AWS Certified Foundational CLF-C02 Amazon Web Services Study Notes

ASecurity Groupacts as a virtual firewall for your Amazon EC2 instances to control inbound and outbound traffic. It provides granular control over network connections to and from a specific EC2 instance or set of instances. Unlike Network ACLs, which operate at the subnet level, Security Groups operate at the instance level, allowing control over network traffic for individual instances.

A. Network ACL: Incorrect, as it controls traffic at the subnet level and not for individual instances.

B. AWS WAF: Incorrect, as AWS WAF is a web application firewall that helps protect web applications from common web exploits but is not designed for controlling instance-level traffic.

C. Route table: Incorrect, as route tables are used for network routing within a VPC and do not act as firewalls.

AWS Cloud References:

AWS Security Groups

On-Demand Instances are ideal for workloads that require flexibility, offering compute capacity with no upfront cost, allowing users to pay by the second for the instances they use. This makes it suitable for applications with short-term, spiky, or unpredictable workloads that cannot be interrupted. Reserved Instances require long-term commitments, Spot Instances can be interrupted, and Dedicated Instances are for specific hardware requirements, making On-Demand the correct choice for uninterruptible and flexible instance usage.

AWS Direct Connect is an AWS service that allows users to establish a dedicated network connection between their on-premises data center and the AWS Cloud. This connection bypasses the public internet and provides more predictable network performance, reduced bandwidth costs, and increased security. Users can choose from different port speeds and connection types, and use AWS Direct Connect to access AWS services in any AWS Region globally. Users can also use AWS Direct Connect in conjunction with AWS VPN to create a hybrid network architecture that combines the benefits of both private and public connectivity. References: AWS Direct Connect, [AWS Cloud Practitioner Essentials: Module 3 - Compute in the Cloud]

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. You can use VPC Flow Logs to diagnose network issues, monitor traffic patterns, detect security anomalies, and comply with auditing requirements34. References: Logging IP traffic using VPC Flow Logs - Amazon Virtual Private Cloud, New – VPC Traffic Mirroring – Capture & Inspect Network Traffic | AWS News Blog