- What is Amazon EC2?
- Elastic Compute Cloud — resizable virtual servers (instances) in the cloud; the core IaaS compute service
- What is Amazon S3?
- Simple Storage Service — highly durable, scalable object storage for files of any type, stored in buckets
- What is AWS Lambda?
- A serverless compute service that runs your code in response to events; you pay only for compute time used, no servers to manage
- What is Amazon VPC?
- Virtual Private Cloud — a logically isolated virtual network in AWS where you launch resources with full control over IP ranges, subnets, and routing
- What is an AWS Region?
- A separate geographic area containing multiple, isolated Availability Zones
- What is an Availability Zone (AZ)?
- One or more discrete data centers with redundant power and networking within a Region, isolated from failures in other AZs
- What is an edge location?
- A site used by Amazon CloudFront and Route 53 to cache content and serve it closer to users for low latency
- Region vs Availability Zone vs edge location?
- Region = geographic area; AZ = isolated data center(s) within a Region; edge location = caching site for content delivery
- How do you achieve high availability in AWS?
- Deploy resources across multiple Availability Zones so the failure of one AZ does not take down the application
- What is Amazon CloudFront?
- A content delivery network (CDN) that caches content at edge locations to deliver it with low latency
- What are AWS Local Zones?
- Extensions of a Region that place compute and storage closer to large population centers for single-digit-millisecond latency
- What is AWS Outposts?
- AWS infrastructure and services delivered as physical racks installed in your own on-premises data center for hybrid workloads
- What is AWS Wavelength?
- Embeds AWS compute and storage within 5G networks to deliver ultra-low-latency applications to mobile devices
- What are EC2 instance families?
- Categories of instance types optimized for different workloads: general purpose, compute optimized, memory optimized, storage optimized, and accelerated computing
- What is an Amazon Machine Image (AMI)?
- A template containing the operating system, configuration, and software used to launch EC2 instances
- What is Amazon EC2 Auto Scaling?
- Automatically adds or removes EC2 instances based on demand to maintain performance and minimize cost
- What is Elastic Load Balancing (ELB)?
- Automatically distributes incoming traffic across multiple targets such as EC2 instances across Availability Zones
- What is an Application Load Balancer (ALB)?
- A Layer 7 load balancer that routes HTTP/HTTPS traffic based on content such as URL path or host
- What is a Network Load Balancer (NLB)?
- A Layer 4 load balancer that handles TCP/UDP traffic at very high performance and ultra-low latency
- What is a Gateway Load Balancer (GWLB)?
- Distributes traffic to virtual appliances such as firewalls and intrusion-detection systems
- What is Amazon ECS?
- Elastic Container Service — a fully managed service to run and orchestrate Docker containers on AWS
- What is Amazon EKS?
- Elastic Kubernetes Service — a managed Kubernetes service for running containerized applications
- What is AWS Fargate?
- A serverless compute engine for containers that runs ECS or EKS tasks without managing the underlying servers
- What is AWS Elastic Beanstalk?
- A PaaS that automatically handles deployment, capacity, load balancing, and scaling for web applications you upload
- What is Amazon Lightsail?
- An easy-to-use service offering pre-configured virtual servers, databases, and networking at a low, predictable price
- What is AWS Batch?
- A service that runs large numbers of batch computing jobs, dynamically provisioning the optimal compute resources
- What is Amazon S3 Standard?
- The default S3 storage class for frequently accessed data, offering high durability and availability across multiple AZs
- What is S3 Standard-Infrequent Access (S3 Standard-IA)?
- A lower-cost S3 class for data accessed less often but needed quickly, with a per-GB retrieval fee
- What is S3 One Zone-IA?
- An infrequent-access S3 class storing data in a single Availability Zone at lower cost, for re-creatable data
- What is S3 Glacier Instant Retrieval?
- An archive S3 class for rarely accessed data that still needs millisecond retrieval
- What is S3 Glacier Flexible Retrieval?
- A low-cost archive class with retrieval times from minutes to hours, for data accessed once or twice a year
- What is S3 Glacier Deep Archive?
- The lowest-cost S3 storage class for long-term archival, with retrieval times of about 12 hours
- What is S3 Intelligent-Tiering?
- An S3 class that automatically moves objects between access tiers based on usage to optimize cost
- What is Amazon EBS?
- Elastic Block Store — durable block storage volumes you attach to EC2 instances, like a virtual hard drive
- What is Amazon EFS?
- Elastic File System — a scalable, fully managed shared file system that multiple Linux EC2 instances can mount at once
- What is Amazon FSx?
- Fully managed third-party file systems such as FSx for Windows File Server and FSx for Lustre
- EBS vs EFS vs S3?
- EBS = block storage for one instance; EFS = shared file storage for many Linux instances; S3 = object storage accessed over the internet
- What is AWS Storage Gateway?
- A hybrid service that connects on-premises applications to AWS cloud storage
- What is the AWS Snow Family?
- Physical devices (Snowcone, Snowball Edge) for migrating large amounts of data into and out of AWS, including in disconnected environments
- What is AWS Backup?
- A centralized service to automate and manage backups across AWS services
- What is Amazon RDS?
- Relational Database Service — managed relational databases (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server) that handle patching, backups, and failover
- What is Amazon Aurora?
- A high-performance, MySQL- and PostgreSQL-compatible relational database built for the cloud, part of RDS
- What is Amazon DynamoDB?
- A fully managed, serverless NoSQL key-value and document database with single-digit-millisecond performance at any scale
- What is Amazon Redshift?
- A fully managed, petabyte-scale cloud data warehouse for analytics and business intelligence
- What is Amazon ElastiCache?
- A managed in-memory caching service supporting Redis and Memcached to speed up applications
- What is Amazon DocumentDB?
- A managed document database service compatible with MongoDB
- What is Amazon Neptune?
- A fully managed graph database service for highly connected data sets
- What is Amazon Keyspaces?
- A managed, serverless database compatible with Apache Cassandra
- What is AWS Database Migration Service (DMS)?
- A service that migrates databases to AWS with minimal downtime, including between different database engines
- What is a subnet in AWS?
- A range of IP addresses within a VPC, placed in a single Availability Zone, that can be public or private
- Public vs private subnet?
- A public subnet has a route to an internet gateway; a private subnet does not have direct inbound internet access
- What is an internet gateway?
- A VPC component that allows communication between resources in the VPC and the internet
- What is a NAT gateway?
- Allows instances in a private subnet to initiate outbound internet connections while blocking inbound connections from the internet
- What is a security group?
- A stateful virtual firewall at the instance level that controls inbound and outbound traffic; allow rules only
- What is a network ACL (NACL)?
- A stateless firewall at the subnet level that supports both allow and deny rules
- Security group vs NACL?
- Security group = stateful, instance level, allow rules only; NACL = stateless, subnet level, allow and deny rules
- What is Amazon Route 53?
- A scalable Domain Name System (DNS) web service for domain registration, routing, and health checks
- What is AWS Direct Connect?
- A dedicated private network connection from your premises to AWS, bypassing the public internet
- What is an AWS Site-to-Site VPN?
- An encrypted connection over the internet between your on-premises network and your AWS VPC
- What is Amazon API Gateway?
- A fully managed service to create, publish, and secure REST, HTTP, and WebSocket APIs at scale
- What is AWS Transit Gateway?
- A network hub that connects VPCs and on-premises networks through a central gateway
- What is VPC peering?
- A networking connection between two VPCs that lets resources route traffic privately between them
- What is AWS PrivateLink?
- Provides private connectivity between VPCs and AWS services without exposing traffic to the public internet
- What is the AWS Management Console?
- A web-based graphical interface for accessing and managing AWS services
- What is the AWS CLI?
- The AWS Command Line Interface — a tool to control AWS services from the command line using commands and scripts
- What is an AWS SDK?
- Software Development Kits that let you interact with AWS services programmatically from languages such as Python, Java, and JavaScript
- What is AWS CloudFormation?
- An infrastructure-as-code service that provisions and manages AWS resources using templates
- What is infrastructure as code (IaC)?
- Defining and provisioning infrastructure through machine-readable templates or code rather than manual processes
- What is AWS Systems Manager?
- A service to view and control your AWS and on-premises infrastructure, including patching, automation, and Parameter Store
- What is Amazon CloudWatch?
- A monitoring service that collects metrics, logs, and alarms to observe AWS resources and applications
- What is AWS CloudTrail?
- A service that records API calls and account activity for governance, compliance, and auditing
- CloudWatch vs CloudTrail?
- CloudWatch monitors performance (metrics and logs); CloudTrail audits who did what (API call history)
- What is AWS Config?
- A service that tracks AWS resource configurations over time and evaluates them against rules for compliance
- What is AWS Elastic Beanstalk's benefit?
- It lets developers deploy applications quickly without managing the underlying infrastructure
- What is Amazon SNS?
- Simple Notification Service — a pub/sub messaging service that sends notifications to subscribers and other services
- What is Amazon SQS?
- Simple Queue Service — a fully managed message queue that decouples and scales application components
- SNS vs SQS?
- SNS pushes messages to many subscribers (pub/sub); SQS holds messages in a queue to be pulled by consumers
- What is Amazon EventBridge?
- A serverless event bus that connects application data from your apps, AWS services, and SaaS sources
- What is AWS Step Functions?
- A serverless service that coordinates multiple AWS services into visual workflows
- What is Amazon SageMaker?
- A fully managed service to build, train, and deploy machine learning models at scale
- What is Amazon Rekognition?
- An AI service that analyzes images and video for objects, faces, text, and content moderation
- What is Amazon Comprehend?
- A natural-language-processing service that finds insights and relationships in text
- What is Amazon Polly?
- A service that turns text into lifelike speech (text-to-speech)
- What is Amazon Lex?
- A service for building conversational chatbots using voice and text
- What is Amazon Transcribe?
- An automatic speech-recognition service that converts audio to text
- What is Amazon Translate?
- A neural machine-translation service that translates text between languages
- What is Amazon Textract?
- A service that automatically extracts text and data from scanned documents
- What is Amazon Q?
- A generative-AI-powered assistant for work and software development on AWS
- What is Amazon Athena?
- A serverless, interactive query service that analyzes data directly in Amazon S3 using SQL
- What is Amazon Kinesis?
- A platform to collect, process, and analyze real-time streaming data
- What is AWS Glue?
- A serverless data-integration and ETL (extract, transform, load) service to prepare data for analytics
- What is Amazon QuickSight?
- A cloud-based business-intelligence service for building dashboards and visualizations
- What is Amazon EMR?
- Elastic MapReduce — a managed big-data platform for processing data using frameworks like Apache Spark and Hadoop
- What is Amazon Connect?
- A cloud-based contact-center service for customer support
- What is AWS Amplify?
- A set of tools to build and deploy full-stack web and mobile applications quickly
- What is the AWS Well-Architected Tool?
- A free tool in the console that reviews your workloads against the Well-Architected Framework best practices
- What are the three cloud deployment options for compute access?
- AWS Management Console (GUI), AWS CLI (command line), and AWS SDKs (programmatic) — all call the same APIs
- What is the AWS global infrastructure made of?
- Regions, Availability Zones within each Region, and a global network of edge locations
- Why choose a particular AWS Region?
- Based on data residency/compliance, proximity to users (latency), service availability, and cost
- What is Amazon CloudFront used for?
- Delivering static and dynamic content with low latency by caching at edge locations worldwide
- What is AWS Elastic Beanstalk's pricing?
- Free service — you pay only for the underlying resources it provisions (EC2, S3, etc.)
- What is a launch template in EC2?
- A reusable configuration that specifies instance settings (AMI, type, key pair) used to launch instances
- What is the AWS Shared Responsibility Model?
- AWS is responsible for security OF the cloud; the customer is responsible for security IN the cloud
- Under shared responsibility, what does AWS secure?
- Security OF the cloud: hardware, the global infrastructure, Regions, AZs, edge locations, and the managed-service software
- Under shared responsibility, what does the customer secure?
- Security IN the cloud: their data, identity and access management, OS/app patching for what they run, encryption, and network/firewall configuration
- How does shared responsibility shift for Amazon EC2?
- EC2 is closer to IaaS, so the customer manages the guest OS, patching, applications, and security configuration
- How does shared responsibility shift for managed services like S3, RDS, or Lambda?
- AWS handles more (the OS and platform); the customer mainly manages data, access permissions, and encryption settings
- Who is always responsible for data classification and IAM?
- The customer — managing their own data and controlling access is always the customer's responsibility
- What is AWS IAM?
- Identity and Access Management — controls who is authenticated and authorized to use AWS resources
- What is an IAM user?
- An identity representing a person or application with long-term credentials for accessing AWS
- What is an IAM group?
- A collection of IAM users that share the same permissions, making access easier to manage
- What is an IAM role?
- An identity with temporary permissions that can be assumed by users, applications, or AWS services — no long-term credentials
- What is an IAM policy?
- A JSON document that defines permissions — what actions are allowed or denied on which resources
- What is the principle of least privilege?
- Granting only the minimum permissions required to perform a task, and nothing more
- What is the AWS account root user?
- The identity created when you open an AWS account, with full access; it should be locked down and used only for a few tasks
- What are root user best practices?
- Enable MFA, do not use it for daily tasks, never create access keys for it, and create IAM identities for everyday use
- What is multi-factor authentication (MFA)?
- An extra layer of sign-in security requiring a second factor (such as a code from a device) in addition to a password
- What is IAM Identity Center?
- Formerly AWS SSO — centrally manages single sign-on access to multiple AWS accounts and applications
- What are temporary credentials in AWS?
- Short-lived access keys provided when assuming a role, more secure than long-term credentials
- What is AWS Organizations?
- A service to centrally manage and govern multiple AWS accounts, with consolidated billing and policies
- What is a service control policy (SCP)?
- An Organizations policy that sets the maximum permissions for accounts in an organizational unit
- What is an organizational unit (OU)?
- A group of AWS accounts within AWS Organizations that can be managed as a single unit
- What is AWS Control Tower?
- A service that sets up and governs a secure, multi-account AWS environment based on best practices
- What is AWS Shield?
- A managed service that protects applications against Distributed Denial of Service (DDoS) attacks
- What is AWS Shield Standard vs Advanced?
- Shield Standard is free automatic DDoS protection; Shield Advanced adds enhanced protection, reporting, and DDoS cost protection
- What is AWS WAF?
- Web Application Firewall — filters and blocks malicious web traffic such as SQL injection and cross-site scripting
- What is Amazon GuardDuty?
- A threat-detection service that continuously monitors for malicious activity and unauthorized behavior
- What is Amazon Inspector?
- An automated vulnerability-management service that scans workloads for software vulnerabilities and exposure
- What is Amazon Macie?
- A service that uses machine learning to discover and protect sensitive data such as PII stored in Amazon S3
- What is AWS Security Hub?
- A service that gives a centralized view of security alerts and compliance status across AWS accounts
- What is AWS KMS?
- Key Management Service — creates and manages encryption keys to encrypt your data across AWS services
- What is AWS CloudHSM?
- A hardware security module (HSM) service that provides dedicated hardware to manage your encryption keys
- What is AWS Secrets Manager?
- A service to store, manage, and automatically rotate secrets such as database credentials and API keys
- What is AWS Certificate Manager (ACM)?
- A service to provision, manage, and deploy SSL/TLS certificates for AWS resources
- What is Amazon Cognito?
- A service that adds user sign-up, sign-in, and access control to web and mobile apps
- What is AWS Artifact?
- A self-service portal providing on-demand access to AWS compliance reports and agreements
- What is encryption at rest?
- Protecting stored data by encrypting it on disk, so it is unreadable without the key
- What is encryption in transit?
- Protecting data as it moves across networks, typically using TLS/SSL
- What are AWS compliance programs?
- Third-party attestations and certifications (e.g., SOC, PCI DSS, HIPAA, ISO, FedRAMP) that AWS meets
- What is the AWS Compliance Center / Artifact's role?
- To provide evidence that AWS infrastructure meets regulatory and compliance requirements
- What is Amazon Detective?
- A service that analyzes and visualizes security data to investigate the root cause of security findings
- What is AWS Firewall Manager?
- Centrally configures and manages firewall rules (WAF, Shield, security groups) across accounts
- What is AWS Network Firewall?
- A managed network firewall service for VPCs that filters traffic at the perimeter
- What is AWS IAM Access Analyzer?
- Identifies resources shared with external entities and helps validate least-privilege policies
- What is AWS Audit Manager?
- Automates evidence collection to help audit AWS usage against compliance frameworks
- What is the difference between authentication and authorization?
- Authentication verifies who you are (sign-in); authorization determines what you are allowed to do (permissions)
- What is a customer managed key (CMK) in KMS?
- An encryption key that the customer creates, owns, and manages within AWS KMS
- What is AWS Trusted Advisor's security role?
- It checks for security gaps such as open ports, exposed access keys, and missing MFA on the root user
- What does 'security of the cloud' mean?
- AWS protecting the infrastructure that runs all AWS services — compute, storage, networking, and facilities
- What does 'security in the cloud' mean?
- The customer protecting their content, applications, identity management, and configurations
- Who patches the guest operating system on an EC2 instance?
- The customer is responsible for guest OS patching on EC2
- Who patches the database engine on Amazon RDS?
- AWS handles patching of the managed RDS database engine; the customer manages data and access
- What is the value of MFA?
- It greatly reduces the risk of account compromise even if a password is stolen
- What is an IAM policy's structure?
- JSON with Effect (Allow/Deny), Action, Resource, and optional Condition elements
- What is identity federation?
- Allowing users authenticated by an external identity provider to access AWS without separate IAM users
- What is AWS Resource Access Manager (RAM)?
- A service to securely share AWS resources across accounts
- Why use IAM roles instead of access keys for EC2?
- Roles provide temporary, automatically rotated credentials, avoiding hard-coded long-term keys
- What is data residency / data sovereignty?
- The requirement that data be stored within a specific country or Region; you control the Region in AWS
- What is the AWS Customer Agreement's relevance to security?
- It defines the terms of service, including the shared responsibility for security and compliance
- What is least privilege's benefit?
- Reduces the attack surface and limits damage if credentials are compromised
- What is AWS Abuse / reporting?
- AWS provides channels to report suspected abuse of AWS resources, such as spam or malicious activity
- What is a bastion host (jump box)?
- A hardened instance in a public subnet used to securely access instances in private subnets
- What is the benefit of a Web Application Firewall?
- It protects web applications from common exploits by filtering HTTP/HTTPS requests with rules
- What is penetration testing policy on AWS?
- Customers may run pen tests on permitted services without prior approval, subject to AWS policy
- What is AWS Security Token Service (STS)?
- Issues temporary, limited-privilege credentials for IAM users or federated users
- What service detects exposed credentials in your account?
- Amazon GuardDuty (threat detection) and Trusted Advisor flag suspicious or exposed credentials
- What is the benefit of centralized logging with CloudTrail?
- It provides an auditable record of API activity across the account for security investigations
- What is a key pair in EC2?
- A public and private key used to securely connect (SSH/RDP) to an EC2 instance
- What is AWS WAF's relationship to CloudFront and ALB?
- WAF can be attached to CloudFront, Application Load Balancer, or API Gateway to filter traffic
- Why is the root user MFA critical?
- The root user has unrestricted access, so MFA is essential to prevent full account takeover
- What is a permissions boundary in IAM?
- An advanced feature that sets the maximum permissions an IAM entity can have
- What is the default for security group inbound rules?
- All inbound traffic is denied by default until you add allow rules
- What is the default for NACL on a default VPC?
- The default NACL allows all inbound and outbound traffic; custom NACLs deny all by default
- What is data encryption's shared responsibility?
- AWS provides encryption tools (KMS); the customer is responsible for enabling and configuring encryption
- What is AWS Config's compliance use?
- It continuously evaluates resource configurations against desired rules and flags non-compliance
- What is Amazon Macie primarily used to protect?
- Sensitive data such as personally identifiable information (PII) stored in Amazon S3
- What is the difference between Inspector and GuardDuty?
- Inspector scans for software vulnerabilities; GuardDuty detects active threats and malicious behavior
- What is AWS Shield Standard included with?
- It is automatically included at no extra cost for all AWS customers, protecting against common DDoS attacks
- What is the customer's role in S3 bucket security?
- Configuring bucket policies, access control, Block Public Access, and encryption to protect data
- What is S3 Block Public Access?
- An S3 setting that prevents buckets and objects from being made publicly accessible
- What is the least secure way to grant EC2 AWS access?
- Embedding long-term access keys in code; the secure way is to attach an IAM role
- What compliance evidence can AWS Artifact provide?
- On-demand reports such as SOC reports, PCI DSS attestations, and ISO certifications
- What is the goal of AWS Security Hub?
- To aggregate, organize, and prioritize security findings from multiple AWS security services
- What is encryption key rotation?
- Periodically replacing encryption keys to limit exposure; KMS can rotate keys automatically
- What is a managed policy vs inline policy in IAM?
- A managed policy is reusable and attachable to many identities; an inline policy is embedded in a single identity
- What is the benefit of AWS Organizations for security?
- It enables centralized governance, SCP guardrails, and consistent policies across all accounts
- What is GuardDuty's data source?
- It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to detect threats
- What does 'defense in depth' mean in AWS?
- Applying multiple layers of security controls (network, identity, encryption, monitoring) so no single failure is catastrophic
- What is AWS WAF used to block?
- Common web exploits like SQL injection, cross-site scripting, and bad bots
- Who controls who can access an S3 bucket?
- The customer, through IAM policies, bucket policies, ACLs, and Block Public Access settings
- What is the principle behind temporary roles for cross-account access?
- Assume-role grants short-lived credentials, avoiding shared long-term keys between accounts
- What is cloud computing?
- On-demand delivery of IT resources (compute, storage, databases) over the internet with pay-as-you-go pricing
- What are the six benefits of cloud computing?
- Trade fixed for variable expense, benefit from economies of scale, stop guessing capacity, increase speed and agility, stop spending on data centers, and go global in minutes
- What is the pay-as-you-go model?
- Paying only for the resources you actually use, with no large upfront investment
- What is CapEx vs OpEx?
- Capital expenditure is upfront spending on owned assets; operational expenditure is ongoing pay-as-you-go spending — the cloud shifts CapEx to OpEx
- What is elasticity in the cloud?
- The ability to automatically add or remove resources to match demand in real time
- What is scalability in the cloud?
- The ability to increase capacity to handle growth, by scaling up (bigger) or scaling out (more)
- Elasticity vs scalability?
- Scalability is the capacity to grow; elasticity is automatically scaling in and out with fluctuating demand
- What is agility in the cloud?
- The ability to quickly develop, test, and launch applications because resources are available on demand
- What are economies of scale in the cloud?
- Because AWS aggregates usage from many customers, it achieves lower costs and passes savings to customers
- What does 'go global in minutes' mean?
- You can deploy applications to multiple Regions worldwide quickly, reaching users with low latency
- What is high availability?
- Designing systems to remain operational with minimal downtime, often by using multiple Availability Zones
- What is fault tolerance?
- The ability of a system to keep running even when a component fails
- What is the AWS Well-Architected Framework?
- A set of best practices and design principles for building secure, reliable, efficient, and cost-effective workloads, organized into six pillars
- How many pillars are in the Well-Architected Framework?
- Six: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability
- What is the Operational Excellence pillar?
- Running and monitoring systems to deliver business value and continually improving processes and procedures
- What is the Security pillar?
- Protecting data, systems, and assets through risk assessment and mitigation strategies
- What is the Reliability pillar?
- Ensuring a workload performs its function correctly and recovers quickly from failures
- What is the Performance Efficiency pillar?
- Using computing resources efficiently and maintaining efficiency as demand and technology change
- What is the Cost Optimization pillar?
- Running systems to deliver business value at the lowest price point
- What is the Sustainability pillar?
- Minimizing the environmental impact of running cloud workloads
- What is the AWS Cloud Adoption Framework (CAF)?
- Guidance that helps organizations plan and accelerate cloud adoption across six perspectives
- What are the six perspectives of the AWS CAF?
- Business, People, Governance, Platform, Security, and Operations
- What are the migration strategies (the 7 Rs)?
- Rehost, Replatform, Repurchase, Refactor, Retire, Retain, and Relocate
- What is rehosting (lift and shift)?
- Moving an application to the cloud with little or no change
- What is replatforming (lift, tinker, and shift)?
- Making a few cloud optimizations to gain benefits without changing the core architecture
- What is refactoring (re-architecting)?
- Redesigning an application to take full advantage of cloud-native features
- What is repurchasing?
- Moving from a licensed product to a different one, often a SaaS offering
- What is retiring in migration?
- Decommissioning applications that are no longer needed
- What is retaining in migration?
- Keeping certain applications on-premises for now (revisit later)
- What is relocating in migration?
- Moving infrastructure to the cloud without purchasing new hardware or changing operations, e.g., VMware Cloud on AWS
- What is Total Cost of Ownership (TCO)?
- The full cost of owning a solution, including hardware, software, operations, and staffing, used to compare on-premises vs cloud
- What is right-sizing?
- Matching instance types and sizes to actual workload requirements to optimize cost and performance
- What is IaaS?
- Infrastructure as a Service — basic building blocks (compute, storage, networking) with maximum control, e.g., EC2
- What is PaaS?
- Platform as a Service — a managed platform to develop and deploy apps without managing infrastructure, e.g., Elastic Beanstalk
- What is SaaS?
- Software as a Service — completed applications delivered over the internet, e.g., email or a web app
- IaaS vs PaaS vs SaaS?
- IaaS gives the most control over infrastructure; PaaS manages the platform; SaaS delivers ready-to-use software
- What are the cloud deployment models?
- Cloud (all-in), Hybrid (cloud plus on-premises), and On-premises (private cloud)
- What is a hybrid deployment?
- Connecting cloud resources with existing on-premises infrastructure
- What is cloud economics?
- Understanding and optimizing the cost benefits of the cloud, such as variable cost and reduced TCO
- What is undifferentiated heavy lifting?
- Routine tasks (racking servers, patching) that add no unique value, which the cloud offloads to AWS
- What is loose coupling in architecture?
- Designing components so they operate independently, reducing the impact of one failing
- What is the benefit of automation in the cloud?
- It reduces manual effort and errors, improves consistency, and lowers operational cost
- What is a managed service?
- An AWS service where AWS handles the operational tasks (patching, scaling, backups), reducing customer burden
- What is serverless computing?
- Running code without provisioning or managing servers; AWS handles scaling and you pay per use, e.g., Lambda
- What does 'stop guessing capacity' mean?
- With elastic cloud resources you no longer need to over- or under-provision hardware for peak demand
- What is the value of going to the cloud for speed?
- Resources are available in minutes, so teams experiment and deliver faster
- What is a Region's relationship to compliance?
- Choosing a Region lets you keep data in a specific geography to meet legal and regulatory requirements
- What is disaster recovery in the cloud?
- Using AWS to back up and recover workloads quickly across Regions/AZs to minimize downtime and data loss
- What is the benefit of global reach?
- Deploying close to end users worldwide reduces latency and improves experience
- What is the difference between vertical and horizontal scaling?
- Vertical scaling adds power to one resource (scale up); horizontal scaling adds more resources (scale out)
- What does the cloud do to upfront costs?
- It eliminates large upfront capital costs in favor of variable operating costs
- What is the value of the Well-Architected Framework?
- It helps you measure architectures against best practices and identify areas for improvement
- What is the AWS Cloud value proposition in one line?
- On-demand, scalable IT resources with pay-as-you-go pricing and no upfront infrastructure investment
- What is the difference between cloud and on-premises?
- On-premises means you own and run the data center; cloud means AWS owns the infrastructure and you consume it as a service
- What is workload portability?
- The ability to run workloads across environments, supported by containers and standard tooling
- What is the benefit of microservices on AWS?
- Breaking apps into small, independent services improves agility, scalability, and resilience
- What is the difference between scaling out and scaling in?
- Scaling out adds resources to meet demand; scaling in removes them when demand drops, saving cost
- What is the relationship between elasticity and cost savings?
- Paying only for resources while in use, and releasing them when idle, lowers total spend
- What is the design principle 'design for failure'?
- Assume components will fail and architect so the system continues operating despite failures
- What is the benefit of using multiple Availability Zones?
- It increases availability and fault tolerance by isolating workloads from a single AZ failure
- What is a proof of concept (POC) advantage in the cloud?
- Low-cost, fast experimentation because you can spin resources up and tear them down on demand
- What does CAF help an organization create?
- An action plan (cloud transformation roadmap) for a successful cloud migration
- What is the difference between a public and private cloud?
- Public cloud resources are shared and delivered over the internet (AWS); private cloud is dedicated to one organization
- Why is the cloud considered more secure for many organizations?
- AWS invests heavily in security and compliance at a scale most organizations cannot match on their own
- What is the benefit of pay-as-you-go for variable workloads?
- You avoid paying for idle capacity during low-demand periods
- What is the cloud's effect on time to market?
- It shortens time to market by removing procurement and provisioning delays
- What is the benefit of consolidating infrastructure in the cloud?
- Reduced operational overhead, better utilization, and economies of scale
- What is a benefit of the Sustainability pillar?
- It reduces energy use and carbon footprint by optimizing resource usage
- What are the main AWS EC2 pricing models?
- On-Demand, Reserved Instances, Savings Plans, Spot Instances, and Dedicated Hosts
- What is On-Demand pricing?
- Pay for compute by the second or hour with no commitment — best for short-term, unpredictable workloads
- What are Reserved Instances (RIs)?
- A 1- or 3-year commitment to a specific instance configuration in exchange for a large discount over On-Demand
- What are Savings Plans?
- A flexible pricing model offering lower prices for a committed amount of compute usage (per hour) over 1 or 3 years
- What are Spot Instances?
- Unused EC2 capacity at up to 90% off On-Demand; AWS can reclaim them with short notice — ideal for fault-tolerant workloads
- What are Dedicated Hosts?
- Physical EC2 servers dedicated to you, often used for licensing or compliance requirements
- Which pricing model is cheapest for fault-tolerant, flexible workloads?
- Spot Instances, which offer the deepest discount but can be interrupted
- Which pricing model suits steady, predictable usage?
- Reserved Instances or Savings Plans, which discount in exchange for a 1- or 3-year commitment
- What is the AWS Free Tier?
- A way to try AWS services free, in three forms: always free, 12-months free, and short-term trials
- What are the three types of AWS Free Tier?
- Always Free, 12 Months Free (for new accounts), and Free Trials (short-term)
- What are the three fundamental drivers of AWS cost?
- Compute, storage, and data transfer out of AWS (inbound transfer is generally free)
- Is data transfer into AWS charged?
- Inbound data transfer is generally free; you are charged for data transferred out
- What is consolidated billing?
- An AWS Organizations feature that combines billing for multiple accounts into one bill and can earn volume discounts
- What is a benefit of consolidated billing?
- One bill across accounts plus aggregated usage that can qualify for volume pricing tiers
- What is AWS Cost Explorer?
- A tool to visualize, understand, and forecast your AWS costs and usage over time
- What is AWS Budgets?
- A tool to set custom cost and usage budgets and receive alerts when you exceed or are forecast to exceed them
- What is the AWS Cost and Usage Report (CUR)?
- The most detailed report of your AWS costs and usage, delivered to an S3 bucket
- What is the AWS Pricing Calculator?
- A web tool to estimate the cost of AWS services before you deploy them
- What is AWS Billing Conductor?
- A service to customize billing and show back/charge back costs across accounts
- What are cost allocation tags?
- Labels on resources used to categorize and track AWS costs in billing reports
- Cost Explorer vs AWS Budgets?
- Cost Explorer analyzes and forecasts past/current spend; Budgets sets thresholds and alerts you proactively
- What are the five AWS Support plans?
- Basic, Developer, Business, Enterprise On-Ramp, and Enterprise
- What is included in AWS Basic Support?
- Free for all customers: documentation, whitepapers, AWS re:Post, and access to a limited set of Trusted Advisor checks
- What does the Developer Support plan offer?
- Business-hours email access to Cloud Support associates, for early development and testing
- What does the Business Support plan offer?
- 24/7 phone, email, and chat support, full Trusted Advisor checks, and faster response times — for production workloads
- What does Enterprise On-Ramp add?
- A pool of Technical Account Managers and faster critical response, between Business and Enterprise
- What does the Enterprise Support plan offer?
- A designated Technical Account Manager (TAM), 24/7 support, fastest response (15 minutes for business-critical), and concierge support
- Which support plans include a designated TAM?
- Enterprise Support includes a designated TAM; Enterprise On-Ramp provides a pool of TAMs
- Which support plans include full Trusted Advisor checks?
- Business, Enterprise On-Ramp, and Enterprise (Basic and Developer get a limited set)
- What is AWS Trusted Advisor?
- A tool that inspects your environment and recommends improvements across five categories
- What are the five Trusted Advisor categories?
- Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits (quotas)
- What is the AWS Health Dashboard?
- Shows the health and status of AWS services and any events affecting your specific resources
- What is AWS re:Post?
- A community-driven, AWS-managed question-and-answer service that replaced AWS Forums
- What is the AWS Knowledge Center?
- A collection of answers to the most frequent technical questions about AWS
- What is AWS Marketplace?
- A curated digital catalog to find, buy, and deploy third-party software that runs on AWS
- What is a Technical Account Manager (TAM)?
- A designated AWS advocate who provides proactive guidance and architectural support to Enterprise customers
- Which support plan suits a business running production workloads?
- Business Support — 24/7 access, full Trusted Advisor, and quick response times
- What is the benefit of volume discounts on AWS?
- The more you use of certain services (like S3), the lower the per-unit price through tiered pricing
- What is the difference between Savings Plans and Reserved Instances?
- Savings Plans commit to a dollar-per-hour spend with flexibility across instance families; RIs commit to specific instance configurations
- What is the cost benefit of automation tools like Trusted Advisor?
- They identify idle or underused resources and security gaps, helping reduce cost and risk
- How much does the AWS Cloud Practitioner exam cost?
- $100 USD
- What does compensatory scoring mean for billing/support questions on the exam?
- You do not need to pass each domain separately; only the overall scaled score of 700 matters
