AWS Cloud Practitioner

1. You need to run an application with ultra-low latency for 5G mobile users. Which AWS service puts your compute closest to the end user?

AWS Wavelength builds and launches applications inside a telecom datacenter, pushed over the 5G network to be as close as possible to end users. Local Zones reduce latency for populated areas but are not tied to 5G telecom infrastructure.

2. Which S3 storage class automatically moves objects between tiers based on access patterns, with no retrieval fee?

S3 Intelligent Tiering uses machine learning to automatically move objects to the most cost-effective tier based on access patterns. Unlike Standard-IA or Glacier, there is no retrieval fee when data is accessed.

3. Your company needs to migrate 80TB of on-premise data to AWS. The internet connection is too slow. Which Snow Family device is the right fit?

Snowball Edge handles 50-80TB and is designed for briefcase-size data migration jobs. Snowcone is too small at 14TB, and Snowmobile (a semi-trailer) is overkill for 80TB - it is used for petabyte-scale migrations.

4. A Security Group and a NACL are both protecting an EC2 instance. Which statement is correct?

NACLs act as firewalls at the subnet level and support both Allow and Deny rules - useful for blocking a specific abusive IP. Security Groups act at the instance level and only support Allow rules; you cannot block a single IP address with a Security Group.

5. Your VPC has CIDR range 10.0.0.0/16. A subnet is created with CIDR 10.0.0.0/24. How many IP addresses does the subnet have?

A /24 CIDR block contains 256 IP addresses. The VPC's /16 gives 65,536 addresses total. Subnets partition the VPC's IP range into smaller segments and must have a smaller CIDR range than the VPC.

6. You want a dedicated, private gigabit connection from your on-premise datacenter to AWS - not over the public internet. Which service provides this?

AWS Direct Connect provides a dedicated gigabit connection from on-premise directly to AWS, bypassing the public internet entirely. AWS VPN is secure but still traverses the internet. PrivateLink keeps AWS-to-AWS traffic off the internet.

7. Which AWS database service is described as the 'flagship' NoSQL option, designed to scale to billions of records with guaranteed sub-second response?

DynamoDB is AWS's flagship database service for any massively scalable workload. Amazon themselves migrated 7,500 Oracle databases to DynamoDB in 2019, cutting costs by 60% and latency by 40%.

8. You need to run analytics on terabytes of data and generate reports once or twice a day. The data rarely changes. Which AWS service is purpose-built for this?

Redshift is a petabyte-scale data warehouse designed for OLAP (Online Analytical Processing). It is column-oriented, optimized for aggregation queries, and keeps data HOT for fast reporting - perfect for infrequent but heavy analytics workloads.

9. Your application is slowing down because the relational database is overwhelmed with read requests. You want to add a caching layer in front of it. Which service fits?

ElastiCache is a managed in-memory caching service (Redis or Memcached). It sits in front of a database to absorb repeated read requests, dramatically improving application performance without hitting the database every time.

10. Which AWS storage service is a cloud-native NFS file system that can be mounted simultaneously by multiple EC2 instances?

EFS is a cloud-native NFS file system service. Unlike EBS which attaches to a single EC2 instance, EFS can be mounted by multiple EC2 instances at the same time - ideal for shared file storage across a fleet of servers.

1. Where are AWS Access Keys stored on your local machine by default?

AWS Access Keys are stored in ~/.aws/credentials in TOML format. The default profile is used when no profile is specified, and named profiles let you store multiple sets of credentials.

2. A developer accidentally commits their AWS Access Key to a public GitHub repo. Why is this so dangerous?

Access Keys carry the full IAM permissions of the user they belong to. Anyone with the key + secret can call the AWS API as that user, potentially reading data, launching resources, or causing serious damage.

3. The AWS Shared Responsibility Model uses the phrase 'security IN the cloud' vs 'security OF the cloud.' Which side does AWS own?

AWS is responsible for security OF the cloud - the hardware, physical security, global infrastructure (Regions, AZs, Edge Locations), and the underlying software (Compute, Storage, Database, Networking). Customers are responsible for what they put IN the cloud.

4. You are running an EC2 instance (IaaS). Which of the following is YOUR responsibility as the customer?

In IaaS, the customer is responsible for everything above the hypervisor - the guest OS, middleware, runtime, applications, and data. AWS owns the physical hardware and hypervisor layer.

5. A company uses On-Premise, IaaS, PaaS, and SaaS for different workloads. For which model is the customer responsible for the MOST layers?

On-Premise means the customer owns and manages every layer - Applications, Data, Runtime, Middleware, OS, Virtualization, Servers, Storage, and Networking. As you move toward SaaS, the CSP takes on more and more layers.

6. You are running containers on AWS ECS (not Fargate). What is AWS responsible for in this model?

With ECS (IaaS containers), AWS manages the OS, Hypervisor, and Container Runtime. The customer is responsible for configuring, deploying, and storing their containers. This is why it's still considered IaaS - you manage the container layer.

7. You upload a Python function to AWS Lambda. What is the customer responsible for in the FaaS model?

Lambda is FaaS - the customer only uploads code. AWS handles deployment, container runtime, networking, storage, security, and the physical machine. You choose memory and max duration, then AWS handles everything else.

8. What is an AMI (Amazon Machine Image)?

An AMI is a predefined configuration template for a VM - it defines the OS (e.g. Ubuntu, Amazon Linux 2), and can include pre-installed software. You select an AMI when launching an EC2 instance. It is not a memory snapshot.

9. EC2 is called the 'backbone of AWS.' Which of the following services specifically runs on EC2 underneath?

S3, RDS, DynamoDB, and Lambda all use EC2 as their underlying infrastructure - that is why EC2 is called the backbone. Route 53, IAM, and CloudFront are global services with their own infrastructure. CloudWatch and Organizations are management-layer services.

10. What is the key difference between ECS Fargate and standard ECS?

Fargate is a serverless container service - it runs the same ECS workloads but AWS manages the underlying server so you pay per container run and never need to maintain EC2. EKS (not Fargate) is the Kubernetes service.

1. You want to interact with AWS programmatically using HTTPS requests without installing any software. Which tool allows you to send raw HTTP requests to AWS Service Endpoints?

The AWS API is an HTTP API - any tool that can send HTTPS requests (like Postman) can interact with it directly. The CLI and SDK are wrappers around the API that require installation.

2. When making a request to the AWS API, what does a 'signed request' require you to do?

To authorize an AWS API request, you generate a signed request by making a separate call with your AWS credentials to receive a token. This token is then included in the Authorization header of your actual request.

3. What is the AWS Management Console also informally called due to its point-and-click nature?

The AWS Management Console is nicknamed ClickOps because you can configure and launch AWS resources with limited programming knowledge just by pointing and clicking.

4. Which of the following is an example of an 'umbrella console' - a single AWS console that contains multiple AWS services?

CloudWatch is an umbrella console containing multiple AWS services. The full list from the course: VPC, EC2, Systems Manager, SageMaker, and CloudWatch. Lambda and S3 are single-service consoles.

5. How many digits make up an AWS Account ID?

Every AWS Account ID is exactly 12 digits long (e.g. 123456789012). It appears in the top-right navigation of the Management Console and is used in IAM policies, ARNs, and cross-account configurations.

6. Given the ARN `arn:aws:s3:::my-bucket`, which component is missing compared to a full EC2 ARN?

S3 is a globally scoped service, so its ARNs intentionally omit the region and account-id fields - leaving them blank (`:::`). An EC2 ARN would include both, e.g. `arn:aws:ec2:us-east-1:123456789012:instance/i-abc`.

7. What is a Cmdlet in AWS Tools for PowerShell, and what is an example of one?

A Cmdlet is PowerShell's special command format: capitalized verb-and-noun. AWS Tools for PowerShell exposes the full AWS API as Cmdlets, e.g. `New-S3Bucket` creates an S3 bucket without writing any code.

8. The AWS CLI is described as a Python executable program. What is the name of the CLI program itself?

The AWS CLI program is named `aws`. Python is required to install it, but once installed you interact with it using the `aws` command (e.g. `aws ec2 describe-instances`). Boto3 is the Python SDK, not the CLI.

9. AWS CloudShell gives you free storage per region. How much?

CloudShell provides 1 GB of persistent storage per AWS region at no cost. Files saved in your home directory persist across sessions in the same region.

10. A DevOps engineer with no programming background needs to write Infrastructure as Code. They prefer explicit, verbose configuration over writing code. Which AWS IaC tool is better suited for them?

CloudFormation is declarative - you describe what you want in JSON or YAML and AWS handles the rest. CDK is imperative and requires programming knowledge. CloudFormation is the better fit for someone without a dev background.

1. What is the primary purpose of AWS Wavelength Zones?

Wavelength Zones are embedded within Telecom providers' 5G networks, allowing compute to run at the edge - as close as possible to mobile users - for ultra-low latency applications.

2. Which of the following best describes Data Sovereignty?

Data Sovereignty is the legal or jurisdictional authority that can be asserted over data because of its physical location - it determines which laws govern your data.

3. AWS GovCloud Regions are only operated by employees who are:

GovCloud Regions are exclusively operated by U.S. citizens physically located on U.S. soil, and are only accessible to U.S. entities and root account holders who pass a screening process.

4. A company needs to host workloads that comply with ITAR (International Traffic in Arms Regulations). Which AWS offering should they use?

AWS GovCloud is specifically designed for regulated workloads and supports compliance with ITAR, FedRAMP, CJIS, EAR, and DoD requirements.

5. What is required to operate an AWS account in China?

AWS China is completely separate from global AWS. To operate there you need a Chinese Business License (ICP license). Not all services are available, and data must traverse the Great Firewall.

6. AWS has committed to powering its global infrastructure with 100% renewable energy by which year?

AWS's goal is 100% renewable energy by 2025. 2040 is the Net-Zero Carbon / Climate Pledge target - both numbers appear in the same slide, making this a common mix-up.

7. AWS Outposts comes in which of the following form factors?

AWS Outposts comes in three form factors: the full 42U rack, and smaller 1U and 2U options that can be placed into existing racks at your physical site.

8. What is the difference between High Scalability and High Elasticity?

Scalability means you have the ability to increase or decrease resources - it can be manual. Elasticity means that scaling happens automatically in response to current demand, typically through services like Auto Scaling Groups.

9. Your primary RDS database goes down. Traffic is automatically shifted to a standby database in a different Availability Zone with no data loss. Which architecture feature does this describe?

This describes Fault Tolerance - specifically RDS Multi-AZ, where a standby database is kept in sync in another AZ. When the primary fails, traffic automatically fails over to the standby. CloudEndure is a disaster recovery tool used after a broader failure event, not an automatic AZ fail-over mechanism.

10. A company's BCP states they can tolerate losing up to 4 hours of data in a disaster. Which metric does this describe?

RPO (Recovery Point Objective) is about data loss - how far back in time you can afford to go when restoring. RTO is about downtime - how long the service can be unavailable. '4 hours of data' = RPO.

1. A company is abandoning its legacy on-premise ERP system and migrating everything to cloud - despite uncertainty about success - because leadership believes staying on old tech will kill the business. What concept describes this situation?

Burning Platform describes when a company abandons old technology for new technology under fear and uncertainty, because the organization's survival depends on digital transformation.

2. Which AWS service is designed for quantum computing workloads?

AWS Bracket (via CalTech) is AWS's quantum computing service. EC2 handles general CPU computing and Inferentia handles GPU/ML workloads.

3. The 'Benefits of Cloud' is described as a reworking of the Six Advantages. Which two concepts are NOT in the Benefits list but belong to Cloud Architecture instead?

Fault Tolerance and Disaster Recovery are Cloud Architecture concepts, not Benefits of Cloud. The nine Benefits include Agility, Pay-as-you-go, Economy of Scale, Global Reach, Security, Reliability, High Availability, Scalability, and Elasticity.

4. Which of the Six Advantages of Cloud addresses the problem of over-provisioning servers 'just in case'?

Stop guessing capacity means you scale up or down to meet current need instead of paying for idle or underutilized servers you provisioned speculatively.

5. Among the Seven Advantages to Cloud, which advantage specifically refers to automated scaling during traffic spikes?

Elastic means scaling is automated during spikes and drops in demand. Scalable means you have the ability to increase or decrease resources - but it doesn't imply automation. The distinction matters on the exam.

6. AWS currently has 25 launched regions. How many Availability Zones do they have?

AWS has 81 Availability Zones across its 25 launched regions. 108 refers to Direct Connection Locations, a different infrastructure concept.

7. You are launching an EC2 instance. During setup you are asked to choose a Subnet, not an Availability Zone. Why?

Every subnet belongs to exactly one Availability Zone. When you pick a subnet, you are indirectly selecting which AZ your resource will run in.

8. An AWS Region is considered a Fault Level, and an Availability Zone is considered a Fault Domain. What is the key property of a Fault Domain?

A Fault Domain contains failures - if something fails inside it, that failure won't cascade to other domains. This is the core purpose of the concept. Data replication is a separate concern.

9. Which of the following AWS services uses Points of Presence to generate a special URL, allowing end users to upload files to a nearby Edge Location for faster transfer to S3?

S3 Transfer Acceleration generates a special URL so end users upload to a nearby Edge Location. Once the file hits the Edge Location, it travels the fast AWS backbone network to reach S3 instead of traversing the public internet the whole way.

10. You need a private, dedicated network connection between your on-premise datacenter and AWS with consistent performance for high-traffic workloads. Which service should you use, and what are the available bandwidth options?

AWS Direct Connect is the private/dedicated physical connection between your datacenter and AWS. It offers two bandwidth tiers: lower (50Mbps-500Mbps) and higher (1Gbps or 10Gbps). Global Accelerator still uses the public internet for the first hop to an Edge Location - it is not a dedicated connection.

1. What is the key difference between a Cloud Service Provider (CSP) and a Cloud Platform like Twilio or HashiCorp?

A CSP must offer a Single Unified API, metered billing, IaaS, and automation via IaC. Cloud Platforms like Twilio offer multiple services under a single UI but don't meet all these requirements.

2. Which hosting model shares one physical machine among hundreds of businesses, relying on tenants under-utilizing resources?

Shared Hosting puts hundreds of businesses on one physical machine and is very cheap, but offers limited functionality and poor isolation because it depends on tenants not fully using their allocation.

3. In the evolution of computing, what software layer enables multiple Virtual Machines to run on a single physical server?

The Hypervisor is the software layer that sits between the Host OS and the VMs, allowing multiple virtual machines to share one physical server. Docker Daemon is similar but operates one level up - it runs containers inside VMs.

4. You deploy your web app on AWS (public cloud) but keep your legacy database on-premise. The two sides are connected via VPN. How do end users access your web app?

The VPN in a hybrid setup is a private tunnel between infrastructure environments, not a user-facing gateway. End users access the public-facing parts of the app via the regular internet, unaware of the VPN.

5. Which type of cloud computing service is best described as: 'You upload code, choose memory and duration, and only pay while the code is running'?

Functions (Serverless) are managed VMs running managed containers where you only upload code. VMs spin up only when code needs to execute, so you pay only for that runtime - though this causes cold starts when the VM isn't already warm.