Cloud Computing AWS Practice Exam

Question 1 Cloud Computing AWS

What is Amazon CloudFront and how does it work?

AWS Shield is a managed DDoS protection service.

Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

Amazon Cognito provides authentication, authorization, and user management for web/mobile apps. Components:

User Pools — User directories with sign-in, MFA, federation (SAML/OIDC)
Identity Pools — Exchange user pool/IdP tokens for AWS credentials to access AWS services

Tokens are JWT (ID, access, refresh). Cognito can act as an OIDC IdP for API Gateway and ALB. AWS Amplify is a set of tools and services to build full-stack web and mobile apps on AWS. Features:

Amplify Studio — Visual UI builder for frontends and data models
Amplify CLI — Configure backend resources (Auth, Storage, Functions, GraphQL)
Amplify Hosting — Git-based CI/CD with CloudFront, branch previews, custom domains

Targets React, Vue, Angular, iOS, Android, Flutter. CloudFront is a global CDN with 600+ Points of Presence (PoPs). Behavior:

User requests are routed to the nearest edge via DNS and Anycast IPs
Edges cache responses based on TTL and cache key (path, query string, headers, cookies)
Cache misses forward to origin (S3, ALB, EC2, MediaStore, custom) and store the result
Supports origin failover via origin groups

Question 2 Cloud Computing AWS

What is AWS Elastic Beanstalk?

Amazon Rekognition is a managed image and video analysis service. Capabilities include: object/scene/text detection, face analysis and comparison, face liveness, celebrity recognition, unsafe content moderation, and PPE detection. Charges per image or per minute of video analyzed. Lifecycle policies automate transitioning objects between storage classes or deleting them. You define rules based on:

Transition actions — Move objects to cheaper classes after N days (e.g., Standard → Glacier after 90 days)
Expiration actions — Delete objects after N days

Policies can target objects by prefix or tags and apply to current or previous versions. Object Lock prevents an object from being deleted or overwritten for a fixed period or indefinitely. Two retention modes:

Governance mode — Protected, but users with special IAM permissions can overwrite/delete
Compliance mode — Cannot be deleted or overwritten by anyone, including root, until the retention period expires

Requires versioning; enables WORM (write once, read many) for regulatory archives. AWS Elastic Beanstalk is a PaaS that deploys and manages applications automatically. You upload your code and Beanstalk handles:

Capacity provisioning (EC2, Auto Scaling)
Load balancing (ELB)
Health monitoring (CloudWatch)
Patching and updates

Supports Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker. You retain full control over underlying resources.

Question 3 Cloud Computing AWS

What is S3 Multipart Upload?

AWS CodePipeline is a fully managed continuous delivery service that orchestrates the steps to release software: source → build → test → deploy. It uses stages and actions, supports manual approvals, parallel execution, and triggers from CodeCommit, S3, ECR, GitHub, or Bitbucket. Multipart Upload lets you upload a single object as a set of parts (each between 5 MB and 5 GB, last part can be smaller; up to 10,000 parts). Benefits:

Parallelize uploads for speed
Resume from failed parts without restarting
Recommended for objects larger than 100 MB

Initiate with CreateMultipartUpload, upload parts, then CompleteMultipartUpload. AWS Site-to-Site VPN creates an encrypted IPsec tunnels over the public internet between your on-prem network and your AWS VPC. Two tunnels per connection for redundancy. Often paired with Direct Connect as a backup. Transit Gateway simplifies multi-VPC and multi-account VPN topologies. Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service. Key concepts:

Topic — A communication channel for messages
Publisher — Sends messages to a topic
Subscriber — Receives messages (email, SMS, HTTP, SQS, Lambda)

One message published to a topic is delivered to all subscribers (fan-out pattern). Supports message filtering to route specific messages to specific subscribers.

Question 4 Cloud Computing AWS

What is the AWS Well-Architected Tool?

A cache behavior in a CloudFront distribution defines how a URL pattern is processed: which origin to use, which viewer protocol policy (HTTP/HTTPS), cache policy (TTL, key), origin request policy, and response headers policy. The default behavior applies to all requests not matched by another path pattern. AWS Shield is a managed DDoS protection service.

Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

S3 Storage Lens provides organization-wide visibility into object-storage usage and activity trends. It delivers 30+ metrics (e.g., storage bytes, request count, encryption status) via an interactive dashboard, with daily exports to S3. Free default metrics; advanced metrics and recommendations are paid. The AWS Well-Architected Tool is a free self-service console that helps you review workloads against the Well-Architected Framework. You answer questions for each pillar, mark risks (high/medium), and track improvements over time. Lenses (e.g., serverless, SaaS, financial services) extend the framework to specific domains.

Question 5 Cloud Computing AWS

What is AWS Batch vs Lambda?

DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId. S3 Versioning keeps multiple variants of an object in the same bucket. When enabled:

Every overwrite or delete creates a new version
Deleted objects get a delete marker (recoverable)
Protects against accidental deletion and overwrites
Once enabled, versioning can be suspended but not disabled

Versioning is a prerequisite for Cross-Region Replication. Lambda deployment package limits:

Direct upload (.zip) — 50 MB compressed, 250 MB uncompressed (function + layers)
S3 upload (.zip) — 250 MB compressed, 250 MB uncompressed
Container image — 10 GB max image size

Layers count toward the unzipped size; total function size includes all layers and custom runtimes.

Lambda — Event-driven, short-lived (≤15 min), pay per ms, scales to thousands. Best for stateless, spiky work.
Batch — Long-running, containerized batch jobs with queueing and priority. Best for scheduled, large-scale, multi-step workloads that need more than 15 min or specific hardware (e.g., GPU).

Use Step Functions to orchestrate both.

Question 6 Cloud Computing AWS

What are Reserved Instances?

Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network you define in AWS. You control:

IP address range (CIDR block, e.g., 10.0.0.0/16)
Subnets (public and private)
Route tables for traffic direction
Gateways for internet or VPN access

Each AWS account gets a default VPC in every Region. VPCs are Region-specific. AWS Fargate is a serverless compute engine for containers that works with ECS and EKS. You define task/pod CPU and memory; Fargate provisions and scales the infrastructure. No EC2 instances to manage, no patching, no over-provisioning. Charged per vCPU/GB-hour consumed. Amazon Athena is a serverless interactive query service that lets you run standard SQL directly against data in S3 (CSV, JSON, Parquet, ORC, Avro). It uses the Glue Data Catalog for table metadata. Pricing is $5 per TB scanned; partition data, use columnar formats (Parquet/ORC), and compress to cut cost. Reserved Instances (RIs) provide a capacity reservation and up to 75% discount for EC2 and RDS in exchange for a 1- or 3-year term. Options:

Standard RIs — Cheapest, but cannot be resold after exchange
Convertible RIs — Can change instance family, OS, tenancy
Regional vs Zonal — Zonal reserves capacity in a specific AZ

Savings Plans are generally more flexible for equivalent savings.

Question 7 Cloud Computing AWS

What is Amazon GuardDuty?

Amazon Lex is a service for building conversational interfaces (chatbots and voice bots) using the same technology as Alexa. Supports automatic speech recognition (ASR) and natural language understanding (NLU). Integrates with Lambda for fulfillment, Cognito for auth, and many messaging channels via Connect. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. Findings are categorized as low/medium/high severity and integrated with Security Hub, EventBridge, and Lambda for automated response. Amazon ElastiCache is a managed in-memory caching service that improves application performance. Two engines:

Redis — Rich data structures, persistence, replication, pub/sub, Lua scripting
Memcached — Simple key-value caching, multi-threaded, no persistence

Common uses: session stores, database query caching, leaderboards, and real-time analytics. Reduces database load significantly. IAM Access Analyzer analyzes resource-based policies (S3, KMS, IAM, SQS, SNS, Lambda, etc.) to identify unintended public or cross-account access. It also generates least-privilege IAM policies from access activity in CloudTrail, and validates policies against JSON grammar and best practices.

Question 8 Cloud Computing AWS

What is Amazon QuickSight?

Amazon Textract extracts printed text, handwriting, and structured data (tables, form fields) from documents and images. Goes beyond OCR by returning key-value pairs and tables with spatial context. Expense and ID document analysis is available as pre-trained APIs. DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId. S3 Select lets you run simple SQL expressions to filter and retrieve a subset of data from an S3 object (CSV, JSON, Parquet) without downloading the whole object. S3 Glacier Select does the same against objects stored in Glacier. Reduces data transfer and processing cost. Amazon QuickSight is a serverless business intelligence (BI) service with pay-per-session pricing ($0.30/session after the free trial). Features:

Build dashboards and interactive analyses with ML Insights (forecasting, anomaly detection, natural language Q&A)
Connects to RDS, Aurora, Redshift, Athena, S3, and on-prem/JDBC
Embed dashboards in applications

Targets SPICE in-memory engine for fast queries.

Question 9 Cloud Computing AWS

What is AWS PrivateLink?

AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-prem networks over the AWS backbone — no internet traversal. You create an Interface VPC endpoint with ENIs in your subnets and consume the service privately. Used for SaaS, marketplace services, and cross-account access. AWS Security Hub provides a single pane of glass for security alerts and compliance posture across AWS accounts. It aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools. It runs continuous, automated security checks against standards like CIS AWS Foundations Benchmark and PCI DSS. AWS Key Management Service (KMS) is a managed service to create and control encryption keys used to encrypt data. Features:

Integrated with S3, EBS, RDS, DynamoDB, Lambda, SQS, and many more
AWS-managed keys (free, automatic rotation) and customer-managed keys (CMKs) (full control)
Auditable via CloudTrail
FIPS 140-2 validated HSMs

KMS enforces envelope encryption at scale. AWS CodeDeploy automates application deployments to EC2, ECS, Lambda, and on-prem servers. Strategies:

In-place — Replace on the same instance (EC2/on-prem)
Blue/Green — New instances; traffic is shifted via ALB/Route 53; fast rollback

Integrates with Auto Scaling for Lambda hooks via traffic shifting (Canary/Linear/All-at-once).

Question 10 Cloud Computing AWS

What are Service Control Policies (SCPs)?

SCPs are JSON policies in AWS Organizations that define the maximum permissions for accounts in an OU or the entire org. They are permission boundaries, not grants — an SCP denies actions by default if not allowed. SCPs do not affect service-linked roles and do not grant permissions; they only restrict what IAM entities can do. Lambda Layers are ZIP archives containing libraries, custom runtimes, or other dependencies that can be shared across multiple functions. Benefits:

Reduce deployment package size
Promote code reuse across functions
Separate dependencies from business logic
A function can use up to 5 layers

Total unzipped size (function + layers) must be under 250 MB. AWS Distro for OpenTelemetry (ADOT) is a secure, AWS-supported distribution of the OpenTelemetry project. It provides auto-instrumentation agents for Java, Python, .NET, and Go that collect traces/metrics/logs and export to CloudWatch, X-Ray, or any OTLP backend. Security Groups:

Operate at the instance (ENI) level
Stateful — return traffic auto-allowed
Only allow rules

Network ACLs (NACLs):

Operate at the subnet level
Stateless — must explicitly allow return traffic
Support both allow and deny rules
Rules evaluated in number order

Use both for defense in depth.

Question 11 Cloud Computing AWS

What is S3 Replication?

S3 Replication automatically copies objects across buckets, often across regions (CRR) or within the same region (SRR). Use cases: disaster recovery, low-latency access, compliance, and data sovereignty. Requires versioning on both buckets. Replicates new objects by default; S3 Batch Replication backfills existing objects. Amazon Redshift is a fast, fully managed cloud data warehouse using columnar storage and massively parallel processing (MPP). Features:

RA3 nodes with managed storage and AQUA query accelerator
Redshift Serverless — No cluster management; per-second billing
Spectrum queries S3 without loading data
Concurrency Scaling and Elastic Resize

Pricing: per-node (DC2/RA3) or RPU-second (Serverless). Amazon SageMaker is a fully managed machine learning platform covering the entire ML lifecycle: labeling, data prep, training (built-in algorithms, BYO framework, JumpStart), tuning, deployment, and monitoring. Studio is the integrated IDE. Inference can run real-time, async, batch, or serverless. Long polling lets ReceiveMessage wait up to 20 seconds for messages to arrive instead of returning immediately. Benefits:

Reduces empty responses and API cost
Reduces latency of message delivery (messages appear as soon as they arrive)

Enable via WaitTimeSeconds at the queue level or per request.

Question 12 Cloud Computing AWS

What are the S3 storage classes?

A Dead Letter Queue is a special SQS queue that receives messages that failed processing after a configured number of attempts (maxReceiveCount). Benefits:

Isolates problematic messages for debugging
Prevents poison messages from blocking the main queue
Allows analysis and reprocessing of failed messages

DLQs should match the source queue type (Standard with Standard, FIFO with FIFO).

S3 Standard — Frequently accessed data, low latency
S3 Intelligent-Tiering — Auto-moves data between tiers based on access
S3 Standard-IA — Infrequent access, lower cost, retrieval fee
S3 One Zone-IA — Infrequent access, single AZ (cheaper)
S3 Glacier Instant Retrieval — Archive with millisecond access
S3 Glacier Deep Archive — Lowest cost, 12-hour retrieval

AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define AWS resources in JSON or YAML templates. Key concepts:

Template — Describes the desired resources
Stack — A running collection of resources from a template
Change Set — Preview changes before applying
Drift Detection — Identifies manual changes made outside CloudFormation

Amazon Route 53 is a highly available DNS (Domain Name System) web service. It provides:

Domain registration
DNS routing — Translates domain names to IP addresses
Health checks — Monitors endpoint availability

Named after port 53, the standard DNS port. Supports both public and private hosted zones.

Question 13 Cloud Computing AWS

What is SQS Message Timer (DelaySeconds)?

Long polling lets ReceiveMessage wait up to 20 seconds for messages to arrive instead of returning immediately. Benefits:

Reduces empty responses and API cost
Reduces latency of message delivery (messages appear as soon as they arrive)

Enable via WaitTimeSeconds at the queue level or per request. DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId. The Principle of Least Privilege means granting only the minimum permissions required to perform a task. Best practices:

Start with no permissions and add as needed
Use IAM Access Analyzer to identify unused permissions
Prefer managed policies over inline policies
Enable MFA (Multi-Factor Authentication) for all human users
Regularly review and rotate credentials

Parameter Store provides secure, hierarchical storage for configuration data and secrets. Two parameter tiers:

Standard — Free, up to 10,000 parameters
Advanced — $0.05/parameter/month, larger size, higher throughput

Use SecureString type with KMS to encrypt sensitive values. Integrated with ECS, Lambda, EC2 via aws ssm get-parameter.

Question 14 Cloud Computing AWS

What is Amazon Macie?

A cooldown period is a configurable time (default 300 seconds) after a scaling activity completes during which Auto Scaling does not launch or terminate additional instances. Purpose:

Prevents rapid fluctuations (thrashing)
Allows metrics to stabilize before the next scaling decision
Can be set per scaling policy or as a default cooldown

Use shorter cooldowns for fast-changing workloads.

Global Secondary Index (GSI) — An index with a different partition key and sort key from the base table. Can be created anytime. Has its own provisioned throughput.
Local Secondary Index (LSI) — Same partition key as the base table but a different sort key. Must be created at table creation time. Shares throughput with the base table.

Both enable efficient queries on non-primary-key attributes. AWS Identity and Access Management (IAM) controls who can access what in your AWS account. Core components:

Users — Individual people or applications
Groups — Collections of users with shared permissions
Roles — Assumed by services, users, or external identities
Policies — JSON documents defining allow/deny permissions

IAM is global (not region-specific) and free. Amazon Macie is a data security and privacy service that uses machine learning to automatically discover, classify, and protect sensitive data in S3. It identifies PII, credentials, and financial data, surfaces findings in Security Hub, and produces dashboards of data privacy risks.

Question 15 Cloud Computing AWS

What is the difference between horizontal and vertical scaling?

Horizontal scaling (scaling out/in) — Add or remove more instances (e.g., more EC2s, more Lambda concurrency). Common for stateless web tiers.
Vertical scaling (scaling up/down) — Increase the size of a single instance (more CPU/RAM). Limited by hardware; usually requires downtime.

AWS prefers horizontal scaling because it is elastic and fault-tolerant. AWS Wavelength embeds AWS compute and storage at 5G telecom provider edge locations to deliver single-digit millisecond latency to mobile devices. Targets 5G applications like AR/VR, IoT, real-time gaming, and smart factories. Wavelength Zones are tied to a parent Region. Lifecycle policies automate transitioning objects between storage classes or deleting them. You define rules based on:

Transition actions — Move objects to cheaper classes after N days (e.g., Standard → Glacier after 90 days)
Expiration actions — Delete objects after N days

Policies can target objects by prefix or tags and apply to current or previous versions. Logs Insights is an interactive query language for CloudWatch Logs. You write queries to search, filter, and aggregate log events (e.g., count errors, top IP addresses, average latency). Queries support functions, stats, parse, fields, sort, limit, and you can visualize results in a time-series chart.

Question 16 Cloud Computing AWS

What is AWS Config?

AWS AppSync is a managed GraphQL service that simplifies application development by providing a single endpoint to securely query/mutate data from multiple sources (DynamoDB, Aurora, Lambda, OpenSearch, HTTP). It supports real-time subscriptions via WebSockets, offline data sync, and caching with ElastiCache. Amazon EventBridge is a serverless event bus that connects applications using events. Features:

Built-in buses for AWS services, SaaS apps (Datadog, Zendesk), and custom apps
Schema registry for event contracts
Rules with content-based filtering, routing to Lambda, SQS, SNS, Step Functions, Kinesis
Replaces and supersedes CloudWatch Events

AWS Config provides a detailed inventory of AWS resources and tracks configuration changes over time. It answers "What did my resource look like at time T?" Features:

Records configuration history of resources
Evaluates resources against Config Rules (desired state)
Integrates with Security Hub and EventBridge

Useful for compliance auditing and change management. Lambda deployment package limits:

Direct upload (.zip) — 50 MB compressed, 250 MB uncompressed (function + layers)
S3 upload (.zip) — 250 MB compressed, 250 MB uncompressed
Container image — 10 GB max image size

Layers count toward the unzipped size; total function size includes all layers and custom runtimes.

Question 17 Cloud Computing AWS

What is AWS CloudFormation?

AWS Identity and Access Management (IAM) controls who can access what in your AWS account. Core components:

Users — Individual people or applications
Groups — Collections of users with shared permissions
Roles — Assumed by services, users, or external identities
Policies — JSON documents defining allow/deny permissions

IAM is global (not region-specific) and free. AWS Shield is a managed DDoS protection service.

Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

Placement Groups control how instances are placed on hardware:

Cluster — Packs instances close together in one AZ for low-latency, high-throughput (e.g., HPC)
Spread — Places instances on distinct hardware to reduce correlated failures (max 7 per AZ)
Partition — Spreads instances across logical partitions so groups don't share hardware (e.g., Hadoop, Kafka)

AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define AWS resources in JSON or YAML templates. Key concepts:

Template — Describes the desired resources
Stack — A running collection of resources from a template
Change Set — Preview changes before applying
Drift Detection — Identifies manual changes made outside CloudFormation

Question 18 Cloud Computing AWS

What is AWS Client VPN?

Throttling protects backend systems from request floods. Default limits:

Steady-state 10,000 RPS per account, per region
Burst 5,000 RPS per account
You can configure per-method rate and burst limits

Throttled requests return HTTP 429. For usage plans and API-key-based quotas, use REST API. AWS Amplify is a set of tools and services to build full-stack web and mobile apps on AWS. Features:

Amplify Studio — Visual UI builder for frontends and data models
Amplify CLI — Configure backend resources (Auth, Storage, Functions, GraphQL)
Amplify Hosting — Git-based CI/CD with CloudFront, branch previews, custom domains

Targets React, Vue, Angular, iOS, Android, Flutter. Amazon Polly is a text-to-speech (TTS) service that turns text into lifelike speech. Supports many languages and voices, Neural TTS for higher quality, Speech Synthesis Markup Language (SSML), and lexicons for custom pronunciation. Output formats include MP3, OGG, PCM. AWS Client VPN is a managed client-based VPN that lets remote users securely access AWS and on-prem resources using OpenVPN-based clients. It scales automatically and integrates with mutual TLS or SAML-based SSO. Useful for remote workforces needing private access to internal apps.

Question 19 Cloud Computing AWS

What is envelope encryption?

S3 Select lets you run simple SQL expressions to filter and retrieve a subset of data from an S3 object (CSV, JSON, Parquet) without downloading the whole object. S3 Glacier Select does the same against objects stored in Glacier. Reduces data transfer and processing cost. AWS AppSync is a managed GraphQL service that simplifies application development by providing a single endpoint to securely query/mutate data from multiple sources (DynamoDB, Aurora, Lambda, OpenSearch, HTTP). It supports real-time subscriptions via WebSockets, offline data sync, and caching with ElastiCache. Amazon Elastic File System (EFS) is a managed, shared, elastic NFS file system for Linux. Features:

Scales to petabytes; you pay only for what you use
Mount from thousands of EC2, ECS, Lambda, and on-prem via Direct Connect
Standard and Infrequent Access (IA) storage classes with lifecycle management
Multi-AZ regional or One Zone option

Envelope encryption encrypts data with a data key, and then encrypts the data key with a KMS key (a key encryption key). The data key is stored alongside the encrypted data for performance; only the encrypted copy is protected by KMS. This pattern allows you to encrypt large payloads without hitting KMS API limits.

Question 20 Cloud Computing AWS

What is Amazon CloudWatch Logs?

AWS Outposts is a fully managed hybrid solution that brings native AWS hardware and services to your on-premises data center. Outposts racks run EC2, EBS, S3, RDS, ECS, EKS using the same APIs and tools as in-region. Use cases: low-latency to on-prem systems, data residency, regulated industries. Amazon Lex is a service for building conversational interfaces (chatbots and voice bots) using the same technology as Alexa. Supports automatic speech recognition (ASR) and natural language understanding (NLU). Integrates with Lambda for fulfillment, Cognito for auth, and many messaging channels via Connect. Amazon Elastic Container Service (ECS) is a fully managed, highly scalable container orchestration service. Components:

Task Definition — Blueprint for containers (image, CPU/memory, env)
Service — Maintains N running tasks; integrates with ALB
Cluster — Logical grouping of tasks/services
Launch type — EC2 instances you manage, or Fargate (serverless)

CloudWatch Logs is the central log aggregation service in AWS. Features:

Ingests logs from EC2, Lambda, ECS, Route 53, VPC Flow Logs, and on-prem
Logs Insights to query and visualize log data
Metric filters turn log patterns into CloudWatch metrics
Subscription filters stream to Kinesis, Lambda, or OpenSearch

Logs are stored indefinitely unless you set a retention policy.

Question 21 Cloud Computing AWS

What is Amazon Kinesis Data Firehose?

Every Lambda function has an execution role — an IAM role that grants the function permissions to access AWS services and resources. The basic trust policy allows the Lambda service to sts:AssumeRole. Common permissions: CloudWatch Logs (always), X-Ray, and service-specific (e.g., S3 read, DynamoDB write). Amazon Lightsail is a beginner-friendly, low-cost VPS-style service with predictable monthly pricing. It bundles compute, storage, networking, and a static IP (often under $5/month). Best for small sites, dev/test, and learning. You can peer Lightsail with your VPC for advanced networking. AWS Identity and Access Management (IAM) controls who can access what in your AWS account. Core components:

Users — Individual people or applications
Groups — Collections of users with shared permissions
Roles — Assumed by services, users, or external identities
Policies — JSON documents defining allow/deny permissions

IAM is global (not region-specific) and free. Kinesis Data Firehose is the easiest way to load streaming data into S3, Redshift, OpenSearch, or custom HTTP endpoints. It is fully managed (no shards, no consumers) and supports near real-time delivery (lowest ~60 seconds) with optional Lambda transformations. No replay capability — for that use Kinesis Data Streams.

Question 22 Cloud Computing AWS

What are Auto Scaling cooldown periods?

AWS CDK is an open-source framework to define cloud resources using familiar programming languages (TypeScript, Python, Java, Go, .NET). CDK synthesizes your code into CloudFormation templates and deploys via cdk deploy. You author constructs (reusable cloud components) and share them as libraries. A cooldown period is a configurable time (default 300 seconds) after a scaling activity completes during which Auto Scaling does not launch or terminate additional instances. Purpose:

Prevents rapid fluctuations (thrashing)
Allows metrics to stabilize before the next scaling decision
Can be set per scaling policy or as a default cooldown

Use shorter cooldowns for fast-changing workloads. AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-prem networks over the AWS backbone — no internet traversal. You create an Interface VPC endpoint with ENIs in your subnets and consume the service privately. Used for SaaS, marketplace services, and cross-account access. Steps to host a static site on S3:

Create a bucket with your domain name
Enable Static Website Hosting in bucket properties
Set the index document (e.g., index.html) and error document
Make objects publicly readable via a bucket policy
Optionally, use CloudFront as a CDN and Route 53 for DNS

The endpoint format is: http://bucket-name.s3-website-region.amazonaws.com

Question 23 Cloud Computing AWS

What is Amazon Managed Service for Prometheus?

Kinesis Data Firehose is the easiest way to load streaming data into S3, Redshift, OpenSearch, or custom HTTP endpoints. It is fully managed (no shards, no consumers) and supports near real-time delivery (lowest ~60 seconds) with optional Lambda transformations. No replay capability — for that use Kinesis Data Streams. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. Findings are categorized as low/medium/high severity and integrated with Security Hub, EventBridge, and Lambda for automated response. Amazon Managed Service for Prometheus (AMP) is a serverless, Prometheus-compatible metrics monitoring service. It is integrated with ADOT, EKS, ECS, and EC2 for scraping Prometheus exporters, and dashboards via Amazon Managed Grafana. Removes the operational burden of running a Prometheus server. Lambda Layers are ZIP archives containing libraries, custom runtimes, or other dependencies that can be shared across multiple functions. Benefits:

Reduce deployment package size
Promote code reuse across functions
Separate dependencies from business logic
A function can use up to 5 layers

Total unzipped size (function + layers) must be under 250 MB.

Question 24 Cloud Computing AWS

What is Amazon S3?

The visibility timeout is the period during which SQS prevents other consumers from receiving a message that is currently being processed. Default: 30 seconds, max 12 hours. If the consumer fails to DeleteMessage within that window, SQS makes the message visible again. Set it to longer than the worst-case processing time to avoid duplicate processing. AWS Step Functions is a serverless workflow orchestrator for coordinating distributed components using state machines defined in Amazon States Language (ASL) JSON. Two workflow types:

Standard — Long-running (up to 1 year), exactly-once execution, full history
Express — Short-lived (up to 5 min), at-least-once, high throughput, lower cost

Useful for retries, parallelism, and human approvals. Amazon Simple Storage Service (S3) is an object storage service offering virtually unlimited storage. Data is stored as objects inside buckets. Each object can be up to 5 TB in size. S3 provides 99.999999999% (11 nines) durability and is accessed via HTTP/HTTPS APIs. Amazon Relational Database Service (RDS) is a managed service for relational databases. Supported engines:

MySQL, PostgreSQL, MariaDB
Oracle, SQL Server
Amazon Aurora (MySQL/PostgreSQL compatible, up to 5x faster)

RDS handles provisioning, patching, backups, and replication, letting you focus on your application.

Question 25 Cloud Computing AWS

What is Amazon SNS?

A Security Group acts as a virtual firewall for EC2 instances controlling inbound and outbound traffic. Key features:

Rules are stateful — return traffic is automatically allowed
You can only specify allow rules (no deny rules)
Evaluated as a group — all rules are checked before deciding
Applied at the instance (ENI) level

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service. Key concepts:

Topic — A communication channel for messages
Publisher — Sends messages to a topic
Subscriber — Receives messages (email, SMS, HTTP, SQS, Lambda)

One message published to a topic is delivered to all subscribers (fan-out pattern). Supports message filtering to route specific messages to specific subscribers. A pre-signed URL is a signed S3 URL that grants temporary, time-limited access (default 15 min, max 7 days) to a private object. Generated with the AWS SDK using your IAM credentials. Use cases: share private files, allow direct browser upload, distribute content without making the bucket public. You can scope to GET, PUT, or any verb. CloudFront Functions are lightweight, sub-millisecond JavaScript functions at the edge for viewer request/response events. They are cheaper and faster than Lambda@Edge but limited to JS only, no network calls, no third-party libraries. Best for URL rewrites, header manipulation, and cache key normalization.

Question 26 Cloud Computing AWS

What is CloudWatch Anomaly Detection?

Amazon Managed Grafana is a fully managed, secure Grafana service for visualizing metrics, logs, and traces from CloudWatch, Prometheus, X-Ray, and many data sources. Built-in SSO via IAM Identity Center, Okta, or Auth0; fine-grained access controls; supports alerting and dashboards.

IaaS (Infrastructure as a Service) — You manage OS, apps, and data; provider manages hardware (e.g., EC2)
PaaS (Platform as a Service) — Provider manages OS and runtime; you manage code and data (e.g., Elastic Beanstalk)
SaaS (Software as a Service) — Provider manages everything; you just use the app (e.g., Gmail, Salesforce)

Anomaly Detection applies machine learning models to a metric's past behavior to surface unusual activity. You create a band around expected values, and CloudWatch fires alarms when the metric crosses it. Reduces false positives from static thresholds for spiky or seasonal workloads. Amazon Textract extracts printed text, handwriting, and structured data (tables, form fields) from documents and images. Goes beyond OCR by returning key-value pairs and tables with spatial context. Expense and ID document analysis is available as pre-trained APIs.

Question 27 Cloud Computing AWS

How do RDS automated backups differ from manual snapshots?

Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network you define in AWS. You control:

IP address range (CIDR block, e.g., 10.0.0.0/16)
Subnets (public and private)
Route tables for traffic direction
Gateways for internet or VPN access

Each AWS account gets a default VPC in every Region. VPCs are Region-specific. Amazon Elastic Block Store (EBS) provides persistent block-level storage volumes for EC2 instances. Key types:

gp3/gp2 — General Purpose SSD (most workloads)
io2/io1 — Provisioned IOPS SSD (databases)
st1 — Throughput Optimized HDD (big data)
sc1 — Cold HDD (infrequent access)

EBS volumes are AZ-specific and can be snapshotted for backups.

Automated Backups — Enabled by default, retention 1–35 days, support point-in-time recovery (every 5 minutes), deleted when RDS instance is deleted
Manual Snapshots — User-initiated, retained indefinitely until explicitly deleted, can be shared across accounts and copied across regions

Both create full snapshots of the DB instance stored in S3. Amazon Route 53 is a highly available DNS (Domain Name System) web service. It provides:

Domain registration
DNS routing — Translates domain names to IP addresses
Health checks — Monitors endpoint availability

Named after port 53, the standard DNS port. Supports both public and private hosted zones.

Question 28 Cloud Computing AWS

What is an IAM Policy and what does it look like?

AWS Service Catalog lets organizations centrally manage and govern approved IT services as products (CloudFormation templates). End users (often in separate accounts) can self-service launch the products into their accounts within guardrails set by launch constraints (IAM roles). S3 Select lets you run simple SQL expressions to filter and retrieve a subset of data from an S3 object (CSV, JSON, Parquet) without downloading the whole object. S3 Glacier Select does the same against objects stored in Glacier. Reduces data transfer and processing cost.

Simple — Maps a domain to a single resource
Weighted — Distributes traffic by percentage across resources
Latency-based — Routes to the lowest-latency region
Failover — Routes to a standby if the primary is unhealthy
Geolocation — Routes based on the user's geographic location
Geoproximity — Routes based on resource location with bias
Multivalue Answer — Returns multiple IPs with health checks

An IAM Policy is a JSON document that defines permissions. Structure:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}

Policies can be identity-based (attached to users/groups/roles) or resource-based (attached to resources like S3 buckets).

Question 29 Cloud Computing AWS

What is AWS Fargate?

AWS Client VPN is a managed client-based VPN that lets remote users securely access AWS and on-prem resources using OpenVPN-based clients. It scales automatically and integrates with mutual TLS or SAML-based SSO. Useful for remote workforces needing private access to internal apps. AWS Storage Gateway is a hybrid storage service that connects on-prem software appliances to AWS cloud storage. Three types:

File Gateway — NFS/SMB files backed by S3
Volume Gateway — iSCSI block storage with EBS snapshots
Tape Gateway — Virtual tape library for backups, backed by S3 Glacier

Use cases: backup, archive, and tiered storage for on-prem workloads. AWS Fargate is a serverless compute engine for containers that works with ECS and EKS. You define task/pod CPU and memory; Fargate provisions and scales the infrastructure. No EC2 instances to manage, no patching, no over-provisioning. Charged per vCPU/GB-hour consumed. Amazon Athena is a serverless interactive query service that lets you run standard SQL directly against data in S3 (CSV, JSON, Parquet, ORC, Avro). It uses the Glue Data Catalog for table metadata. Pricing is $5 per TB scanned; partition data, use columnar formats (Parquet/ORC), and compress to cut cost.

Question 30 Cloud Computing AWS

What is AWS SAM?

Amazon CloudFront is a Content Delivery Network (CDN) that caches content at edge locations worldwide for low-latency delivery. Features:

Caches static and dynamic content
Integrates with S3, EC2, ALB, and custom origins
HTTPS support with free SSL/TLS certificates (ACM)
DDoS protection via AWS Shield
Lambda@Edge for request/response customization

Multipart Upload lets you upload a single object as a set of parts (each between 5 MB and 5 GB, last part can be smaller; up to 10,000 parts). Benefits:

Parallelize uploads for speed
Resume from failed parts without restarting
Recommended for objects larger than 100 MB

Initiate with CreateMultipartUpload, upload parts, then CompleteMultipartUpload. AWS Serverless Application Model (SAM) is an open-source framework for building serverless applications. It extends CloudFormation with simplified syntax for Lambda functions, API Gateway, DynamoDB, SQS, and Step Functions. The sam local command runs Lambda/APIs locally in Docker for testing. SAM CLI also powers sam build, sam deploy, and sam pipeline. Kinesis Data Analytics (now Managed Service for Apache Flink) runs real-time stream processing on Apache Flink without managing servers. You author SQL or Flink code that reads from Kinesis Data Streams or Firehose, transforms data, and writes to S3, OpenSearch, or another Kinesis stream. Useful for anomaly detection, dashboards, and stateful aggregations.

Question 31 Cloud Computing AWS

What is AWS Storage Gateway?

AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define AWS resources in JSON or YAML templates. Key concepts:

Template — Describes the desired resources
Stack — A running collection of resources from a template
Change Set — Preview changes before applying
Drift Detection — Identifies manual changes made outside CloudFormation

Amazon Relational Database Service (RDS) is a managed service for relational databases. Supported engines:

MySQL, PostgreSQL, MariaDB
Oracle, SQL Server
Amazon Aurora (MySQL/PostgreSQL compatible, up to 5x faster)

RDS handles provisioning, patching, backups, and replication, letting you focus on your application. Amazon Polly is a text-to-speech (TTS) service that turns text into lifelike speech. Supports many languages and voices, Neural TTS for higher quality, Speech Synthesis Markup Language (SSML), and lexicons for custom pronunciation. Output formats include MP3, OGG, PCM. AWS Storage Gateway is a hybrid storage service that connects on-prem software appliances to AWS cloud storage. Three types:

File Gateway — NFS/SMB files backed by S3
Volume Gateway — iSCSI block storage with EBS snapshots
Tape Gateway — Virtual tape library for backups, backed by S3 Glacier

Use cases: backup, archive, and tiered storage for on-prem workloads.

Question 32 Cloud Computing AWS

What is AWS CodeCommit?

Global Secondary Index (GSI) — An index with a different partition key and sort key from the base table. Can be created anytime. Has its own provisioned throughput.
Local Secondary Index (LSI) — Same partition key as the base table but a different sort key. Must be created at table creation time. Shares throughput with the base table.

Both enable efficient queries on non-primary-key attributes. AWS CodeCommit is a managed, private Git repository service. It supports standard Git workflows, integrates with IAM for auth, CodePipeline, and pull requests. Note: AWS announced that CodeCommit is being closed to new customers — most teams now use GitHub, GitLab, or CodeCatalyst instead. AWS Organizations lets you centrally manage multiple AWS accounts in a hierarchy of Organizational Units (OUs) rooted in a master account. Features include:

Consolidated billing across all accounts
Service Control Policies (SCPs) to set permission guardrails
Group accounts by team, environment, or workload

It is the foundation for multi-account architectures. Amazon API Gateway is a fully managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs. Two main flavors:

REST API — Feature-rich (request validation, usage plans, API keys)
HTTP API — Cheaper, lower latency, built on Lambda for serverless backends

Integrates with Lambda, ECS, EKS, ALB, and VPC links.

Question 33 Cloud Computing AWS

What is an Amazon Machine Image (AMI)?

The AWS Free Tier lets new users explore services for free within limits for 12 months after account creation. It has three categories:

Always Free — Lambda, DynamoDB, etc. up to monthly limits
12 Months Free — EC2 750 hrs/month, S3 5 GB, RDS 750 hrs, etc.
Trials — Short-term free trials (e.g., Amazon SageMaker, Amazon Redshift)

You still need a credit card; overages are charged. An AMI is a template that contains a software configuration (OS, application server, applications) used to launch EC2 instances. AMIs can be:

AWS-provided (Amazon Linux, Ubuntu, Windows)
Marketplace (third-party pre-configured)
Custom (your own golden images)

AMIs are region-specific but can be copied across regions. Amazon CloudFront is a Content Delivery Network (CDN) that caches content at edge locations worldwide for low-latency delivery. Features:

Caches static and dynamic content
Integrates with S3, EC2, ALB, and custom origins
HTTPS support with free SSL/TLS certificates (ACM)
DDoS protection via AWS Shield
Lambda@Edge for request/response customization

AWS Shield is a managed DDoS protection service.

Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

Question 34 Cloud Computing AWS

What is AWS IAM Identity Center (formerly AWS SSO)?

A VPC Endpoint connects your VPC privately to supported AWS services without going through the public internet. Two types:

Gateway endpoint — S3 and DynamoDB only; route-table entry; free
Interface endpoint — Most services; PrivateLink ENI; per-hour + per-GB pricing

Endpoints improve security (private IPs) and can reduce NAT costs. Every Lambda function has an execution role — an IAM role that grants the function permissions to access AWS services and resources. The basic trust policy allows the Lambda service to sts:AssumeRole. Common permissions: CloudWatch Logs (always), X-Ray, and service-specific (e.g., S3 read, DynamoDB write). AWS X-Ray provides distributed tracing across your application. It captures requests as they travel through services (Lambda, ECS, EC2, API Gateway, DynamoDB), shows a service map of dependencies, and surfaces latency/segmentation. Use the X-Ray SDK or AWS Distro for OpenTelemetry to instrument apps. IAM Identity Center is the recommended way to manage human access to AWS accounts. It provides:

Single sign-on to multiple accounts and applications
Integration with identity sources (Active Directory, Okta, Google Workspace)
Permission sets (collections of IAM policies) assignable to users/groups

It replaces per-account IAM users for everyday access.

Question 35 Cloud Computing AWS

What are EC2 Placement Groups?

The AWS Well-Architected Tool is a free self-service console that helps you review workloads against the Well-Architected Framework. You answer questions for each pillar, mark risks (high/medium), and track improvements over time. Lenses (e.g., serverless, SaaS, financial services) extend the framework to specific domains. AWS Shield is a managed DDoS protection service.

Shield Standard — Free for all AWS customers; protects against common network and transport-layer DDoS attacks on CloudFront and Route 53.
Shield Advanced — Paid ($3,000/month) tier with enhanced protection, real-time visibility, 24/7 DRT (DDoS Response Team) access, and cost protection for scaling charges during attacks.

Transit Gateway (TGW) is a central hub that connects VPCs, VPNs, and Direct Connect through a single gateway, replacing complex VPC peering meshes. It supports transit routing, peering between Transit Gateways (inter-region), and shared services VPCs. Scales to 5,000 attachments per TGW. Placement Groups control how instances are placed on hardware:

Cluster — Packs instances close together in one AZ for low-latency, high-throughput (e.g., HPC)
Spread — Places instances on distinct hardware to reduce correlated failures (max 7 per AZ)
Partition — Spreads instances across logical partitions so groups don't share hardware (e.g., Hadoop, Kafka)

Question 36 Cloud Computing AWS

What is the difference between a Security Group and a NACL?

Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service. AWS runs the control plane across multiple AZs and you manage worker nodes (EC2, Fargate, or on-prem via Outposts). Features: EKS Add-ons, EKS Anywhere for on-prem, EKS Connector for hybrid visibility. Compatible with standard Kubernetes tooling. Amazon Lightsail is a beginner-friendly, low-cost VPS-style service with predictable monthly pricing. It bundles compute, storage, networking, and a static IP (often under $5/month). Best for small sites, dev/test, and learning. You can peer Lightsail with your VPC for advanced networking. Security Groups:

Operate at the instance (ENI) level
Stateful — return traffic auto-allowed
Only allow rules

Network ACLs (NACLs):

Operate at the subnet level
Stateless — must explicitly allow return traffic
Support both allow and deny rules
Rules evaluated in number order

Use both for defense in depth. Amazon Managed Service for Prometheus (AMP) is a serverless, Prometheus-compatible metrics monitoring service. It is integrated with ADOT, EKS, ECS, and EC2 for scraping Prometheus exporters, and dashboards via Amazon Managed Grafana. Removes the operational burden of running a Prometheus server.

Question 37 Cloud Computing AWS

What are the main EC2 instance type families?

General Purpose (T, M) — Balanced CPU, memory, and networking
Compute Optimized (C) — High-performance processors for batch processing, ML inference
Memory Optimized (R, X) — Fast performance for large in-memory datasets
Storage Optimized (I, D, H) — High sequential read/write to large local datasets
Accelerated Computing (P, G) — GPU instances for machine learning and graphics

Kinesis Data Streams is a real-time, durable, ordered data streaming service. Producers write records to shards; consumers (Lambda, KCL apps) process them with sub-second latency. Features:

Replay data up to 365 days with extended retention (default 24h)
On-demand mode for variable throughput
Provisioned mode: pay per shard

Common for analytics, log ingestion, clickstreams, IoT. Envelope encryption encrypts data with a data key, and then encrypts the data key with a KMS key (a key encryption key). The data key is stored alongside the encrypted data for performance; only the encrypted copy is protected by KMS. This pattern allows you to encrypt large payloads without hitting KMS API limits. DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId.

Question 38 Cloud Computing AWS

What is Amazon RDS?

AWS X-Ray provides distributed tracing across your application. It captures requests as they travel through services (Lambda, ECS, EC2, API Gateway, DynamoDB), shows a service map of dependencies, and surfaces latency/segmentation. Use the X-Ray SDK or AWS Distro for OpenTelemetry to instrument apps. Amazon Relational Database Service (RDS) is a managed service for relational databases. Supported engines:

MySQL, PostgreSQL, MariaDB
Oracle, SQL Server
Amazon Aurora (MySQL/PostgreSQL compatible, up to 5x faster)

RDS handles provisioning, patching, backups, and replication, letting you focus on your application. IAM Access Analyzer analyzes resource-based policies (S3, KMS, IAM, SQS, SNS, Lambda, etc.) to identify unintended public or cross-account access. It also generates least-privilege IAM policies from access activity in CloudTrail, and validates policies against JSON grammar and best practices. Amazon Macie is a data security and privacy service that uses machine learning to automatically discover, classify, and protect sensitive data in S3. It identifies PII, credentials, and financial data, surfaces findings in Security Hub, and produces dashboards of data privacy risks.

Question 39 Cloud Computing AWS

What is CloudWatch Logs Insights?

Route 53 health checks monitor the health of endpoints (HTTP/HTTPS/TCP) from multiple global probes. You can attach them to records in failover or multivalue answer routing policies to remove unhealthy endpoints from DNS responses. CloudWatch alarms can be linked to health checks for application-level health. Logs Insights is an interactive query language for CloudWatch Logs. You write queries to search, filter, and aggregate log events (e.g., count errors, top IP addresses, average latency). Queries support functions, stats, parse, fields, sort, limit, and you can visualize results in a time-series chart. Amazon Lex is a service for building conversational interfaces (chatbots and voice bots) using the same technology as Alexa. Supports automatic speech recognition (ASR) and natural language understanding (NLU). Integrates with Lambda for fulfillment, Cognito for auth, and many messaging channels via Connect. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. Findings are categorized as low/medium/high severity and integrated with Security Hub, EventBridge, and Lambda for automated response.

Question 40 Cloud Computing AWS

What is CloudFront Lambda@Edge?

AWS Data Pipeline is a managed orchestration service for data-driven workflows. It schedules and runs ETL jobs and data movements between AWS services (S3, RDS, DynamoDB, EMR) and on-prem. Now legacy for new use cases — AWS Glue workflows or Step Functions are the modern replacements. Lambda@Edge lets you run Lambda functions at CloudFront edge locations in response to CloudFront events: viewer request, viewer response, origin request, and origin response. Use cases: A/B testing, header rewrites, cookie stripping, simple auth. Functions run in Node.js or Python with limited Lambda features. AWS Local Zones place AWS compute, storage, and database services closer to large population centers where there is no AWS Region. They extend the VPC from a parent region and run EC2, EBS, FSx, ALB, and more. Useful for sub-10 ms latency workloads (gaming, media, ML inference). When a Lambda function is connected to a VPC, AWS automatically attaches an ENI (Elastic Network Interface) to access VPC resources. This is called VPC cold start and adds several seconds of latency. Mitigation:

Use shared ENIs (Hyperplane) — automatically enabled for many services
Pre-warm with Provisioned Concurrency
Avoid VPC for services reachable over public endpoints

Question 41 Cloud Computing AWS

What is AWS Security Hub?

When a Lambda function is connected to a VPC, AWS automatically attaches an ENI (Elastic Network Interface) to access VPC resources. This is called VPC cold start and adds several seconds of latency. Mitigation:

Use shared ENIs (Hyperplane) — automatically enabled for many services
Pre-warm with Provisioned Concurrency
Avoid VPC for services reachable over public endpoints

Lambda deployment package limits:

Direct upload (.zip) — 50 MB compressed, 250 MB uncompressed (function + layers)
S3 upload (.zip) — 250 MB compressed, 250 MB uncompressed
Container image — 10 GB max image size

Layers count toward the unzipped size; total function size includes all layers and custom runtimes. AWS Security Hub provides a single pane of glass for security alerts and compliance posture across AWS accounts. It aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools. It runs continuous, automated security checks against standards like CIS AWS Foundations Benchmark and PCI DSS. AWS Data Pipeline is a managed orchestration service for data-driven workflows. It schedules and runs ETL jobs and data movements between AWS services (S3, RDS, DynamoDB, EMR) and on-prem. Now legacy for new use cases — AWS Glue workflows or Step Functions are the modern replacements.

Question 42 Cloud Computing AWS

What is Amazon Rekognition?

Amazon Rekognition is a managed image and video analysis service. Capabilities include: object/scene/text detection, face analysis and comparison, face liveness, celebrity recognition, unsafe content moderation, and PPE detection. Charges per image or per minute of video analyzed. S3 Replication automatically copies objects across buckets, often across regions (CRR) or within the same region (SRR). Use cases: disaster recovery, low-latency access, compliance, and data sovereignty. Requires versioning on both buckets. Replicates new objects by default; S3 Batch Replication backfills existing objects. AWS CodePipeline is a fully managed continuous delivery service that orchestrates the steps to release software: source → build → test → deploy. It uses stages and actions, supports manual approvals, parallel execution, and triggers from CodeCommit, S3, ECR, GitHub, or Bitbucket. Kinesis Data Streams is a real-time, durable, ordered data streaming service. Producers write records to shards; consumers (Lambda, KCL apps) process them with sub-second latency. Features:

Replay data up to 365 days with extended retention (default 24h)
On-demand mode for variable throughput
Provisioned mode: pay per shard

Common for analytics, log ingestion, clickstreams, IoT.

Question 43 Cloud Computing AWS

What is Amazon CloudWatch Alarms?

Amazon Simple Storage Service (S3) is an object storage service offering virtually unlimited storage. Data is stored as objects inside buckets. Each object can be up to 5 TB in size. S3 provides 99.999999999% (11 nines) durability and is accessed via HTTP/HTTPS APIs. CloudFront is a global CDN with 600+ Points of Presence (PoPs). Behavior:

User requests are routed to the nearest edge via DNS and Anycast IPs
Edges cache responses based on TTL and cache key (path, query string, headers, cookies)
Cache misses forward to origin (S3, ALB, EC2, MediaStore, custom) and store the result
Supports origin failover via origin groups

S3 Versioning keeps multiple variants of an object in the same bucket. When enabled:

Every overwrite or delete creates a new version
Deleted objects get a delete marker (recoverable)
Protects against accidental deletion and overwrites
Once enabled, versioning can be suspended but not disabled

Versioning is a prerequisite for Cross-Region Replication. A CloudWatch Alarm watches a single metric over a time period and performs one or more actions based on the value relative to a threshold. Three states: OK, ALARM, INSUFFICIENT_DATA. Actions can target SNS, Auto Scaling, EC2, Lambda, and many more. Composite alarms combine multiple alarms using AND/OR logic.

Question 44 Cloud Computing AWS

What is an S3 bucket and what are its naming rules?

Amazon Lex is a service for building conversational interfaces (chatbots and voice bots) using the same technology as Alexa. Supports automatic speech recognition (ASR) and natural language understanding (NLU). Integrates with Lambda for fulfillment, Cognito for auth, and many messaging channels via Connect. An S3 bucket is a container for objects. Rules:

Bucket names must be globally unique across all AWS accounts
Names must be 3–63 characters, lowercase, no underscores
Buckets are created in a specific Region
You can have up to 100 buckets per account (soft limit)

Objects are identified by a key (the full path within the bucket). Placement Groups control how instances are placed on hardware:

Cluster — Packs instances close together in one AZ for low-latency, high-throughput (e.g., HPC)
Spread — Places instances on distinct hardware to reduce correlated failures (max 7 per AZ)
Partition — Spreads instances across logical partitions so groups don't share hardware (e.g., Hadoop, Kafka)

AWS Well-Architected Framework describes key principles and questions to build secure, high-performing, resilient, and efficient cloud infrastructure. The six pillars are:

Operational Excellence
Security
Reliability
Performance Efficiency
Cost Optimization
Sustainability

AWS publishes the AWS Well-Architected Tool to review workloads against these pillars.

Question 45 Cloud Computing AWS

What is Lambda's /tmp storage limit?

Steps to host a static site on S3:

Create a bucket with your domain name
Enable Static Website Hosting in bucket properties
Set the index document (e.g., index.html) and error document
Make objects publicly readable via a bucket policy
Optionally, use CloudFront as a CDN and Route 53 for DNS

The endpoint format is: http://bucket-name.s3-website-region.amazonaws.com Amazon Relational Database Service (RDS) is a managed service for relational databases. Supported engines:

MySQL, PostgreSQL, MariaDB
Oracle, SQL Server
Amazon Aurora (MySQL/PostgreSQL compatible, up to 5x faster)

RDS handles provisioning, patching, backups, and replication, letting you focus on your application. AWS CodeCommit is a managed, private Git repository service. It supports standard Git workflows, integrates with IAM for auth, CodePipeline, and pull requests. Note: AWS announced that CodeCommit is being closed to new customers — most teams now use GitHub, GitLab, or CodeCatalyst instead. Lambda functions get 512 MB of ephemeral disk space at /tmp. The space is not shared with other invocations on the same environment but persists across invocations while the execution environment is warm. Useful for caching, scratch work, or large data extraction. Mounted with full POSIX file semantics.

Question 46 Cloud Computing AWS

What is Amazon Kinesis Data Analytics?

AWS X-Ray provides distributed tracing across your application. It captures requests as they travel through services (Lambda, ECS, EC2, API Gateway, DynamoDB), shows a service map of dependencies, and surfaces latency/segmentation. Use the X-Ray SDK or AWS Distro for OpenTelemetry to instrument apps. AWS Secrets Manager stores, rotates, and retrieves secrets (DB credentials, API keys, OAuth tokens) at runtime. Features:

Automatic rotation via Lambda for RDS, Redshift, DocumentDB
Fine-grained IAM access and CloudTrail auditing
Cross-region replication of secrets

Compared to SSM Parameter Store SecureString, Secrets Manager is purpose-built for secrets rotation and has higher cost per secret. Kinesis Data Analytics (now Managed Service for Apache Flink) runs real-time stream processing on Apache Flink without managing servers. You author SQL or Flink code that reads from Kinesis Data Streams or Firehose, transforms data, and writes to S3, OpenSearch, or another Kinesis stream. Useful for anomaly detection, dashboards, and stateful aggregations. When a Lambda function is connected to a VPC, AWS automatically attaches an ENI (Elastic Network Interface) to access VPC resources. This is called VPC cold start and adds several seconds of latency. Mitigation:

Use shared ENIs (Hyperplane) — automatically enabled for many services
Pre-warm with Provisioned Concurrency
Avoid VPC for services reachable over public endpoints

Question 47 Cloud Computing AWS

What are Lambda triggers and common event sources?

AWS Control Tower automates the setup of a secure, multi-account AWS environment based on best practices. It uses Account Factory to provision new accounts and applies guardrails (preventive and detective) for compliance. Built on AWS Organizations, IAM Identity Center, and CloudFormation StackSets. Amazon Route 53 is a highly available DNS (Domain Name System) web service. It provides:

Domain registration
DNS routing — Translates domain names to IP addresses
Health checks — Monitors endpoint availability

Named after port 53, the standard DNS port. Supports both public and private hosted zones. A trigger is an AWS service or event that invokes a Lambda function. Common sources:

API Gateway — HTTP requests
S3 — Object upload/delete events
DynamoDB Streams — Table changes
SQS — Queue messages
CloudWatch Events/EventBridge — Scheduled or event-driven
SNS — Notification messages

Envelope encryption encrypts data with a data key, and then encrypts the data key with a KMS key (a key encryption key). The data key is stored alongside the encrypted data for performance; only the encrypted copy is protected by KMS. This pattern allows you to encrypt large payloads without hitting KMS API limits.

Question 48 Cloud Computing AWS

What is an IAM Role and when would you use one?

An IAM Role is an identity with permissions that can be assumed by trusted entities — no permanent credentials. Use cases:

EC2 instance roles — Let instances access AWS services securely
Cross-account access — Allow users from another account
Lambda execution roles — Grant Lambda permissions
Federation — Allow external identity providers (SAML, OIDC)

Roles use temporary security credentials via STS. AWS Config provides a detailed inventory of AWS resources and tracks configuration changes over time. It answers "What did my resource look like at time T?" Features:

Records configuration history of resources
Evaluates resources against Config Rules (desired state)
Integrates with Security Hub and EventBridge

Useful for compliance auditing and change management. CloudFront Functions are lightweight, sub-millisecond JavaScript functions at the edge for viewer request/response events. They are cheaper and faster than Lambda@Edge but limited to JS only, no network calls, no third-party libraries. Best for URL rewrites, header manipulation, and cache key normalization. DelaySeconds hides a message from consumers for up to 900 seconds (15 minutes) after it's added to the queue. Use cases: deferred tasks, scheduled retries, batch processing. For longer delays, use EventBridge Scheduler or place messages on a per-second basis in a FIFO queue with MessageGroupId.

Question 49 Cloud Computing AWS

What is AWS IAM Access Analyzer?

Amazon Cognito provides authentication, authorization, and user management for web/mobile apps. Components:

User Pools — User directories with sign-in, MFA, federation (SAML/OIDC)
Identity Pools — Exchange user pool/IdP tokens for AWS credentials to access AWS services

Tokens are JWT (ID, access, refresh). Cognito can act as an OIDC IdP for API Gateway and ALB. IAM Access Analyzer analyzes resource-based policies (S3, KMS, IAM, SQS, SNS, Lambda, etc.) to identify unintended public or cross-account access. It also generates least-privilege IAM policies from access activity in CloudTrail, and validates policies against JSON grammar and best practices. Kinesis Data Firehose is the easiest way to load streaming data into S3, Redshift, OpenSearch, or custom HTTP endpoints. It is fully managed (no shards, no consumers) and supports near real-time delivery (lowest ~60 seconds) with optional Lambda transformations. No replay capability — for that use Kinesis Data Streams. Each AWS Region has a default 1,000 concurrent executions account-level limit for Lambda. You can:

Request a quota increase from AWS
Configure Reserved Concurrency to cap a function's concurrency (throttles at the limit)
Use Provisioned Concurrency to pre-warm environments for low latency

Throttled invocations receive an async retry with backoff or, for sync sources, a 429 error.

Question 50 Cloud Computing AWS

What are AWS Regions and Availability Zones?

AWS Service Catalog lets organizations centrally manage and govern approved IT services as products (CloudFormation templates). End users (often in separate accounts) can self-service launch the products into their accounts within guardrails set by launch constraints (IAM roles). EC2 Auto Scaling automatically adjusts the number of EC2 instances to match demand. Components:

Launch Template — Defines instance configuration (AMI, type, key pair, security groups)
Auto Scaling Group (ASG) — Manages min, max, and desired capacity
Scaling Policies — Rules that trigger scaling (target tracking, step, simple)

Ensures availability and cost optimization. Amazon Rekognition is a managed image and video analysis service. Capabilities include: object/scene/text detection, face analysis and comparison, face liveness, celebrity recognition, unsafe content moderation, and PPE detection. Charges per image or per minute of video analyzed. An AWS Region is a geographic area (e.g., us-east-1) containing multiple isolated data centers. An Availability Zone (AZ) is one or more discrete data centers within a Region, each with independent power, networking, and connectivity. Deploying across multiple AZs provides high availability and fault tolerance.