Title: AWS Developer Associate Dva C02 — LearnCoachAssist

Q: What does the AWS shared responsibility model define?
A: The division of security responsibilities between AWS (security OF the cloud: infrastructure, hardware, regions, services) and the customer (security IN the cloud: data, IAM, OS patching, network/firewall config, encryption).

Q: Which AWS service is required to launch an EC2 instance?
A: An AMI (Amazon Machine Image), an instance type, a VPC with subnet, a security group, an IAM role/credentials, and optionally key pair and EBS volume.

Q: What is an IAM role vs an IAM user?
A: An IAM user is a permanent identity with long-lived credentials. An IAM role is an identity with no long-lived credentials that is assumed temporarily by users, services, or external identities to obtain temporary STS tokens.

Q: What is the maximum size of an IAM policy?
A: 5,120 characters for managed policies attached to a user/group/role; service-specific quotas apply (e.g. inline user policy up to 2,048 chars, group 5,120, role 10,240).

Q: What does AWS STS provide?
A: Security Token Service — issues short-lived temporary credentials (access key, secret key, session token) for federated identities, assumed roles, or cross-account access.

Q: How do you grant an EC2 instance permission to call AWS APIs without storing keys?
A: Attach an IAM instance profile (a container for an IAM role) to the EC2 instance. The SDK/CLI automatically retrieves credentials from IMDS on the instance.

Q: What is the difference between a managed policy and an inline policy?
A: A managed policy is a standalone, reusable policy that can be attached to many identities (AWS- or customer-managed). An inline policy is embedded in a single identity and removed when the identity is deleted.

Q: How long can temporary STS credentials last?
A: From 15 minutes up to a maximum of 12 hours (the absolute STS session duration hard cap); the role's MaxSessionDuration must be set within that range.

Q: What is the recommended way to give a Lambda function access to AWS services?
A: Attach an IAM execution role to the Lambda function. Lambda automatically populates environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.

Q: Which AWS service provides a centralized place to audit API calls and configuration changes?
A: AWS CloudTrail — records every API call made in the account, including identity, time, source IP, and request/response details, stored in S3 and optionally CloudWatch Logs.

Q: What is the difference between CloudTrail and CloudWatch?
A: CloudTrail records API activity (who called what and when) for governance/audit. CloudWatch collects metrics, logs, and events for monitoring, alarming, and operational response.

Q: What is AWS CloudWatch Logs?
A: A service to ingest, monitor, store, and access log files from EC2, Lambda, VPC Flow Logs, CloudTrail, Route 53, and custom sources. Retention is configurable from 1 day to indefinitely.

Q: What is a CloudWatch metric?
A: A time-ordered set of data points published to CloudWatch. Metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1-minute, detailed resolution is 1-second.

Q: How long does CloudWatch keep metrics?
A: Standard resolution metrics: 15 months with detailed data points (1 minute) available for the first 15 days, then aggregated to 5-minute and 1-hour. Detailed 1-second metrics expire after 3 hours.

Q: What is a CloudWatch alarm?
A: An object that watches a single metric over a time period and performs one or more actions (e.g. notify SNS, trigger Auto Scaling, stop/terminate EC2) when the threshold is crossed for a configured number of evaluation periods.

Q: What is an Amazon SNS topic?
A: A logical access point for pub/sub messaging that fans out notifications to SQS queues, Lambda functions, HTTP(S) endpoints, email, SMS, or mobile push via platform endpoints.

Q: What is the difference between SNS and SQS?
A: SNS is a pub/sub fan-out push service with no message retention. SQS is a message queue with message retention (up to 14 days), consumers poll for messages, and supports standard and FIFO queues.

Q: What is an SQS standard queue?
A: A queue offering best-effore ordering, at-least-once delivery, and unlimited throughput. Messages may be delivered more than once and out of order.

Q: What is an SQS FIFO queue?
A: A queue providing exactly-once processing and first-in-first-out order. Throughput is limited to 300 messages/second without batching, 3,000 with batching. Names must end with .fifo.

Q: What is the maximum SQS message retention period?
A: 14 days. Default retention is 4 days. Messages older than the retention are automatically deleted.

Q: What is the visibility timeout in SQS?
A: The duration (default 30s, max 12h) during which a message is hidden from other consumers after being received. If the consumer does not delete the message before the timeout expires, it becomes visible again.

Q: What is the maximum size of an SQS message?
A: 256 KB. For larger payloads, store the data in S3 and send only the S3 reference in the message (use the Amazon SQS Extended Client for Java library pattern).

Q: What is a dead-letter queue (DLQ) in SQS?
A: A separate queue (redrive allows up to 100 source queues) that receives messages that failed processing after the redrive policy's maxReceiveCount is exceeded. Helps isolate and analyze failed messages.

Q: How does long polling differ from short polling in SQS?
A: Long polling waits up to 20 seconds for messages to arrive, reducing empty ReceiveMessage responses and cost. Short polling returns immediately even with no messages. Long polling is the recommended default.

Q: What is Amazon EventBridge?
A: A serverless event bus service that ingests events from AWS services, SaaS apps, and custom sources, and routes them to targets (Lambda, SQS, SNS, Step Functions, etc.) using rules with event patterns or schedules.

Q: What is the difference between EventBridge and CloudWatch Events?
A: EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus.

Q: What is AWS Step Functions?
A: A serverless orchestrator that coordinates multiple AWS services into workflows using state machines defined in Amazon States Language (JSON). Supports standard (long-running, exactly-once) and express (high-volume, at-least-once) workflows.

Q: What is a Lambda execution context?
A: A runtime environment that hosts the execution of a Lambda function, including the function code, runtime, environment variables, and any initialized state. Reused across invocations to amortize cold-start cost.

Q: What is a Lambda cold start?
A: The latency added when Lambda must initialize a new execution context (download code, start runtime, run init code). Mitigated by Provisioned Concurrency or by minimizing package size and init logic.

Q: What is the maximum Lambda deployment package size?
A: 50 MB zipped for direct upload, 250 MB unzipped (direct), or up to 4 GB when uploaded from /tmp via EFS (Lambda mounts EFS for large files).

Q: What is the default Lambda timeout?
A: 900 seconds (15 minutes). Maximum timeout is also 15 minutes; use Step Functions for longer workflows.

Q: How much memory can a Lambda function be configured with?
A: 128 MB to 10,240 MB, in 1-MB increments. CPU and network bandwidth scale linearly with memory allocation.

Q: What is the Lambda concurrency limit?
A: Default account concurrency limit is 1,000. Each function can be reserved (reserved concurrency) or limited, and provisioned concurrency provides warm execution environments on demand.

Q: What is AWS SAM (Serverless Application Model)?
A: An open-source framework (CloudFormation extension) used to define serverless applications (Lambda, API Gateway, DynamoDB, SQS) in simplified YAML/JSON syntax. Build with `sam build`, deploy with `sam deploy`.

Q: What is Amazon API Gateway?
A: A managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale. Handles routing, auth, throttling, request/response transformation, and integrates with Lambda and other backends.

Q: What is the difference between API Gateway REST API and HTTP API?
A: HTTP API is cheaper (~70% lower), lower latency, and supports OIDC/OAuth2, JWT, and CORS but fewer features. REST API is feature-rich: API keys, usage plans, request validation, AWS WAF integration, request/response transformations.

Q: What is API Gateway throttling?
A: Rate limits that protect backends and your account. Default account limit is 10,000 RPS steady-state with 5,000 burst. Per-method/per-stage limits can be set lower; exceeding returns HTTP 429.

Q: What is a Lambda authorizer in API Gateway?
A: A Lambda function that authenticates and authorizes API requests (token-based or request-parameter-based) before they reach the backend. Caches the policy result (configurable TTL, default 300s) to reduce latency and cost.

Q: What is DynamoDB?
A: A fully managed NoSQL key-value and document database offering single-digit millisecond performance at any scale, with built-in security, backup, and multi-region replication.

Q: What are the two types of DynamoDB primary keys?
A: Partition key (hash) only — items are distributed by partition. Composite primary key (partition key + sort key) — items sharing a partition are ordered by the sort key for range queries.

Q: What is a DynamoDB partition?
A: A storage unit for a group of items. Items are placed in partitions based on the hash of the partition key. A single partition can hold up to 10 GB and serve up to 3,000 RCUs and 1,000 WCUs.

Q: How are DynamoDB read capacity units (RCU) billed?
A: Strongly consistent read of 4 KB/item = 1 RCU. Eventually consistent read of 4 KB/item = 0.5 RCU. Transactional read of 4 KB/item = 2 RCU. All rounded up to 4 KB.

Q: How are DynamoDB write capacity units (WCU) billed?
A: One standard write of up to 1 KB = 1 WCU. One transactional write of up to 1 KB = 2 WCU. Rounded up to 1 KB.

Q: What is DynamoDB on-demand capacity?
A: A pricing mode that charges per request (no provisioned capacity). Useful for unpredictable workloads. Pricing: $1.25 per million read request units, $1.25 per million write request units (varies by region).

Q: What is DynamoDB auto scaling?
A: Automatically adjusts provisioned RCU/WCU within a min/max target based on actual consumption (target utilization, default 70%). Uses CloudWatch metrics and Application Auto Scaling.

Q: What is a DynamoDB Global Table?
A: A multi-region, multi-active replicated table that supports low-latency global reads and writes. Replication is synchronous using a write-through architecture; conflict resolution is last-writer-wins.

Q: What is a DynamoDB LSI (Local Secondary Index)?
A: An index that uses the same partition key as the base table but a different sort key. Shares throughput and storage with the base table. Must be defined at table creation. Size limit: 10 GB per partition.

Q: What is a DynamoDB GSI (Global Secondary Index)?
A: An index with a partition key and optional sort key, different from the base table's. Has its own provisioned or on-demand throughput. Can be added/modified after table creation. Size is not constrained to 10 GB per partition.

Q: What is a DynamoDB hot partition?
A: A partition receiving disproportionately more read/write traffic than others, often due to a skewed partition key. Causes throttling (ProvisionedThroughputExceededException). Mitigate with better key design, write sharding, or caching.

Q: What is a DynamoDB transaction?
A: An operation that provides ACID guarantees across up to 100 items in one or more tables within a single AWS account and region. Uses TransactGetItems and TransactWriteItems APIs and consumes 2x the WCU/RCU.

Q: What is DynamoDB Streams?
A: A time-ordered stream of item-level changes (insert, modify, remove) in a DynamoDB table. Retained for 24 hours. Used to trigger Lambda, replicate to other stores, or build materialized views.

Q: What is DynamoDB TTL (Time to Live)?
A: A feature that automatically deletes expired items at no cost. Specify a numeric attribute containing epoch time; expired items are removed within 48 hours of expiration.

Q: What is DynamoDB DAX?
A: DynamoDB Accelerator — a fully managed in-memory cache for DynamoDB that delivers up to 10x read performance. API-compatible with DynamoDB. Cluster must be in a single VPC and uses its own subnet group.

Q: What is an S3 bucket policy vs IAM policy?
A: An S3 bucket policy is a resource-based policy attached to a specific bucket using JSON. An IAM policy is identity-based and can grant access to multiple S3 buckets. Bucket policies are required for cross-account access and for public/anonymous principals.

Q: What is S3 versioning?
A: A feature that keeps multiple variants of an object in the same bucket. Once enabled, it cannot be disabled — only suspended. Deletes become delete markers that can be reversed.

Q: What is S3 lifecycle policy?
A: Rules that automatically transition objects to other storage classes (e.g. STANDARD_IA, GLACIER, DEEP_ARCHIVE) or expire (delete) them based on age or prefix/tag.

Q: What are the main S3 storage classes?
A: STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER_INSTANT_RETRIEVAL, GLACIER_FLEXIBLE_RETRIEVAL (formerly Glacier), GLACIER_DEEP_ARCHIVE, and EXPRESS_ONEZONE (single-AZ, lowest latency).

Q: What is the S3 strong consistency model?
A: As of 2020, S3 provides strong read-after-write consistency for all GET, PUT, LIST, and DELETE operations — there is no eventual consistency for object listings or updates.

Q: What is S3 multipart upload?
A: An upload split into parts (5 MB to 5 GB each, up to 10,000 parts) to improve throughput, allow parallel uploading, and enable resumable uploads of objects up to 5 TB. Recommended for files larger than 100 MB.

Q: What is S3 pre-signed URL?
A: A URL generated using IAM credentials that grants temporary access to download or upload a specific S3 object. The URL inherits the permissions of the IAM principal who created it and can be customized with an expiration.

Q: What is S3 Transfer Acceleration?
A: Uses CloudFront edge locations to speed up uploads/downloads to S3 over long distances by routing data through the AWS backbone. Charged per GB transferred; enable with `aws s3api put-bucket-accelerate-configuration`.

Q: What is S3 Object Lock?
A: A feature that enforces WORM (write-once-read-many) on objects via retention periods or legal holds. Must be enabled at bucket creation, and versioning must be enabled. Complies with SEC 17a-4.

Q: What is S3 Replication?
A: Cross-Region Replication (CRR) or Same-Region Replication (SRR) automatically copies new and (optionally) existing objects to a destination bucket. Requires versioning, IAM role with s3:Replicate permissions, and a destination in a different (or same) account.

Q: What is Amazon S3 Glacier?
A: A low-cost cold storage service for archives. Retrieval options: Expedited (1–5 min), Standard (3–5 h), Bulk (5–12 h). Glacier Flexible Retrieval is the renamed Glacier; Glacier Deep Archive is the cheapest (12–48 h).

Q: What is the AWS SDK retry behavior?
A: The SDK uses exponential backoff with jitter for retryable errors (e.g. throttling, 5xx). Default is 3 retries; tune `retries` config. Use exponential backoff with full jitter for custom retry logic.

Q: What is the AWS SDK pagination mechanism?
A: APIs that return truncated results return a continuation token (NextToken, Marker, NextContinuationToken). The SDK auto-paginates with `paginators` and async iterators.

Q: What is an EC2 instance type family?
A: EC2 families are grouped by workload: General Purpose (M, T), Compute Optimized (C), Memory Optimized (R, X), Storage Optimized (I, D), Accelerated Computing (P, G, F), HPC Optimized (H). Naming: e.g. m6i.2xlarge = family m, generation 6, intel, 2xlarge size.

Q: What is an EC2 placement group?
A: A logical grouping for instances that influence placement: cluster (low-latency single AZ), spread (distinct hardware, up to 7 per AZ), partition (distinct racks, up to 7 partitions per AZ for Hadoop/Kafka).

Q: What is an EC2 Hibernation?
A: Persists RAM contents to EBS root volume and stops instance. On start, RAM is restored. Works only for certain instance types and supported AMIs. Useful to skip cold starts.

Q: What is EC2 user data?
A: A script passed at launch that runs on first boot as root (Linux) or LocalSystem (Windows). Used to bootstrap, install software, register with services. Limited to 16 KB.

Q: What is an EC2 instance metadata?
A: Data about the instance accessible at http://169.254.169.254/latest/meta-data/. Includes instance ID, IAM role credentials (under /iam/), region, AZ. IMDSv2 requires session-token PUT to mitigate SSRF attacks.

Q: What is IMDSv2?
A: Instance Metadata Service Version 2 — requires a PUT request with a custom header to get a session token before any metadata request. Protects against SSRF and reduces risk of credential theft.

Q: What is an EBS volume?
A: A durable block storage device that attaches to a single EC2 instance in one AZ. Snapshots are stored in S3 and are incremental. Use gp3 for general SSD, io1/io2 for high IOPS, st1 for throughput, sc1 for cold HDD.

Q: What is the difference between gp3 and io1/io2 EBS volumes?
A: gp3: baseline 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s at extra cost. io1/io2: provisioned IOPS, suitable for high-I/O databases; io2 Block Express supports up to 256,000 IOPS per volume and 4,000 MB/s with Nitro instances.

Q: What is an EBS snapshot?
A: A point-in-time backup of an EBS volume stored incrementally in S3. Snapshots are AZ-independent; you can copy them across regions/accounts. The first snapshot is full, subsequent ones are incremental.

Q: What is Amazon EFS?
A: A fully managed, elastic, shared NFS file system for Linux. Scales automatically, pay-per-use, supports thousands of concurrent connections. Mount targets are per-AZ; data is stored across multiple AZs in a region.

Q: What is Amazon FSx?
A: A managed file system service with options: FSx for Windows File Server (SMB), FSx for Lustre (HPC), FSx for NetApp ONTAP, FSx for OpenZFS.

Q: What is Amazon S3 Glacier Instant Retrieval?
A: Storage class for archive data needing millisecond retrieval, with a minimum 90-day storage charge and retrieval fees. Cheaper than S3 Standard-IA for rarely accessed data needing instant access.

Q: What is an Amazon VPC?
A: A logically isolated virtual network in AWS where you launch AWS resources. You control IP range (CIDR), subnets, route tables, gateways, and security.

Q: What is a public vs private subnet?
A: Public subnet has a route to an Internet Gateway (IGW); instances get public IPs and are reachable from the internet. Private subnet has no IGW route; instances need NAT Gateway (or NAT instance) for outbound internet.

Q: What is a NAT Gateway?
A: A managed AWS service in a public subnet that allows instances in private subnets to initiate outbound internet traffic (e.g. for updates) while preventing unsolicited inbound connections. Charged per hour + per GB processed.

Q: What is a security group?
A: A stateful virtual firewall at the ENI/instance level that controls inbound and outbound traffic. Default SG allows all outbound and no inbound. SGs reference other SGs or CIDRs as sources; rules are stateful (return traffic allowed).

Q: What is a Network ACL (NACL)?
A: A stateless firewall at the subnet level. Rules are evaluated by rule number; default NACL allows all. NACLs are stateless — return traffic requires explicit rules. Each subnet can have only one NACL.

Q: What is a VPC endpoint?
A: A private connection from a VPC to an AWS service without traversing the public internet. Interface endpoint (PrivateLink) uses ENIs with private IPs. Gateway endpoint is free for S3 and DynamoDB — uses a route table entry.

Q: What is VPC Flow Logs?
A: A feature that captures information about IP traffic going to/from network interfaces in a VPC. Stored in CloudWatch Logs or S3. Used for troubleshooting connectivity, security analysis, and detecting anomalous traffic.

Q: What is AWS PrivateLink?
A: Technology powering interface VPC endpoints. Provides private connectivity between VPCs, AWS services, and on-premises networks using elastic network interfaces with private IP addresses.

Q: What is an Application Load Balancer (ALB)?
A: A Layer 7 load balancer that routes HTTP/HTTPS/gRPC traffic based on path, host, query string, or header. Supports WebSockets, sticky sessions, WAF, OIDC auth, and target groups of EC2, IP, Lambda, ECS.

Q: What is a Network Load Balancer (NLB)?
A: A Layer 4 load balancer that routes TCP/UDP/TLS traffic with ultra-low latency and high throughput. Preserves source IP, supports static IPs, and integrates with PrivateLink service providers.

Q: What is a Classic Load Balancer (CLB)?
A: The legacy (Generation 1) load balancer. Layer 4 and 7 features but limited compared to ALB/NLB. AWS recommends migrating to ALB or NLB.

Q: What is a target group?
A: A set of registered targets (EC2 instances, IPs, Lambda, containers) that an ALB or NLB routes requests to. Each target group has health checks that determine routing.

Q: What is a sticky session?
A: ALB/NLB feature that binds a user session to a specific target using a cookie. Useful for stateful apps. Cookie types: application-based (custom), duration-based, or load-balancer-generated.

Q: What is an Auto Scaling group?
A: A collection of EC2 instances treated as a logical group for scaling and management. Defines min, max, and desired capacity. Supports dynamic scaling (target tracking, step, simple), scheduled, and predictive scaling.

Q: What is target tracking scaling?
A: An Auto Scaling policy that adjusts capacity to keep a chosen CloudWatch metric (e.g. CPUUtilization at 50%) near a target value. Recommended over step/scheduled for most cases.

Q: What is an EC2 launch template?
A: An instance configuration template that includes AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options. Required for Auto Scaling groups and Spot Fleets; can have multiple versions.

Q: What is Amazon ECS?
A: Elastic Container Service — a fully managed container orchestration service supporting Docker containers. Two launch types: EC2 (you manage instances) and Fargate (serverless, AWS manages infra).

Q: What is Amazon EKS?
A: Elastic Kubernetes Service — managed Kubernetes. AWS manages the control plane (etcd, scheduler, API server) across multiple AZs; you provide worker nodes (EC2) or use Fargate.

Q: What is AWS Fargate?
A: Serverless compute engine for containers that works with ECS and EKS. You define task/pod requirements; AWS provisions and scales the underlying infrastructure. Pay per vCPU and GB-hour.

Q: What is a CI/CD pipeline on AWS?
A: Common services: CodeCommit (Git), CodeBuild (build/test), CodeDeploy (deploy), CodePipeline (orchestration). Each can be replaced by third-party tools (GitHub, Jenkins, GitLab, Spinnaker).

Q: What is AWS CodeDeploy?
A: A deployment service that automates application deployments to EC2, ECS, Lambda, and on-premises. Supports in-place and blue/green deployments via appspec.yml.

Q: What is a blue/green deployment?
A: A strategy where two identical environments (blue = current, green = new) run simultaneously. Traffic is shifted from blue to green via DNS/ALB/Route 53 weighted records. Allows instant rollback.

Q: What is AWS CodePipeline?
A: A continuous delivery service that models release pipelines. Each stage contains actions (e.g. source, build, test, deploy) and can have manual approval steps. Triggers Lambda on state changes.

Q: What is AWS CloudFormation?
A: A service that models and provisions AWS resources using declarative templates (JSON/YAML). StackSets extend CloudFormation to multiple accounts/regions. Supports drift detection, change sets, and nested stacks.

Q: What is the difference between CloudFormation and SAM?
A: SAM is a CloudFormation extension with simplified syntax for serverless resources (Lambda, API Gateway, DynamoDB, etc.). SAM templates are transformed into standard CloudFormation at deploy time.

Q: What is AWS CDK?
A: Cloud Development Kit — a software development framework (TypeScript, Python, Java, Go, .NET) to define cloud resources in code and synthesize them into CloudFormation templates.

Q: What is the AWS Well-Architected Framework?
A: Five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization. Plus Sustainability. Used to evaluate architectures and identify improvements.

Q: What is the AWS Well-Architected Tool?
A: A free service in the AWS Console that helps you review workloads against the Well-Architected Framework, identify risks, track improvements, and benchmark against industry standards.

Q: What is the AWS Shared Responsibility for managed services?
A: For managed services like S3 or DynamoDB, AWS handles OS, patching, physical security, and the service infrastructure. The customer is responsible for data, access policies, encryption settings, and network/firewall configuration.

Q: What is AWS X-Ray?
A: A distributed tracing service that helps developers analyze and debug distributed applications. Captures traces, segments, errors, and provides a service map. SDKs available for Java, Node.js, Python, Go, .NET, Ruby.

Q: What is Amazon CloudWatch Container Insights?
A: A CloudWatch feature that collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on ECS, EKS, Fargate, and Kubernetes.

Q: What is AWS Secrets Manager?
A: A service to securely store, rotate, manage, and retrieve database credentials, API keys, and other secrets. Supports automatic rotation via Lambda. Integrates with RDS, Redshift, DocumentDB.

Q: What is the difference between Secrets Manager and SSM Parameter Store?
A: Parameter Store is free (standard tier), stores plaintext or SecureString (KMS-encrypted) config and secrets, with versioning. Secrets Manager is paid, designed for secrets, includes automatic rotation and cross-region replication.

Q: What is AWS KMS?
A: Key Management Service — a managed service to create and control encryption keys (CMKs). Supports symmetric and asymmetric keys, integrates with most AWS services. Charges per key + per API call.

Q: What is the difference between AWS managed and customer managed CMKs?
A: AWS managed CMKs are created/managed by AWS services on your behalf (cannot be shared or rotated manually). Customer managed CMKs are created and managed by you, support key policies, rotation, aliases, and cross-account access.

Q: What is envelope encryption?
A: Encrypting data with a data key, then encrypting that data key with a KMS CMK. The data key is stored with the encrypted data. Reduces KMS API calls and lets you encrypt large payloads.

Q: What is AWS WAF?
A: Web Application Firewall — protects web applications from common exploits (SQLi, XSS, bad bots, IP rate limiting) by inspecting HTTP/S requests. Can be attached to CloudFront, ALB, API Gateway, AppSync, Cognito User Pool.

Q: What is AWS Shield?
A: A managed DDoS protection service. Standard is free for all AWS customers (defends against common network/transport layer attacks). Advanced is paid and adds detection, mitigation, cost protection, and 24/7 DRT.

Q: What is Amazon Cognito?
A: A service to add authentication, authorization, and user management to web/mobile apps. Two main components: User Pools (sign-in, JWT tokens) and Identity Pools (federation, AWS temporary credentials for direct AWS access).

Q: What is the difference between Cognito User Pools and Identity Pools?
A: User Pools are user directories (sign-up, sign-in, MFA, social IdP) that return JWT tokens. Identity Pools exchange those tokens (or other IdPs) for AWS STS temporary credentials to access AWS resources directly.

Q: What is an Amazon API Gateway usage plan?
A: A mechanism to define throttling and quota limits for client API keys. Tracks usage per key and enforces rate limits and burst, returning 429 when exceeded.

Q: What is AWS AppSync?
A: A managed GraphQL service that securely connects to data sources (DynamoDB, RDS, Lambda, HTTP endpoints). Supports real-time subscriptions, offline caching, fine-grained auth via OIDC/Cognito/API key/IAM.