8 Global Infrastructure and Ways to Deploy · AWS Cloud Practitioner

In this chapter you will learn how AWS organizes its physical infrastructure into Regions, Availability Zones, and edge locations; when to reach for Local Zones, Wavelength Zones, and AWS Outposts; which services are global and which are regional; the different ways you can talk to AWS (the console, the CLI, SDKs, and CloudShell); how infrastructure as code works with AWS CloudFormation and the AWS CDK; what Elastic Beanstalk and AWS Infrastructure Composer do for you; and how your own network connects to AWS over the internet, a Site-to-Site VPN, or AWS Direct Connect. This chapter opens Domain 3, Cloud Technology and Services (34% of the scored exam), and maps to Task Statement 3.1 (define methods of deploying and operating in the AWS Cloud) and Task Statement 3.2 (define the AWS global infrastructure).

8.1 Why the physical layout matters

When people say “the cloud,” it is easy to picture something weightless. In reality, every virtual server, database, and file you store in AWS lives on physical hardware in a building somewhere on Earth. That building has a street address, a power supply, cooling, and network cables. Because physics still applies, where your resources live affects three things you care about: how fast your users get a response (latency), which laws apply to your data (data residency and compliance), and how well your application survives when something breaks (resilience).

AWS has organized its hardware into a clear hierarchy so that you can make those choices deliberately. Learn this hierarchy well. A surprising number of exam questions, including many that look like they are about other topics, quietly depend on knowing whether a resource lives in one data center, one Availability Zone, one Region, or everywhere at once.

8.2 Regions

An AWS Region is a separate geographic area, such as Northern Virginia, Ireland, Frankfurt, Tokyo, Sydney, or São Paulo. AWS operates more than 30 Regions around the world and keeps adding new ones. Each Region has a name you will see in the console (for example, “US East (N. Virginia)”) and a code you will see in the CLI and in documentation (for example, us-east-1 , eu-west-1 , ap-southeast-2 ).

The most important property of a Region is isolation. Regions are designed to be independent of one another. A problem in one Region is not supposed to spill into another. By default, your data stays in the Region where you put it; AWS does not copy it to another Region unless you, or a service feature you turn on, ask it to. This is the foundation for data residency: if your data must stay in Germany, you choose the Frankfurt Region and do not configure anything that replicates it elsewhere.

Some newer Regions, and a few older ones, are opt-in Regions. They are disabled by default in a new account, and an administrator must enable them before resources can be created there. You do not need to memorize which ones; just know the concept exists.

How to choose a Region

The exam expects you to know the four factors that drive Region choice. A handy way to remember them is to think “Can we, Location, Services, Price”:

Factor Question to ask Example

Compliance Are we legally allowed to store data here? Patient data must stay in-country Latency (proximity) Is it close to our users? Customers in Brazil, use São Paulo Serviceavailability Does it offer the services we need? A new AI feature is not yet in every Region Pricing What does it cost here? Prices differ between Regions

Compliance usually comes first because it is not negotiable. If a regulation or contract says data must stay within a country or economic area, the other three factors only help you choose among the Regions that satisfy it. Latency is about physical distance: light in fiber is fast but not instant, and a user in Singapore will feel the difference between a server in Singapore and one in Oregon. Service availability matters because AWS usually launches new services and features in a few Regions first and then expands. Pricing varies because land, power, taxes, and other costs differ from place to place; the same instance type can cost noticeably more in one Region than another.

Exam tip

When a question mentions laws, regulations, data sovereignty, or “data must not leave the country,” the answer is about choosing the right Region. Edge locations, Availability Zones, and caching do not solve a data-residency requirement.

8.3 Availability Zones

Inside each Region are multiple Availability Zones (AZs). An AZ is one or more discrete data centers with redundant power, networking, and connectivity. AWS designs Regions with at least three AZs. The AZs in a Region are physically separated by a meaningful distance (many kilometers), so that a fire, flood, or power event that affects one is unlikely to affect another, but they are close enough (within about 100 km, or 60 miles) to be linked with high-bandwidth, low-latency private fiber. That combination is what makes synchronous replication between AZs practical. AZ names look like the Region code plus a letter, such as us-east-1a and us-east-1b . One subtle detail: the letter-to-physical-zone mapping can differ between AWS accounts, so your us-east-1a may not be the same building as another customer’s us-east-1a . AWS also provides AZ IDs (such as use1-az1 ) that are consistent across accounts when you need to coordinate.

Run copies of your app in 2+ AZs so losing one AZ does not take you offline.

Figure 8.1: The AWS infrastructure hierarchy. A Region contains at least three isolated Availability Zones, and each Availability Zone

contains one or more data centers linked by low-latency private networking.

Why AZs matter: high availability

The whole point of AZs is to let you build applications that keep running when a single location fails. If you run one web server in one AZ, your application has a single point of failure. If you run web servers in two or three AZs behind a load balancer, losing one AZ means losing only part of your capacity. Many managed services do this for you automatically. Amazon S3 Standard, for example, stores data across multiple AZs, and Amazon RDS can maintain a standby copy of your database in a second AZ (a Multi-AZ deployment).

Common trap

“Deploy across multiple Regions” and “deploy across multiple AZs” are not the same answer. Multiple AZs is the standard, recommended way to achieve high availability within a Region. Multiple Regions is for disaster recovery from a regional event, for serving users on different continents with low latency, or for meeting residency rules in several countries. If the question only asks for high availability at reasonable cost, pick multiple AZs.

8.4 Edge locations and points of presence

Regions are where your applications run. Edge locations are where AWS meets your users. AWS operates hundreds of edge locations, plus smaller regional edge caches, in major cities around the world, far more of them than there are Regions. Collectively these sites are called points of presence (PoPs).

You do not launch EC2 instances in an edge location. Instead, specific services use the edge network: Amazon CloudFront, the content delivery network (CDN), caches copies of your content (images, videos, web pages, API responses) at edge locations so that users download it from a nearby city instead of from your origin Region.

Amazon Route 53, the DNS service, answers DNS queries from edge locations around the world.

AWS Global Accelerator gives you fixed anycast IP addresses at the edge and then carries user traffic across the AWS private global network to your application, avoiding much of the congestion of the public internet. AWS WAF and AWS Shield can protect traffic at the edge when used with CloudFront.

Amazon S3 Transfer Acceleration uses edge locations to speed up long-distance uploads into S3 buckets (see Chapter 10).

Lambda@Edge and CloudFront Functions run small pieces of code at edge locations to customize content close to the user.

All of these sites, Regions and edge locations alike, are connected by the AWS global network, a private backbone of redundant fiber that AWS owns or leases. Traffic between Regions and between edge locations and Regions can ride this backbone rather than the open internet.

Figure 8.2: A schematic view of the AWS global footprint. A small number of large Regions host your workloads, while many more edge

locations near users cache content and accept traffic, all linked by the AWS private global network. Not drawn to scale or to real geography.

Exam tip

If a question says users far from your Region see slow load times for static content like images and videos, the answer is almost always CloudFront (caching at edge locations). If the traffic is not cacheable (gaming over UDP, dynamic APIs) and the goal is a faster, more reliable path plus static IP addresses, think Global Accelerator.

8.5 Bringing AWS closer: Local Zones, Wavelength Zones, and Outposts

Regions and edge locations cover most needs, but some workloads need AWS compute even closer to a specific place. AWS offers three ways to extend its infrastructure outward. The exam likes to test whether you can tell them apart, so focus on where each one physically sits.

AWS Local Zones

A Local Zone is an extension of a Region placed in a large metropolitan area that is far from the Region itself. It offers a subset of services, such as EC2, EBS, and some database and container services, so that you can run latency-sensitive parts of an application within single-digit milliseconds of users in that city. Typical users include media studios doing real-time video rendering, game servers, and hybrid applications that must stay close to an on-premises data center in that city. A Local Zone is managed and owned by AWS; you enable it in your account and then extend a VPC subnet into it.

AWS Wavelength Zones

A Wavelength Zone places AWS compute and storage inside a telecommunications provider’s 5G network. Traffic from a mobile device on that carrier’s network can reach your application without leaving the carrier’s network to travel across the internet. This gives ultra-low latency for mobile and connected-device use cases such as interactive video streaming, augmented and virtual reality, connected vehicles, and real-time game streaming to phones.

AWS Outposts

AWS Outposts brings AWS infrastructure into your own data center or on-premises facility. AWS delivers, installs, and maintains racks (Outposts racks) or smaller servers (Outposts servers) that run AWS services such as EC2, EBS, ECS, EKS, and RDS. You manage them with the same console, APIs, and tools you use in a Region, and the Outpost connects back to its parent Region. Outposts is the answer when data must stay on premises for residency or processing reasons, when an application needs very low latency to on-premises systems (for example, factory equipment), or when you want a consistent hybrid experience.

Figure 8.3: Where each extension of AWS lives. Local Zones sit in AWS-run facilities in large cities, Wavelength Zones sit inside a carrier’s 5G

network, and Outposts sit in the customer’s own data center. All are anchored to a parent Region.

Option Physically located in Best for
Local Zone AWS site in a big city Low latency to a metro area
Wavelength Zone Telecom 5G network Ultra-low latency to mobile devices
Outposts Your data center On-premises data, hybrid consistency
Edge location AWS PoP in many cities Caching and DNS (CloudFront, Route
53)

Good to know

With Outposts, the shared responsibility model shifts a little. AWS still owns and maintains the hardware, but you are responsible for the physical security of your facility, its power, and its network connectivity.

8.6 Global, regional, and zonal services

Not every AWS service is scoped the same way. Knowing the scope tells you where you must create a resource and what happens if a location fails.

Global services are not tied to a single Region. You see the same resources no matter which Region the console is pointed at. The classic examples are IAM (users, groups, roles, and policies), Amazon Route 53 (DNS), Amazon CloudFront (CDN), and AWS Organizations. AWS WAF rules attached to CloudFront are also managed globally. Regional services are the majority. You create the resource in one Region and it stays there: Amazon S3 buckets, Amazon DynamoDB tables, AWS Lambda functions, Amazon VPCs, Amazon RDS databases, and so on. Many regional services spread their data across several AZs automatically.

Zonal resources live in a single AZ. An EC2 instance, an EBS volume, and a subnet each belong to exactly one AZ. That is why high availability requires you to place copies in more than one AZ.

Common trap

Amazon S3 is a regional service, even though bucket names must be globally unique and the S3 console shows all your buckets on one page. You choose a Region when you create each bucket, and the data stays there unless you configure replication.

8.7 Ways to access and operate AWS

Every action in AWS, from launching a server to reading a bill, is ultimately an API call: an authenticated HTTPS request to an AWS service endpoint. The different access methods are simply different ways of making those calls.

AWS Management Console

The AWS Management Console is the web-based graphical interface. It is great for learning, exploring, one-off tasks, and viewing dashboards. You sign in with root user credentials (rarely), an IAM user, or, preferably, through IAM Identity Center. The console has a Region selector in the top bar, which matters for regional services: if you cannot find a resource you know you created, check that the console is pointed at the right Region. There is also a mobile app for checking resources and alarms on the go.

AWS Command Line Interface (CLI)

The AWS CLI is a single tool you install on Windows, macOS, or Linux that lets you run AWS commands from a terminal, such as aws s3 ls or aws ec2 describe-instances . It is ideal for repeatable tasks and simple automation scripts. The CLI authenticates using credentials you configure, such as access keys or, better, short-lived credentials from IAM Identity Center.

AWS Software Development Kits (SDKs)

The AWS SDKs are libraries for programming languages such as Python (Boto3), JavaScript/TypeScript, Java, .NET, Go, Ruby, PHP, C++, and Rust. Developers use them to call AWS services from inside their own applications. For example, a web application might use an SDK to upload a user’s profile photo to S3 or to write an order to DynamoDB.

AWS CloudShell

AWS CloudShell is a browser-based command line that you open directly from the console with one click. It comes preauthenticated with the credentials of the person who is signed in, and it has the AWS CLI and common tools (such as Python, Node.js, and git) already installed. Each user gets a small amount of persistent home-directory storage per Region (1 GB), so scripts you save there are still there next time. There is no extra charge for CloudShell itself. It is the quickest way to run CLI commands when you cannot or do not want to install anything locally.

Figure 8.4: AWS CloudShell opens a terminal panel inside the console, already signed in as the current user, with the AWS CLI ready to use. (Illustration, not an actual AWS screenshot.)

Hands-on lab

Hands-on mini lab: run your first CLI command in CloudShell

1. Sign in to the AWS Management Console with an IAM Identity Center user or IAM user (not the root user).
2. Check the Region selector in the top navigation bar and choose a Region close to you.
3. Choose the CloudShell icon (a small terminal symbol) in the top navigation bar. A terminal panel opens at the bottom of the page after a few seconds.
4. Type aws sts get-caller-identity and press Enter. The output shows your account ID and the identity you are signed in as.
5. Type aws s3 ls to list your S3 buckets (the list may be empty).
6. Type aws ec2 describe-availability-zones --query "AvailabilityZones[].ZoneName" to list the AZs in the current Region.
7. Close the CloudShell panel. Nothing you did created a billable resource.

Programmatic access versus console access

The exam sometimes contrasts these. Console access uses a user name and password (plus MFA). Programmatic access (CLI, SDKs, direct API calls) uses access keys or temporary credentials. Long-term access keys should be avoided where possible; roles and IAM Identity Center provide temporary credentials that expire automatically.

8.8 Infrastructure as code

Clicking through the console is fine for learning, but it does not scale. Suppose you build a working environment by hand with a VPC, subnets, security groups, a load balancer, and a database, and then need an identical copy for testing, or a third copy in another Region. Doing it again by hand is slow and error-prone. Infrastructure as code (IaC) solves this by describing infrastructure in text files that can be version-controlled, reviewed, reused, and deployed automatically. IaC is a direct application of the Well-Architected guidance to “perform operations as code.”

AWS CloudFormation

AWS CloudFormation is AWS’s native IaC service. You write a template in JSON or YAML that declares the resources you want and how they are configured. You give the template to CloudFormation, which creates all the resources as a single unit called a stack. CloudFormation works out the correct order (it creates the VPC before the subnet that lives in it), and if something fails partway through, it rolls back by default so you are not left with a half-built environment. Key ideas:

Declarative. You describe what you want, not the step-by-step commands to build it.

Repeatable. The same template can create identical stacks in different accounts and Regions. StackSets extend this to many accounts and Regions at once.

Updatable. To change infrastructure, you edit the template and update the stack. A change set previews what CloudFormation will add, modify, or replace before you commit.

Drift detection tells you if someone changed a resource by hand so that it no longer matches the template. Deleting a stack deletes the resources it created, which makes cleanup of test environments easy. No extra charge for CloudFormation itself when used with AWS resources; you pay for the resources it creates. From template to stack with AWS CloudFormation

Figure 8.5: How CloudFormation works. A template stored in version control is submitted to CloudFormation, which creates, updates, or deletes the resources of a stack as one unit and rolls back if anything fails.

AWS Cloud Development Kit (CDK)

Many developers prefer writing real code to writing long YAML files. The AWS CDK lets you define infrastructure using familiar programming languages: TypeScript, JavaScript, Python, Java, C#, and Go. CDK provides high-level building blocks called constructs that bundle sensible defaults; a few lines of code might produce a load-balanced container service with all its networking. When you deploy, the CDK synthesizes your code into a CloudFormation template, and CloudFormation does the actual provisioning. So CDK is not a replacement for CloudFormation; it is a friendlier way to produce CloudFormation templates.

AWS Infrastructure Composer

AWS Infrastructure Composer (formerly AWS Application Composer) is a visual designer. You drag resources such as API Gateway, Lambda functions, DynamoDB tables, and queues onto a canvas, connect them, and Infrastructure Composer generates the corresponding CloudFormation (or AWS SAM) template for you. It also works in reverse: load an existing template and see it drawn as a diagram. It is available in the console and inside popular code editors. It is a good fit for people who think visually or who want to learn what a template looks like.

Exam tip

“Provision the same resources repeatedly and consistently,” “version-control infrastructure,” or “treat infrastructure as code” all point to CloudFormation. If the question adds “using a familiar programming language,” choose the AWS CDK. If it says “visually design” or “drag and drop” to build a template, choose Infrastructure Composer.

8.9 AWS Elastic Beanstalk

AWS Elastic Beanstalk is a platform as a service (PaaS) for web applications. You upload your application code (Java, .NET, PHP, Node.js, Python, Ruby, Go, or a Docker container), and Elastic Beanstalk automatically handles the deployment details: provisioning EC2 instances, setting up a load balancer and Auto Scaling, monitoring health, and applying platform updates. You keep full access to the underlying resources if you want to tune them, but you do not have to.

There is no additional charge for Elastic Beanstalk; you pay only for the EC2 instances, load balancers, and other resources it creates. Behind the scenes it uses CloudFormation.

How it differs from CloudFormation is a common exam angle. CloudFormation is a general tool for provisioning any infrastructure from a template. Elastic Beanstalk is an opinionated service for deploying and running a web application where the developer wants to focus on code, not infrastructure.

Real-world example

Real-world scenario: A small team has a Python web application running on a single server in their office. They want to move it to AWS quickly, have it scale with traffic, and avoid learning load balancers and Auto Scaling in detail. Elastic Beanstalk is a strong fit: they upload a zip of the code, choose the Python platform, and get a load-balanced, auto-scaling environment with health monitoring.

8.10 Connecting your network to AWS

Most organizations start in the cloud while keeping some systems on premises. That creates a hybrid environment, and the exam expects you to know the three basic ways your network can reach resources in a VPC.

Over the public internet

The simplest option is to reach public endpoints over the internet using HTTPS. This is how you use the console and how customers reach a public website. It needs nothing special, but traffic crosses the public internet, so performance can vary.

AWS Site-to-Site VPN

AWS Site-to-Site VPN creates an encrypted IPsec tunnel between your on-premises network (your router or firewall, called the customer gateway) and AWS (a virtual private gateway or transit gateway). Each VPN connection includes two tunnels for redundancy. It runs over the internet, so it can be set up in minutes to hours and costs relatively little, but bandwidth and latency depend on internet conditions. A related service, AWS Client VPN, lets individual users connect securely from their laptops.

AWS Direct Connect

AWS Direct Connect is a dedicated, private network connection from your data center or office to AWS through a Direct Connect location. Because it does not travel over the public internet, it provides more consistent latency and throughput, and it can reduce data transfer costs for high-volume workloads. Dedicated connections come in speeds such as 1, 10, and 100 Gbps, and AWS Partners offer hosted connections at lower speeds. Setting one up involves physical cabling and typically takes weeks, not minutes.

Direct Connect traffic is private but not encrypted by default. If you need encryption, you can run a Site-to-Site VPN over the Direct Connect link or, on supported connections, use MACsec. For resilience, organizations often pair a Direct Connect link with a backup VPN, or use two Direct Connect connections at different locations.

Need Choose
Quick, low-cost, encrypted link Site-to-Site VPN
Consistent performance, high bandwidth Direct Connect
Privateand encrypted, high bandwidth VPN over Direct Connect
Individual remote workers Client VPN

Exam tip

Keywords “dedicated,” “private connection that does not use the internet,” and “consistent network performance” mean Direct Connect. Keywords “encrypted,” “over the internet,” and “quickly” mean Site-to-Site VPN.

Chapter 8 summary

A Region is an isolated geographic area; choose one based on compliance, latency to users, service availability, and pricing. Data stays in a Region unless you move it.

Each Region has at least three Availability Zones, each made of one or more data centers with independent power and networking. Deploying across multiple AZs is the standard way to achieve high availability.

Edge locations (points of presence) number in the hundreds and serve CloudFront, Route 53, Global Accelerator, and edge security; you do not run EC2 there.

Local Zones put AWS in large cities, Wavelength Zones put it inside 5G carrier networks, and Outposts put it in your own data center.

IAM, Route 53, CloudFront, and Organizations are global; most services are regional; EC2 instances, EBS volumes, and subnets are zonal.

You can operate AWS through the console, the CLI, SDKs, and CloudShell; all of them make API calls. CloudFormation provisions stacks from JSON or YAML templates; the CDK generates those templates from programming languages; Infrastructure Composer builds them visually.

Elastic Beanstalk deploys and runs web applications from uploaded code, handling capacity, load balancing, scaling, and health, at no extra charge.

Connect on-premises networks with a Site-to-Site VPN (encrypted, over the internet, fast to set up) or Direct Connect (dedicated, private, consistent).

Key terms
Term Meaning
Region Isolated geographic area containing multiple AZs
Availability Zone One or more data centers with independent powerand networking
Edge location AWS site near users for caching and DNS
Local Zone Region extension in alarge metro area
Wavelength Zone AWS compute insidea 5G carrier network
AWS Outposts AWS-managed racks or servers on premises
CloudShell Browser-based, preauthenticated shell in the console
CloudFormation IaC service that builds stacks from templates
Stack Set of resources managed as one unit
AWS CDK Define infrastructure in programming languages
Infrastructure Composer Visual designer that produces templates
Elastic Beanstalk PaaS that deploys web apps from code
Site-to-Site VPN Encrypted IPsec tunnel over the internet
Direct Connect Dedicated private connection to AWS
Practice questions

1. A healthcare company must ensure that patient records never leave Canada. Which decision best addresses this requirement?

A. Use Amazon CloudFront with edge locations in Canada B. Deploy resources in an AWS Region located in Canada
C. Deploy resources across multiple Availability Zones D. Use AWS Global Accelerator to route Canadian users

2. Which of the following correctly describes an Availability Zone?

A. A single server rack within a Region B. A content cache located in a major city
C. One or more discrete data centers with redundant

power, networking, and connectivity

D. A geographic area that contains multiple Regions

3. A company wants its web application to keep running if a single data center fails, while keeping costs reasonable. What should it do?

A. Deploy the application in multiple Availability Zones

within one Region

B. Deploy the application in a single AZ with a larger

instance

C. Deploy the application in a Local Zone D. Deploy the application to edge locations

4. Which factors should a company consider when selecting an AWS Region? (Choose two.)

A. Proximity to its customers B. The number of IAM users in the account
C. Compliance with data residency laws D. The number of edge locations in the world
E. The AWS Support plan it has purchased

5. Users in Australia report slow loading of images on a website hosted in a European Region. Which service will most directly improve performance?

A. AWS Direct Connect B. Amazon CloudFront
C. AWS Outposts D. AWS Site-to-Site VPN

6. A manufacturer needs to run Amazon EC2 instances inside its own factory to process sensor data with very low latency, using the same APIs as in AWS Regions. Which service meets this need?

A. AWS Local Zones B. AWS Wavelength
C. AWS Outposts D. Amazon CloudFront

7. A gaming company wants to deliver ultra-low-latency experiences to players on mobile devices connected to a carrier’s 5G network. Which AWS offering is designed for this?

A. AWS Wavelength Zones B. AWS Outposts
C. Edge locations D. AWS Direct Connect

8. A film studio in a city far from any AWS Region needs single-digit-millisecond latency between artists’ workstations and cloud rendering servers. Which option is most appropriate?

A. AWS Local Zones B. AWS Outposts servers in each artist’s home
C. Amazon S3 Transfer Acceleration D. A second AWS account

9. Which AWS service is global rather than regional?

A. Amazon EC2 B. Amazon RDS
C. AWS Identity and Access Management (IAM) D. Amazon DynamoDB

10. An administrator wants to run AWS CLI commands without installing anything on a locked-down laptop. Which option is quickest?

A. AWS CloudShell B. AWS SDK for Python
C. AWS Direct Connect D. AWS Elastic Beanstalk

11. A company wants to create identical development, test, and production environments across several AWS Regions in a repeatable way. Which service should it use?

A. AWS Elastic Beanstalk B. AWS CloudFormation
C. Amazon CloudWatch D. AWS Trusted Advisor

12. A team of Python developers wants to define AWS infrastructure using Python code instead of YAML templates. Which service should they use?

A. AWS CloudShell B. AWS Cloud Development Kit (AWS CDK)
C. AWS Infrastructure Composer D. AWS Systems Manager

13. Developers want to upload application code and have AWS automatically handle capacity provisioning, load balancing, auto scaling, and health monitoring. Which service fits best?

A. AWS CloudFormation B. AWS Elastic Beanstalk
C. Amazon EC2 D. AWS Outposts

14. A company needs a dedicated, private connection between its data center and AWS that provides consistent network performance and does not travel over the public internet. Which service should it choose?

A. AWS Site-to-Site VPN B. AWS Client VPN
C. AWS Direct Connect D. Amazon CloudFront

15. A small company needs an encrypted connection between its office network and its VPC within a day, at low cost. Which option is best?

A. AWS Direct Connect B. AWS Site-to-Site VPN
C. AWS Outposts D. AWS Global Accelerator

16. Which statements about edge locations are true? (Choose two.)

A. They are used by Amazon CloudFront to cache content B. Customers launch EC2 instances directly in them
C. There are many more edge locations than Regions D. Each edge location is a full AWS Region
E. They are required to meet data residency rules

17. A solutions architect wants to visually drag and drop resources onto a canvas and generate a CloudFormation template from the design. Which service should they use?

A. AWS Infrastructure Composer B. AWS CloudShell
C. AWS Config D. AWS Elastic Beanstalk

18. Which resource is scoped to a single Availability Zone?

A. An Amazon S3 bucket B. An IAM role
C. An Amazon EBS volume D. A CloudFront distribution

Answers and explanations

1. B. Data stays in the Region you choose unless you move it, so a Canadian Region satisfies residency. CloudFront and Global Accelerator are about delivery speed, not where data is stored, and multiple AZs are still within whichever Region you pick.
2. C. An AZ is one or more discrete data centers with redundant power, networking, and connectivity. A Region contains AZs (not the reverse), and a city cache is an edge location.
3. A. Spreading across multiple AZs protects against a single data center or AZ failure at modest cost. A bigger instance in one AZ is still a single point of failure, and edge locations do not run the application.
4. A and C. Proximity (latency) and compliance are two of the four Region-selection factors, along with service availability and pricing. IAM users and Support plans are not Region-specific considerations.
5. B. CloudFront caches images at edge locations near Australian users. Direct Connect and VPN connect corporate networks, and Outposts is for on-premises hardware.
6. C. Outposts installs AWS-managed infrastructure in the customer’s facility with the same APIs. Local Zones and Wavelength are AWS-run locations outside the customer’s site.
7. A. Wavelength Zones embed AWS compute in 5G carrier networks for mobile ultra-low latency. Outposts is for customer data centers and edge locations do not host compute for this purpose.
8. A. Local Zones place compute close to large metropolitan areas for single-digit-millisecond latency. Outposts in homes is impractical, and Transfer Acceleration only speeds S3 uploads.
9. C. IAM is a global service. EC2, RDS, and DynamoDB are regional.
10. A. CloudShell runs in the browser, is preauthenticated, and has the CLI preinstalled. SDKs require a local development setup.
11. B. CloudFormation templates create the same stacks repeatedly across Regions and accounts. Elastic Beanstalk focuses on deploying a web app, and CloudWatch and Trusted Advisor do not provision resources.
12. B. The CDK lets developers define infrastructure in Python and other languages and synthesizes it to CloudFormation. Infrastructure Composer is visual, and CloudShell is a terminal.
13. B. Elastic Beanstalk takes code and manages capacity, load balancing, scaling, and health. CloudFormation provisions what you declare but does not specialize in running an app from code.
14. C. Direct Connect is a dedicated private link with consistent performance. Site-to-Site VPN runs over the internet, and Client VPN is for individual users.
15. B. A Site-to-Site VPN is encrypted, inexpensive, and quick to set up over the internet. Direct Connect typically takes weeks to provision.
16. A and C. Edge locations cache CloudFront content, and there are hundreds of them compared with a few dozen Regions. They do not host EC2 instances and do not address data residency.
17. A. Infrastructure Composer is a visual designer that generates CloudFormation or SAM templates. Config tracks resource configuration, and Elastic Beanstalk deploys apps.
18. C. An EBS volume lives in one AZ and attaches to instances in that AZ. S3 buckets are regional, and IAM roles and CloudFront distributions are global.