--- title: "AWS: Cloud Services & Architecture Fundamentals" description: "Test your knowledge of AWS fundamentals with this comprehensive quiz covering key services, architecture, security, and best practices." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/aws-architecture-essentials-quiz --- # AWS: Cloud Services & Architecture Fundamentals Welcome to the AWS Basics Quiz! This quiz is designed to test your understanding of fundamental AWS concepts and best practices. Each question is multiple-choice, and you'll find hints to help you along the way. Good luck! ## Questions ### 1. Which AWS service allows you to build and scale generative AI applications using foundation models (FMs)? - Amazon SageMaker - SageMaker is primarily for building, training, and deploying custom machine learning models. - **Amazon Bedrock** ✅ - Bedrock provides access to foundation models from leading AI companies via a managed API. - Amazon Lex - Amazon Lex is used for building conversational interfaces like chatbots using voice and text. - Amazon Rekognition - Rekognition is a computer vision service for analyzing image and video content. **Hint:** Think of the 'bedrock' or foundation for AI apps. ### 2. Under the AWS Shared Responsibility Model, which task is the customer's responsibility? - Physical security of data centers - AWS manages the physical security and access control of all global infrastructure. - Patching the host virtualization layer - AWS is responsible for maintaining the underlying hypervisor and hardware virtualization software. - **Configuration of security groups** ✅ - Customers are responsible for configuring network access controls and firewall settings for their instances. - Disposal of decommissioned hardware - AWS handles the secure destruction and disposal of all physical storage media and server hardware. **Hint:** Customers handle settings and data; AWS handles the physical hardware. ### 3. Which storage class is most cost-effective for long-term archiving with retrieval times of several hours? - S3 Standard - S3 Standard is designed for frequently accessed data and is the most expensive storage tier. - S3 Glacier Instant Retrieval - This tier provides millisecond access and is more expensive than long-term archive tiers. - **S3 Glacier Deep Archive** ✅ - This is the lowest-cost storage class, designed for data that is rarely accessed and can wait for retrieval. - S3 Intelligent-Tiering - This class automatically moves data between tiers but includes monitoring and automation fees. **Hint:** The 'Deepest' storage for the lowest price. ### 4. Which AWS service provides a central hub to manage resources across multiple AWS accounts? - **AWS Organizations** ✅ - Organizations allows for central management, consolidated billing, and policy enforcement across multiple accounts. - AWS Resource Explorer - Resource Explorer is a search tool used to discover resources within an account across regions. - AWS Control Tower - Control Tower is a governance service used to set up and manage a secure multi-account environment. - AWS Systems Manager - Systems Manager is an operations service used to manage resources at the instance and application level. **Hint:** Used for consolidated billing and account hierarchy. ### 5. Which EC2 instance purchasing option offers the deepest discount for fault-tolerant applications? - On-Demand Instances - On-Demand instances have a fixed hourly rate and provide the least amount of savings. - Reserved Instances - Reserved Instances offer significant savings in exchange for a 1-year or 3-year time commitment. - **Spot Instances** ✅ - Spot instances use spare capacity for up to 90% savings but can be interrupted with two minutes notice. - Dedicated Hosts - Dedicated hosts provide physical server isolation but are typically the most expensive EC2 option. **Hint:** Think of a 'spot market' for spare capacity. ### 6. Which pillar of the Well-Architected Framework focuses on running and monitoring systems effectively? - Security Pillar - The Security pillar focuses on protecting information, systems, and assets through risk assessment. - Reliability Pillar - The Reliability pillar ensures a workload performs its intended function correctly and consistently. - **Operational Excellence Pillar** ✅ - Operational Excellence focuses on continuous process improvement and running workloads effectively. - Performance Efficiency Pillar - Performance Efficiency focuses on using IT and computing resources to meet requirements as demand changes. **Hint:** Focuses on 'How we work' and 'How we improve'. ### 7. Which service provides a dedicated private network connection from on-premises to AWS? - AWS Site-to-Site VPN - Site-to-Site VPN creates an encrypted tunnel over the public internet rather than a private line. - **AWS Direct Connect** ✅ - Direct Connect bypasses the internet to provide a dedicated, consistent, and private network link. - Amazon Route 53 - Route 53 is a scalable Domain Name System service and does not provide physical connectivity. - AWS Transit Gateway - Transit Gateway acts as a network hub to connect VPCs but does not provide the physical link itself. **Hint:** It is a 'Direct' physical cable connection. ### 8. Which service automatically distributes application traffic across multiple targets like EC2? - AWS Auto Scaling - Auto Scaling monitors applications and automatically adjusts capacity to maintain steady performance. - Amazon CloudFront - CloudFront is a content delivery network used to distribute content globally with low latency. - **Elastic Load Balancing** ✅ - Elastic Load Balancing (ELB) distributes incoming traffic across multiple targets in one or more AZs. - AWS Global Accelerator - Global Accelerator improves availability by directing traffic over the AWS global network infrastructure. **Hint:** It 'balances' the 'load'. ### 9. What is the primary purpose of an AWS IAM Role? - Provide long-term credentials - IAM Users provide long-term credentials; roles are designed for short-term, temporary access. - Define a collection of users - An IAM Group is the entity used to define a collection of users with shared permissions. - **Grant temporary permissions** ✅ - IAM Roles provide temporary security credentials to trusted entities and AWS services. - Store Root user passwords - IAM is used to manage identities, but it is not a vault for root account passwords. **Hint:** Used by EC2 instances to talk to S3 without storing keys. ### 10. Which AWS service is a serverless, NoSQL database designed for high-performance at any scale? - Amazon RDS - RDS is a managed service for relational databases such as MySQL, PostgreSQL, and SQL Server. - Amazon Aurora - Aurora is a MySQL and PostgreSQL-compatible relational database built specifically for the cloud. - **Amazon DynamoDB** ✅ - DynamoDB is a key-value and document database that delivers single-digit millisecond performance. - Amazon Redshift - Redshift is a fast, fully managed data warehouse that uses SQL to analyze large volumes of data. **Hint:** It is 'Dynamic' and serverless. ### 11. Which service is best suited for petabyte-scale data warehousing and complex analytics? - Amazon Athena - Athena is an interactive query service that makes it easy to analyze data in S3 using standard SQL. - **Amazon Redshift** ✅ - Redshift is a dedicated data warehouse service optimized for large-scale datasets and complex queries. - Amazon EMR - EMR is a managed cluster platform that simplifies running big data frameworks like Apache Spark. - AWS Glue - Glue is a serverless data integration service that makes it easy to discover and prepare data for analytics. **Hint:** Think of 'shifting' data into a warehouse. ### 12. Which tool allows you to estimate the cost of an AWS environment before you begin building it? - AWS Budgets - AWS Budgets is used to set custom cost and usage limits and receive alerts when thresholds are met. - AWS Cost Explorer - Cost Explorer is used to visualize, understand, and manage your actual AWS costs and usage over time. - **AWS Pricing Calculator** ✅ - The Pricing Calculator allows you to estimate costs for various services and architectural scenarios. - AWS Trusted Advisor - Trusted Advisor provides real-time guidance to help you provision resources following AWS best practices. **Hint:** A 'calculator' for future costs. ### 13. What is the minimum number of Availability Zones (AZs) found in an AWS Region? - At least one - A single AZ would not provide the high availability required by AWS architectural standards. - At least two - While some older regions started with two, the modern standard for new regions is higher. - **At least three** ✅ - Most AWS Regions are designed with at least three AZs to provide high availability and fault tolerance. - At least five - While some regions like us-east-1 have many AZs, five is not the global minimum requirement. **Hint:** AWS design standards require multiple 'locations' for redundancy. ### 14. Which service provides a stateful virtual firewall for EC2 instances to control traffic? - Network ACL - Network ACLs are stateless firewalls that operate at the subnet level to control inbound and outbound traffic. - **Security Group** ✅ - Security Groups are stateful firewalls that operate at the instance level to filter specific traffic. - AWS WAF - AWS WAF is a web application firewall that helps protect web applications from common web exploits. - AWS Shield - AWS Shield is a managed Distributed Denial of Service (DDoS) protection service for AWS resources. **Hint:** It is 'stateful' and attached directly to the instance. ### 15. Which service tracks user activity and API usage across your entire AWS infrastructure? - Amazon CloudWatch - CloudWatch is a monitoring and observability service designed for DevOps and IT managers. - **AWS CloudTrail** ✅ - CloudTrail enables auditing, security monitoring, and operational troubleshooting by logging API calls. - AWS Config - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your resources. - AWS Trusted Advisor - Trusted Advisor inspects your environment and makes recommendations to help close security gaps. **Hint:** It leaves a 'trail' of who did what. ### 16. What is the term for the ability to scale resources up and down based on changing demand? - High Availability - High Availability refers to the ability of a system to remain operational despite individual component failures. - Fault Tolerance - Fault Tolerance is the property that enables a system to continue operating properly in the event of a failure. - **Elasticity** ✅ - Elasticity is the power to scale computing resources up or down dynamically to meet workload demands. - Durability - Durability refers to the ability of a system to keep data intact and protected over long periods of time. **Hint:** Like a rubber band. ### 17. Which AWS service is used to manage and rotate database credentials and API keys? - AWS KMS - AWS Key Management Service (KMS) is used to create and control the keys used to encrypt your data. - **AWS Secrets Manager** ✅ - Secrets Manager helps you protect secrets, rotate them automatically, and manage access via IAM policies. - AWS Systems Manager - Systems Manager Parameter Store can store strings and secrets but does not offer native secret rotation. - AWS Certificate Manager - AWS Certificate Manager is used to provision, manage, and deploy public and private SSL/TLS certificates. **Hint:** It 'manages' your 'secrets'. ### 18. Which service provides a content delivery network (CDN) to speed up delivery of web content? - Amazon Route 53 - Route 53 is a Domain Name System service that routes users to internet applications by translating names. - AWS Direct Connect - Direct Connect is a network service that provides an alternative to using the internet to connect to AWS. - **Amazon CloudFront** ✅ - CloudFront is a CDN service that delivers data, videos, and APIs to customers globally with low latency. - AWS Global Accelerator - Global Accelerator uses the AWS global network to improve the performance of your users’ traffic. **Hint:** Content is delivered at the 'front' of the 'cloud'. ### 19. In the Shared Responsibility Model, who is responsible for encrypting data at rest? - AWS Only - AWS provides the infrastructure and tools for encryption, but does not manage the customer’s data settings. - **The Customer** ✅ - Customers are responsible for managing their data, including enabling encryption and managing keys. - AWS and Customer - While AWS provides the tools, the responsibility for data-level encryption lies squarely with the customer. - Third-party vendors - Third-party vendors may provide tools, but the ultimate responsibility remains with the customer identity. **Hint:** The data belongs to the customer. ### 20. Which service provides automated security assessments for EC2 instance vulnerabilities? - AWS Artifact - AWS Artifact is a self-service portal for on-demand access to AWS’s compliance documentation and reports. - **Amazon Inspector** ✅ - Amazon Inspector is an automated security assessment service that helps improve the security of applications. - AWS Shield - AWS Shield is a managed DDoS protection service that safeguards applications running on AWS. - Amazon GuardDuty - GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. **Hint:** It 'inspects' your instances for vulnerabilities. ### 21. What does the AWS 'Total Cost of Ownership' (TCO) concept help businesses compare? - Monthly vs. Annual bills - TCO focuses on long-term investment and infrastructure costs rather than just billing cycles. - **On-premises vs. Cloud** ✅ - TCO is a financial metric used to estimate and compare direct and indirect costs of different environments. - Compute vs. Serverless - This is a specific architectural cost comparison rather than a broad Total Cost of Ownership analysis. - Storage vs. Network - Comparing internal service costs is part of cost optimization, but TCO refers to the entire environment. **Hint:** Cloud vs. Physical hardware. ### 22. Which service allows you to run code in response to events without managing servers? - Amazon EC2 - Amazon EC2 provides virtual servers that require the user to manage operating systems and patching. - **AWS Lambda** ✅ - Lambda is a serverless, event-driven compute service that lets you run code for virtually any application. - Amazon Lightsail - Lightsail offers easy-to-use virtual private server (VPS) instances, containers, and storage. - AWS Batch - AWS Batch enables developers to run hundreds of thousands of batch computing jobs on AWS. **Hint:** The face of serverless compute. ### 23. Which support plan provides access to a dedicated Technical Account Manager (TAM)? - Developer Plan - The Developer plan provides business hours email access to support but does not include a TAM. - Business Plan - The Business plan offers 24/7 access to support engineers but does not provide a dedicated TAM. - **Enterprise Plan** ✅ - The Enterprise support plan is the only tier that includes a dedicated Technical Account Manager. - Basic Plan - The Basic plan is free and only includes access to billing support and the AWS community forums. **Hint:** The highest tier of support. ### 24. Which service is used to manage and deploy SSL/TLS certificates for AWS services? - AWS Key Management - AWS KMS is used to create and manage cryptographic keys and control their use across AWS services. - AWS Directory - AWS Directory Service for Microsoft Active Directory enables your workloads to use managed AD in the cloud. - **AWS Certificate Manager** ✅ - ACM handles the complexity of creating, storing, and renewing SSL/TLS certificates for AWS resources. - AWS Identity Management - IAM is used to securely control individual and group access to AWS resources and service APIs. **Hint:** It 'manages' your 'certificates'. ### 25. What is the primary function of Amazon Route 53? - Content Delivery Network - This function is performed by Amazon CloudFront, which uses edge locations to serve content. - **Domain Name System service** ✅ - Route 53 is a highly available and scalable cloud DNS service designed to route end users to applications. - Elastic Load Balancing - ELB is used to distribute incoming application traffic across multiple targets, such as EC2 instances. - Virtual Private Cloud - A VPC is a logically isolated section of the AWS Cloud where you can launch your own AWS resources. **Hint:** It 'routes' traffic using port 53. ### 26. Which service allows you to create a logically isolated section of the AWS Cloud? - AWS Direct Connect - Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection. - **Amazon VPC** ✅ - Amazon Virtual Private Cloud (VPC) gives you full control over your virtual networking environment. - Amazon Route 53 - Route 53 is a Domain Name System (DNS) service and does not provide network isolation features. - AWS CloudFormation - CloudFormation is a service that gives you an easy way to model and set up your AWS resources via code. **Hint:** Your 'Private Cloud' inside AWS. ### 27. Which AWS service is used to migrate databases to AWS with minimal downtime? - AWS Snowball - Snowball is a petabyte-scale data transport solution that uses physical devices to transfer data into AWS. - **AWS DMS** ✅ - Database Migration Service (DMS) helps you migrate databases to AWS quickly and securely while maintaining uptime. - AWS DataSync - DataSync is an online data transfer service that simplifies and accelerates moving data between storage systems. - AWS Discovery Service - Application Discovery Service helps enterprise customers plan migration projects by gathering information. **Hint:** Database Migration... Service. ### 28. Which service provides a simple way to govern a secure, multi-account environment? - AWS Organizations - AWS Organizations is the foundational service used to centrally manage and govern multiple AWS accounts. - **AWS Control Tower** ✅ - Control Tower provides the easiest way to set up and govern a new, secure, multi-account AWS environment. - AWS Config - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your resources. - AWS Service Catalog - Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use. **Hint:** It 'controls' the 'tower' of accounts. ### 29. Which service is a managed message broker for Apache ActiveMQ and RabbitMQ? - Amazon SQS - Amazon Simple Queue Service (SQS) is a fully managed message queuing service for microservices. - Amazon SNS - Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service for a2a and a2p. - **Amazon MQ** ✅ - Amazon MQ is a managed message broker service that makes it easy to set up and operate message brokers. - Amazon Kinesis - Amazon Kinesis makes it easy to collect, process, and analyze real-time, streaming data for rapid insights. **Hint:** Same name as the protocol. ### 30. What is an AWS 'Edge Location' primarily used for? - Running EC2 instances - Compute instances like EC2 are hosted within Regions and Availability Zones, not Edge Locations. - Hosting primary databases - Primary database workloads such as RDS are deployed within specific Availability Zones for durability. - **Caching content via CloudFront** ✅ - Edge Locations are used by CloudFront to cache content closer to end users to reduce latency. - Storing S3 Glacier backups - Long-term archival storage like S3 Glacier is maintained within the high-durability infrastructure of a Region. **Hint:** The 'edge' of the network.