AWS / Cloud Computing MCQ

Explanation

Cloud computing provides on-demand access to computing resources over the internet, allowing users to pay only for what they use instead of owning physical hardware.

Explanation

AWS stands for Amazon Web Services, a comprehensive cloud computing platform offered by Amazon providing a wide range of infrastructure and application services.

Explanation

Amazon EC2 (Elastic Compute Cloud) provides scalable virtual machines (instances) that you can configure and use to run applications in the cloud.

Explanation

Amazon S3 (Simple Storage Service) is a scalable object storage service used for storing files, backups, static website assets, and more, organized into "buckets".

Explanation

An AWS Region is a geographic area (e.g. "us-east-1") composed of multiple Availability Zones, each consisting of one or more discrete data centers.

Explanation

Availability Zones are isolated locations within a Region; deploying resources across multiple AZs increases fault tolerance, since a failure in one AZ shouldn't affect others.

Explanation

IAM (Identity and Access Management) lets you securely manage access to AWS services and resources by creating users, groups, roles, and policies that define permissions.

Explanation

The root user has unrestricted access to the entire AWS account, including billing. AWS recommends securing it (e.g. with MFA) and creating individual IAM users with limited permissions for everyday tasks.

Explanation

Horizontal scaling ("scaling out") adds more machines/instances, while vertical scaling ("scaling up") increases the capacity of a single machine, such as upgrading to a larger EC2 instance type.

Explanation

Amazon RDS (Relational Database Service) manages common database administration tasks like backups, patching, and scaling for engines such as MySQL, PostgreSQL, MariaDB, and SQL Server.

Explanation

Pay-as-you-go pricing means you are billed based on actual usage (e.g. compute hours, storage used), allowing costs to scale with demand rather than requiring large upfront capital expenditure.

Explanation

A VPC lets you define your own isolated network environment in AWS, including IP addressing, subnets, route tables, and gateways, giving you control similar to a traditional on-premises network.

Explanation

Public clouds (like AWS, Azure, GCP) provide shared infrastructure to many customers, while private clouds are dedicated to a single organization for greater control, often used for compliance or security requirements.

Explanation

IaaS provides fundamental compute, storage, and networking resources on-demand, with the user responsible for managing the OS, middleware, and applications (e.g. AWS EC2, Azure VMs).

Explanation

PaaS (e.g. AWS Elastic Beanstalk, Heroku) abstracts away infrastructure management, letting developers focus on writing and deploying code while the platform handles servers, scaling, and patching.

Explanation

SaaS delivers fully functional software applications over the internet (e.g. Gmail, Salesforce), with the provider managing all underlying infrastructure, platforms, and the application itself.

Explanation

CloudFront is AWS's CDN, caching content (web pages, images, videos) at edge locations close to users to reduce latency and improve performance.

Explanation

ELB automatically distributes incoming traffic across multiple targets in one or more Availability Zones, helping ensure no single instance is overwhelmed and improving fault tolerance.

Explanation

Amazon EBS (Elastic Block Store) provides durable, persistent block storage volumes that can be attached to EC2 instances, similar to a virtual hard drive.

Explanation

Route 53 is AWS's DNS service, used for domain registration, DNS routing, and health checking, helping route end-user requests to infrastructure running in AWS or elsewhere.

Explanation

Tags help organize and categorize AWS resources, useful for cost tracking, automation, and applying access control policies based on tag values.

Explanation

Despite the name, servers are still involved — but the provider fully manages provisioning, scaling, and maintenance, so developers can focus purely on code (e.g. AWS Lambda).

Explanation

AWS Lambda lets you run code in response to triggers (like HTTP requests or file uploads) without managing servers, automatically scaling and charging only for compute time consumed.

Explanation

Security Groups act as virtual firewalls at the instance level, with rules specifying allowed inbound and outbound traffic based on protocol, port, and source/destination.

Explanation

The AWS Free Tier provides limited free usage (e.g. certain EC2 hours, S3 storage) for 12 months or always-free amounts for some services, allowing new users to explore AWS without immediate cost.

Explanation

Elasticity refers to a system's ability to dynamically acquire or release resources to match current demand, helping avoid both over-provisioning and under-provisioning.

Explanation

CloudWatch collects and tracks metrics, monitors log files, and sets alarms to automatically react to changes in AWS resources, helping with observability and operational health.

Explanation

Subnets divide a VPC's IP address range into smaller segments, often placed in different Availability Zones, and classified as public (with internet access via an Internet Gateway) or private.

Explanation

Amazon SNS (Simple Notification Service) enables applications to send messages to multiple subscribers (email, SMS, SQS queues, Lambda functions) using a publish/subscribe model.

Explanation

Amazon SQS (Simple Queue Service) lets components of an application send, store, and receive messages asynchronously, helping decouple services so they can scale independently.

Explanation

Under the shared responsibility model, AWS secures the underlying infrastructure (hardware, facilities, virtualization), while customers are responsible for securing their data, applications, and access configurations.

Explanation

An AMI provides the information required to launch an EC2 instance, including the operating system, pre-installed software, and configuration, allowing repeatable instance creation.

Explanation

DynamoDB is a managed NoSQL database designed for high-performance applications needing consistent, single-digit-millisecond latency at any scale, storing data as key-value pairs or documents.

Explanation

An Internet Gateway is a horizontally scaled, redundant component attached to a VPC that allows resources within public subnets to communicate with the internet.

Explanation

On-Demand instances let you pay for compute capacity by the hour or second with no upfront payment or long-term commitment, ideal for unpredictable workloads.

Explanation

Auto Scaling automatically adds or removes EC2 instances according to conditions you define, ensuring you have the right number of instances to handle the current load.

Explanation

S3 offers multiple storage classes optimized for different access patterns and costs — Standard for frequently accessed data, and Glacier variants for low-cost, long-term archival with retrieval times ranging from minutes to hours.

Explanation

CloudFormation lets you define your infrastructure as code in templates, which AWS uses to provision and configure resources consistently and repeatably (Infrastructure as Code).

Explanation

Multi-cloud involves distributing workloads across multiple cloud providers, which can improve resilience and flexibility but adds operational complexity compared to a single-provider approach.

Explanation

EC2 instance type families (e.g. "t" for burstable general purpose, "c" for compute-optimized, "r" for memory-optimized) let you choose hardware specifications matching your workload's needs.

Explanation

Roles provide temporary, assumable credentials ideal for granting permissions to AWS services (like EC2 or Lambda) or for cross-account access, avoiding the need to embed long-term access keys.

Explanation

Security Groups are stateful and apply to instances/ENIs, automatically allowing response traffic, while Network ACLs are stateless subnet-level firewalls that evaluate rules in numbered order and require explicit rules for both inbound and outbound traffic.

Explanation

Amazon ECS (Elastic Container Service) is AWS's native container orchestration platform, letting you deploy containerized applications either on managed EC2 instances or serverless infrastructure via AWS Fargate.

Explanation

With Fargate, AWS manages the underlying compute infrastructure for your containers, so you don't need to provision, patch, or scale EC2 instances — you simply specify resource requirements for your tasks.

Explanation

Bucket policies are attached to the resource (the S3 bucket) and are useful for cross-account access scenarios, while IAM policies are attached to identities (users/roles) and can apply across multiple services.

Explanation

VPC Peering connects two VPCs (in the same or different accounts/regions) so resources can communicate using private IPs, but peering connections are not transitive — each pair must be explicitly connected.

Explanation

A Launch Template specifies what instances should look like (AMI, type, security groups), while the ASG uses it to launch/terminate instances automatically based on scaling policies and desired capacity.

Explanation

CloudTrail records account activity, including who made which API calls, when, and from where, which is essential for security analysis, compliance auditing, and troubleshooting.

Explanation

Stateless applications are easier to scale because any instance can handle any request; stateful applications need mechanisms like sticky sessions or external session stores (e.g. ElastiCache, DynamoDB) to maintain consistency across instances.

Explanation

ElastiCache provides managed Redis or Memcached clusters, used to cache frequently accessed data in memory, significantly reducing latency and database load for read-heavy applications.

Explanation

Cross-Region Replication (CRR) copies objects across buckets in different regions, useful for meeting geographic data residency requirements, reducing latency for global users, or maintaining a disaster recovery copy.

Explanation

Auto Scaling Groups periodically check instance health (EC2 status checks or ELB health checks); unhealthy instances are terminated and replaced automatically to maintain the desired number of healthy instances.

Explanation

KMS provides centralized management of encryption keys used by services like S3, EBS, and RDS to encrypt data at rest, with audit logging via CloudTrail and access controlled through IAM and key policies.

Explanation

Parameter Store provides secure, hierarchical storage for configuration data and secrets, which applications can retrieve at runtime instead of hardcoding sensitive values, with optional encryption via KMS.

Explanation

RDS Multi-AZ deployments maintain a synchronously replicated standby in another AZ; if the primary instance fails, RDS automatically fails over to the standby, minimizing downtime.

Explanation

Multi-AZ focuses on availability via synchronous replication to a standby (not normally readable), while Read Replicas use asynchronous replication and can actively serve read queries to help scale read-heavy workloads.

Explanation

Elastic Beanstalk simplifies deploying and managing applications by handling infrastructure details automatically, while still giving developers the option to access and customize the underlying AWS resources (like EC2, ELB, ASG) if needed.

Explanation

VPC Endpoints (Gateway endpoints for S3/DynamoDB or Interface endpoints via PrivateLink for many other services) enable private connectivity to AWS services, keeping traffic within the AWS network and improving security.

Explanation

A NAT Gateway enables instances in private subnets to access the internet (for software updates, etc.) for outbound connections, while blocking unsolicited inbound connections from the internet.

Explanation

Aurora is AWS's proprietary database engine, compatible with MySQL and PostgreSQL wire protocols, offering up to several times the throughput of standard MySQL with built-in high availability and storage scaling.

Explanation

Reserved Instances offer substantial discounts (up to 70%+) over On-Demand pricing in exchange for a 1- or 3-year commitment, suitable for predictable, steady-state workloads.

Explanation

Spot Instances can be up to 90% cheaper than On-Demand, making them great for fault-tolerant or flexible workloads (like batch processing), but AWS can interrupt them with a two-minute warning when capacity is reclaimed.

Explanation

API Gateway handles tasks like request routing, authorization, throttling, and monitoring for APIs, commonly used as an entry point to trigger Lambda functions or other backend services.

Explanation

EC2 Auto Scaling Groups scale horizontally by launching/terminating instances based on demand; resizing an existing instance's type (vertical scaling) generally requires stopping and changing the instance type manually.

Explanation

AWS Organizations lets enterprises manage multiple AWS accounts centrally, applying Service Control Policies (SCPs) to restrict permissions across accounts and consolidating billing for cost management.

Explanation

Lifecycle policies let you define rules to automatically move objects to cheaper storage classes as they age, or expire (delete) them after a certain time, reducing storage costs without manual intervention.

Explanation

Amazon EFS (Elastic File System) provides a network file system that multiple instances can mount simultaneously, useful for shared content, whereas EBS volumes are generally attached to one instance at a time as block devices.

Explanation

CloudWatch Alarms monitor metrics and change state (e.g. to ALARM) when thresholds are breached, which can trigger automated responses like notifications, Auto Scaling adjustments, or EC2 actions.

Explanation

The Well-Architected Framework provides a consistent approach for evaluating architectures against best practices across multiple pillars, helping identify risks and areas for improvement.

Explanation

Because some AWS services (like SQS or certain event sources) may deliver events more than once, designing Lambda functions to be idempotent ensures repeated processing of the same event doesn't cause issues like duplicate charges or records.

Explanation

GuardDuty analyzes logs (VPC Flow Logs, DNS logs, CloudTrail) to detect suspicious activity such as unusual API calls or potentially compromised instances, alerting security teams to investigate.

Explanation

Synchronous invocations (e.g. via API Gateway) return the function's response directly to the caller, while asynchronous invocations (e.g. from S3 or SNS events) are queued internally, with Lambda handling retries on errors.

Explanation

Trusted Advisor inspects your AWS environment and provides actionable recommendations to help follow best practices, save money, improve performance, and close security gaps.

Explanation

Elastic IPs provide a persistent public IP that can be remapped to a different instance, useful for masking instance failures by quickly remapping the address to a healthy replacement.

Explanation

CDK provides higher-level abstractions in general-purpose programming languages, ultimately generating CloudFormation templates under the hood, combining the benefits of code reuse and type safety with CloudFormation's provisioning engine.

Explanation

Automated backups support restoring a database to any point within the retention window (using backups plus transaction logs), while manual snapshots are explicitly created and retained until the user deletes them, even after instance deletion.

Explanation

The principle of least privilege reduces security risk by ensuring identities have only the permissions they need; broader permissions increase the blast radius if credentials are compromised or misused.

Explanation

Amazon SES (Simple Email Service) lets applications send and receive email reliably at scale, commonly used for transactional emails like order confirmations or password resets.

Explanation

Secrets Manager offers built-in automatic rotation for supported databases and integrates with services to retrieve credentials securely, while Parameter Store is a more general configuration store that can hold secrets but requires custom rotation logic.

Explanation

EventBridge routes events between sources (AWS services, custom apps, SaaS providers) and targets (like Lambda functions) based on rules, forming the backbone of many event-driven serverless architectures.

Explanation

Route 53 failover routing uses health checks to determine endpoint status and automatically shifts DNS answers from a primary to a secondary resource when the primary fails health checks, enabling automated multi-region disaster recovery (subject to DNS TTL propagation delays).

Explanation

Choosing between eventual and strong consistency involves trade-offs between latency/availability and read accuracy; DynamoDB lets you choose "eventually consistent" (cheaper, default) or "strongly consistent" reads, while modern S3 guarantees strong read-after-write consistency.

Explanation

CloudFront focuses on caching and delivering web content (HTTP/HTTPS) closer to users, while Global Accelerator improves availability and performance for various TCP/UDP applications by routing client traffic over AWS's backbone network to the optimal endpoint.

Explanation

Cold starts add latency due to environment setup; choosing lighter runtimes, reducing deployment package size, using Provisioned Concurrency, and minimizing VPC attachment (which historically added ENI setup time) can reduce cold start impact.

Explanation

DynamoDB automatically partitions data using the hash of the partition key to distribute items across storage nodes; a poorly chosen key (e.g. one with low cardinality or skewed access) can create "hot partitions" that limit throughput even if overall table capacity seems sufficient.

Explanation

Flow Logs record connection metadata (the "who, what, when" of traffic) for analysis and troubleshooting, but since they don't capture payload data, they aren't a substitute for deep packet inspection or real-time blocking tools.

Explanation

SCPs act as permission boundaries at the account level — even if an IAM policy grants a permission, an SCP can deny it organization-wide; effective permissions are the intersection of what IAM policies allow and what SCPs do not block.

Explanation

Step Functions define workflows visually as state machines, managing the execution order, error handling, retries, and parallel branches of tasks (often Lambda functions), reducing the need for custom glue code to coordinate complex processes.

Explanation

S3 Object Lock helps meet regulatory requirements for immutable storage; Compliance mode is particularly strict, preventing any user — including the account root — from shortening or removing retention settings once applied.

Explanation

PrivateLink exposes a specific service through an ENI, offering more granular, scalable access without full network connectivity or CIDR conflicts, while VPC Peering links entire networks and requires careful IP address planning since peered VPCs cannot have overlapping CIDR ranges.

Explanation

Transfer Acceleration leverages CloudFront edge locations as entry points, routing data over AWS's optimized backbone network rather than the public internet for the majority of the trip, which can significantly speed up uploads over long distances.

Explanation

Provisioned Concurrency pre-warms execution environments to avoid cold-start latency for latency-sensitive applications, but introduces a cost trade-off since you pay for the reserved, initialized capacity continuously, regardless of actual invocation volume.

Explanation

STS AssumeRole lets a trusted principal obtain temporary credentials for a role in another account; external IDs add an extra layer of verification, commonly used by SaaS providers to ensure they're only assuming roles intended for their specific customer relationship, mitigating confused-deputy attacks.

Explanation

Direct Connect provides a dedicated network link (via a colocation facility) for predictable performance and potentially lower data transfer costs, while VPNs are quicker and cheaper to set up but rely on internet connectivity, making them more variable in latency and throughput.

Explanation

Global Tables use a multi-region, multi-active design — applications can read and write in any participating region with low latency, while changes propagate asynchronously to other regions, meaning replicas are eventually (not immediately) consistent, and conflict resolution uses a "last writer wins" approach.

Explanation

Shield (Standard, included by default, or Advanced for additional cost) defends against volumetric/network-layer DDoS, while WAF inspects application-layer traffic for malicious patterns, allowing custom rules to block specific attack signatures or suspicious request patterns.

Explanation

Without reserved concurrency, a function competes for the shared account-level pool of concurrent executions; setting reserved concurrency carves out a dedicated allocation for that function (protecting it from contention) but also caps how far it can scale, even if the account has spare capacity.

Explanation

Blue-green deployments minimize downtime and risk by keeping the old (blue) environment running until the new (green) one is verified, with traffic cutover achieved through mechanisms like load balancer target swaps or DNS updates, and rollback simply means switching traffic back.

Explanation

CloudTrail is an audit log of API activity, while Config is a configuration management/compliance tool that records resource configuration snapshots and changes, evaluating them against rules (e.g. "is encryption enabled?") — combining both gives a full picture of changes and their compliance impact.

Explanation

Without connection draining, removing an instance (e.g. during a rolling deployment or scale-in) could abruptly cut off active requests; the deregistration delay gives in-flight requests time to complete gracefully before the target is fully removed.