--- title: "AWS Cloud Practitioner Flashcards (CLF-C02)" description: "Full exam coverage for the AWS Certified Cloud Practitioner (CLF-C02) exam using spaced repetition. Covers Cloud Concepts, Security, Technology, and Billing." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/aws-cloud-practitioner-flashcards --- # AWS Cloud Practitioner Flashcards (CLF-C02) ## Flashcards ### 1. What is cloud computing? Cloud computing is the on-demand delivery of IT resources (compute, storage, databases, networking) over the internet with pay-as-you-go pricing. Instead of owning physical hardware, you rent resources from a cloud provider like AWS. ### 2. What are the 6 advantages of cloud computing (AWS)? 1. Trade capital expense for variable expense. 2. Benefit from massive economies of scale. 3. Stop guessing capacity. 4. Increase speed and agility. 5. Stop spending money on running data centers. 6. Go global in minutes. ### 3. What is the difference between CapEx and OpEx in cloud? CapEx (Capital Expenditure) is upfront spending on physical infrastructure you own. OpEx (Operational Expenditure) is paying for services as you consume them. Cloud computing shifts IT spending from CapEx to OpEx, improving cash flow and flexibility. ### 4. What are the three cloud computing deployment models? 1. Public Cloud resources owned and operated by a provider (e.g., AWS) and shared over the internet. 2. Private Cloud resources used exclusively by one organization, on-premises or hosted. 3. Hybrid Cloud a mix of public and private cloud connected together. ### 5. What are the three main cloud service models? 1. IaaS (Infrastructure as a Service) provides raw compute, storage, and networking. You manage the OS and up. Example: EC2. 2. PaaS (Platform as a Service) provides a managed platform to deploy apps. Example: Elastic Beanstalk. 3. SaaS (Software as a Service) fully managed software delivered over the internet. Example: Gmail, Salesforce. ### 6. What is the AWS Global Infrastructure? AWS Global Infrastructure consists of Regions, Availability Zones, and Edge Locations. It is designed to deliver low latency, high availability, and fault tolerance worldwide. ### 7. What is an AWS Region? An AWS Region is a physical geographic location in the world that contains multiple, isolated Availability Zones. Each Region is independent, and you choose which Region to deploy resources in based on latency, compliance, and pricing. ### 8. What is an Availability Zone (AZ)? An Availability Zone is one or more discrete data centers with redundant power, networking, and connectivity within a Region. Deploying across multiple AZs protects workloads from single data center failures. ### 9. What is an AWS Edge Location? An Edge Location is a site used by Amazon CloudFront to cache content closer to end users. There are many more Edge Locations than Regions, enabling low-latency content delivery globally. ### 10. What is the AWS Shared Responsibility Model? The Shared Responsibility Model defines what AWS secures vs. what the customer secures. AWS is responsible for security OF the cloud (hardware, infrastructure, physical facilities). The customer is responsible for security IN the cloud (data, IAM, OS configuration, network settings). ### 11. What does AWS manage under the Shared Responsibility Model? AWS manages the physical security of data centers, hardware, networking, hypervisors, and the global infrastructure. This is often summarized as "security of the cloud." ### 12. What does the customer manage under the Shared Responsibility Model? Customers manage their data, identity and access management, OS patching, network and firewall configuration, client-side encryption, and application security. This is summarized as "security in the cloud." ### 13. What is elasticity in cloud computing? Elasticity is the ability to automatically acquire resources when needed and release them when they are no longer needed. It allows systems to scale with demand without over-provisioning or under-provisioning. ### 14. What is high availability in AWS? High availability means designing systems to remain operational despite failures, typically by eliminating single points of failure. In AWS this is achieved by deploying across multiple Availability Zones and using services like ELB and Auto Scaling. ### 15. What is fault tolerance? Fault tolerance is the ability of a system to continue operating correctly even when one or more of its components fail. It goes beyond high availability by ensuring zero disruption during a failure, often using redundant components. ### 16. What is the AWS Well-Architected Framework? The AWS Well-Architected Framework provides best practices across six pillars: 1. Operational Excellence 2. Security 3. Reliability 4. Performance Efficiency 5. Cost Optimization 6. Sustainability ### 17. What is the Reliability pillar of the Well-Architected Framework? The Reliability pillar focuses on a workload's ability to perform its intended function correctly and consistently, recover from failures, and dynamically acquire resources to meet demand. Key practices include Multi-AZ deployments and automated recovery. ### 18. What is the AWS Cloud Adoption Framework (CAF)? The AWS CAF provides guidance and best practices to help organizations migrate to the cloud. It organizes guidance into six perspectives Business, People, Governance, Platform, Security, and Operations. ### 19. What is AWS IAM? AWS IAM (Identity and Access Management) lets you manage access to AWS services and resources. You create users, groups, and roles, then attach policies that allow or deny actions. IAM is global and free to use. ### 20. What is an IAM User? An IAM User is an identity that represents a person or application interacting with AWS. Each user has long-term credentials (password or access keys) and can be assigned permissions via policies. ### 21. What is an IAM Group? An IAM Group is a collection of IAM users. Permissions attached to a group apply to all users in that group, making it easier to manage permissions at scale instead of assigning policies individually. ### 22. What is an IAM Role? An IAM Role is an identity with permission policies that AWS services, applications, or external identities can temporarily assume. Roles use short-lived credentials and are preferred over long-term access keys. ### 23. What is an IAM Policy? An IAM Policy is a JSON document that defines permissions. It specifies which actions are allowed or denied on which AWS resources, and can be attached to users, groups, or roles. ### 24. What is the principle of least privilege? Granting only the minimum permissions necessary to perform a task. It limits the blast radius of accidental or malicious actions. AWS recommends always starting with no permissions and adding only what is needed. ### 25. What is AWS MFA? Multi-Factor Authentication (MFA) requires a second form of verification such as a one-time code from an authenticator app in addition to a password. AWS strongly recommends MFA on the root account and all privileged users. ### 26. What is the AWS root account? The root account is created when you first sign up for AWS and has unrestricted access to all resources and billing. AWS recommends not using it for daily tasks create IAM users instead, and protect the root account with MFA. ### 27. What is AWS Organizations? AWS Organizations lets you centrally manage and govern multiple AWS accounts. You can apply Service Control Policies (SCPs) to restrict what actions accounts can perform, consolidate billing, and group accounts into Organizational Units (OUs). ### 28. What is a Service Control Policy (SCP)? An SCP is a policy in AWS Organizations that sets the maximum permissions for member accounts in an OU or the entire organization. SCPs do not grant permissions they only restrict what can be granted within accounts. ### 29. What is AWS Shield? AWS Shield is a managed DDoS (Distributed Denial of Service) protection service. Shield Standard is automatically included for all AWS customers at no cost. Shield Advanced provides enhanced detection and 24/7 support for an additional fee. ### 30. What is AWS WAF? AWS WAF (Web Application Firewall) helps protect web applications from common exploits like SQL injection and cross-site scripting. You define rules to allow, block, or monitor HTTP(S) requests to CloudFront, API Gateway, or ALB. ### 31. What is Amazon GuardDuty? Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity using machine learning and threat intelligence. It analyzes CloudTrail, VPC Flow Logs, and DNS logs. ### 32. What is AWS CloudTrail? AWS CloudTrail records all API calls and user activity in your AWS account, providing a complete audit trail. It is used for security analysis, compliance auditing, and troubleshooting operational issues. ### 33. What is Amazon Inspector? Amazon Inspector is an automated security assessment service that checks EC2 instances and container images for software vulnerabilities and unintended network exposure, then provides a prioritized list of findings. ### 34. What is AWS Artifact? AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports (e.g., SOC, ISO, PCI) and security agreements. It helps customers meet regulatory and compliance requirements. ### 35. What is AWS Key Management Service (KMS)? AWS KMS is a managed service for creating and controlling encryption keys used to encrypt data across AWS services. It integrates with S3, EBS, RDS, and many other services to provide easy, centralized key management. ### 36. What is data encryption at rest vs in transit? Encryption at rest protects stored data (e.g., files on S3 or EBS volumes) when it is not moving. Encryption in transit protects data as it travels over a network using protocols like TLS/HTTPS. Both are important layers of data security. ### 37. What is Amazon Cognito? Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. It lets users sign in with a username/password or via social identity providers like Google and Facebook. ### 38. What is Amazon EC2? Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers in the cloud. You choose the instance type (CPU, memory), OS, and storage. You pay for running instances by the second or hour. ### 39. What are EC2 purchasing options? 1. On-Demand pay by the second, no commitment. 2. Reserved Instances 1 or 3-year commitment for up to 72% discount. 3. Spot Instances bid for unused capacity, up to 90% discount, can be interrupted. 4. Savings Plans flexible commitment to a spend level for discounts. 5. Dedicated Hosts physical servers dedicated to your use. ### 40. What is AWS Lambda? AWS Lambda is a serverless compute service that runs code in response to events (e.g., an S3 upload or API call). You do not manage servers; AWS handles scaling automatically. You are billed only for execution time in milliseconds. ### 41. What is Amazon ECS? Amazon ECS (Elastic Container Service) is a fully managed container orchestration service for running Docker containers. You can run containers on EC2 instances or with AWS Fargate for a fully serverless experience. ### 42. What is AWS Fargate? AWS Fargate is a serverless compute engine for containers. It works with ECS and EKS, letting you run containers without provisioning or managing EC2 instances. You pay only for the vCPU and memory your containers use. ### 43. What is Amazon S3? Amazon S3 (Simple Storage Service) is object storage built to store and retrieve any amount of data. Objects are stored in buckets. S3 offers 99.999999999% (11 nines) durability and is used for backups, static websites, data lakes, and more. ### 44. What are S3 storage classes? 1. S3 Standard frequent access, high availability. 2. S3 Intelligent-Tiering auto-moves data between tiers based on access. 3. S3 Standard-IA infrequent access, lower cost. 4. S3 One Zone-IA infrequent access, single AZ. 5. S3 Glacier Instant Retrieval archive, milliseconds retrieval. 6. S3 Glacier Flexible Retrieval archive, minutes to hours retrieval. 7. S3 Glacier Deep Archive lowest cost, 12-hour retrieval. ### 45. What is Amazon EBS? Amazon EBS (Elastic Block Store) provides persistent block storage volumes attached to EC2 instances. Volumes exist independently of the instance, support snapshots for backup, and are replicated within their Availability Zone. ### 46. What is Amazon EFS? Amazon EFS (Elastic File System) is a scalable, managed NFS file system for Linux workloads. Multiple EC2 instances can mount the same EFS file system simultaneously, and it scales automatically as files are added or removed. ### 47. What is a VPC? A VPC (Virtual Private Cloud) is a logically isolated virtual network in AWS where you launch resources. You define IP address ranges, subnets, route tables, and gateways, giving you full control over your network environment. ### 48. What is Amazon CloudFront? Amazon CloudFront is AWS's global CDN (Content Delivery Network). It caches content at hundreds of Edge Locations worldwide, reducing latency for users and offloading traffic from origin servers. ### 49. What is Amazon Route 53? Amazon Route 53 is a scalable and highly available DNS service. It routes end users to applications by translating domain names to IP addresses and supports health checks, failover, and geolocation routing policies. ### 50. What is Amazon RDS? Amazon RDS (Relational Database Service) is a managed relational database service supporting MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. AWS handles provisioning, patching, backups, and Multi-AZ failover. ### 51. What is Amazon DynamoDB? Amazon DynamoDB is a fully managed, serverless NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It automatically replicates data across multiple AZs. ### 52. What is Amazon Aurora? Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud. It is up to 5x faster than standard MySQL and 3x faster than PostgreSQL, with automatic replication across 3 AZs and up to 15 read replicas. ### 53. What is Amazon ElastiCache? Amazon ElastiCache is a managed in-memory caching service supporting Redis and Memcached. It reduces database load by caching frequently accessed data, enabling microsecond response times. ### 54. What is the difference between SQS and SNS? SQS (Simple Queue Service) is a pull-based message queue for decoupling services one consumer processes each message. SNS (Simple Notification Service) is a push-based pub/sub system that fans messages out to multiple subscribers simultaneously. ### 55. What is Amazon API Gateway? Amazon API Gateway is a fully managed service for creating, securing, and scaling REST, HTTP, and WebSocket APIs. It is the common front door for serverless applications built with AWS Lambda. ### 56. What is AWS Elastic Beanstalk? AWS Elastic Beanstalk is a PaaS that lets you deploy and manage web applications without worrying about the underlying infrastructure. You upload your code, and Beanstalk handles provisioning, load balancing, scaling, and monitoring. ### 57. What is AWS CloudFormation? AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you model and provision AWS resources using JSON or YAML templates. It automates the creation and management of entire stacks of AWS resources. ### 58. What is the AWS CDK? The AWS CDK (Cloud Development Kit) is an open-source framework for defining cloud infrastructure using familiar programming languages like TypeScript, Python, or Java. It synthesizes CloudFormation templates under the hood. ### 59. What is Amazon CloudWatch? Amazon CloudWatch is AWS's monitoring and observability service. It collects metrics, logs, and events from AWS resources, lets you set alarms on thresholds, create dashboards, and trigger automated responses. ### 60. What is AWS Auto Scaling? AWS Auto Scaling monitors applications and automatically adjusts capacity (e.g., EC2 instances) to maintain performance at the lowest possible cost. It scales out during demand spikes and scales in when demand drops. ### 61. What is Elastic Load Balancing (ELB)? Elastic Load Balancing distributes incoming traffic across multiple targets (EC2, Lambda, containers) in one or more AZs. It has three types ALB (HTTP/HTTPS), NLB (TCP/UDP), and CLB (legacy). It integrates with Auto Scaling for high availability. ### 62. What is the difference between ALB and NLB? ALB (Application Load Balancer) operates at Layer 7 (HTTP/HTTPS) and supports path-based and host-based routing. NLB (Network Load Balancer) operates at Layer 4 (TCP/UDP) and is designed for ultra-high performance and static IP addresses. ### 63. What is AWS Trusted Advisor? AWS Trusted Advisor is an online tool that analyzes your AWS environment and provides real-time recommendations across five categories Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits. Some checks are free; more advanced checks require Business or Enterprise Support. ### 64. What is Amazon SNS? Amazon SNS (Simple Notification Service) is a fully managed pub/sub messaging service. Publishers send messages to a topic, and SNS delivers them to all subscribers which can be Lambda, SQS, email, SMS, or HTTP endpoints. ### 65. What is AWS Direct Connect? AWS Direct Connect is a dedicated private network connection from your on-premises data center to AWS. It provides more consistent network performance and lower latency than internet-based connections, and can reduce data transfer costs. ### 66. What is an AWS VPN? AWS VPN creates an encrypted tunnel between your on-premises network and your AWS VPC over the public internet. It is a quick, cost-effective way to extend your network to the cloud, though performance depends on internet conditions. ### 67. What is Amazon Lightsail? Amazon Lightsail is a simplified cloud platform designed for developers who need a straightforward way to launch virtual servers, databases, and storage. It bundles compute, SSD storage, data transfer, DNS, and a static IP into simple monthly plans. ### 68. What are the three fundamental AWS pricing drivers? 1. Compute charged per hour or second based on instance type. 2. Storage charged per GB of data stored. 3. Data Transfer outbound data transfer to the internet is charged; inbound is generally free. ### 69. What is the AWS Free Tier? The AWS Free Tier lets new customers use certain AWS services at no cost for 12 months (e.g., 750 hours/month of EC2 t2.micro) or always free (e.g., 1 million Lambda requests/month). Some services also offer free trials. ### 70. What is the AWS Pricing Calculator? The AWS Pricing Calculator is a free web tool that lets you estimate the cost of AWS services before you deploy anything. You configure services and usage patterns to generate a monthly cost estimate. ### 71. What is AWS Cost Explorer? AWS Cost Explorer is a tool for visualizing, understanding, and managing your AWS costs and usage over time. It provides built-in reports, lets you filter by service or tag, and can forecast future spending. ### 72. What are AWS Budgets? AWS Budgets lets you set custom cost and usage budgets and receive alerts when your spending exceeds (or is forecasted to exceed) your defined thresholds. You can also set budgets for Reserved Instance utilization. ### 73. What is consolidated billing in AWS Organizations? Consolidated billing combines the usage and costs of all AWS accounts in an organization into a single bill. This simplifies payment and allows the organization to aggregate usage across accounts to reach higher volume discount tiers. ### 74. What is an AWS Reserved Instance? A Reserved Instance (RI) is a billing discount applied to On-Demand instance usage when you commit to a 1-year or 3-year term. RIs can save up to 72% compared to On-Demand pricing and come in Standard or Convertible types. ### 75. What is an AWS Savings Plan? Savings Plans are a flexible pricing model offering up to 66% savings over On-Demand in exchange for a commitment to a consistent amount of compute usage (in $/hour) for 1 or 3 years. They apply automatically to eligible usage. ### 76. What is a Spot Instance? A Spot Instance lets you use spare AWS EC2 capacity at up to 90% discount compared to On-Demand prices. AWS can reclaim Spot Instances with a 2-minute warning, so they are best for fault-tolerant, flexible workloads like batch jobs. ### 77. What are the AWS Support plans? 1. Basic free, access to documentation and forums. 2. Developer email support during business hours, from $29/month. 3. Business 24/7 phone/chat, Trusted Advisor full checks, from $100/month. 4. Enterprise On-Ramp access to a pool of TAMs, from $5,500/month. 5. Enterprise dedicated TAM, concierge support, from $15,000/month. ### 78. What is a Technical Account Manager (TAM)? A TAM is a dedicated AWS expert assigned to customers on Enterprise On-Ramp or Enterprise Support plans. They provide proactive guidance, architectural reviews, and help optimize AWS environments. ### 79. What is the AWS Marketplace? AWS Marketplace is a digital catalog with thousands of third-party software listings that run on AWS. You can find, buy, deploy, and manage software from independent vendors, paying via your AWS bill. ### 80. What is the TCO Calculator / Migration Evaluator? The AWS Migration Evaluator (formerly TCO Calculator) helps estimate the cost savings of migrating on-premises workloads to AWS by comparing the total cost of ownership of running workloads on-premises vs. in the cloud. ### 81. What is a cost allocation tag? A cost allocation tag is a key-value label you attach to AWS resources (e.g., Project=Marketing). Once activated, tags appear in your Cost Explorer and billing reports, allowing you to track and allocate costs by team, project, or environment. ### 82. What is AWS Snow Family? The AWS Snow Family (Snowcone, Snowball, Snowmobile) consists of physical devices for migrating large amounts of data to AWS when internet transfer is too slow or costly. Snowmobile can transfer up to 100 PB in a shipping container. ### 83. What is AWS Storage Gateway? AWS Storage Gateway is a hybrid cloud storage service that connects on-premises environments to AWS cloud storage. It enables seamless integration for backups, archiving, and tiered storage use cases. ### 84. What is Amazon Rekognition? Amazon Rekognition is a managed AI service for image and video analysis. It can identify objects, people, text, scenes, and activities, as well as perform facial analysis and recognition with no machine learning expertise required. ### 85. What is Amazon SageMaker? Amazon SageMaker is a fully managed service for building, training, and deploying machine learning models at scale. It provides tools for every step of the ML workflow, from data labeling to model monitoring. ### 86. What is AWS Glue? AWS Glue is a serverless data integration service that makes it easy to discover, prepare, and combine data for analytics and machine learning. It provides a managed ETL (Extract, Transform, Load) environment. ### 87. What is Amazon Athena? Amazon Athena is an interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. It is serverless there is nothing to set up and you pay only for the queries you run. ### 88. What is AWS Config? AWS Config continuously monitors and records your AWS resource configurations and evaluates them against desired settings. It provides a configuration history and helps with compliance auditing and change management. ### 89. What is Amazon EventBridge? Amazon EventBridge is a serverless event bus that connects application data from your own apps, SaaS tools, and AWS services. It routes events to targets like Lambda, SQS, and Step Functions based on rules you define. ### 90. What is AWS Step Functions? AWS Step Functions is a serverless workflow service that lets you coordinate multiple AWS services into automated workflows using visual state machines. It handles error handling, retries, and parallel execution. ### 91. What is the difference between AWS CloudTrail and CloudWatch? CloudTrail records WHO did WHAT API action and WHEN it is an audit and compliance log. CloudWatch monitors HOW your resources are performing (metrics, logs, alarms). They are complementary CloudTrail for governance, CloudWatch for operations. ### 92. What is Amazon Macie? Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3, such as personally identifiable information (PII) or financial data. ### 93. What is AWS Security Hub? AWS Security Hub provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from services like GuardDuty, Inspector, and Macie into a single dashboard.