from AWS.
– Physical and Environmental controls
Shared Controls: Controls which apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services. Examples include:
– Patch Management: AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest OS and applications.
– Configuration Management: AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.
– Awareness & Training: AWS trains AWS employees, but a customer must train their own employees.
Customer Specific: Controls which are solely the responsibility of the customer based on the application they are deploying within AWS services. Examples include:
– Service and Communications Protection or Zone Security which may require a customer to route or zone data within specific security environments.
Hence, the correct answer is: Awareness and training.
The options that say: Client-side data encryption and Server-side data encryption are incorrect because these items fall under the responsibilities of the customer.
The option that says: Physical and environmental controls of the AWS data centers is incorrect because this is the sole responsibility of AWS.
References:
https://aws.amazon.com/compliance/shared-responsibility-model/
https://d1.awsstatic.com/Marketplace/scenarios/security/SEC_02_TSB_Final.pdf
Tutorials Dojo‘s AWS Certified Cloud Practitioner Exam Study Guide:
https://tutorialsdojo.com/aws-certified-cloud-practitioner/