AWS Cloud Practitioner Syllabus

Compare Security Groups and Network ACLs in a VPC.

Security Groups are stateful, operate at the instance level, and support allow rules only. Network ACLs are stateless, operate at the subnet level, and support both allow and deny rules. Return traffic must be explicitly allowed for stateless NACLs.

What is Amazon Route 53?

Route 53 is AWS's highly available and scalable Domain Name System (DNS) web service that performs domain registration, DNS routing, and health checking, with routing policies such as simple, weighted, latency, failover, and geolocation.

What is the difference between an Internet Gateway and a NAT Gateway?

An Internet Gateway lets resources in public subnets communicate bidirectionally with the internet. A NAT Gateway lets instances in private subnets initiate outbound internet traffic while blocking inbound connections from the internet.

What does Amazon CloudFront do and what is it categorized as?

CloudFront is a Content Delivery Network (CDN) that caches content at global edge locations to reduce latency, and it also provides DDoS protection when combined with AWS Shield.

What is AWS Direct Connect used for?

Direct Connect establishes a dedicated private network connection from your on-premises data center to AWS, providing consistent bandwidth and lower latency than an internet-based VPN connection.

What are the four main components/entities in AWS IAM?

Users (individual identities), Groups (collections of users), Roles (temporary credentials assumed by users/services/resources), and Policies (JSON documents that define permissions).

What is the principle of least privilege in IAM and what is the default permission stance?

Grant only the permissions required to perform a task. By default, IAM denies all actions (implicit deny); access must be explicitly allowed, and an explicit deny always overrides any allow.

What is the difference between an IAM user and an IAM role?

An IAM user has permanent long-term credentials for a specific person or application. An IAM role has no long-term credentials and provides temporary security credentials that trusted entities (users, services, or accounts) assume when needed.

What is AWS MFA and why is it recommended for the root user?

Multi-Factor Authentication adds a second verification factor (a one-time code) beyond the password. AWS recommends enabling MFA on the root user and not using the root account for daily tasks, because the root user has unrestricted access.

What is AWS KMS and what does it manage?

AWS Key Management Service is a managed service to create and control cryptographic keys (KMS keys/CMKs) used to encrypt data across AWS services, integrated with CloudTrail for auditing key usage.

What is the difference between encryption in transit and encryption at rest?

Encryption in transit protects data as it moves over networks (e.g., TLS/SSL). Encryption at rest protects stored data on disk (e.g., S3 SSE, EBS encryption via KMS). Both are customer responsibilities for data protection.

What AWS service protects web applications from common web exploits like SQL injection and XSS?

AWS WAF (Web Application Firewall) filters and monitors HTTP/HTTPS requests using rules, and can be deployed with CloudFront, Application Load Balancer, or API Gateway.

What is the difference between AWS Shield Standard and AWS Shield Advanced?

Shield Standard provides free automatic protection against common network/transport-layer DDoS attacks. Shield Advanced is a paid tier adding enhanced protection, 24/7 DDoS Response Team access, and cost protection against usage spikes from attacks.

What is AWS Artifact used for?

AWS Artifact is a self-service portal for on-demand access to AWS compliance reports and documents (such as SOC reports, PCI, and ISO certifications) and for reviewing/accepting AWS agreements.

What is AWS Organizations and one key governance feature it provides?

AWS Organizations centrally manages multiple AWS accounts, enabling consolidated billing and Service Control Policies (SCPs) that set permission guardrails across all accounts in an organizational unit.

What compliance frameworks/certifications does AWS support, and where do you find them?

AWS supports frameworks like PCI DSS, HIPAA, SOC 1/2/3, ISO 27001, FedRAMP, and GDPR. Reports and attestations are available through AWS Artifact; scope is verified in AWS documentation and Compliance pages.

What is Amazon CloudWatch and what three main data types does it collect?

CloudWatch is a monitoring and observability service that collects metrics (performance data), logs, and events/alarms, enabling dashboards, alarms, and automated actions based on thresholds.

What is the key difference between Amazon CloudWatch and AWS CloudTrail?

CloudWatch monitors performance and operational health (what your resources are doing). CloudTrail records API activity and account governance/audit logs (who did what, when, and from where).

What does AWS X-Ray provide?

AWS X-Ray helps developers analyze and debug distributed applications (especially microservices/serverless) by tracing requests end-to-end, identifying bottlenecks, latency, and errors across services.

What is AWS CloudFormation and what concept does it enable?

CloudFormation enables Infrastructure as Code: you define AWS resources in a JSON/YAML template, and CloudFormation provisions and manages them as a repeatable, version-controlled stack.

What is AWS Systems Manager used for?

AWS Systems Manager provides operational management and automation for AWS and on-premises resources, including Parameter Store for configuration/secrets, patch management, run command, and session management.

What is the difference between AWS Config and AWS CloudTrail?

AWS Config records and evaluates the configuration state and changes of resources over time (compliance/drift). CloudTrail records the API calls/actions taken. Config answers 'what does it look like now/then'; CloudTrail answers 'who changed it'.

Name the four AWS developer 'Code' services and their functions.

CodeCommit (managed Git source control), CodeBuild (compile/test builds), CodeDeploy (automated deployments), and CodePipeline (orchestrates the CI/CD pipeline). CodeStar/CodeCatalyst tie them together into a project.

What is the AWS CLI and how does it differ from an SDK?

The AWS Command Line Interface is a unified tool to manage AWS services from a terminal via commands. An SDK (Software Development Kit) provides language-specific libraries (Python, Java, JavaScript, etc.) to call AWS APIs from within application code.

What is AWS Elastic Beanstalk?

Elastic Beanstalk is a PaaS that automatically handles deployment, capacity provisioning, load balancing, and scaling for web applications; you upload code and it manages the underlying EC2, ELB, and Auto Scaling resources.

What is Amazon EMR and what is it used for?

Amazon EMR (Elastic MapReduce) is a managed big-data platform for processing vast datasets using open-source frameworks such as Apache Spark, Hadoop, Hive, and Presto, commonly for ETL and large-scale data processing.

What is the role of Amazon Kinesis in data processing?

Amazon Kinesis collects, processes, and analyzes real-time streaming data (video, logs, clickstreams, IoT). Kinesis Data Streams ingests streams, and Kinesis Data Firehose loads streams into destinations like S3 or Redshift.

What is Amazon Athena?

Amazon Athena is a serverless interactive query service that lets you analyze data directly in Amazon S3 using standard SQL, charging per amount of data scanned with no infrastructure to manage.

What is AWS Glue used for in data analytics?

AWS Glue is a serverless ETL (extract, transform, load) service that discovers, catalogs, cleans, and transforms data, and it maintains the Glue Data Catalog used by services like Athena and Redshift Spectrum.

Match these AWS AI/ML services to their function: Rekognition, Comprehend, Polly, Transcribe, Translate.

Rekognition = image/video analysis; Comprehend = natural language processing/sentiment; Polly = text-to-speech; Transcribe = speech-to-text; Translate = language translation.

What is Amazon SageMaker?

Amazon SageMaker is a fully managed service to build, train, tune, and deploy machine learning models at scale, covering the entire ML workflow from data labeling to hosted inference endpoints.

What is the AWS Database Migration Service (DMS) and its typical companion tool?

AWS DMS migrates databases to AWS with minimal downtime, supporting homogeneous and heterogeneous migrations while the source stays operational. The AWS Schema Conversion Tool (SCT) converts the schema/code when the source and target engines differ.