A guide to AWS Cloud Practitioner Exam
Tags: aws, cloud, exam, certification
Published: 2020-06-16 04:19:39

---
title: A guide to AWS Cloud Practitioner Exam
published: true
description: This is simple guide that will help you pass your cloud practitioner exam as this has everything you need to know.
tags: aws,cloud,exam,certification
---

>

- [AWS Cloud Practioner](#aws-cloud-practioner)
- [Where you can take this exam ?](#where-you-can-take-this-exam-)
- [Exam Guide](#exam-guide)
- [What is Cloud Computing](#what-is-cloud-computing)
- [Benefits of the cloud computing](#benefits-of-the-cloud-computing)
- [Types of Cloud Computing](#types-of-cloud-computing)
- [Cloud Computing Models](#cloud-computing-models)
- [`AWS` Global Infrastructure](#aws-global-infrastructure)
- [Regions `AWS`](#regions-aws)
- [AZs\(Availability Zones\)](#azsavailability-zones)
- [Edge Locations \(Get Data Fast or Upload Data Fast\)](#edge-locations-get-data-fast-or-upload-data-fast)
- [Gov Cloud](#gov-cloud)
- [EC2 Instances](#ec2-instances)
- [AMI \(Amazon Machine Image\)](#ami-amazon-machine-image)
- [AutoScaling](#autoscaling)
- [Elastic Load Balancer `(ELBs)`](#elastic-load-balancer-elbs)
- [S3 Buckets](#s3-buckets)
- [CloudFront `(CDN)`](#cloudfront-cdn)
- [RDS `(Relational Database Service)`](#rds-relational-database-service)
- [AWS Lambda](#aws-lambda)
- [EC2 Pricing Models](#ec2-pricing-models)
    - [On Demand](#on-demand)
    - [Reserved Instances](#reserved-instances)
    - [Spot instances](#spot-instances)
    - [Dedicated](#dedicated)
- [Billing and Pricing](#billing-and-pricing)
    - [AWS Free Services](#aws-free-services)
    - [AWS Support Plan](#aws-support-plan)
    - [AWS MarketPlace](#aws-marketplace)
    - [AWS Trusted Advisor Check](#aws-trusted-advisor-check)
    - [Consolidated Billing](#consolidated-billing)
    - [AWS Cost Explorer](#aws-cost-explorer)
    - [AWS Budgets](#aws-budgets)
    - [TCO Calculator](#tco-calculator)
    - [AWS Landing Zone](#aws-landing-zone)
    - [AWS Resource Groups & Tagging](#aws-resource-groups--tagging)
    - [AWS QuickStart](#aws-quickstart)
    - [AWS Cost and Usage Report](#aws-cost-and-usage-report)
- [AWS Networking](#aws-networking)
- [AWS `Database` Services](#aws-database-services)
- [AWS `Provisioning` Services](#aws-provisioning-services)
- [AWS Compute Services](#aws-compute-services)
- [AWS Storage Services](#aws-storage-services)
- [AWS Business Centric Services](#aws-business-centric-services)
- [AWS Enterprise Integration](#aws-enterprise-integration)
- [AWS Logging Services](#aws-logging-services)
- [Most Common `AWS` Initials](#most-common-aws-initials)
- [AWS Security](#aws-security)
    - [Things Customer should take care of](#things-customer-should-take-care-of)
    - [Things AWS takes care of](#things-aws-takes-care-of)
    - [AWS Compliance Programs](#aws-compliance-programs)
    - [AWS Artifact](#aws-artifact)
    - [AWS Inspector](#aws-inspector)
    - [AWS WAF \(Web Application Firewall\)](#aws-waf-web-application-firewall)
    - [AWS Shield](#aws-shield)
    - [AWS Penetration Testing](#aws-penetration-testing)
    - [Permitted Services](#permitted-services)
    - [Prohibited Services](#prohibited-services)
- [Amazon Guard Duty Service](#amazon-guard-duty-service)
- [KMS \(Key Management System\)](#kms-key-management-system)
    - [Envelope Encryption](#envelope-encryption)
- [Amazon Macie](#amazon-macie)
- [Security Groups VS NACLs\(Network Access Control Lists\)](#security-groups-vs-naclsnetwork-access-control-lists)
- [AWS VPN\(Virtual Private Network\)](#aws-vpnvirtual-private-network)
- [Same Name But Different Services \(Don't Get Confused\)](#same-name-but-different-services-dont-get-confused)
- [AWS Connect Services](#aws-connect-services)
- [Elastic Transcoder VS AWS Elemental MediaConvert](#elastic-transcoder-vs-aws-elemental-mediaconvert)
- [`SNS` vs `SQS`](#sns-vs-sqs)
    - [SNS](#sns)
    - [SQS \(Examples `RabbitMQ`\) - \(think of it as message broker service\)](#sqs-examples-rabbitmq---think-of-it-as-message-broker-service)
    - [NLB vs ALB  vs CLB](#nlb-vs-alb-vs-clb)

<!-- /MarkdownTOC -->


## AWS Cloud Practioner
This certification is mostly used by people to get the understanding of the `AWS` services. 

## Where you can take this exam ?
You can take this exam on Pearson VUE online.

- This cost $100
- 90 mins
- 65 Questions
- 70% passing score
- Valid for 3 years.

## Exam Guide 
This is what exam mostly comprises of 
- Cloud Concepts `28%`.
- Security `24%`
- Technology `36%`
- Billing & Pricing `12%`

We have total of `65` questions and most of them are `mutiple choice` or `multiple response` questions.


## What is Cloud Computing

Its the practice of using a network of remote servers hosted on the internet to store,manage and process data rather using a local server or personal computer.

## Benefits of the cloud computing

- No upfront costs such as paying for server. You can Pay On Demand.
- Economies of sale you can simply save alot of money since there are so many people using the cloud.
* You can scale up or scale down based on your need.
- With few clicks of a button your service is deployed.
- No more maintenance costs.
- Go global in few minutes since there are global regions where cloud servers are hosted.

## Types of Cloud Computing
- `SaaS` --> Software as a Service. Basically a complete product that is ran and managed by the service provider.(Examples: Salesforce,Gmail,GoogleDocs)
- `PaaS` --> Platform as a Service. Focusing on deploying applications without worrying about managing the infrastructure.
(Examples: Heroku,Netlify and etc)
- `IaaS` --> Infrastructure as a Service. The building blocks of the IT. Providing computers access and storage needs and etc.
(Examples: AWS,GCP and Azure).

## Cloud Computing Models
- Cloud (Fully hosted on Cloud such as startups)
- Hybrid (On-Premise and Public Cloud such as Banks)
- On-Premise (On Private Cloud where sensitive data is being stored).

## `AWS` Global Infrastructure
- There over a million active customers using `aws`.
- there are total `69` Availability Zones `22` Geographic Regions around the world.
- `Regions` --> physical location with multiple availabilty zones.
- `Availability Zones(AZ)` --> one or more discrete data locations.(owned by aws)
- `Edge Locations` --> data center owned by trusted partner of `aws`

## Regions `AWS`
- A geographically distinct location with multiple data centers.
- Each region has two `AZs`.
- `US-EAST(North Virginia)` is the largest `AWS` region and services almost always become available first in this region.
- Not all services are available in the all regions.
- `US-EAST-1` is where you see your billing information.


## AZs(Availability Zones)
- Each Region has two AZs.
- An AZ is a data center ran and owned by AWS.
- less than 10ms latency between `AZs`

## Edge Locations (Get Data Fast or Upload Data Fast)
- A data center owned by trusted partner of `AWS` and has direct connection to the `aws` network.
- These location serve requests for `CloudFront` and `Route53`. Requests going to either of these services will be routed to the nearest edge location automatically.
- `S3 Transfer accelaration`  and `API Gateway ` endpoint also use the `AWS Edge Network`.
- This allows for low latency no matter where ever you are located.

## Gov Cloud
An `AWS` service that allows customers to host sensitive Controlled 
`Unclassified Information` or other types of workloads

- Only operated by `US Citizens` or on the `US Soil`.
- Should follow several compliance guidelines.
- [GovCloud](https://aws.amazon.com/govcloud-us/?whats-new-ess.sort-by=item.additionalFields.postDateTime&whats-new-ess.sort-order=desc)


## EC2 Instances
- In order to create a `EC2` instance head over to [AWS Console](https://console.aws.amazon.com).
- Choose `EC2` and follow along. Make sure you select `Amazon Linux 2 AMI` and select the type as `t2.micro` since that is offered with free tier.
- Now follow along and make sure to set IAM role.
- lastly make sure you have billing alerts turned on.
- You can either use `ssh` or `sessions manager` to get into `ec2` instance.
- You can also get to `sessions-manager` by going to `systems manager`.
- `sessions-manager` opens a simple `bash` shell that can help you access your `ec2` instance.

## AMI (Amazon Machine Image)
- You can create an image by going into `ec2` management console and clicking on actions and selecting `image`.
- Basically this creates a copy that allows you launch multiple servers.

## AutoScaling
- This allows you ensure that multiple instances and multiple servers are running.
- This also allows you meet the demand of web traffic.
- In order to configure this its located in `ec2` management console.

## Elastic Load Balancer `(ELBs)` 
- This allows reroute the traffic. especially when doing updates to the application.

## S3 Buckets
- Its usually global and the buckets are usually region specific.
- its a block storage used to store the files.

## CloudFront `(CDN)` 
- CloudFront is basically Cotent Delivery Network. 
- It makes easier for companies to distribute there content.
- Hook it up to S3 Bucket and deliver your content around the world.

## RDS `(Relational Database Service)`
- It's used to setup a relational database (Examples: SQL,PSQL).
- Amazon aurora would be default when setting up this service
- It has auto scaling.

## AWS Lambda
- Serverless framework.
- Allows you to run simple functions you can think of it as cronjobs.

## EC2 Pricing Models
E2 has four different pricing models

### On Demand
- Low Cost and Flexible.
- only charges per hr
- short term 
- good for first time apps or prototypes.
- No upfront payment.

### Reserved Instances
- Good for committed applications.
- Standard savings 75% (Cannot change the RI attributes.)
- Best for long term
- You can schedule to reserve the instances.
- there's a commitment like 1 to 3 year with AWS.
- RI's can be shared between multiple accounts.
- You can even sell your unused instances.

### Spot instances
- You can think of it has a hotel who offers discounts to fill there spots.
- Just like hotel `aws` uses similar approach to maximize the usage of there idle servers.
- There are conditions such as, 
    + Instances can be terminated anytime.
    + If you instance gets terminated you dont get charged for partial hour of usuage.
    + If you terminate an instance you will be charged for any hour that it ran.
- Good for applications feasible for very low usage.
- It provides you 90% savings.

### Dedicated
- Its the most expensive `EC2` instance.
- Its built for tenant customers. Its more useful for large enterprises.
- Its offered both in demand and reserved.

## Billing and Pricing

### AWS Free Services

- IAM `(Identity Access Management)` --> used for creating user roles.
- **Auto Scaling**
- **CloudFormation**
- **Elastic Bean**
- **Opswork**
- **Amplify**
- **AppSync**
- **CodeStar**
- AWS Cost Explorer

**NOTE**: Services in bold are free but they can provision AWS Services to cost money.

### AWS Support Plan
- $0/month - Basic (Support Only by Email).
- $20/month - Developer (Tech Support Via Email _reply within 24hrs_)
    + No Third Party Support.
    + General Guidance only. 
- $100/month - Business (Tech Support Via Chat/Phone _24/7_)
    + Does support third party.
    + Production system down less than 1hr response time (_business downtime_)
- $15000/month - Enterprise (Tech Support Via Chat/Phone _24/7_)
    + Personal Concierge.
    + TAM (Technical Account Manager)
    + Response time less than 15min. (_business downtime_)

### AWS MarketPlace
- A place where you will thousands of software listings from independant software vendors.
- The product is free to use or can have a charge which becomes part of the 
- `AWS` bill.

### AWS Trusted Advisor Check
- This advises customers on `security`,`saving money`,`performance` , `service limits` and `fault tolerance`.
- FREE has 7 trusted Advisor Checks
- Enterprise and Business - All trusted advisor checks.

### Consolidated Billing
- One Master account for all member accounts.
- Cost Explorer tool for visualizing the usage.
- It also offers volume discounts (The more you use the cheaper it gets.)

### AWS Cost Explorer
- Allows you to visualize the  usage of the multiple accounts.

### AWS Budgets
- First two budgets are free of charge.
- Allows you setup alerts when you exceed your limits.
- You can set three types of alerts `Budget`,`Usage` and `instance reservation`
- Alerts supports `EC2`,`RDS`,`RedShift` and `Elastic Cache`.
- You can manage budgets from `AWS Budget Dashboard` or `Budgets API`.
- Get notified through email or ChatBot.

### TCO Calculator
The Total Cost of Ownership calculator allows you show how much can save by shifting to `aws`.

- A tool that allows you build reports for execs to show how much you can save.
- Only for approximation purposes.

### AWS Landing Zone
- Meant for enterprises.
- Automatically provisions and configure new accounts via `Service Catalog template`.
- uses `SSO`.

### AWS Resource Groups & Tagging
- Tags are words or phrases that act as metadata for organizing `AWS` resources.
- Resource Groups are collection of resources that share one or more tag.
- Resource Group can display following details of about a group of resource based on.
    + Metrics
    + Alarms
    + Configuration Settings.

### AWS QuickStart
Prebuilt templates offered by `AWS` or `AWS` partners that helps you deploy popular stacks on `AWS`. This allows to reduce the manual effort.

It's divided into three steps.
- A reference architecture for deployment.
- `AWS CloudFormation` templates that automate and configure the deployment.
- A guide explaining the architecture and implementation in detail.

### AWS Cost and Usage Report
This allows you to generate a detailed report of your `AWS` costs.
You'll get a spreadsheet highlighting the costs.

- Reports are stored in `S3`.
- You can use `ATHENA` to turn this into queryable database.
- `QuickSight` for analyzing.

## AWS Networking
- `Region` -> The geographic location of the network.
- `VPC` -> An isolated space of `aws` where you can launch `aws` resources.
- `AZ` -> the data center of the `aws` resources.
- `Security Groups` -> Acts as a firewall at the instance level.
- `Internet Gateway` -> Enables access to the internet.
- `NACLs` -> acts as a firewall at the subnet level.
- `Route Tables` -> determine where network traffic from your subnets are directed.
- `Subnets` -> A logical partition of an IP network into multiple,smaller network segments.

## AWS `Database` Services
- `DynamoDB` -> NoSQL `key/value` database. (Examples:Cassandra).This is really fast for read and write access.
- `DocumentDB` -> NoSQL Document database that is compatible to `MongoDB`.
- `RDS` -> Relational DataBase Service that supports multiple engines `MySQL`,`Postgres`,`MariaDB`. (Most Popular DB)
- `AuroraDB` -> MySQL (5x fast) and PSQL (3x Fast) fully managed database. (Runs 6 copies of the Database when  used and more expensive DB)
- `Aurora Serverless` -> Only runs when needed.
- `Neptune` -> Graph DataBase.
- `RedShift` -> Columnar Database petabyte warehouse.
- `Elastic Cache` -> Redis or Memecached database.
 
## AWS `Provisioning` Services
- `Elastic BeanStalk` -> Think of it as `Heroku`. Its a service used for deploying and scaling the web applications and services deployed with `Java`,`python`,`c++` and etc (Perfect for deploying WebApps)
- `OpsWork` -> Configuration management service that provides managed instances of `CHEF` and `Puppet`.(It has layers like tier 2 or tier 3)
- `CloudFormation` -> IaaS , Infrastructure as Code `JSON` or `YAML`.
- `AWS QuickStart` -> ready made templates that can launch and configure your aws compute, network, and other services.
- `AWS MarketPlaces` A place where you can buy or sell software or services for `AWS Cloud`.

## AWS Compute Services
- `EC2` -> Elastic Compute Cloud highly configurable server.
- `ECS` -> Elastic Container Service `Docker As Service` highly scalable,high performance and good for microservices.
- `Fargate` -> You don't chose the `ec2` like you might chose in `ECS`. You define and `AWS` will run the service. (Like Lambda since you dont pay for EC2)
- `EKS` -> Kuberenetes as services makes it easy to deploy ,manage and scale.
- `Lambda Serverless`. Just upload code as function and `AWS` will run the code for you.
- `Elastic BeanStalk` -> upload the code and it will do the rest for you. Good for developers who want to just upload there apps.
- `AWS Batch` -> Its for Batch Processing where you can schedule `Batch` jobs.

## AWS Storage Services
- `S3` -> A simple storage service - Object Store (Simply Upload Files).
- `S3 Glacier` -> low cost for storage and good for archiving the data for long term backup.
- `Storage Gateway` -> A hybrid solution from on premisis to cloud for storage.
- `EBS (Elastic Block Storage)` -> A hard drive in cloud you attach to `ec2` instance such as `SSDs`,`HDDS`.
- `EFS (Elastic File Storage)` -> file storage moutable to multiple `EC2` instances at the same time.
- `Snowball` -> A way of moving data from on premise to aws.
    + `Snowball Edge` -> 100 TB (better version and additional features).
    + `SnowMobile` -> Allows to move petabytes of data (DataCenter on Wheels).

## AWS Business Centric Services
- `Amazon Connect` -> Cloud Based call center service you can setup in few minutes and later you can save the calls in s3 for furhter analysis.You can even route calls based on defined rules
- `WorkSpaces` -> Secured managed `virutal desktops`.
- `WorkDocs` -> aws version of sharepoint where you can collaborate and share documents.
- `Chime` -> Think of it as skype where you can do business calls and meetings.
- `WorkMail` -> Managed `aws` email service just like `Microsoft Outlook Exchange` uses `IMAP` Protocol
- `PinPoint` -> For marketing campaigns for targetted sending emails and sms notifications.
- `SES (Simple Email Service)` A cloud based email sending service used to send emails and notifications (Good for webapps that supports sending email notifications and has `HTML` format email option)
- `QuickSight`. Think of it as `QlikSense` or `Tableau` as this allows you to visualize the data.
 
## AWS Enterprise Integration
- `Direct Connect` -> A dedicated Gigabit connection from on premise to aws.
- `VPN`
    + `Site to Site` -> Connecting to on premise to aws.
    + `Client Vpn` -> Connecting a client to `AWS` network.
- `Storage Gateway` A hybrid storate service that enables on premise applications to use `AWS` cloud storage.
    + Good for backup.
    + Archiving
    + Disaster Recovery.
    + migration
    + data processing.
- `AD (Active Directory)` An AWS directory service for Microsoft Active Directory also known as AWS Managed Microsoft AD - Enables your workloads and AWS related resources to use managed `AD` in aws cloud.

## AWS Logging Services
- `CloudTrail` -> a logging service that logs all the `api calls` (SDK,CLIs) between `AWS` services.
    + Who created the service.
    + Who spun up the `EC2` instance.
    + Who launched sagemaker notebook
    + Detects developer misconfigurations.
    + Detects Malicious Activity.
    + Automates responses.

- `CloudWatch` A collection of multiple services. Its more like a storage solution for all the logs.
    + Stores all types of the logs.
    + `CloudWatch Metrics` -> timeseries data of logs.
    + `CloudWatch Events` -> trigger event based on a condition.(Taking the snapshot of the server)
    + `CloudWatch Alarms` -> trigger notifications based on metrics.
    + `CloudWatch Dashboard` -> create visualizations based on metrics.

## Most Common `AWS` Initials
- `IAM`:Identity Access Management.
- `S3`: Simple Storage
- `SWF`: Simple Workflow Service.
- `SNS`: Simple Notification System.
- `SQS`: Simple Queue Service.
- `SES`: Simple Email Service.
- `SSM`: Simple Systems Manager.
- `RDS`: Relations DataBase Service.
- `VPC`: Virtual Private Cloud.
- `VPN`: Virtual Private Network.
- `CFN`: Cloud Formation
- `WAF`: Web Application Firewall.
- `MQ`: Amazon ActiveMQ.
- `ASG`: AutoScaling Groups.
- `TAM`: Technical Account Manager.
- `ELB`: Elastic Load Balancer.
- `ALB`: Application Load Balancer.
- `NLB`: Network Load Balancer.
- `EC2`: Elastic Cloud Compute .
- `ECS`: Elastic Container Service.
- `ECR`: Elastic Container Repository.
- `EBS`: Elastic Block Storage.
- `ELF`: Elastic File Storage.
- `EMR`: Elastic MapReduce.
- `EB`: Elastic Beanstalk.
- `ES`: Elastic Search.
- `EKS`: Elastic Kubernetes Service.
- `MKS`: Managed Kafka Service.
- `IoT`: Internet of Things.
- `RI`: Reserved Instances. 

## AWS Security

In the `Shared Responsibility Model` the customer is responsible for the security of the cloud such as securing the data and using the right configuration.
and anything the customer can't touch or get access is secured by aws. Such as Hardward,Operation of Managed Services and Global Infrastructure.

### Things Customer should take care of
- IAM
- Customer Data
- OS,Network and Firewall Configs.
- Maintaining Encryption Protocols.

### Things AWS takes care of
- Software
- Hardware
- Services that `aws` provides.

### AWS Compliance Programs
A set of internal policies and procedures of a company to comply with rules and regulations or to uphold reputation.

**two most popular ones**

- HIPPA
- PCI (Payment Card Data/You can readmore by googling it)

- [ReadMore Here](https://aws.amazon.com/compliance/)

### AWS Artifact
A no cost, self service portal for on demand access to AWS compliance reports.

### AWS Inspector
AWS inspector is a tool that runs a security benchmarks against specific EC2 instances. The most popular one is run by `CIS (Center for Internet Security)` which has `699` benchmarks.It can even inspect the network to check if there are any ports are open and running.

### AWS WAF (Web Application Firewall)
It allows you protect your web application against the most common exploits.
You can write your own rules that will allow the traffic based on the contents of `HTTP` requests. You can  use `ruleset` from `AWS` trusted secuirty partner. It can be either attached to `CloudFront` or `Application Load Balance (ALB)`.

Most Common Attacks Include
- `Injection`
- `Broken Authentication`
- `Sensitive Data Exposure`
- `XML External Entities XXE`
- `Broken Access Control`
- `Security Misconfigurations`
- `XSS Cross Site Scripting`
- `Insecure Deserialization`
- `Using Components with known Vulnerabilities`
- `Insufficient logging and Monitoring`

### AWS Shield
A managed `DDOS(Distributed Denial of Service)` protection service that safeguards applications running on aws.

All AWS customers benefit from the automatic protections of AWS shield standard at no charge.

When you route your traffic through `ROUTE53` or `CloudFront` you are using `AWS Shield`.

Protects you against `Layer3`,`Layer4`, and `Layer7` attacks
- 7 Application
- 4 Transport
- 3 Network

There's also a paid tier known as `Shield Advance` and that costs `$3000/Year`(upfront or Commitment).
It gives you extra protection with `24/7` support and its available on 
- Amazon Route 53
- Amazon CloudFront
- ELB
- AWS Global Accelarator
- Elastic IP(Amazon Elastic Compute Cloud and Netword and Load Balancer).

### AWS Penetration Testing
An authorized service that allows you simulate a cyber attack on a computer system, performed to evaluate the security of the system.

### Permitted Services
- EC2 Instances,NAT Gateways, and ELB.
- RDS
- CloudFront
- Aurora
- API Gateways
- AWS Lambda and Lambda@Edge function
- LightSail resources.

### Prohibited Services
- DNS zone walking via Amazon Route 53 Hosted Zones.
- DoS(Denial Of Service),DDoS,Simulated DoS,Simulated DDoS.
- Port flooding
- Protocol flooding
- Request flooding

## Amazon Guard Duty Service

`IDS`: Intrustion Detection System

`IPS`: Intrustion Protection System

A device or software that monnitors a network or systems for malicious activity or policy violations.

`Guard Duty` is a threat detection service that continuously monitors for the malicious,suspicious activity and unauthorized behavior. It uses machine learning ty8111o analyze following AWS logs.

- CloudTrail Logs.
- VPC Flow Logs
- DNS logs.

It will alert you of the findings which you can automate an incident response via `CloudWatch` Events or 3rd Party Software.

## KMS (Key Management System)

A managed service that makes it easy for you to create or control the encryption keys used to encrypt that data.
- `KMS` is a multi-tenant HSM (Hardware Security Model).
- Many AWS services are intergrated to use `KMS` to encrypt your data with simple checkbox.
- `KMS` uses Envelope Encryption.

### Envelope Encryption
When you encrypt your data, your data is protect but you have to protect your encryption key. When you encrypt your data key with master key as an additional layer of security. [READMORE](https://lobster1234.github.io/2017/09/29/aws-kms-envelope-encryption/)

## Amazon Macie
Macie is fully managed service that continuously monitors `S3 data access` activity for anomalies and generates detailed alerts when it detects risk of unqthorized access or inadvertent data leaks.

It uses machine learning to analyze `CloudTrail` logs.

It provides you with following alerts.

- Anonymized Access.
- Config Compliance
- Credential loss
- Data Compliance
- File Hosting
- Identity Enumeration
- Information Loss
- Location Anomaly
- Open Permisson
- Privilege Escalation
- Ransomware
- Service Disruption
- Suspiscious Activity

## Security Groups VS NACLs(Network Access Control Lists)

<table>
    <thead>
        <tr>
            <th>Security Groups</th>
            <th> Network Access Control Lists (NACLs)</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>Acts as a firewall at the instance level. </td>
            <td>Acts as a firewall at the subnet level</td>
        </tr>
        <tr>
            <td>Implicitly denies all traffic. You create Allow rules (For Example allow an `EC2` Instance to access `port 22`)</td>
            <td>You create `allow` and `deny` rules </td>
        </tr>
    </tbody>
</table>



## AWS VPN(Virtual Private Network)

It allows you create a secure and private tunnel from your network or device to the aws global network.

**AWS Site-to-Site VPN** : Securely connect to on premises network or branch office site to VPC.
**AWS Client VPN:** Securely connect users to AWS or on premises networks.

## Same Name But Different Services (Don't Get Confused)
- `CloudFormation`: IaaS (Infrastructure as a Service) used to setup template scripting (`YAML`,`JSON`).
- `CloudTrail`: logs all the `api` calls between `aws-services` (who to blame).
- `CloudFront`:  CDN(Content Delivery Network),It is used to distribute the content (Such as videos,static assets and etc).
- `CloudWatch`: a collection of multiple services
- `CloudSearch`: search engine for your site (Ecommerce).

## AWS Connect Services
- `Direct Connect`: A dedicated fiber optics connections from data center to AWS.
Lets say an enterprise want a direct connection from there on premise datacenter to aws they might use this service to connect to AWS. 
If you want to add extra layer of security you might need a `vpn` connection.

- `Amazon Connect`: Call Center Service.

- `Media Connect`: A new version of Elastic Transcoder, Converts videos to different formats.

Lets say you have 1000 videos and you need to transcode them into different formats then this might be a useful service. You can even add watermarks and insert intro infront of every video.

## Elastic Transcoder VS AWS Elemental MediaConvert

<table>
<thead>
  <tr>
    <th>Elastic Transcoder `OldWay`</th>
    <th>AWS Elemental MediaConvert `NewWay`<br></th>
  </tr>
</thead>
<tbody>
  <tr>
    <td>Transcodes videos to <br> streaming formats</td>
    <td>Transcodes videos to<br>streaming formats<br></td>
  </tr>
  <tr>
    <td></td>
    <td>Overlay images</td>
  </tr>
  <tr>
    <td></td>
    <td>Insert Video Clips</td>
  </tr>
  <tr>
    <td></td>
    <td>Extract captions data</td>
  </tr>
  <tr>
    <td></td>
    <td>Better and Robust UI</td>
  </tr>
</tbody>
</table>

## `SNS` vs `SQS`

They Both Connect Apps via Messages.

### SNS
- It uses `PubSub` model which is also known as publisher subscriber model.
- It sends notifications to subscribers via protocols such as `HTTP`,`Email` `SQS` and `SMS`.
- It is generally used for sending `plaintext` emails which is triggered via other `aws` services. The best example can be billing alerts.
- Can retry sending in case of failure for `HTTPS`.
- Its good for `webhooks`,internal emails and triggering lambda functions.

### SQS (Examples `RabbitMQ`) - (think of it as message broker service)

**Queue Up Messages, Guaranteed Delivery**
- It places messages into a queue and applications pull queue using `AWS SDK`.
- It can retain a message for up to 14 days.
- Can send them in sequential order or parallel.
- Can ensure only one message is sent.
- Can ensure messages are delivered at least once.
- Really good for delayed tasks,queueing up emails.

You can readmore about this [here](https://stackoverflow.com/questions/13681213/what-is-the-difference-between-amazon-sns-and-amazon-sqs)

### NLB vs ALB  vs CLB

<table>
<thead>
  <tr>
    <th>Application</th>
    <th>Network</th>
    <th>Classic</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><code>Layer 7</code> Requests</td>
    <td><code>Layer 4</code> IP protocol data<br></td>
    <td><code>Layer 4</code> and <code>Layer 7</code></td>
  </tr>
  <tr>
    <td><code>HTTPS</code> and <code>HTTP</code> traffic</td>
    <td><code>TCP</code> and <code>TLS</code> traffic where extreme<br>performance is required (Example: Netflix)<br></td>
    <td>Intended for applications<br>that were built within the <br><br><code>EC2 Classic network</code><br></td>
  </tr>
  <tr>
    <td>**Routing Rules**,more usability <br><br>from one load balancer<br></td>
    <td>Capable of handling millions of requests<br>per second while maintaining `ultra-low-latencies`<br></td>
    <td>Doesn't use Target Groups</td>
  </tr>
  <tr>
    <td>Can attach WAF(WebApp Firewall)</td>
    <td>Optimized for `sudden and volatile` traffic patterns<br>while using a single static IP address per AZ<br></td>
    <td></td>
  </tr>
</tbody>
</table>

**Can Attach `ACM (Amazon Certification Manager) SSL Manager`**


---------

Anyways this all you need to know for your `AWS Cloud Practitioner` Exam and I hope you found these helpful.


I am always available through [twitter](https://twitter.com/muhammad_o7)
and [email](mailto:muhammadraza0047@gmail.com)

Originally Posted [here](https://knowledge-book-six.now.sh/2020/06/05/aws-notes/)