AWS Certified Cloud Practitioner Concept Review

Overview

This chapter covers why companies use the cloud and how they plan the move. You learn the benefits of the AWS Cloud, the six pillars of the AWS Well-Architected Framework, the common migration strategies, and the six perspectives of the AWS Cloud Adoption Framework (AWS CAF). Most questions describe a business situation and ask which benefit, pillar, strategy, or perspective it matches.

The main benefits of the cloud are easy to remember as short phrases. You trade fixed expense for variable expense, so you pay only for what you use. You benefit from economies of scale, stop guessing capacity, increase speed and agility, stop spending money running data centers, and go global in minutes. Elasticity means resources grow and shrink with demand, often automatically.

The Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Reliability is about recovering from failure, and running across multiple Availability Zones is a key way to stay available. Loose coupling, such as using a queue between parts of a system, keeps one failure from stopping everything.

Migration strategies describe what happens to each application. Rehost is lift and shift, replatform makes a few changes such as moving to a managed database, and refactor redesigns the application. Repurchase switches to a new product, retire turns an application off, retain keeps it where it is, and relocate moves VMware workloads as they are. AWS CAF groups planning advice into the Business, People, Governance, Platform, Security, and Operations perspectives.

Overview

This chapter is about who protects what in AWS and which tools help. It covers the shared responsibility model, identity and access with IAM, encryption, and the security services that detect, block, and report problems. Many questions ask whether a task belongs to AWS or the customer, or which security service fits a need.

Under the shared responsibility model, AWS is responsible for security of the cloud, such as data centers, hardware, and the global network. The customer is responsible for security in the cloud, such as its data, who can access it, and settings like security groups. On Amazon EC2 the customer patches the guest operating system, while on managed services such as Amazon RDS and AWS Lambda, AWS handles more of the work. Patch management is a shared control.

IAM is a global service with no additional charge. Use groups to give many users the same permissions, roles to give temporary credentials to applications and other accounts, and policies written in JSON to define permissions. Follow least privilege, protect the root user with MFA, and use it only for tasks that need it. Service control policies in AWS Organizations limit what whole accounts can do.

Several services split up the security work. CloudTrail records API calls, Config tracks resource settings, GuardDuty detects threats, Inspector finds vulnerabilities, Macie finds sensitive data in S3, Detective investigates findings, and Security Hub brings findings together. Shield Standard gives free DDoS protection, Shield Advanced adds more, and AWS WAF blocks harmful web requests. KMS manages encryption keys, Secrets Manager stores and rotates secrets, and AWS Artifact provides AWS compliance reports.

Overview

This chapter is the largest part of the exam. It covers the AWS global infrastructure, ways to access AWS, and the main services for compute, storage, databases, networking, analytics, AI, and application integration. Most questions describe a need in one sentence and ask which service fits.

AWS is built from Regions around the world. Each Region contains multiple isolated Availability Zones, and each Availability Zone is one or more data centers. Edge locations cache content for Amazon CloudFront. Local Zones bring AWS close to large cities, Wavelength Zones sit inside 5G networks, and Outposts puts AWS hardware in your own building. Choose a Region by compliance, latency to users, service availability, and price, because not every service is in every Region.

For compute, Amazon EC2 gives virtual servers, AWS Lambda runs code on events without servers, Fargate runs containers without servers, and Elastic Beanstalk and Lightsail make deployment simple. Elastic Load Balancing spreads traffic and EC2 Auto Scaling adds or removes instances. For storage, Amazon S3 is object storage, Amazon EBS is a block volume for one instance, and Amazon EFS is a shared file system. S3 Glacier Deep Archive is the lowest-cost class for archives.

For databases, Amazon RDS is managed relational, DynamoDB is serverless NoSQL, Redshift is a data warehouse, and ElastiCache is an in-memory cache. Athena queries data in S3 with SQL, Kinesis handles streaming data, and Glue prepares data. SQS queues messages, SNS sends to many subscribers, EventBridge routes events, and Step Functions runs workflows. AI services include Rekognition for images, Textract for documents, Comprehend for text, Transcribe for speech to text, Polly for text to speech, and Bedrock for foundation models.

Overview

This chapter covers how you pay for AWS and where to get help. It includes the EC2 pricing options, the tools for estimating and tracking costs, AWS Organizations consolidated billing, and the main support resources. Questions usually describe a workload or a money question and ask which option or tool fits.

On-Demand Instances have no commitment and suit short or unpredictable work. Spot Instances are the cheapest but can be interrupted, so they suit flexible jobs. Reserved Instances and Savings Plans give lower prices for a 1-year or 3-year commitment, and Compute Savings Plans also cover Lambda and Fargate. Dedicated Hosts give you a whole physical server for licenses tied to sockets or cores, and On-Demand Capacity Reservations hold capacity in an Availability Zone without a long commitment.

Use the AWS Pricing Calculator to estimate costs before you build, AWS Budgets to get alerts when costs go over a limit, and AWS Cost Explorer to study past spending. Cost allocation tags split costs by team or project, and Compute Optimizer and Trusted Advisor point out resources that are too big or idle. Consolidated billing gives one bill for many accounts and combines usage for volume discounts. In general, data coming into AWS is not charged, while data going out is.

For help, AWS re:Post is a community question-and-answer site, AWS Marketplace sells third-party software that runs on AWS, and the AWS Partner Network connects you with partner companies such as consulting firms. The AWS Health Dashboard tells you about AWS events that may affect your resources.