CLF-C02 — frequently asked questions

Tagging requires strict governance and continuous monitoring to ensure all resources are tagged correctly. It adds operational overhead compared to the automatic separation provided by separate accounts.

No. Consolidated billing aggregates payments into one bill, but each linked account retains its own separate detailed invoice and cost breakdown, preserving visibility per business unit.

Program and project management is categorized under the Governance perspective in AWS CAF, which focuses on managing resources and processes rather than direct business value creation.

It focuses on aligning IT with business needs, linking investments to key business results, and leveraging capabilities like data science for decision-making.

Cognito is designed for external customer apps, whereas IAM Identity Center is built for internal workforce management and multi-account access.

It refers to internal employees who need access to corporate AWS accounts, requiring an enterprise-grade identity solution like IAM Identity Center.

Patching is a security responsibility under the shared model. While it saves labor, it is not a primary economic driver like variable pricing or economies of scale.

No, deploying globally affects latency and reach. It does not inherently reduce costs compared to local deployment.

Operational Excellence focuses on people, processes, and tools to support continuous improvement. Reliability focuses on the system's ability to recover from failures and maintain performance.

Look for phrases like 'continuous improvement', 'iterative improvements', 'learning', and 'operating effectively' in the context of processes and procedures.

Yes, Amazon RDS automatically manages the maintenance of the guest operating system, including applying security patches and updates.

It refers to customer responsibilities such as managing data encryption, configuring security groups, and creating IAM policies for access control.

Quick Starts automate deployments of best-practice architectures, often using AWS-native services. While some partners have listings there, AWS Marketplace is the dedicated storefront for buying and licensing third-party software.

No. AWS Security Center (or GuardDuty/Security Hub) are native AWS security management services. They do not provide a mechanism to purchase or install software from external third-party vendors.

Direct Connect connects on-premises to AWS but does not simplify VPC-to-VPC peering. Transit Gateway is needed for multi-VPC hub-and-spoke architecture.

It doesn't replace peering technically, but it simplifies the topology by acting as a central hub, avoiding the need for full-mesh peering connections.

Intelligent-Tiering has retrieval fees for the Archive Access Tier. For known rare access (twice/year), Glacier Instant Retrieval's lower storage rate outweighs these fees.

Yes, Glacier Deep Archive is cheaper for storage, but it has slower retrieval times (minutes to hours). This question implies need for standard access, and Deep Archive wasn't an option.

Cloud native implies using cloud-specific services and architectures exclusively. Since the solution retains on-premises components, it is hybrid, not pure cloud native.

A hybrid cloud architecture integrates at least one public cloud service with existing on-premises infrastructure, allowing data and applications to be shared between them.

Cognito is a customer identity service for web and mobile applications; it authenticates your app's end users with its own user pool credentials rather than signing employees into AWS accounts.

Yes. Identity Center supports external SAML 2.0 and OIDC identity providers as identity sources, which is why employees keep their existing corporate credentials.

Rehost is lift-and-shift with no application changes, so it cannot fix a compatibility defect. The audit already established the CMS will not run in the cloud as-is, so a zero-change move fails.

Repurchase, or drop-and-shop, replaces the unsupported CMS with a cloud-ready or SaaS CMS, so no code is rewritten. AWS's own example of repurchase is moving a CMS to Drupal.

No. Developer Support exposes only the core Trusted Advisor checks; the complete check set begins with Business Support and continues through the Enterprise tiers.

Enterprise On-Ramp does include the full Trusted Advisor checks, but it costs more than Business Support. The question asks for the lowest-cost plan with full checks, which is Business.

Yes. Compute Savings Plans apply to EC2, AWS Lambda, and AWS Fargate usage regardless of instance family, region, OS, or tenancy, which is why they suit a workload moving partly to serverless.

It cuts costs only for a chosen EC2 instance family in a specific region, so any serverless usage from the migration — Lambda or Fargate — receives no discount at all.

Reserved Instances trade a 1- or 3-year commitment for a discount on steady-state usage; they do not reward short, interruptible jobs the way Spot Instances do.

Yes—Spot interruptions include a two-minute warning, and batch jobs that checkpoint can resume, which is exactly the fault-tolerant pattern Spot pricing is designed for.

Availability Zones provide fault tolerance inside a Region, but they do not let you choose the country or geography where the application runs — only the Region choice does that.

AWS Regions are separate geographic areas, so deploying into a chosen Region keeps the application and its data inside that jurisdiction, which is what residency regulations require.

FSx for Lustre is an HPC-oriented file system that uses S3 as a linked data repository or cache for compute workloads; it is not designed to mount an S3 bucket as a general file share over NFS.

The volume gateway serves block storage over iSCSI with S3-backed snapshots, so it never presents NFS or SMB file shares the way the file gateway does.

AWS manages the infrastructure and provides encryption tools such as KMS, but the customer controls whether Aurora clusters and snapshots are encrypted. The shared responsibility model keeps data protection configuration with the company.

AWS KMS supplies and protects the keys, but the company creates or selects the KMS key and enables encryption on the Aurora cluster and its snapshots. Key management permissions and rotation settings remain customer responsibilities.

CloudFront is a CDN that caches content at edge locations to speed delivery to end users, but it still runs over the public internet and offers no dedicated bandwidth or throughput guarantee to AWS.

No. AWS VPN tunnels are encrypted connections carried over the public internet, so latency and throughput vary, while Direct Connect uses a dedicated private link into AWS.

Savings Plans require a 1- or 3-year hourly spend commitment tuned to steady usage, so a small, irregular 3-hour weekly lab workload rarely justifies the commitment risk.

Reserved Instances require a 1- or 3-year term for steady-state usage, and Spot capacity can be reclaimed with a short interruption notice, breaking the cannot-be-interrupted rule.

No. Only Business, Enterprise On-Ramp, and Enterprise Support plans include the Support API; Developer Support provides email-based technical guidance without programmatic case management.

Because being cheaper is irrelevant if the plan does not satisfy the requirement. Since Developer Support has no Support API, the lowest-cost plan that actually works is Business Support.

No. Developer Support only provides access to a limited set of Trusted Advisor checks, primarily focused on service limits and basic security.

It monitors the health of AWS services and notifies you of issues affecting your resources, but it does not provide best practice recommendations like Trusted Advisor.

MGN focuses on automating the technical migration (lift-and-shift), whereas Migration Hub is the centralized dashboard for tracking progress and planning across all tools.

It provides a single place to monitor migration progress across multiple AWS and partner tools, offering visibility into the status of each migration.

Storage Optimized focuses on disk I/O throughput. While useful for data lakes, the specific requirement here is 'High-Performance Computing,' which demands CPU power, not just storage speed.

Choose Memory Optimized when the workload requires massive amounts of RAM, such as in-memory databases (Redis), real-time big data analytics, or high-performance caching systems.

ECS manages running containers but does not automatically build images from source code; you must provide pre-built images.

App Runner is optimized for web applications and APIs. For other container workloads, ECS or Fargate are better suited.

Horizontal scaling is an implementation strategy or tactic. The design principles are broader architectural concepts like 'Use serverless architectures' that guide how you approach building systems.

The other four are: Democratize advanced technologies, Go global in minutes, Experiment more often, and Consider mechanical sympathy.

S3 Standard has low latency, but S3 Express One Zone is optimized for even faster, consistent single-digit millisecond access in a single AZ, making it superior for latency-sensitive apps.

It stores data in a single Availability Zone, so it lacks the multi-AZ durability of S3 Standard, though it offers higher performance and lower request costs.

EBS provides block-level snapshots, not logical database backups managed by a database engine. It requires manual configuration for consistency.

No, it supports specific engines like MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, and Amazon Aurora.

CloudTrail logs API calls and user activity for auditing. AWS Config tracks configuration changes and compliance of resources over time.

No. To get a report of IAM user credentials and their status, you must use the IAM Credential Report feature within IAM.

EC2 is a compute service for hosting applications. While you can run DNS software on EC2, Route 53 is the managed, highly available service specifically designed for this purpose.

Yes, Route 53 supports latency-based, geolocation, and global routing policies to direct users to the optimal endpoint based on their location.

Spot Instances can be interrupted with only a two-minute warning if AWS needs the capacity. This violates the requirement for the server to stay active at all times.

Savings Plans are also valid for discounts but are flexible across instance families and regions. However, in this specific multiple-choice context, Reserved Instances are the standard answer for dedicated capacity commitment.

Business ensures cloud investments accelerate business outcomes and covers strategy, finance, and value realization. Hiring, skills, culture, and inclusion are explicitly the People perspective's remit.

Business, Governance, Platform, Security, and Operations. Only People addresses workforce transformation, leadership, learning, and talent enablement, so the other options cannot fit this scenario.

Amazon EFS uses the NFS protocol and is optimized for Linux workloads, so it does not natively provide Windows ACLs, Active Directory integration, or SMB sharing.

No, Amazon FSx for Lustre is built for high-performance computing and Linux POSIX workloads; it does not provide native SMB or Windows Server features.

ElastiCache for Redis is an in-memory cache and key-value store, not a relational database, so it cannot run SQL or provide the relational schema required here.

Amazon RDS handles hardware provisioning, database setup, patching, backups, and options for Multi-AZ resiliency and read replicas, so the user does not manage that infrastructure.

CodePipeline orchestrates build, test, and deploy stages of a release; it does not ship in-application libraries that code uses at runtime to call AWS APIs.

It manages AWS Signature Version 4 request signing, credential resolution, retries, pagination, and error handling so developers can call services without implementing that logic.

AWS Organizations creates, groups, and governs accounts and consolidated billing, but it stores no user identities and has no sign-in portal. It hosts IAM Identity Center, yet it cannot authenticate users itself.

No. An IAM user exists in a single account; cross-account access requires assuming a role, which is why a centralized identity service such as IAM Identity Center is needed for one credential set.

Multi-AZ spreads resources across Availability Zones inside one Region, which improves availability but keeps the application in a single geographic area, so it does not provide global reach or reduced latency for worldwide users.

Yes. Besides serving global users from nearby Regions, Multi-Region design isolates workloads from a full regional outage, which a Single-Region or Multi-AZ deployment cannot do.

MGN executes the migration by replicating and cutting over source servers to AWS; it does not provide the portfolio-wide dashboard that shows the status of each application. Migration Hub consumes MGN's status updates to do that tracking.

Application Discovery Service collects on-premises server inventory, dependencies, and utilization data, and Migration Hub displays that discovered portfolio alongside per-application migration status in one central location.

Snowball Edge is designed for terabytes to low petabytes per device; moving 75 PB would require many devices, raising cost and logistics far above a single Snowmobile job.

No. Direct Connect provides dedicated ongoing network connectivity, but transferring 75 PB over it would consume excessive time and cost compared with AWS Snowmobile.

No. EKS manages the Kubernetes control plane, but worker nodes still need capacity and patching; you only get serverless pods if you schedule them on Fargate.

Outposts puts AWS-managed hardware in your own data center, so you still own the physical footprint and capacity planning rather than consuming on-demand serverless compute.

Dedicated Instances give single-tenant hardware but do not expose the physical sockets or cores, so they cannot satisfy per-socket or per-core BYOL license terms.

No. Reserved Instances are a billing discount and do not expose host sockets or cores, so they fail the per-socket, per-core, or per-VM license requirement.

Lex builds conversational interfaces for bots/apps, while QuickSight Q analyzes BI data to provide insights and visualizations via natural language.

It is included in the Enterprise edition of Amazon QuickSight, requiring appropriate licensing for access.

No, Amazon Aurora is a relational database service compatible with MySQL and PostgreSQL, which are SQL-based.

No, Amazon RDS manages relational database engines. For NoSQL, you should use DynamoDB.

Yes, Amazon CloudWatch Logs allows you to monitor, store, and access log files from EC2 instances, Lambda, and other sources in real time.

No, CloudTrail only records API calls for security and auditing. It does not provide performance metrics like CPU usage or disk I/O.

Security focuses on protection mechanisms like encryption and IAM. While it applies to data, the architectural design of the data platform itself falls under the Platform perspective.

Operations covers monitoring, incident response, and maintaining system health post-deployment, not the initial architectural design of platform components.

The other perspectives are Governance, Platform, Security, Operations, and Performance.

No, Governance focuses on policies, budgeting, and risk management. Training falls under the People perspective.

Product management focuses on defining product vision and value, which aligns with the Business perspective's goal of driving business outcomes.

Portfolio management is part of the Business perspective, focusing on prioritizing investments and managing the portfolio of cloud initiatives.

No. Application development and custom DevSecOps pipelines are customer responsibilities. AMS manages the underlying AWS infrastructure and security controls.

While AMS includes monitoring, 'Landing zone and network management' is the broader, foundational scope element that defines how the environment is secured and operated from day one.

GuardDuty detects threats and sends alerts, but Detective investigates the root cause using ML and graph theory on collected logs.

No, Detective can analyze findings from GuardDuty, but it is designed for investigation, not continuous threat detection.

The CLI is a command-line interface for managing AWS services, while SDKs are libraries integrated into application code for programmatic interaction.

No, Direct Connect only provides a network link. You still need SDKs or the CLI over that connection to deploy resources programmatically.

Yes, if an instance has consistently low utilization over a period, Compute Optimizer may recommend stopping it to save costs.

No, AWS Config monitors compliance and configuration history but does not analyze performance metrics to suggest instance size changes.

FSx is a specific file storage service, not a centralized management tool for backup policies across different AWS resource types.

Yes, AWS Backup can also be used to centralize and automate backups of on-premises applications using the AWS Backup Agent.

Yes, but they must be activated as Cost allocation tags in the Billing Console to appear in cost reports.

No, Organizations manages accounts, while tags categorize costs within those accounts for billing clarity.

S3 is a storage service, not a migration tool. DataSync moves data TO and FROM S3.

No, DataSync also transfers data between different AWS storage services like S3 and EFS.

No. Business Support provides a Concierge Team for billing/pricing guidance, but a dedicated Technical Account Manager is exclusive to Enterprise Support plans.

Enterprise On-Ramp is a lower-cost entry into the Enterprise tier with fewer response time guarantees but still includes a TAM. Enterprise Support is the full suite with higher SLAs.

Read Replicas replicate data asynchronously, meaning changes are applied after they occur on the source. Multi-AZ uses synchronous replication to ensure zero data loss during failover.

Blue/Green Deployment is used for seamless application updates and migrations by running two identical environments, switching traffic only when ready, not for database replication.

Network ACLs operate at the subnet level, applying rules to all instances within that subnet. They cannot target individual instances specifically.

Security Groups are stateful and instance-level, while NACLs are stateless and subnet-level. SGs are better for fine-grained instance control.

No, S3 is a global object storage service. It is not a structural component of a VPC, though VPCs can use endpoints to access S3 privately.

API Gateway is a managed service for handling API traffic. While it can be integrated with VPCs, it is not a building block of the VPC network architecture itself.

High availability is a goal (uptime), while loose coupling is an architectural strategy (decoupled services) that helps achieve that goal by preventing single points of failure.

Automation is a tool/practice used to deploy or recover resources. It doesn't define the structural relationship between components that prevents failure propagation.

GuardDuty detects threats and anomalies but does not classify or protect sensitive data content like PII in S3 buckets.

Macie uses ML to discover, classify, and protect sensitive data in S3, helping ensure compliance and data security.

Security Groups are stateful and operate at the instance level (ENI), whereas the question specifically requires subnet-level control.

NACLs are stateless and work at the subnet level, while Security Groups are stateful and work at the instance level.

ACM manages certificates, not the raw encryption keys themselves. You cannot export or directly manage the private keys in ACM.

Both manage keys, but CloudHSM provides dedicated hardware appliances. The question's context often favors CloudHSM when emphasizing 'hardware' or 'dedicated' management.

Avoiding over-provisioning is primarily an aspect of Elasticity (scaling resources efficiently). While it helps operations, Agility specifically refers to the speed at which you can build and try new things.

No, that is Cost Optimization. While it reduces financial risk, it does not inherently speed up the technical process of developing and deploying new applications or experiments.

Yes, AWS CodeDeploy supports automated deployments to AWS Lambda functions, allowing you to manage blue/green or canary deployments for serverless architectures.

CodeDeploy performs the actual deployment of code to instances, while CodePipeline is the continuous delivery service that orchestrates the entire pipeline, including building and testing stages before invoking CodeDeploy.

The SDK encrypts data but doesn't provide a managed service for storing and rotating secrets.

It provides on-demand access to AWS compliance reports and agreements, not credentials.

No. AWS WAF is a managed service that must be attached to supported resources like CloudFront, ALB, API Gateway, or AppSync. It cannot be installed directly on EC2.

Network Load Balancer operates at Layer 4 (TCP/UDP), whereas AWS WAF functions at Layer 7 (HTTP/HTTPS). WAF needs to inspect HTTP headers and payloads, which NLB does not process.

Route 53 routes DNS queries but doesn't cache content. It directs traffic to origins, which may still be far away, whereas CloudFront brings content closer.

Yes, you can configure EC2 instances as origins for CloudFront distributions to serve web content via the CDN.

Loose coupling reduces dependencies between components to prevent cascading failures. Scalability allows the system to handle more load by adding resources.

Automation speeds up operations but doesn't inherently reduce architectural dependencies between services like loose coupling does.

Spot Instances are cheaper but can be interrupted. The question asks for the most cost-effective billing model among standard choices, and On-Demand provides necessary reliability for scheduled reporting without interruption risk.

No. Capacity Reservations charge the same On-Demand rate but guarantee capacity. They do not reduce costs for unused time.

EMR manages EC2 instances/clusters, whereas Glue runs on a fully managed serverless infrastructure without requiring you to provision servers.

Glue is for ETL (preparing/moving data), while Athena is for ad-hoc querying of existing data in S3 using SQL.

Security Hub aggregates and prioritizes security findings and runs compliance checks, but it only reports on posture. It cannot restrict or approve which users deploy, manage, or decommission AWS resources.

Admins publish approved products into portfolios and attach constraints and IAM launch roles. End users can then deploy only those pre-approved, standardized resources in their accounts.

IAM users, password policies, and identity management are customer responsibilities known as "security in the cloud." AWS secures the underlying infrastructure, not your identity configuration.

They are tools customers deploy to protect their own environments and workloads — again security in the cloud. AWS's side remains protecting the global infrastructure and managed service layers.

RDS and Aurora are relational engines that require a defined schema, while DynamoDB is a schema-flexible NoSQL database built for continuously produced, variably structured data.

Not ideally; DynamoDB is best for semi-structured key-value or document items, whereas true binary objects such as images usually belong in Amazon S3.

The six CAF perspectives are Business, People, Governance, Platform, Security, and Operations; architectural guidance sits inside the Platform perspective and in the AWS Well-Architected Framework, not on the perspective list.

Six: Business, People, Governance, Platform, Security, and Operations. Questions often mix in non-perspective terms like Cloud fluency or Change acceleration to test exact recall.

Edge locations are CloudFront points of presence for caching content near users, not general compute placement targets. Only Availability Zones inside a Region host EC2 instances.

No. Each AZ has independent power, cooling, and network connectivity, which is why spreading EC2 instances across AZs satisfies the independent infrastructure requirement.

NLB operates at Layer 4 for TCP/UDP/TLS traffic and does not natively understand HTTP, so it cannot match ALB's HTTP-aware balancing and routing.

No. Auto Scaling only adds or removes instances based on demand; it works alongside a load balancer, which performs the actual traffic distribution.

A virtual private gateway terminates one Site-to-Site VPN or Direct Connect link for a single VPC. It cannot interconnect many VPCs transitively, so it is not a central hub.

A customer gateway is an AWS resource that represents the physical VPN device in your on-premises network. It defines a peer endpoint, while Transit Gateway routes traffic between many networks.

ACM issues, renews, and deploys SSL/TLS certificates for your endpoints. It does not give you custody of the underlying encryption keys, which is what the question asks for.

KMS is a shared, AWS-managed service for creating and controlling keys, while CloudHSM gives you dedicated single-tenant hardware where you own and manage the keys yourself.

EFS is an NFS file system that clients mount from inside a VPC; it has no HTTP endpoint, so there is no URL an external user could open to download a file.

No. The URL only resolves for an anonymous user if a bucket policy, ACL, or presigned URL grants read access; otherwise S3 returns Access Denied.

SageMaker builds, trains, and deploys machine learning models; it has no native dashboarding or BI visualization layer, which is what the company asked for.

Kinesis streams real-time data ingestion, and Rekognition analyzes images and video — neither produces the interactive visual dashboards the scenario requires.

One Zone-IA is cheaper but lacks multi-AZ durability. Also, it doesn't auto-tier for the daily-accessed subset, making Intelligent-Tiering more efficient overall.

No, you cannot mix tiers within a single object easily. Intelligent-Tiering handles the split automatically, whereas Glacier would block daily access.

AWS Artifact provides static reports and agreements for compliance audits. AWS Config continuously monitors and records configuration changes of AWS resources.

No. Trusted Advisor offers best practice checks for cost and performance, not regulatory compliance reports like ISO or PCI DSS.

Outposts runs in your own data center, while Local Zones are in urban areas near users. Outposts ensures data stays strictly on-premises.

No. Transit Gateway connects networks but does not provide local compute resources or guarantee data residency at the edge.

Yes, Amazon Connect integrates with Amazon Lex for conversational bots and Amazon Polly for voice synthesis, providing AI capabilities without extra setup.

Direct Connect provides network connectivity to AWS but does not host or manage the contact center application itself.

Lambda abstracts infrastructure, preventing you from specifying exact instance types or deep OS-level configurations required by the custom apps.

No, Athena is only for querying data in S3 using SQL; it does not host or run application code.

Yes, AWS WAF integrates directly with CloudFront distributions to filter web requests before they reach your origin.

No, GuardDuty detects threats but does not block them. You need a service like AWS WAF or Security Groups for blocking.

No, S3 is object storage. It cannot execute database software or manage transactions.

RDS does support PostgreSQL, but it was not provided as a selectable option in this specific question.

Inspector focuses on security vulnerabilities in OS and apps, not the configuration state of all AWS resources needed for broad compliance auditing.

No. CloudTrail logs API calls (who did what), while Config tracks resource configurations (what the resources look like). Both are often used together.

AZs protect against data center failures but are within the same region. Natural disasters can disable entire regions.

CloudFront caches content at edge locations but does not host EC2 instances. It complements, but doesn't replace, multi-region compute.

Rehost moves the app as-is ('lift and shift'), while Replatform makes minor changes to use cloud-native features like managed databases.

Choose Refactoring when you need to fully leverage cloud benefits like scalability and cost-efficiency by rewriting the application code.

DynamoDB is a key-value store. It does not natively support graph traversal algorithms or efficient querying of multi-hop relationships, which are critical for fraud pattern detection.

Yes, Neptune is also commonly used for recommendation engines, social networking graphs, and knowledge graphs where understanding entity relationships is key.

Rekognition analyzes visual content (images/video), while Personalize builds recommendation systems based on user interaction data.

Yes, Amazon Rekognition can analyze both static images and streaming or stored video files for face detection and recognition.

QuickSight can visualize data, but it requires manual integration. The Carbon Footprint Tool provides native, pre-calculated metrics directly from AWS.

Yes, the AWS Customer Carbon Footprint Tool is available at no additional charge to AWS customers.

CodeDeploy automates application code deployment to servers, not the creation or management of infrastructure resources like VPCs or EC2 instances.

No, Systems Manager manages existing resources via patches and commands; it does not provision new infrastructure declaratively like CloudFormation.

WorkSpaces provides virtual desktops for employees, not a customer-facing interface for handling inbound voice or chat inquiries.

No, Amazon Connect is an omni-channel contact center that supports voice, chat, tasks, and phone numbers out of the box.

RDS is optimized for OLTP (transactions), not OLAP (analytics). It lacks the columnar storage and query optimization needed for large-scale data warehousing.

No, Aurora is a relational database engine compatible with MySQL and PostgreSQL, designed for high-performance transactional applications, not analytical data warehousing.

AWS Shield protects against DDoS attacks at the network and transport layers (L3/L4), while AWS WAF filters malicious HTTP/HTTPS traffic at the application layer (L7).

Yes, AWS Shield Standard provides automatic protection against common network and transport layer DDoS attacks for all AWS customers at no additional cost.

Yes, AWS manages the runtime environment and underlying OS for Lambda functions, so the customer never touches the guest OS.

Yes, as a managed service, AWS handles all hardware, OS, and database maintenance for DynamoDB.

Rehost is a pure lift-and-shift. Moving to RDS involves adopting a managed service with different operational characteristics, which classifies it as Replatforming.

Refactoring requires significant code changes to leverage cloud-native features. Replatform involves minor tweaks to optimize for the cloud without altering the core application structure.

No. Replatform involves minimal changes (e.g., swapping DB engines). Microservices require significant architectural rework, which defines Refactoring.

Rehost is 'lift and shift' with zero code changes. Refactor involves rewriting or restructuring code to leverage cloud-native capabilities.

Yes, you can apply tags to existing resources at any time. However, only active tags on running resources contribute to current charges.

For account-level tags, you must enable them in the AWS Billing Console. For resource-level tags, you can simply start using them immediately.

CloudWatch Alarms are primarily for metrics (CPU, memory), not instance states. While you can create custom metrics for states, EventBridge natively listens to instance state changes via the EC2 API.

SNS is a notification delivery service. It doesn't know about EC2 states itself. You would typically use EventBridge to catch the state change and then publish to SNS if needed, making EventBridge the primary trigger.

Inspector performs vulnerability scanning on EC2 instances, not continuous behavioral threat detection across the entire environment.

Yes, GuardDuty analyzes S3 data events and access logs to detect unusual or unauthorized access patterns in S3 buckets.

Using a data platform (Option C) is a technological solution. The question specifically asks about organizational transformation and becoming responsive through team structure, which falls under the People perspective.

The Business pillar focuses on value propositions and ROI. The People pillar focuses on internal structures, skills, and culture, such as realigning teams to be more agile.

AWS Config monitors and audits configuration changes after deployment. Service Catalog enforces compliance before deployment by controlling access to approved templates.

Yes, AWS Service Catalog supports provisioning from AWS CloudFormation templates and Terraform configurations, making it versatile for IaC workflows.

AWS Config tracks resource state and configuration changes, not real-time performance metrics like CPU load.

No, CloudTrail only logs API requests and responses for security auditing and governance, not system metrics.

EC2 is the infrastructure that executes the AMI, but it is not a distribution channel. You cannot 'sell' or 'list' an AMI directly through EC2; you must use Marketplace to reach prospective customers.

Yes, you can share AMIs privately with specific AWS accounts by modifying permissions, but Marketplace is required for public listing, billing integration, and reaching prospective customers broadly.

ElastiCache is an in-memory cache, not a persistent data store. It lacks durability and is meant to supplement a database, not replace it for primary storage.

No, DynamoDB is a NoSQL database optimized for simple key-value lookups and single-table design patterns, not complex SQL-style joins.

No. Cloud has LOW upfront capital expense but HIGH variable expenses based on usage. A describes on-premises.

No. You cannot control physical security or rack location in AWS; this is managed entirely by the provider.

Versioning allows objects to be overwritten or deleted if permissions allow. It does not provide the cryptographic immutability or locked retention periods required for true WORM compliance.

Yes, S3 Object Lock also provides WORM capabilities for S3 buckets. However, among the options provided, Glacier Vault Lock is the specific service mentioned for archival compliance in this context.

Snapshots are offline backups. They do not keep the database running during an outage or provide automatic failover capability.

No, Multi-AZ is for availability, not performance. It adds replication overhead but does not increase read/write throughput.

No, Amazon Cognito manages user identity and access control but does not have video or image analysis capabilities.

No, AWS Lambda is a serverless compute service. It can invoke Rekognition to analyze video, but it does not perform the analysis itself.

Support is for troubleshooting and technical issues. Compliance reports are pre-generated and available instantly via the self-service Artifact portal.

No. Security Hub monitors your environment's configuration and security posture against standards, but it does not host the vendor's attestation reports.

AWS Shield protects against DDoS attacks but does not support creating custom rules to inspect and filter specific web request contents like SQL injections or XSS.

Yes, AWS WAF can be associated with an Application Load Balancer (ALB) that distributes traffic to your EC2 instances, or with CloudFront distributions.

While Spot is good for variable workloads, it can be interrupted. The requirement 'cannot stop' makes Spot invalid.

No, Savings Plans require long-term commitments (1-3 years) and are best for steady-state baseline usage, not short bursts.

AWS Glue is an ETL service focused on extracting, transforming, and loading data, and creating a Data Catalog. It does not provide a direct interface for ad-hoc SQL querying like Athena does.

While Redshift Spectrum allows querying S3 data, it requires managing a Redshift cluster. Athena is serverless and better fits the 'direct query' requirement without infrastructure overhead.

Lightsail provides VMs requiring OS management, whereas S3 is serverless object storage with zero infrastructure maintenance.

No, S3 only supports static websites. For dynamic content, you need compute services like EC2, Lambda, or Elastic Beanstalk.

No, SNS is for sending notifications to endpoints like email or SMS. The Health Dashboard is the specific tool that provides RSS feeds for AWS service issues.

CloudWatch monitors your resources and metrics. The Health Dashboard shows the overall health of AWS services and your account's specific impact from those issues.

No, AWS EC2 Reserved Instances are only available in 1-year and 3-year terms. There is no 5-year option.

A 3-year commitment requires a larger upfront obligation from the user, so AWS rewards this with a deeper discount per hour compared to the 1-year term.

Speed and agility refer to how fast you can deploy applications. The question specifically asks about the financial aspect of paying for services as needed.

CapEx is upfront investment in physical hardware (fixed expense). OpEx is paying for services as you use them (variable expense), which is the primary model in the cloud.

Spot Instances can be interrupted by AWS with little notice if capacity is needed elsewhere, which violates the reliability requirements of a critical workload.

Reserved Instances lock you into a specific instance family and region, while Savings Plans offer more flexibility across instance families, regions, and even services like Lambda.

AWS Budgets tracks actual or projected spending on existing resources. It cannot estimate costs for an architecture that hasn't been deployed yet.

No, Cost Explorer analyzes historical usage data. Since the architecture is not yet migrated, there is no historical data to analyze.

Solutions Architects provide free architectural guidance and best practices. Professional Services are paid teams that perform hands-on implementation and migration work.

No. Enterprise Support provides enhanced monitoring, faster response times, and a Technical Account Manager, but it does not include the actual implementation or migration labor.

Yes, Java is a first-class language supported by AWS CDK, along with TypeScript, JavaScript, Python, C#, and Go.

No, Ruby is not currently a supported language for AWS CDK. You must use one of the first-class languages listed in the documentation.

Lambda is designed for short-lived function execution, whereas Fargate is built specifically for running containers, including those that may run for longer durations like 4 hours.

Yes, Fargate supports any container image stored in Amazon ECR, Docker Hub, or other registries, provided the image is compatible with the architecture.

CloudFormation provisions new resources based on templates. It does not automatically clone existing live resources unless their configuration is captured into a template first.

No. CloudTrail only logs API activity for auditing and compliance. It cannot create or replicate AWS resources across regions.

Copying to S3 requires custom scripting and data transfer time. Snapshots are native, faster, and automatically versioned.

Yes, snapshots provide a point-in-time copy ideal for disaster recovery, allowing you to restore volumes or create AMIs.

Lightsail offers a bundled, pre-configured setup with less complexity than standard EC2, making it easier for novices to launch instances without managing separate networking components.

While possible, Lambda requires understanding serverless architectures and IAM permissions, which presents a higher barrier to entry than the straightforward VPS model of Lightsail.

IAM manages permissions for AWS resources and identities, but it does not provide the centralized workforce access portal or SaaS application assignment described in the scenario.

Yes. AWS IAM Identity Center can federate with supported SaaS applications and gives users a single portal for assigned AWS accounts and cloud applications.

AWS Glue is a serverless data integration and ETL service for preparing and moving data; it does not provide a conversational interface for website users.

Yes, Lex bots can be deployed through APIs or SDKs and invoked from website front ends to handle user conversations.

CloudTrail records API calls and account activity for auditing, not performance counters like disk write operations, so it has no metric to alarm on.

No. Basic metrics such as CPUUtilization are automatic, but disk and memory metrics require the CloudWatch agent installed on the instance.

EC2 instances run in AWS Regions, so command traffic to on-premises machinery still crosses the network and adds latency; Outposts places the compute locally instead.

Choose Outposts when workloads must execute on premises for low latency, local data processing, or data residency; Lambda runs regionally and cannot provide local hardware.

The Business perspective covers outcomes and value alignment, while the CAF assigns the metadata and catalog inventory activity itself to Governance data curation. The exam tests the capability's owner, not who benefits downstream.

Platform covers building and running cloud platforms and data pipelines; Governance covers curating, cataloging, and controlling data products. If the keyword is catalog, inventory, or metadata, choose Governance.

Developer Support offers only business-hours email access to Cloud Support Associates with no production SLA, and AWS recommends it for testing or experimentation rather than production systems.

Yes. Business has a much lower monthly minimum and no TAM, while Enterprise On-Ramp adds a pooled Technical Account Manager and a 30-minute business-critical response target at a higher price.

GuardDuty is a detective control that only identifies and reports suspicious activity. Prevention of DDoS and SQL injection is handled by AWS Shield and AWS WAF respectively.

No. GuardDuty is fully managed and analyzes VPC Flow Logs, CloudTrail events, DNS logs, and other data sources without deploying agents or sensors.

Console sign-in credentials only work in the browser-based Management Console. The CLI sends signed API requests, which require an access key ID and secret access key instead.

Systems Manager can run commands and open sessions, but it is an operations service, not a credential. It does not replace the access key needed to sign AWS CLI requests.

Glacier Flexible Retrieval has lower storage cost but cannot retrieve files immediately; the question requires immediate access, so Standard-IA wins on cost-effectiveness for this use case.

Yes, objects smaller than 128 KB are billed as 128 KB in Standard-IA, but these 5 MB audio files exceed that threshold, so no penalty applies.

Direct Connect requires physical cross-connects or hosted connections at an AWS Direct Connect location, plus carrier coordination, so provisioning often takes weeks or months rather than one week.

Yes, it uses IPsec tunnels over the public internet to encrypt traffic between the customer gateway and the AWS virtual private gateway or transit gateway.

No. For Amazon EC2, the customer is responsible for patching the guest operating system and applications. AWS only patches the underlying host infrastructure.

The customer. Security Groups are virtual firewalls attached to instances, and their rules must be defined and managed by the user.

No, AWS Support handles technical issues. You must use the AWS Artifact console for self-service access to compliance documents.

No, Trusted Advisor checks best practices like security groups and cost optimization, but it does not host legal compliance reports.

CloudTrail logs API calls for auditing but does not track resource configuration states or trigger remediation actions.

Yes, AWS Config can invoke Systems Manager Automation documents to automatically remediate non-compliant configurations.

Snowball is typically used when network bandwidth is insufficient or for offline transfers. DataSync is preferred for online, one-time migrations where network connectivity allows for efficient transfer.

Storage Gateway provides hybrid storage access to AWS cloud storage, while DataSync is focused solely on automated data transfer tasks between on-premises and AWS storage services.

Amazon Polly converts text TO speech (synthesis), while Amazon Transcribe converts speech TO text (transcription).

Yes, Amazon Polly falls under AWS AI/ML services as it uses deep learning models for natural language processing.

Secrets Manager stores long-term secrets like passwords. It does not issue temporary, self-expiring tokens for immediate session access like STS does.

Yes, STS can provide temporary credentials for IAM roles assumed by EC2 instances or other AWS services, not just external federated users.

Rekognition analyzes visual content but does not change file formats. Elastic Transcoder performs the actual encoding.

It is a valid exam answer for CLF-C02, though AWS now recommends MediaConvert for new projects.

No. DataSync moves data; it does not inventory or assess server configurations and dependencies.

Yes, the agent and server components are free, though you pay for any EC2 instances used to run the discovery appliance.

VPC is a logical virtual network within AWS. While it contains your resources, it is not the service that establishes the physical link from your on-premises location.

Direct Connect uses a dedicated private fiber connection, while VPN encrypts traffic over the public internet. Direct Connect offers higher throughput and consistency.

Amazon Transcribe converts speech to text (audio input), while Amazon Polly converts text to speech (text input). They are inverse processes.

No, Amazon Textract extracts text from static images and documents, not from audio streams or voice recordings.

ACM issues and renews SSL/TLS certificates, which encrypt data in transit between clients and endpoints. It does not create or manage the keys that encrypt stored data; that is KMS's role.

IAM controls permissions for who can access AWS resources and call APIs. KMS creates and manages cryptographic keys used to encrypt and decrypt data at rest across integrated AWS services.

Cost Anomaly Detection uses machine learning to flag unusual spending spikes after they happen; it does not track cost and usage against a defined monthly budget for EC2.

Yes. AWS Budgets supports filters by AWS Service, Availability Zone, linked/member account, and cost allocation tags, so you can scope a budget to EC2 in a specific environment.

Compute Optimizer recommends right-sized EC2 instance types based on utilization, while Trusted Advisor runs best-practice checks—neither one tracks monthly cost and usage against a budget.

A NAT gateway routes outbound traffic through an internet gateway, so requests to S3 still cross the public internet. Only a VPC endpoint keeps the path entirely inside AWS's network.

Amazon S3 uses a gateway endpoint, attached to your route tables. A VPC endpoint for S3 requires no public IP and incurs no additional hourly charge.

CodePipeline only orchestrates stages such as source, build, and deploy; it performs no installation itself and must call CodeDeploy to push revisions to EC2 or on-premises hosts.

CodeBuild compiles source code and runs tests to produce artifacts, while CodeDeploy takes that artifact and installs it on the target EC2 or on-premises instances.

Standard Amazon MSK requires you to choose broker count and instance/storage capacity and manage cluster scaling, so it is managed but not serverless. Amazon MSK Serverless is a separate offering not named by the option.

No. With EMR you still provision and scale the underlying cluster nodes and manage their configuration. AWS operates the service, but you retain infrastructure-management responsibility.

Option B describes EC2 Spot Instances, which AWS can interrupt when it needs capacity. On-Demand Instances cost more precisely because AWS guarantees they will not be interrupted.

Use Reserved Instances or Compute Savings Plans with a 1- or 3-year commitment; they cut costs by up to 72% versus On-Demand for always-on, predictable capacity.

Groups are a management structure: only users can belong to them and groups just attach policies in bulk. That fact does not decide whether a user or a role is the correct identity type.

Attach an instance-profile role so AWS delivers temporary credentials automatically to the instance, eliminating any long-term access keys stored on the host.

It only inventories on-premises servers and applications and feeds data into migration planning; it does not compute costs or produce a TCO estimate on its own.

Pricing Calculator builds an itemized estimate of future AWS service costs, while Migration Evaluator compares your current on-premises estate against projected AWS spend, including right-sizing.

B targets portfolio growth and new market offerings under the CAF Business perspective. Responsiveness to existing customer inquiries is better served by team realignment and agile iteration.

A data and analytics platform produces insights for decision-making, but it is a longer-horizon platform investment that does not directly shorten how fast the company replies to or acts on customer feedback.

DynamoDB is a key-value and document store optimized for primary-key lookups; it has no native graph query language and cannot traverse multi-hop relationships between records.

Choose Timestream for timestamped metrics and event time-series data, and Forecast for ML-based demand predictions; neither stores or queries connected graph relationships.

Both are domain-specific managed services that return ready-made predictions for forecasting and recommendations. They do not let you create, train, or deploy your own custom models.

Amazon Comprehend is a natural language processing service that extracts sentiment, entities, and key phrases from text using pre-trained models rather than letting you train your own.

The Pricing Calculator only estimates costs for a proposed architecture you design; it does not read your existing EC2 utilization metrics or generate instance rightsizing recommendations.

Compute Optimizer analyzes utilization history to recommend optimal instance types, while Systems Manager handles operations tasks such as patching, automation, and session management.

SageMaker supports languages like Python, but it is for building, training, and running ML models — not for interactive querying of data stored in Amazon S3.

No. Athena is serverless: you point it at S3 data, write standard SQL, and pay only for the queries you run, with no infrastructure to provision.

Spot capacity can be reclaimed by AWS with a two-minute notice, so interruption-intolerant workloads such as critical databases should use On-Demand, Savings Plans, or Dedicated Hosts instead.

On-Demand offers unlimited scale with no commitment and no interruption risk, while Spot provides deep discounts in exchange for accepting that AWS may reclaim the capacity at any time.

Because it is fault-tolerant and flexible, Spot Instances deliver up to 90% off On-Demand pricing; interruptions are acceptable when the job can be restarted.

Standard Reserved Instances and most Savings Plans require a one-year or three-year term, so a 30-day workload cannot use them and On-Demand is cheapest.

Inspector assesses EC2 instances, ECR images, and Lambda functions for software vulnerabilities and network exposure. Macie is an S3 data-protection service that finds and classifies sensitive data, so it cannot assess EC2 workloads.

Security groups are preventive firewalls that filter traffic; they do not analyze or report vulnerabilities. Shield Standard only mitigates DDoS attacks at the network layer, performing no instance-level vulnerability assessment.

Both services accelerate delivery of application traffic and content over the AWS network, but neither provisions or hosts desktop operating systems. WorkSpaces is the service that actually runs the virtual desktop.

Amazon WorkSpaces is a managed Desktop-as-a-Service (DaaS) offering that provides secure Windows or Linux virtual desktops in the cloud, accessible from a supported client application or web browser.

AWS Budgets sets thresholds and sends alerts when spending nears a limit; it does not provide the visual reporting of historical cost and usage for a chosen period that the question requires.

AWS Organizations manages multiple accounts and produces a consolidated bill, while Cost Explorer is the analysis layer that renders that cost and usage data as filterable, time-based reports.

Amazon DocumentDB is compatible with MongoDB, not MySQL. It is a document database designed for MongoDB workloads and does not support MySQL engines.

No. DynamoDB is a key-value/document NoSQL store and ElastiCache is an in-memory cache using Redis or Memcached; neither can run MySQL, which requires Amazon RDS.

Amazon Connect is a cloud contact center for handling customer calls and chats through agents. It does not provide an intelligent search interface over internal documents, so it fails the requirement.

Kendra searches indexed content and returns answers to natural-language questions, while Lex builds conversational chatbots and voice assistants. The company needs search, not a bot, so Kendra fits.

Compute Savings Plans are flexible across EC2 families and other compute, but that flexibility yields a smaller discount than a Standard RI when the family and type are already known for 12 months.

No; All Upfront is a payment option applied to the RI. Standard RI plus All Upfront is the deepest-discount combination for this predictable workload.

CodeDeploy automates deployments to targets such as EC2 or Lambda, but it does not provide the serverless compute runtime that executes the application code.

No. Glue is a serverless ETL and data integration service; it runs data processing jobs, not general application code as described in the question.

AWS Application Migration Service continuously replicates source servers into an AWS staging area as part of an actual cutover, so it starts the migration instead of performing discovery-only assessment.

Agentless discovery reads server configuration, utilization, and network dependencies through vCenter, while optional agents add in-guest process detail without modifying workloads.

Cost Explorer analyzes and forecasts AWS spend, while EC2 Image Builder automates VM or container image creation and has no cost-monitoring capability. The product images in the scenario are a distractor.

No. CloudFormation provisions infrastructure as code; it does not provide cost analysis, budget tracking, or spend forecasting.

ElastiCache only caches data at the database tier and requires application changes; it does not reduce the network latency users experience before reaching the ALB.

Yes. Global Accelerator supports Application Load Balancers as endpoints, so existing ALB-fronted public apps gain faster edge entry and global network routing.

ECS needs underlying compute capacity that stays provisioned for the cluster, so you pay for idle time between the few daily calls, unlike Lambda's per-invocation billing.

Yes. Processing under 5 minutes fits well inside Lambda's 15-minute maximum, which confirms Lambda is a valid fit rather than a constraint here.

Governance focuses on cloud policies, compliance, risk, and controls; strategy management is grouped under Business, where cloud investments are tied to business outcomes.

Alongside strategy management, the Business perspective includes portfolio, innovation, product, strategic partnership, and data monetization capabilities.

SNS sends pub/sub notifications such as SMS or email, but it has no agent routing, voice call handling, or chat contact flows that a contact center requires.

Yes. Amazon Connect provides voice and chat channels, contact flows, and agent routing in a cloud-based contact center.

DataSync copies files and objects between storage systems such as NFS, SMB, Amazon S3, EFS and FSx. It cannot replicate an instance's operating system and boot volumes or launch a running EC2 instance in the target Region.

No. Migration Hub is a tracking and orchestration dashboard that aggregates migration status across tools and Regions; the actual replication and cutover are done by services such as AWS Application Migration Service.

An internet gateway connects a VPC to the public internet, which risks exposing internal traffic. The question explicitly requires avoiding public internet exposure, so PrivateLink is the appropriate service.

No. PrivateLink uses interface VPC endpoints to provide private access to supported AWS services without VPC peering, public IP addresses, or internet gateways.

Performance efficiency is about selecting and right-sizing resource types and monitoring efficiency, not about surviving failures. Recovery from disruption is the defining scope of Reliability.

AWS now publishes six: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. The CLF-C02 stem still points squarely at Reliability.

Data Pipeline orchestrates scheduled batch data movement between storage and compute services, not high-volume concurrent request handling, and pairing it with EC2 adds server management overhead.

Yes. Lambda polls the queue and scales concurrency with the backlog, so hundreds of queued requests are processed in parallel without provisioning capacity.

Spot capacity is spare EC2 capacity that AWS can reclaim with a short interruption notice, so it cannot guarantee uninterrupted availability for a live game.

Only if the workload were short-lived or unpredictable. With a known one-year need and steady traffic, On-Demand costs more than a one-year Reserved Instance commitment.

AWS VPN creates an encrypted tunnel over the public internet, while Direct Connect is a private dedicated circuit; only Direct Connect matches "dedicated network connection."

No. VPC peering links two VPCs inside AWS; it does not extend a company data center network directly into AWS.

An Availability Zone is one isolated data center group inside a Region; a Region is the broader geographic location that contains at least three AZs.

DataSync is a managed data-transfer service that moves files over the network or from on-premises storage to Amazon S3 — it has no geographic footprint of its own.

Operational Excellence covers running, monitoring, and continuously improving processes; risk assessment and mitigation of threats to data and assets belongs to the Security pillar.

Identity and access management, detection, infrastructure protection, data protection, and incident response — the areas that protect AWS information, systems, and assets.

AWS Artifact only delivers AWS's own compliance documents and agreements (SOC, PCI, ISO). It never lists your IAM users' password or access key dates — the IAM credential report does.

No. Audit Manager orchestrates evidence collection against frameworks and can ingest credential-report data, but the underlying rotation details come from the IAM credential report.

Cost Explorer visualizes and forecasts spend, but it does not itself deliver threshold alarms; you must create a budget or CloudWatch alarm for notifications.

Yes. The EstimatedCharges billing metric in the us-east-1 Region can drive a CloudWatch alarm that notifies through Amazon SNS when charges cross your threshold.

Artifact provides on-demand compliance reports, such as SOC and PCI DSS, and AWS agreements; it does not publish general answers to common security questions.

Yes. It hosts articles, FAQs, and videos for the questions AWS customers ask most often, including security, compliance, and operational guidance.

AWS Wavelength extends AWS services to telecom carrier networks for low-latency 5G workloads. It does not define the geographic Region where an Amazon RDS database is provisioned.

No. Direct Connect establishes a dedicated private network link from on-premises to AWS, but the RDS deployment Region is still selected separately through AWS Regions.

It reports and controls charges for resources you have already provisioned. It has no mechanism to model the cost of an architecture that does not exist yet — that is Pricing Calculator's job.

Yes. You can add many services and configurations to a single estimate, save it, share it, and export it to support project budgeting and approval.

Replication copies objects to buckets in other Regions for durability and locality, but users still hit a regional S3 endpoint with no edge caching, and you pay for storage and replication of every copy.

No. PrivateLink provides private connectivity between VPCs, on-premises networks, and AWS services; it improves security and topology but does not cache content near global end users.

It inverts the real AWS advantage, which is trading fixed expense for variable expense. Moving to fixed costs would recreate the on-premises capital-spend problem.

No. Speed and agility is a separate advantage of cloud computing about provisioning resources faster; economies of scale is purely about lower per-unit cost from aggregated demand.

With EC2 you install and administer the database engine yourself, so version upgrades and security fixes inside that engine are customer tasks. Moving to Amazon RDS shifts engine patching to AWS.

Yes. On RDS, AWS takes over the guest OS and database engine patching, so the customer keeps only data, access and backup-schedule responsibilities.

Firewall Manager centrally administers WAF, Shield Advanced, security group, and Network Firewall policies across accounts in AWS Organizations; it does not itself enforce subnet-level allow/deny rules the way a network ACL does.

No. Security groups attach to ENIs and instances and are stateful with allow-only rules; subnet-wide filtering with explicit deny rules requires a network ACL associated with that subnet.

Data protection belongs to the AWS CAF Security perspective, which covers confidentiality, integrity, and availability of data and workloads rather than platform engineering.

Data science is grouped in the Business perspective, where analytics and data-driven insight support business outcomes instead of platform build-out.

AWS Business Support already includes the full set of Trusted Advisor checks, so it is not an additional benefit when moving from Business to Enterprise Support.

Yes. Business Support includes 24x7 phone, email, and chat access to Cloud Support Engineers, so option B is not an Enterprise-only addition.

Cognito manages customer identities for applications you build; it can federate with a SAML IdP but does not provide an employee-facing portal with per-application assignments to SaaS apps.

Yes. Its application catalog includes SAML 2.0 business apps such as Salesforce, Box, and Microsoft 365, and you can also add custom SAML 2.0 applications.

Inspector scans EC2 instances and container images for vulnerabilities; it does not record inbound and outbound VPC flow metadata.

No. Flow Logs record metadata such as source/destination IP, ports, protocol, and accept/reject status, not the actual packet contents.

Trusted Advisor reports account-level best-practice and quota findings, while Inspector performs per-instance software vulnerability scans driven by assessment templates and rule packages.

Yes. Inspector also scans container images in Amazon ECR and AWS Lambda functions, evaluating both software vulnerabilities and unintended network exposure.

Economies of scale explains lower per-unit prices as AWS aggregates demand; the question specifically describes replacing upfront fixed expenses with variable on-demand charges, which is pay-as-you-go pricing.

It generally means avoiding large upfront capital purchases and paying for resources consumed, though some AWS purchasing options such as Reserved Instances can still include upfront payments.

VPC peering only routes traffic between two VPCs (or a VPC and an AWS service network); it never extends to a customer data center, so it cannot reach an on-premises network.

Pick Direct Connect when you need a dedicated private link with consistent bandwidth and latency that bypasses the public internet; use Site-to-Site VPN for encrypted tunnels over the internet.

Security groups attach to EC2 instance network interfaces, support allow rules only, and have no deny rule; explicit subnet-level blocking is done with a network ACL's deny rules.

A security group is a stateful firewall — return traffic for allowed requests is automatically permitted — whereas network ACLs are the stateless filter in a VPC.

Compute Optimizer only produces rightsizing recommendations from utilization data; it never launches or terminates instances during a live demand spike, so it cannot deliver automatic responsiveness.

Cost Explorer is a reporting tool that shows past and forecasted spend. Visibility into cost is not the same as automatically scaling capacity up and down with demand.

Security groups are virtual firewalls that filter traffic to EC2 resources. They contain network rules, not users, so they cannot grant identity permissions.

An IAM group is a collection of IAM users that share permissions. A resource group is a tag-based collection of AWS resources such as EC2 instances for management and automation.

CloudTrail is a customer-controlled logging service; the customer decides which trails to create, which events to capture, and where to store logs.

No. WorkSpaces authentication is tied to the customer's directory, so enabling and enforcing MFA for each user account is a customer task.

An Internet Gateway connects a VPC to the public internet for HTTP/HTTPS traffic. A Virtual Private Gateway connects a VPC to an on-premises network via a Site-to-Site VPN.

No. Load balancing is performed by Elastic Load Balancing (ELB) services. An Internet Gateway only routes traffic to and from the internet.

Platform manages the technical tools (like AWS Glue), but Governance defines the policies and organizes the inventory of data products themselves.

It is a pillar of the Governance perspective that involves collecting, organizing, and enriching metadata to manage data assets effectively.