Review
Read the description, try to recall the service or concept, then open the card to check.
Cloud computing
What is it?Instead of buying, owning and running data centers and servers, you use compute, storage, databases and other services from a provider such as AWS, when you need them.Show answer
What it is
If a question mentions paying only for what you use and provisioning in minutes, it is describing the cloud, not your own data center.
What is it?AWS sums up the value of the cloud in six advantages, which show up almost word for word in questions.Show answer
Six advantages
Match the scenario to the advantage: "demand is unpredictable" means stop guessing capacity; "launch in another country" means go global in minutes.
What is it?They define how much of the stack AWS manages and how much stays with you. The more abstract the service, the less you manage.Show answer
Service models
Who patches the operating system? On EC2 the customer; on RDS or Lambda, AWS.
What is it?Where resources run: all in the cloud, part in the cloud and part on premises, or all in your own data center.Show answer
Deployment models
"Keep legacy systems in the data center and extend into AWS" describes the hybrid model.
What is it?AWS is responsible for security of the cloud; the customer is responsible for security in the cloud. The split changes with the service.Show answer
Shared responsibility
Classic question: "who is responsible for X?". Physical and infrastructure is AWS; data, access and configuration belong to the customer.
What is it?Why the cloud usually costs less than your own data center, and where the cost still depends on you.Show answer
Cloud economics
Rightsizing and turning off idle resources are the usual answers to cut costs without changing the architecture.
What is it?AWS guidance for planning cloud adoption, organized in six perspectives, each with its own capabilities.Show answer
Cloud Adoption FrameworkAWS CAF
Know how to split the six perspectives into business (Business, People, Governance) and technical (Platform, Security, Operations).
What is it?Ways to take each application to the cloud, from the simplest to the one that changes the application the most.Show answer
Migration strategiesThe 7 Rs
"Move fast, without changing the code" is rehost. "Swap the database for a managed one, without rewriting the app" is replatform.
Global infrastructure
What is it?Geographic locations isolated from one another, each with several Availability Zones. Data does not leave a Region unless you configure it to.Show answer
Regions
If the question cites a data protection law or sovereignty, the first criterion for choosing a Region is compliance.
What is it?One or more data centers with redundant power, networking and connectivity. Every Region has at least three physically separate AZs.Show answer
Availability ZonesAZ
To survive a data center failure, the answer is multi-AZ. To survive losing a whole Region, multi-Region.
What is it?Cache sites in major cities around the world, used by Amazon CloudFront and Route 53 to deliver content with lower latency.Show answer
Edge locationsPoints of presence
"Deliver videos and static files with low latency to users worldwide" points to CloudFront and edge locations.
What is it?Extensions of a Region placed near large metropolitan areas, for workloads that need single-digit millisecond latency.Show answer
Local Zones
Very low latency for users in a specific city with no Region there: Local Zones.
What is it?AWS infrastructure inside the 5G networks of telecom carriers.Show answer
WavelengthAWS Wavelength
The keyword is 5G: ultra-low-latency mobile apps use Wavelength.
What is it?AWS-managed racks and servers installed in your own data center.Show answer
Access
What is it?A web interface to manage most AWS services, also available as a mobile app.Show answer
Management Console
A one-time, visual operation points to the console. For something repeatable, the answer is the CLI, an SDK or IaC.
What is it?A command line tool to control AWS services and automate tasks with scripts.Show answer
CLICommand Line Interface
"Automate tasks with scripts in the terminal" is the AWS CLI.
What is it?Libraries to call AWS services from application code.Show answer
SDKsSoftware Development Kits
"The application needs to write files to S3 from its code": SDK.
What is it?A browser-based terminal opened from the console, already authenticated and with the CLI installed.Show answer
CloudShellAWS CloudShell
"Run CLI commands without installing anything locally": CloudShell.
What is it?Describing infrastructure in versioned files to create it repeatably, with AWS CloudFormation or the AWS CDK.Show answer
Infrastructure as codeIaC
Repeatable processes and identical environments (dev, staging, production) point to IaC.
Architecture
What is it?Running and monitoring systems to deliver value and continually improving processes.Show answer
Operational excellence
Operations automation, runbooks and small, reversible changes belong to operational excellence.
What is it?Protecting data, systems and assets using cloud technologies.Show answer
Security
Least privilege, MFA, encryption and traceability belong to the security pillar.
What is it?Making sure a workload performs its intended function correctly and recovers from failure.Show answer
Reliability
Multi-AZ, tested backups and automatic recovery belong to reliability.
What is it?Using computing resources efficiently and keeping that efficiency as demand changes.Show answer
Performance efficiency
Choosing the right instance type and using managed services to gain performance: performance efficiency.
What is it?Delivering business value at the lowest price point.Show answer
Cost optimization
Rightsizing, Savings Plans and turning off idle resources belong to cost optimization.
What is it?Minimizing the environmental impact of cloud workloads. It is the newest pillar.Show answer
Sustainability
Reducing energy consumption and carbon footprint belongs to sustainability.
What is it?A free console service to review workloads against the best practices of the framework.Show answer
Well-Architected ToolAWS WA Tool
"Review an architecture against AWS best practices": Well-Architected Tool.
Storage
What is it?Object storage designed for 99.999999999% (11 nines) durability. Objects live in
bucketsand are identified by anobject key.Show answerS3Simple Storage Service
Rarely accessed data that still needs immediate retrieval goes to Standard-IA or Glacier Instant Retrieval. Long-term archive, Glacier Deep Archive.
What is it?Persistent block storage volumes attached to EC2 instances within one Availability Zone.Show answer
EBSElastic Block Store
A persistent disk for an EC2 instance: EBS. A temporary, very fast disk: instance store.
What is it?A managed, elastic NFS file system that grows and shrinks as you add and remove files.Show answer
EFSElastic File System
Many Linux instances reading and writing the same files: EFS.
What is it?Fully managed third-party file systems.Show answer
FSxAmazon FSx
Windows file shares (SMB, Active Directory): FSx for Windows File Server.
What is it?A hybrid service that gives on-premises applications access to cloud storage, with a local cache.Show answer
Storage GatewayAWS Storage Gateway
On-premises applications using AWS storage as if it were local: Storage Gateway.
What is it?Centralizes and automates backups across AWS services and hybrid environments.Show answer
What is it?Continuously replicates on-premises or cloud servers to AWS and recovers them within minutes after a disaster.Show answer
Elastic Disaster RecoveryAWS DRS
"Recover servers quickly on AWS with minimal data loss": Elastic Disaster Recovery.
Databases
What is it?A managed relational database with automated backups, patching and high availability.Show answer
RDSRelational Database Service
A relational database without managing servers: RDS. Need access to the database operating system? Then it is EC2.
What is it?An AWS relational database compatible with MySQL and PostgreSQL, built for the cloud.Show answer
AuroraAmazon Aurora
A high-performance, highly available relational database compatible with MySQL or PostgreSQL: Aurora.
What is it?A serverless, fully managed NoSQL key-value and document database.Show answer
What is it?A managed in-memory cache compatible with Valkey, Redis OSS and Memcached.Show answer
ElastiCacheAmazon ElastiCache
An in-memory database to speed up repeated reads: ElastiCache.
What is it?A managed JSON document database compatible with MongoDB.Show answer
DocumentDBAmazon DocumentDB
"Move a MongoDB database to a managed service": DocumentDB.
What is it?A managed graph database for highly connected data.Show answer
NeptuneAmazon Neptune
Relationships between entities (social networks, recommendations): Neptune.
What is it?A columnar data warehouse with massively parallel processing, for analytics at large volume.Show answer
RedshiftAmazon Redshift
Data warehousing and business intelligence over large volumes: Redshift. Day-to-day transactions belong in RDS or Aurora.
What is it?Migrates databases to AWS while the source database stays operational throughout.Show answer
DMSDatabase Migration Service
Migrate a database with minimal downtime: DMS. Changing engines: DMS + SCT.
Compute
What is it?Resizable virtual machines (instances) in the cloud, running Linux, Windows or macOS.Show answer
EC2Elastic Compute Cloud
Match the workload to the family: HPC or batch processing, compute optimized; in-memory database, memory optimized.
What is it?The same server can cost much less depending on how it is bought.Show answer
Purchasing optionsEC2 pricing
Steady, predictable workload: Savings Plans or Reserved. Tolerates interruption: Spot. Short and unpredictable: On-Demand. Per-server licensing: Dedicated Host.
What is it?Adds and removes instances automatically to follow demand.Show answer
Auto ScalingAmazon EC2 Auto Scaling
Elasticity on the exam almost always means Auto Scaling.
What is it?Distributes incoming traffic across multiple targets in one or more Availability Zones.Show answer
ELBElastic Load Balancing
Spread traffic across instances in multiple AZs: ELB, usually together with Auto Scaling.
What is it?Runs code in response to events without provisioning or managing servers (Function as a Service).Show answer
LambdaAWS Lambda
"Run code without servers, only when an event happens": Lambda.
What is it?Services to run and orchestrate containerized applications.Show answer
ContainersECS, EKS, Fargate and ECR
Already on Kubernetes: EKS. Containers without managing servers: Fargate. Storing images: ECR.
What is it?PaaS: you upload the code and the service provisions capacity, load balancing, scaling and monitoring.Show answer
Elastic BeanstalkAWS Elastic Beanstalk
"A developer just wants to upload code without configuring infrastructure": Elastic Beanstalk.
What is it?Virtual servers, databases and networking with a fixed monthly price and simplified setup.Show answer
LightsailAmazon Lightsail
"A simple solution with a predictable monthly cost for a small website": Lightsail.
What is it?Runs batch processing workloads at any scale, provisioning the compute they need.Show answer
Data lakes and analytics
What is it?Serverless, interactive SQL queries directly on data in Amazon S3.Show answer
AthenaAmazon Athena
"Query files in S3 with SQL, without loading them into a database": Athena.
What is it?A managed big data platform for frameworks such as Apache Spark, Hive and Presto.Show answer
What is it?Serverless data integration: discover, prepare and combine data (ETL).Show answer
What is it?Collects, processes and analyzes streaming data in real time.Show answer
KinesisAmazon Kinesis
Real-time data (streaming, clickstream, telemetry): Kinesis.
What is it?Search, observability and log analytics with managed OpenSearch.Show answer
OpenSearch ServiceAmazon OpenSearch Service
Search for websites and log analytics: OpenSearch Service.
What is it?Business intelligence: interactive dashboards and reports from your data.Show answer
Quick SightAmazon Quick Sight
Visualize data in dashboards and reports: Quick Sight.
Management and governance
What is it?Monitoring and observability for resources and applications: metrics, logs, events and alarms.Show answer
CloudWatchAmazon CloudWatch
Performance and alarms: CloudWatch. Who did what: CloudTrail.
What is it?Records API calls and actions in the account: who did what, on which resource and when.Show answer
CloudTrailAWS CloudTrail
"Find out who deleted a resource" or auditing API calls: CloudTrail.
What is it?Continuously records resource configurations and evaluates their compliance against rules.Show answer
ConfigAWS Config
"How was this resource configured last month?" or "is it compliant?": Config.
What is it?Infrastructure as code: describes resources in templates and creates them as stacks.Show answer
CloudFormationAWS CloudFormation
Provision the same infrastructure repeatedly from templates: CloudFormation.
What is it?An operations hub to manage instances and servers on AWS and on premises.Show answer
Systems ManagerAWS Systems Manager
"Apply patches to a fleet of servers" or reach them without SSH: Systems Manager.
What is it?Sets up and governs a multi-account environment following best practices (landing zone).Show answer
Control TowerAWS Control Tower
"Quickly set up a secure, governed multi-account environment": Control Tower.
What is it?Inspects your environment and recommends improvements based on AWS best practices.Show answer
Trusted AdvisorAWS Trusted Advisor
Automatic recommendations on cost, security and limits: Trusted Advisor.
What is it?Shows the status of AWS services and the events affecting your account.Show answer
Health DashboardAWS Health Dashboard
"Know whether an AWS issue is affecting my resources": AWS Health Dashboard.
What is it?Analyzes historical usage with machine learning and recommends the right size for resources.Show answer
Compute OptimizerAWS Compute Optimizer
"Rightsizing recommendations for EC2 instances": Compute Optimizer.
What is it?A catalog of approved IT products (infrastructure templates) that users can deploy on their own.Show answer
Service CatalogAWS Service Catalog
"Let teams deploy only approved resources": Service Catalog.
What is it?Shows and manages the quotas (limits) of every service in one place.Show answer
What is it?Manages software licenses from vendors such as Microsoft, Oracle and SAP, on AWS and on premises.Show answer
License ManagerAWS License Manager
"Track software license usage (BYOL)": License Manager.
Cloud financial management
What is it?Estimates the cost of an architecture before you build it.Show answer
Pricing CalculatorAWS Pricing Calculator
"Estimate the cost before migrating": Pricing Calculator. Analyze what was already spent: Cost Explorer.
What is it?Visualizes, understands and analyzes costs and usage over time.Show answer
Cost ExplorerAWS Cost Explorer
"See the spending trend over recent months and forecast the next ones": Cost Explorer.
What is it?Sets cost and usage budgets and alerts you when actual or forecasted values exceed the threshold.Show answer
What is it?The most detailed cost and usage data set, delivered as files to S3.Show answer
Cost and Usage ReportAWS CUR
The most granular billing report: Cost and Usage Report.
What is it?Key-value labels on resources that let you split the bill by project, team or cost center.Show answer
Cost allocation tags
"Find out how much each department spends": cost allocation tags.
What is it?A discount in exchange for a commitment to an hourly spend (USD/hour) for the contracted term.Show answer
Savings Plans
Compute Savings Plans is the most flexible: it covers any family, Region, EC2, Fargate and Lambda.
What is it?One bill for every account in an organization, paid by the management account.Show answer
Consolidated billingAWS Organizations
Many accounts, one bill and volume discounts: Organizations consolidated billing.
What is it?Network cost depends on the direction and destination of the traffic.Show answer
Data transfer
If a question asks which traffic is not charged, the answer is usually inbound data transfer.
Application integration
What is it?Managed message queues: one component sends, another consumes at its own pace.Show answer
SQSSimple Queue Service
"Decouple components and hold messages until they are processed": SQS.
What is it?Pub/sub messaging: a topic delivers the same message to many subscribers.Show answer
SNSSimple Notification Service
Send alerts by email or SMS, or fan a message out to many systems: SNS.
What is it?A serverless event bus that connects applications through events.Show answer
EventBridgeAmazon EventBridge
Event-driven architecture or reacting to events from AWS services and SaaS: EventBridge.
What is it?Orchestrates services in visual workflows (state machines).Show answer
Step FunctionsAWS Step Functions
Coordinate several steps (e.g. several Lambda functions) in one workflow: Step Functions.
What is it?A managed message broker for Apache ActiveMQ and RabbitMQ.Show answer
Amazon MQ
Move an existing ActiveMQ or RabbitMQ without rewriting the application: Amazon MQ.
Security, identity and compliance
What is it?Controls who can do what in the account: users, groups, roles and policies.Show answer
IAMIdentity and Access Management
Some tasks only the root user can do, such as changing the support plan and closing the account. For everything else, use users or roles with MFA.
What is it?Single sign-on (SSO) to many AWS accounts and applications from one central place.Show answer
IAM Identity CenterAWS IAM Identity Center
"Employees sign in once and reach many accounts": IAM Identity Center.
What is it?Centrally manages many AWS accounts, with governance and consolidated billing.Show answer
OrganizationsAWS Organizations
Prevent accounts from using certain services or Regions: an SCP in Organizations.
What is it?Creates and manages encryption keys used by AWS services and your applications.Show answer
KMSKey Management Service
Encryption at rest with managed keys: KMS. A dedicated HSM: CloudHSM.
What is it?Stores, rotates and retrieves secrets such as database passwords and API keys.Show answer
Secrets ManagerAWS Secrets Manager
Store database credentials with automatic rotation: Secrets Manager.
What is it?Protection against DDoS attacks (Shield) and filtering of malicious web requests (WAF).Show answer
Shield and WAFAWS Shield and AWS WAF
A DDoS attack: Shield. SQL injection or XSS: WAF.
What is it?Continuous threat detection from account, network and DNS logs, using machine learning.Show answer
GuardDutyAmazon GuardDuty
Intelligent threat detection and anomalous behavior: GuardDuty.
What is it?Automated vulnerability management for EC2 instances, container images and Lambda functions.Show answer
InspectorAmazon Inspector
Vulnerabilities in EC2, containers and Lambda: Inspector.
What is it?Discovers and protects sensitive data in Amazon S3 using machine learning.Show answer
What is it?A central view of security posture, bringing together findings from many services.Show answer
Security HubAWS Security Hub
"A single view of security alerts from many services": Security Hub.
What is it?A self-service portal for AWS compliance reports and agreements.Show answer
What is it?Sign-up, sign-in and access control for the users of your web and mobile apps.Show answer
CognitoAmazon Cognito
Sign-in for your app’s customers: Cognito. Employee access to AWS: IAM or Identity Center.
What is it?Investigates the root cause of security findings by building graphs from logs.Show answer
DetectiveAmazon Detective
GuardDuty detects the threat; Detective investigates the root cause.
What is it?Managed Microsoft Active Directory on AWS.Show answer
Directory ServiceAWS Directory Service
"Use Active Directory on AWS without managing domain controllers": Directory Service.
What is it?Shares resources across AWS accounts or within an organization.Show answer
Resource Access ManagerAWS RAM
"Share subnets or a Transit Gateway with other accounts": RAM.
Networking and content delivery
What is it?A logically isolated virtual network under your control: IP ranges, subnets, routes and gateways.Show answer
VPCVirtual Private Cloud
Web server in a public subnet; database in a private subnet.
What is it?Two firewall layers in the VPC: one per instance, the other per subnet.Show answer
Security groups and NACLs
Stateful, per instance: security group. Stateless, per subnet, with deny rules: NACL.
What is it?Encrypted tunnels between your network, or your users, and AWS over the internet.Show answer
VPNAWS Site-to-Site VPN and Client VPN
An encrypted, quick-to-set-up connection over the internet: VPN.
What is it?A dedicated, private network connection between your data center and AWS, bypassing the internet.Show answer
Direct ConnectAWS Direct Connect
A private, dedicated, consistent connection without the internet: Direct Connect.
What is it?A central hub that connects many VPCs and on-premises networks.Show answer
Transit GatewayAWS Transit Gateway
Connect many VPCs and on-premises networks through a central point: Transit Gateway.
What is it?A managed, highly available and scalable DNS service.Show answer
Route 53Amazon Route 53
DNS, domain registration and failover between Regions: Route 53.
What is it?A content delivery network (CDN) that caches at edge locations, close to users.Show answer
What is it?Improves availability and performance by carrying traffic over the AWS global network.Show answer
Global AcceleratorAWS Global Accelerator
Static IPs and routing over the AWS network, without caching: Global Accelerator. With caching: CloudFront.
What is it?Creates, publishes, secures and monitors APIs at any scale; it is the "front door" to the backend.Show answer
API GatewayAmazon API Gateway
Expose Lambda functions as an HTTP API: API Gateway.
What is it?Private connectivity between VPCs and AWS or third-party services, without exposing traffic to the internet.Show answer
PrivateLinkAWS PrivateLink
Reach a service without the internet and without an internet gateway: PrivateLink (VPC endpoint).
AI and machine learning
What is it?A platform to build, train and deploy your own machine learning models.Show answer
SageMaker AIAmazon SageMaker AI
"Build, train and deploy your own ML models": SageMaker AI.
What is it?The AWS generative AI assistant for work and development.Show answer
Amazon Q
"A generative AI assistant that helps developers on AWS": Amazon Q Developer.
What is it?Image and video analysis: objects, faces, text and inappropriate content.Show answer
RekognitionAmazon Rekognition
Images and videos (faces, objects, moderation): Rekognition.
What is it?Extracts text, handwriting, tables and forms from scanned documents.Show answer
TextractAmazon Textract
"Extract data from scanned forms and documents": Textract.
What is it?Natural language processing (NLP) to find meaning in text.Show answer
ComprehendAmazon Comprehend
"Find the sentiment of customer reviews": Comprehend.
What is it?Builds conversational interfaces (chatbots) for voice and text.Show answer
What is it?Turns text into lifelike speech (text-to-speech).Show answer
What is it?Turns speech into text (speech-to-text).Show answer
TranscribeAmazon Transcribe
Speech to text (subtitles, call transcription): Transcribe.
What is it?Neural machine translation of text between languages.Show answer
Migration and transfer
What is it?Builds the business case for migrating by estimating the cost of running the current environment on AWS.Show answer
Migration Evaluator
"Build the business case (TCO) for migrating": Migration Evaluator.
What is it?Collects information about on-premises servers: configuration, usage and dependencies.Show answer
Application Discovery ServiceAWS Application Discovery Service
"Discover servers and dependencies before migrating": Application Discovery Service.
What is it?Migrates servers to AWS lift-and-shift (rehost), with continuous replication.Show answer
Application Migration ServiceAWS MGN
Lift-and-shift of servers: Application Migration Service.
What is it?DMS moves database data; SCT converts the schema when the engine changes.Show answer
DMS and SCTDatabase Migration Service and Schema Conversion Tool
Oracle to Aurora PostgreSQL: SCT converts the schema, DMS moves the data.
What is it?Tracks migration progress in one place. It still appears in the exam guide.Show answer
Migration HubAWS Migration Hub
"Track migration progress on a central dashboard": Migration Hub.
Other in-scope services
What is it?A continuous integration service that compiles code, runs tests and produces packages.Show answer
CodeBuildAWS CodeBuild
"Compile and test code" without managing build servers: CodeBuild.
What is it?Continuous delivery: automates build, test and deploy stages on every change.Show answer
CodePipelineAWS CodePipeline
A CI/CD pipeline from code to production: CodePipeline.
What is it?Traces requests through distributed applications to find bottlenecks and errors.Show answer
X-RayAWS X-Ray
"Trace a request across microservices and find the bottleneck": X-Ray.
What is it?Managed virtual desktops (Desktop as a Service), Windows or Linux.Show answer
WorkSpacesAmazon WorkSpaces
"Give remote employees virtual desktops": WorkSpaces.
What is it?Streams desktop applications to the user’s browser, with nothing to install.Show answer
AppStream 2.0Amazon AppStream 2.0
One application in the browser: AppStream 2.0. A whole desktop: WorkSpaces.
What is it?Secure browser access to internal websites and SaaS applications.Show answer
WorkSpaces Secure BrowserAmazon WorkSpaces Secure Browser
"Secure browser access to internal websites, without a VPN": WorkSpaces Secure Browser.
What is it?Builds, deploys and hosts full-stack web and mobile applications.Show answer
What is it?Securely connects IoT devices to the cloud and routes their messages.Show answer
What is it?A cloud contact center, for voice and chat.Show answer
What is it?High-volume email: transactional, marketing and notifications.Show answer
SESSimple Email Service
Bulk email from the application: SES. Simple email alerts from systems: SNS.
Support
What is it?Included with every account, at no cost.Show answer
What is it?The entry paid plan, with AI-powered assistance and 24/7 access to experts. From US$ 29 per month per account.Show answer
Business Support+
Production workloads that need 24/7 technical support at low cost: Business Support+.
What is it?For business-critical workloads, with a designated TAM (Technical Account Manager). US$ 5,000 per month minimum.Show answer
Enterprise
If the question mentions a designated TAM or a 15-minute response, the plan is Enterprise.
What is it?The highest tier: 24/7 monitored operations and incident management engineers.Show answer
Unified Operations
A 5-minute response and 24/7 workload monitoring: Unified Operations.
What is it?Developer, Business and Enterprise On-Ramp end on January 1, 2027.Show answer
Plans being retired
Older material mentions Developer and Enterprise On-Ramp. Always check the latest exam guide.
What is it?Where to find answers and documentation without opening a support case.Show answer
Technical resources
AWS resources used for spam or attacks: report it to the Trust & Safety team.
What is it?The partner network, the software catalog and professional help from AWS itself.Show answer
Partners and Marketplace
Buy third-party software ready for AWS: Marketplace. Help to migrate: an APN partner or Professional Services.