AWS Certified Cloud Practitioner (CRWT) flashcards
AWS CRWT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared Responsibility Model
- AWS secures the cloud infrastructure, while customers secure what they put in the cloud, including data, IAM, guest OS, and encryption settings.
- IAM Policy Evaluation Logic
- Explicit deny overrides any allow; explicit allow grants access; otherwise the request is implicitly denied. Permissions boundaries and SCPs limit but do not grant permissions.
- Availability Zone
- One or more discrete data centers with redundant power, networking, and connectivity within an AWS Region, isolated from failures in other Availability Zones.
- AWS Region
- A geographic area containing multiple, isolated Availability Zones. Regions are independent and data does not replicate across Regions unless you configure it.
- Elasticity
- The ability to automatically acquire resources as demand increases and release them when demand decreases, matching capacity to workload needs.
- Well-Architected Framework Pillars
- Six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. They guide design reviews of cloud workloads.
- AWS Cloud Adoption Framework
- A guidance framework with six perspectives: Business, People, Governance, Platform, Security, and Operations, used to plan cloud adoption.
- Hybrid Cloud
- A deployment model that integrates on-premises infrastructure with AWS services, often using AWS Direct Connect, Site-to-Site VPN, or AWS Outposts.
- Amazon EC2
- A web service that provides resizable compute capacity in the cloud as virtual servers called instances, with a choice of instance families and purchasing options.
- AWS Lambda
- A serverless compute service that runs code in response to events, scales automatically, and bills per request and per GB-second, with a 15-minute maximum timeout.
- Amazon S3
- Object storage offering 11 nines of durability, with storage classes such as Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, and Glacier tiers for different access patterns.
- Amazon VPC
- A logically isolated virtual network in AWS where you define subnets, route tables, internet gateways, security groups, and network ACLs for your resources.
- Security Group
- A stateful virtual firewall at the instance level that controls inbound and outbound traffic by allow rules only; return traffic is automatically permitted.
- Network ACL
- A stateless subnet-level firewall that evaluates allow and deny rules in numbered order for both inbound and outbound traffic.
- AWS KMS
- A managed service for creating and controlling encryption keys used to encrypt data across AWS services, with AWS managed, customer managed, and AWS owned key types.
- AWS CloudTrail
- A service that records AWS API calls and account activity for auditing, compliance, and operational troubleshooting across accounts and Regions.
- AWS Config
- A service that records resource configuration changes over time, evaluates them against rules, and supports compliance auditing and remediation.
- Amazon GuardDuty
- A threat detection service that continuously monitors accounts and workloads for malicious or unauthorized behavior using machine learning and threat intelligence.
- AWS Artifact
- A self-service portal providing on-demand access to AWS compliance reports, such as SOC and ISO certifications, and to agreements like the BAA.
- AWS WAF
- A web application firewall that filters HTTP and HTTPS requests at Layer 7 using rules to block common exploits such as SQL injection and cross-site scripting.
- Amazon RDS
- A managed relational database service supporting MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora, handling backups, patching, and replication.
- Amazon DynamoDB
- A fully managed NoSQL key-value and document database delivering single-digit millisecond latency at any scale, with optional DAX in-memory caching.
- Amazon CloudFront
- A global content delivery network that caches content at edge locations to reduce latency, with origins such as S3 buckets, EC2 instances, or load balancers.
- Elastic Load Balancing
- A service that distributes incoming traffic across targets. Types include Application (Layer 7), Network (Layer 4), Gateway (Layer 3), and Classic (legacy).
- AWS Direct Connect
- A dedicated private network connection from on-premises to AWS that can reduce network costs and increase bandwidth consistency compared with internet-based connections.
- Amazon Route 53
- A scalable DNS web service that also provides domain registration and health checking with routing policies such as latency, geolocation, and failover.
- AWS Pricing Fundamentals
- Pay-as-you-go for what you use, save when you commit to reserved capacity, and pay less per unit as usage grows through volume and tiered pricing.
- EC2 Reserved Instances
- A purchasing option with a 1- or 3-year commitment in exchange for a significant discount over On-Demand pricing, with Standard and Convertible types.
- Savings Plans
- Flexible pricing models committing to a consistent amount of usage for 1 or 3 years. Compute Savings Plans apply across EC2, Fargate, and Lambda; EC2 Instance Savings Plans are family-specific.
- EC2 Spot Instances
- Unused EC2 capacity offered at discounts up to 90% off On-Demand. Spot can be interrupted with a two-minute warning, so use it for fault-tolerant workloads.
- Consolidated Billing
- An AWS Organizations feature that combines usage from member accounts into one bill, enabling volume discounts and a single payer account.
- AWS Budgets
- A tool to set custom cost and usage budgets with alerts when thresholds are exceeded, helping monitor and control spending proactively.