3.4 - AWS management and monitoring services
AWS Certified Cloud Practitioner objective 3.4 covers services for managing and monitoring your AWS environment. Amazon CloudWatch monitors metrics and logs and can trigger alarms, while AWS CloudTrail records API activity for auditing, and AWS Config tracks resource configuration changes over time - three services often confused, so remember: metrics and logs, API history, configuration history. Amazon Route 53 is a DNS and routing service, whereas Amazon CloudFront is a content delivery network (CDN). To privately connect a VPC to Amazon S3 without traffic crossing the public internet, you use a VPC gateway endpoint. When an enterprise needs a dedicated, consistent, private network connection from its data center to AWS, AWS Direct Connect provides it. Expect scenario questions that describe monitoring, auditing API calls, DNS versus CDN, private S3 access or a dedicated link, and ask which management service applies.
Metrics + logs + alarms = CloudWatch. API activity history = CloudTrail. Resource config history = AWS Config. DNS/routing = Route 53; CDN = CloudFront. Dedicated private link to AWS = Direct Connect.
Practice questions
1. How do CloudWatch, CloudTrail, and AWS Config differ?
- All three record API calls only
- CloudWatch audits API calls; CloudTrail tracks config changes
- They all only send billing alerts
- CloudWatch monitors metrics/logs; CloudTrail records API calls; Config tracks resource configuration (correct answer)
CloudWatch monitors performance metrics, logs and alarms (what a resource is doing). CloudTrail records who made which API calls (auditing/governance). AWS Config tracks and evaluates the configuration state of resources over time for compliance.
2. How do Amazon Route 53 and Amazon CloudFront differ?
- Both are content delivery networks
- Route 53 is a DNS/routing service; CloudFront is a content delivery network (CDN) (correct answer)
- Route 53 caches web content; CloudFront resolves DNS
- Both are relational databases
Route 53 is a scalable DNS service that resolves domain names and routes users to endpoints (with health checks and routing policies). CloudFront is a CDN that caches and delivers content from edge locations to cut latency.
3. To privately connect a VPC to Amazon S3 without traffic traversing the public internet, you should use:
- A VPC gateway endpoint (correct answer)
- An internet gateway
- A NAT gateway
- A customer gateway
A VPC gateway endpoint provides private connectivity from a VPC to S3 (and DynamoDB) without an internet gateway or NAT. An internet gateway and NAT gateway route traffic to the public internet.
4. An enterprise needs a dedicated, consistent, private network connection from its data center to AWS to avoid the variability of the public internet. Which service provides this?
- AWS Site-to-Site VPN
- Amazon CloudFront
- AWS Direct Connect (correct answer)
- AWS Transit Gateway
AWS Direct Connect is a dedicated physical network link between on-premises and AWS, offering consistent bandwidth and lower latency than internet-based connections. A Site-to-Site VPN runs over the public internet.
5. Users report intermittent errors from one instance. Which service should you check FIRST to see CPU utilization and set an alarm on it?
- AWS CloudTrail
- AWS Config
- AWS Trusted Advisor
- Amazon CloudWatch (correct answer)
Amazon CloudWatch collects metrics such as EC2 CPU utilization and lets you create alarms and dashboards. CloudTrail audits API calls, Config tracks configuration, and Trusted Advisor gives best-practice checks.