14 Application Integration, Management, and Developer Tools · AWS Cloud Practitioner

In this chapter you will learn how AWS services pass messages and events between the parts of an application (Amazon SQS, Amazon SNS, Amazon EventBridge, AWS Step Functions, and Amazon MQ), how you watch, audit, and manage an AWS environment (Amazon CloudWatch, AWS CloudTrail, AWS Config, AWS Systems Manager, AWS Health Dashboard, AWS Trusted Advisor, and several governance helpers), and which developer, end-user computing, business application, and IoT services you should be able to recognize on the exam. This material maps to Domain 3, Cloud Technology and Services, especially Task Statement 3.8 (identify services from other in-scope AWS service categories), and supports Domain 2 tasks about monitoring, auditing, and compliance.

14.1 Why applications need integration services

Imagine an online store built as one large program. When a customer places an order, the same program charges the card, updates inventory, sends the confirmation email, and notifies the warehouse. If the email system is slow, the customer waits. If the warehouse system crashes, the whole order fails. The pieces are tightly coupled: each one depends directly on the others being available and fast.

Modern cloud applications are usually split into smaller components, often microservices or serverless functions. Those components still need to talk to each other, but they should not need to wait for each other. AWS application integration services sit in the middle and act like a post office: one component drops off a message or event, and another component picks it up when it is ready. This is called loose coupling or decoupling, and it is one of the design principles in the Reliability pillar of the AWS Well-Architected Framework.

Decoupling gives you three big benefits:

Resilience. If a downstream component fails, messages wait safely instead of being lost.

Independent scaling. The front end can accept a burst of orders while the back end processes them at its own pace. Easier change. You can add a new consumer (for example, an analytics service) without rewriting the producer.

14.2 Messaging and event services

Amazon SQS: queues for decoupling

Amazon Simple Queue Service (Amazon SQS) is a fully managed message queue. A producer sends a message to a queue. A consumer polls the queue, processes the message, and then deletes it. Each message is processed by one consumer. If no consumer is running, the messages simply wait (by default for 4 days, configurable up to 14 days). SQS offers two queue types:

Queue type Ordering Delivery Typical use
Standard Best-effort At least once Highest throughput, order not
critical

FIFO Strict first-in, first-out Exactly once processing Bank transactions, order steps SQS is the classic answer when a question says decouple, buffer, queue, or absorb spikes in traffic. A common pattern is a web tier that writes orders into a queue and an Auto Scaling group of workers that grows or shrinks based on how many messages are waiting.

Amazon SNS: publish/subscribe and fan-out

Amazon Simple Notification Service (Amazon SNS) uses a publish/subscribe (pub/sub) model. A publisher sends one message to an SNS topic. Every subscriber to that topic receives its own copy. Subscribers can be SQS queues, AWS Lambda functions, HTTP/S endpoints, email addresses, mobile push notifications, and SMS text messages. The key difference from SQS: SNS pushes messages out immediately to many receivers, while SQS holds messages until one receiver pulls them. SNS does not store messages for later. If you need both broadcast and durability, you combine them in the fan-out pattern: SNS sends a copy to several SQS queues, and each queue feeds a different processing service.

A. Amazon SQS: decouple with a queue (pull)

then deleted. Messages wait if workers are busy.

B. Amazon SNS: fan-out to many subscribers (push)

Email / SMS subscriber Every subscriber gets its own copy.

SNS + SQS together = fan-out pattern.

Figure 14.1: SQS decouples one producer from a pool of workers, while SNS fans a single message out to many subscribers, often SQS queues.

Exam tip

“One message, many receivers” points to SNS. “Store messages until a worker is ready” points to SQS. “Send an email or text when an alarm fires” is almost always SNS.

Amazon EventBridge: routing events by rules

Amazon EventBridge is a serverless event bus. An event is a small JSON record that says something happened: an EC2 instance changed state, a file landed in S3, a customer signed up in a SaaS application, or your own code reported an order. EventBridge receives events from three kinds of sources:

AWS services (on the default event bus).

Your own applications (custom event buses).

Supported SaaS partners such as ticketing or monitoring tools (partner event buses).

You write rules that match events by their content, and each rule sends matching events to one or more targets, such as Lambda, Step Functions, SQS, SNS, or another bus. EventBridge also has a Scheduler for cron-style jobs (“run this Lambda function every weekday at 6 a.m.”). EventBridge grew out of the older CloudWatch Events feature, so you may still see that name in older material.

Figure 14.2: EventBridge receives events from AWS services, custom applications, and SaaS partners, then rules route each matching event to its targets.

AWS Step Functions: orchestrating workflows

Some processes need several steps in a defined order, with branching, retries, and waiting for humans. AWS Step Functions lets you draw that process as a state machine, a visual workflow in which each step can call Lambda, run a container, write to DynamoDB, or call most other AWS services. Step Functions tracks where each execution is, retries failed steps, and shows a color-coded diagram of every run. Choose it when the question mentions orchestration, coordinating multiple Lambda functions, or a visual workflow.

Amazon MQ: managed traditional message brokers

Many companies already run message brokers such as Apache ActiveMQ or RabbitMQ, using industry protocols like AMQP, MQTT, or STOMP. Rewriting those applications to use SQS and SNS takes effort. Amazon MQ is a managed broker service for ActiveMQ and RabbitMQ, so you can lift and shift existing messaging applications without code changes. On the exam, Amazon MQ is the answer when the scenario stresses migrating an existing application that uses standard messaging protocols; SQS and SNS are the answer for new cloud-native designs.

Need Service
Queue work for one consumer Amazon SQS
Broadcast to many subscribers Amazon SNS
Route events by rules or schedules Amazon EventBridge
Coordinate multi-step workflows AWS Step Functions
Migrate ActiveMQ or RabbitMQ apps Amazon MQ

14.3 Monitoring with Amazon CloudWatch

Amazon CloudWatch is the central monitoring and observability service for AWS resources and applications. Think of it as the instrument panel of your cloud. It has four core features you must know.

Metrics

A metric is a number tracked over time, such as EC2 CPU utilization, the number of messages in an SQS queue, or Lambda errors. Most AWS services publish metrics to CloudWatch automatically at no extra charge. Basic EC2 monitoring sends data every 5 minutes; detailed monitoring (paid) sends it every minute. You can also publish custom metrics from your own code, such as “orders per minute”. Note that EC2 memory usage is not a default metric, because AWS cannot see inside your operating system; you install the CloudWatch agent to collect it.

Logs

CloudWatch Logs collects, stores, and searches log files from applications, Lambda functions, EC2 instances (through the agent), VPC Flow Logs, and CloudTrail. You can set how long logs are retained, search them with Logs Insights queries, and create metric filters that turn log patterns (for example, the word “ERROR”) into metrics.

Alarms

A CloudWatch alarm watches one metric and compares it to a threshold you choose. An alarm has three states: OK, ALARM, and INSUFFICIENT_DATA. When the state changes, the alarm can take actions:

Send a notification through an SNS topic (email, SMS, and so on).

Trigger an EC2 Auto Scaling policy to add or remove instances.

Perform an EC2 action, such as stop, terminate, reboot, or recover an instance.

A popular cost-control example is a billing alarm on the EstimatedCharges metric, although AWS Budgets (Chapter 15) is now the more complete tool for that job.

Dashboards

CloudWatch dashboards are customizable pages of graphs and numbers that put the metrics you care about on one screen, even across Regions and accounts. Operations teams often keep a dashboard on a wall monitor.

Hands-on lab

Hands-on: create a CPU alarm for an EC2 instance

1. Open the CloudWatch console and choose Alarms, then Create alarm.
2. Choose Select metric, then EC2, Per-Instance Metrics, and pick the CPUUtilization metric for your instance.
3. Set the statistic to Average and the period to 5 minutes.
4. Under Conditions, choose Greater than and enter 80 (percent).
5. Under Notification, choose In alarm and create a new SNS topic with your email address. Confirm the subscription email when it arrives.
6. Name the alarm (for example, web-high-cpu ), review, and choose Create alarm.
7. Watch the alarm move from INSUFFICIENT_DATA to OK. Delete the alarm and the SNS topic when you finish. Cloud console | CloudWatch > Alarms > Create alarm

Whenever CPUUtilization is...

Figure 14.3: The main parts of a CloudWatch alarm form: metric, threshold condition, and SNS notification action. (Illustration, not an actual AWS screenshot.)

14.4 CloudTrail, Config, and CloudWatch: what, who, and how it changed

Three services are constantly confused on the exam because they all “watch” your account. The easiest way to keep them apart is to ask what question each one answers.

Amazon CloudWatch answers “What is happening right now, and how is it performing?” It deals in metrics, logs, and alarms about resource performance and health.

AWS CloudTrail answers “Who did what, when, and from where?” It records API calls made in your account, whether from the console, the CLI, an SDK, or another AWS service. Each record shows the identity, time, source IP address, and the request. The Event history shows the last 90 days of management events for free; create a trail to keep records in an S3 bucket for as long as you need. CloudTrail is the go-to service for security investigations and auditing (“Who deleted this S3 bucket?”).

AWS Config answers “How is this resource configured, how has that changed over time, and is it compliant?” It keeps a configuration history of your resources and evaluates them against Config rules, such as “all EBS volumes must be encrypted” or “no security group may allow SSH from anywhere”. Noncompliant resources are flagged, and you can attach automatic remediation. Conformance packs bundle many rules together, for example to match a compliance framework.

The monitoring trio: what, who, how it changed

Amazon CloudWatch

WHAT is happening?

WHO did it?

HOW did it change?

Figure 14.4: The monitoring trio. CloudWatch watches performance, CloudTrail records who made each API call, and Config tracks how resource configurations change and whether they comply.

Real-world example

Real-world scenario: A web server suddenly stops accepting traffic. CloudWatch shows the request count dropping to zero at 14:02 (what happened). AWS Config shows that the instance’s security group lost its port 443 rule at 14:01 (how the configuration changed). CloudTrail shows that a specific IAM user called the RevokeSecurityGroupIngress API at 14:01 from an unfamiliar IP address (who did it). Used together, the three services tell the whole story.

Common trap

CloudTrail does not measure CPU or latency, and CloudWatch does not record which IAM user made a change. If the question contains the words audit, API call, or who, choose CloudTrail. If it says compliance of resource settings or configuration history, choose AWS Config.

14.5 Operating and governing your environment

AWS Systems Manager

AWS Systems Manager is a toolbox for operating fleets of servers, both EC2 instances and on-premises machines (called managed nodes), from one place. A small agent on each machine lets Systems Manager act on it. Capabilities worth recognizing:

Session Manager: open a secure shell or PowerShell session from the browser without opening inbound SSH or RDP ports or managing SSH keys. Sessions can be logged.

Run Command: run a script or command across hundreds of instances at once.

Patch Manager: scan and apply operating system patches on a schedule.

Parameter Store: store configuration values and secrets (such as database connection strings) securely. For automatic secret rotation, AWS Secrets Manager is the specialized choice.

Automation: run predefined runbooks for common tasks, such as restarting an instance or creating an image. Inventory: collect information about software installed across your fleet.

If a question mentions managing many servers, patching, or getting shell access without SSH keys or bastion hosts, think Systems Manager.

AWS Health Dashboard

The AWS Health Dashboard tells you about events at AWS that might affect you. It has two views. The service health view shows the general status of AWS services in every Region, for everyone. The your account health view is personalized: it lists issues, scheduled maintenance (for example, an instance scheduled for retirement), and notifications that affect your resources specifically, with guidance on what to do. You can route Health events to EventBridge to automate responses. Older names for these views were the Service Health Dashboard and the Personal Health Dashboard.

AWS Trusted Advisor

AWS Trusted Advisor inspects your account and recommends improvements against AWS best practices. Its checks fall into categories: cost optimization, performance, security, fault tolerance, service limits (service quotas), and operational excellence. Examples include idle load balancers, underused EC2 instances, security groups with unrestricted ports, root accounts without MFA, and S3 buckets with open access. How many checks you see depends on your Support plan, which Chapter 16 covers.

AWS Service Catalog

AWS Service Catalog lets an organization publish an approved list of IT products, such as a standard web server stack or a preconfigured database, built from infrastructure-as-code templates. Users can launch only what is in the catalog, which keeps deployments consistent and compliant without giving everyone broad permissions. It answers questions about self-service with governance.

AWS License Manager

AWS License Manager helps you track and enforce software licenses from vendors such as Microsoft, Oracle, and SAP across AWS and on-premises. You define licensing rules (for example, the number of cores or instances allowed), and License Manager helps prevent overuse and makes audits easier. It also helps manage Dedicated Hosts used for bring-your-own-license (BYOL) software.

AWS Compute Optimizer

AWS Compute Optimizer uses machine learning on your CloudWatch utilization data to recommend the right size and type for EC2 instances, Auto Scaling groups, EBS volumes, Lambda functions, and some container and database workloads. If a question asks how to find over-provisioned instances and get rightsizing recommendations, Compute Optimizer is the best match. (Trusted Advisor also flags low-utilization instances, but Compute Optimizer gives deeper, specific recommendations.)

Question keyword Service
Patch servers, shell without SSH Systems Manager
AWS outageaffecting my resources AWS Health Dashboard
Best-practice checksacross categories Trusted Advisor
Approved, self-service product list Service Catalog
Track software licenses License Manager
Rightsize instances Compute Optimizer

14.6 Developer tools and CI/CD

Teams that release software often use continuous integration and continuous delivery (CI/CD). Every code change is automatically built, tested, and deployed through a pipeline, so releases become small, frequent, and repeatable instead of large and risky. AWS provides a family of managed services for each stage.

AWS CodePipeline orchestrates the whole release process. It watches a source repository, then moves each change through build, test, approval, and deploy stages. It is the “conveyor belt”.

AWS CodeBuild compiles source code, runs tests, and produces deployable packages. It is fully managed and charges per build minute, so you do not maintain build servers.

AWS CodeDeploy automates deployments to EC2 instances, on-premises servers, Lambda functions, and Amazon ECS services, with options such as rolling and blue/green deployments and automatic rollback.

AWS CodeArtifact is a managed repository for software packages (such as npm, PyPI, and Maven packages), so teams can store and share dependencies securely.

AWS X-Ray traces requests as they travel through a distributed application, showing a service map and where time is spent or errors occur. Choose it for debugging or finding performance bottlenecks in microservices. For the source stage, most teams now connect CodePipeline to a third-party Git provider such as GitHub, GitLab, or Bitbucket. AWS CodeCommit (a managed Git service) and AWS Cloud9 (a browser-based IDE) stopped accepting new customers in 2024, so check current availability before planning around them. You may still see them named in exam questions as the AWS source-control and cloud IDE options.

A CI/CD pipeline on AWS

AWS CodePipeline (orchestrates every stage)

1. Source

Git repository

(GitHub, GitLab...)

2. Build

AWS CodeBuild

compile, package

3. Test

CodeBuild tests,

manual approval

4. Deploy

AWS CodeDeploy

EC2, Lambda, ECS

A failed stage stops the release; developers fix the code and commit again.

Each commit flows automatically: small, frequent, repeatable releases.

CodeArtifact: stores packages and
dependencies used by the build
X-Ray: traces requests in the running
app to find errors and slow spots

Figure 14.5: A CI/CD pipeline. CodePipeline moves each code change from source through build, test, and deploy stages, with CodeBuild and CodeDeploy doing the work.

Building front ends and mobile apps

AWS Amplify helps web and mobile developers build and host full-stack applications quickly. It provides hosting with CI/CD from Git, plus libraries for adding authentication, data, and storage backed by AWS services. AWS AppSync builds managed GraphQL (and real-time) APIs, letting apps fetch exactly the data they need from several sources in one request.

AWS Device Farm tests web and mobile apps on real physical phones and tablets hosted by AWS, so you do not have to buy a drawer full of devices.

Good to know

AWS also offers infrastructure-as-code and design tools covered elsewhere in this book, such as AWS CloudFormation, the AWS CDK, and AWS Infrastructure Composer (formerly Application Composer). Amazon Q Developer is the generative AI assistant for coding and AWS questions.

14.7 End-user computing, business applications, and IoT

End-user computing

Amazon WorkSpaces provides managed virtual desktops (Windows or Linux) in the cloud. Employees log in from almost any device and get a full, persistent desktop. It suits remote workforces, contractors, and replacing aging office PCs.

Amazon AppStream 2.0 streams individual applications (not whole desktops) to a web browser. A design firm could stream a heavy 3D application to students who only have laptops.

Amazon WorkSpaces Secure Browser (formerly WorkSpaces Web) gives users a secure, managed browser for reaching internal websites and SaaS apps, with no data stored on the user’s device.

Exam tip

Full desktop in the cloud = WorkSpaces. One application streamed to a browser = AppStream 2.0.

Business applications

Amazon Connect is a cloud contact center service. You can set up phone and chat customer service, with call routing, recording, and analytics, in a short time and pay per use.

Amazon Simple Email Service (Amazon SES) sends large volumes of email from applications: transactional messages such as receipts and password resets, as well as marketing campaigns. Compare it with SNS, which can send simple email notifications to subscribers but is not built for formatted, high-volume customer email.

Internet of Things

AWS IoT Core securely connects billions of devices, such as sensors, smart meters, and connected cars, to the AWS Cloud. Devices send messages using protocols such as MQTT, and IoT Core routes the data to other services (for example, to store readings in DynamoDB or trigger Lambda). If a question involves connecting many physical devices to the cloud, IoT Core is the answer.

Chapter 14 summary

Decoupling with integration services makes applications more resilient, scalable, and easier to change. SQS queues messages for one consumer at a time (Standard or FIFO); SNS pushes one message to many subscribers; fan-out combines them.

EventBridge routes events from AWS services, your apps, and SaaS partners by rules and schedules; Step Functions orchestrates multi-step workflows; Amazon MQ hosts ActiveMQ and RabbitMQ for migrations.

CloudWatch provides metrics, logs, alarms, and dashboards for performance monitoring; alarms can notify through SNS or trigger scaling and EC2 actions.

CloudTrail records who made API calls (auditing); AWS Config records configuration history and evaluates compliance rules.

Systems Manager operates server fleets (Session Manager, Run Command, Patch Manager, Parameter Store); Health Dashboard reports AWS events affecting you; Trusted Advisor checks best practices.

Service Catalog, License Manager, and Compute Optimizer handle approved products, licenses, and rightsizing. CodePipeline, CodeBuild, CodeDeploy, CodeArtifact, and X-Ray support CI/CD and debugging; Amplify, AppSync, and Device Farm support front-end and mobile work.

WorkSpaces (desktops), AppStream 2.0 (apps), WorkSpaces Secure Browser, Connect (contact center), SES (email), and IoT Core (devices) round out the services to recognize.

Key terms

Loose coupling

Designing components so they communicate through intermediaries and do not depend on each other being available at the same moment.

Fan-out

A pattern in which one SNS message is delivered to several subscribers, often SQS queues, for parallel processing.

Event bus

An EventBridge channel that receives events and applies rules to route them to targets.

State machine

A Step Functions workflow definition made of steps (states) and the transitions between them.

CloudWatch alarm

A watcher on a metric that changes state (OK, ALARM, INSUFFICIENT_DATA) at a threshold and can trigger notifications or actions.

Trail

A CloudTrail configuration that delivers API activity records to an S3 bucket for long-term retention.

Config rule

An AWS Config check that evaluates whether resource configurations meet a desired setting.

CI/CD

Continuous integration and continuous delivery: automatically building, testing, and deploying every code change through a pipeline.

Practice questions

1. A company’s web tier receives sudden bursts of orders. The order-processing servers cannot keep up during peaks, and some orders are lost. Which service should be placed between the tiers to store orders until they can be processed?

A. Amazon SNS B. Amazon SQS
C. AWS Step Functions D. Amazon CloudWatch

2. When a new user signs up, an application must simultaneously notify a billing service, an analytics service, and a welcome-email service. Each service must receive its own copy of the event. Which service is designed for this publish/subscribe pattern?

A. Amazon SNS B. Amazon SQS FIFO queue
C. AWS CloudTrail D. Amazon MQ

3. A company runs an on-premises application that uses Apache ActiveMQ and wants to move it to AWS without rewriting the messaging code. Which service should it use?

A. Amazon SQS B. Amazon EventBridge
C. Amazon MQ D. Amazon SNS

4. A developer wants to run a Lambda function automatically every night at midnight and also react whenever an EC2 instance is stopped. Which service can handle both requirements?

A. Amazon EventBridge B. AWS Config
C. AWS CodeDeploy D. Amazon SES

5. An insurance company processes claims in several steps: validate the claim, check for fraud, wait for manager approval, then pay. It wants a visual workflow with automatic retries. Which service fits best?

A. Amazon SQS B. AWS Step Functions
C. AWS Systems Manager D. Amazon AppStream 2.0

6. A security team needs to find out which IAM user deleted a DynamoDB table yesterday. Which service provides this information?

A. Amazon CloudWatch B. AWS Config
C. AWS CloudTrail D. AWS Trusted Advisor

7. A company must prove to auditors that all of its EBS volumes have been encrypted continuously over the last six months, and it wants noncompliant volumes flagged automatically. Which service should it use?

A. AWS Config B. AWS CloudTrail
C. Amazon CloudWatch Logs D. AWS Health Dashboard

8. An operations team wants an email when the average CPU utilization of an EC2 instance exceeds 80% for 10 minutes. Which combination of services accomplishes this? (Choose two.)

A. Amazon CloudWatch alarm B. AWS CloudTrail trail
C. Amazon SNS topic D. AWS Config rule
E. Amazon SQS queue

9. Administrators need to open shell sessions on EC2 instances in private subnets without opening port 22 or managing SSH keys. Which service provides this?

A. AWS Systems Manager Session Manager B. Amazon WorkSpaces
C. AWS CodeDeploy D. AWS Direct Connect

10. A company receives a notification that one of its EC2 instances is scheduled for retirement due to degraded underlying hardware. Where would this account-specific event appear?

A. AWS Trusted Advisor B. AWS Health Dashboard
C. AWS Config D. AWS Service Catalog

11. Which AWS service inspects an account and provides recommendations across cost optimization, security, fault tolerance, performance, and service limits?

A. AWS Compute Optimizer B. AWS Trusted Advisor
C. Amazon Inspector D. AWS License Manager

12. A central IT team wants employees to launch only preapproved, company-standard environments without granting them broad permissions. Which service should it use?

A. AWS Service Catalog B. AWS Organizations
C. AWS Amplify D. AWS CodeArtifact

13. A company suspects many EC2 instances are larger than necessary. It wants machine learning-based recommendations for better instance types based on actual usage. Which service fits best?

A. AWS Cost Explorer forecasts B. AWS Compute Optimizer
C. Amazon CloudWatch dashboards D. AWS Systems Manager Patch Manager

14. A team wants every commit to a Git repository to be automatically built, tested, and deployed to EC2 instances. Which AWS service orchestrates the stages of this release process?

A. AWS CodeBuild B. AWS CodePipeline
C. AWS X-Ray D. AWS CodeArtifact

15. Users report that a microservices application is slow, but the team cannot tell which service is causing the delay. Which service traces requests end to end to locate the bottleneck?

A. AWS CloudTrail B. AWS X-Ray
C. AWS Config D. Amazon EventBridge

16. A university wants to deliver a resource-intensive engineering application to students’ browsers without installing it on their laptops. Which service should it choose?

A. Amazon WorkSpaces B. Amazon AppStream 2.0
C. AWS Device Farm D. Amazon Connect

17. A retailer needs to set up a cloud-based customer service phone and chat center quickly, paying only for usage. Which service fits?

A. Amazon SES B. Amazon SNS
C. Amazon Connect D. AWS AppSync

18. A utility company wants to securely collect readings from millions of smart meters and route the data to other AWS services for processing. Which service should it use first?

A. AWS IoT Core B. Amazon MQ
C. Amazon WorkSpaces Secure Browser D. AWS Device Farm

Answers and explanations

1. B. SQS buffers messages durably until consumers can process them, which smooths out spikes. SNS pushes messages immediately and does not store them, and Step Functions orchestrates workflows rather than buffering load.
2. A. SNS delivers a copy of each published message to every subscriber. An SQS queue delivers each message to one consumer, and Amazon MQ is meant for migrating existing broker-based apps.
3. C. Amazon MQ is a managed ActiveMQ and RabbitMQ broker that supports the same protocols, so no code changes are needed. SQS and SNS would require rewriting the messaging code.
4. A. EventBridge supports schedules (EventBridge Scheduler or scheduled rules) and rules that match AWS service events such as EC2 state changes. Config records configuration state, and CodeDeploy deploys code.
5. B. Step Functions coordinates multi-step workflows as visual state machines, with retries, branching, and waits for approval. SQS only queues messages and has no workflow logic.
6. C. CloudTrail records API calls, including the identity that made them. CloudWatch focuses on performance metrics and logs, and Config tracks resource configuration rather than who called an API.
7. A. AWS Config keeps configuration history and evaluates resources against rules such as “EBS volumes must be encrypted”. CloudTrail records API activity, not ongoing compliance state.
8. A, C. A CloudWatch alarm watches the CPU metric against the threshold, and its action publishes to an SNS topic that emails subscribers. CloudTrail and Config do not monitor CPU utilization.
9. A. Session Manager provides browser-based or CLI shell access through the Systems Manager agent with no inbound ports or SSH keys. WorkSpaces provides virtual desktops, not server access.
10. B. The account-specific view of the AWS Health Dashboard shows scheduled events and issues affecting your own resources. Trusted Advisor gives best-practice recommendations, not AWS maintenance notices.
11. B. Trusted Advisor runs best-practice checks in these categories (plus operational excellence). Compute Optimizer focuses only on rightsizing, and Amazon Inspector scans workloads for vulnerabilities.
12. A. Service Catalog publishes approved products that users can launch through self-service. Organizations manages accounts and policies but does not offer a product catalog.
13. B. Compute Optimizer analyzes utilization with machine learning and recommends optimal instance types and sizes. Cost Explorer forecasts spending but does not give detailed instance recommendations of this kind.
14. B. CodePipeline orchestrates the source, build, test, and deploy stages. CodeBuild performs only the build and test step inside the pipeline.
15. B. X-Ray traces requests across distributed services and shows where latency and errors occur. CloudTrail records API calls for auditing, not application performance.
16. B. AppStream 2.0 streams individual applications to a browser. WorkSpaces would deliver a full desktop, which is more than the scenario requires.
17. C. Amazon Connect is a pay-as-you-go cloud contact center. SES sends email and SNS sends notifications; neither runs a call center.
18. A. IoT Core connects devices securely and routes their messages to other AWS services. Amazon MQ is for traditional message brokers, and Device Farm tests mobile apps.