CLF-C02 Amazon Web Services AWS Certified Cloud Practitioner Free Practice Exam Questions (2026 Updated)

The AWS Well-Architected Framework is a set of best practices and guidelines for designing and operating systems in the cloud. The framework consists of five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization. The operational excellence pillar focuses on the ability to run workloads effectively, gain insight into operations, and continuously improve supporting processes and procedures. Therefore, the correct answer is C. You can learn more about the AWS Well-Architected Framework and its pillars.

 AWS IAM Identity Center (AWS Single Sign-On) is the AWS service that the company should use to meet the requirements of managing access and permissions for its third-party SaaS applications. AWS Single Sign-On is a cloud-based service that makes it easy to centrally manage single sign-on(SSO) access to multiple AWS accounts and business applications. You can use AWS Single Sign-On to enable your users to sign in to a user portal with their existing corporate credentials and access all of their assigned accounts and applications from one place4.

 Identity and access management is the customer’s responsibility, according to the AWS shared responsibility model. This means that the customer is responsible for managing user access to the AWS resources, using tools such as AWS Identity and Access Management (IAM), AWS Single Sign-On (SSO), and AWS Organizations. The customer is also responsible for securing their data in transit and at rest, using encryption, key management, and other methods. Hard drive initialization, protection of data center hardware, and security of Availability Zones are AWS’s responsibility, as they are part of the infrastructure, physical security, and network security that AWS provides to the customer12

Managing service control policies (SCPs) is an activity that companies can complete by using AWS Organizations. AWS Organizations is a service that enables the user to consolidate multiple AWS accounts into an organization that can be managed as a single unit. AWS Organizations allows the user to create groups of accounts and apply policies to them, such as service control policies (SCPs) that specify the services and actions that users and roles can access in the accounts. AWS Organizations also enables the user to use consolidated billing, which combines the usage and charges from all the accounts in the organization into a single bill3.

The solution that meets the requirement of the company that runs a database on Amazon Aurora in the us-east-1 Region and has a disaster recovery requirement that the database be available inanother Region with minimal disruption to the database operations is to deploy Aurora cross-Region read replicas. Aurora cross-Region read replicas are secondary Aurora clusters that are created in a different AWS Region from the primary Aurora cluster, and are kept in sync with the primary cluster using physical replication. The company can use Aurora cross-Region read replicas to improve the availability and durability of the database, as well as to reduce the recovery time objective (RTO) and recovery point objective (RPO) in case of a regional disaster. Performing an Aurora Multi-AZ deployment, creating Amazon EBS volume snapshots for Aurora and copying them to another Region, and deploying Aurora Replicas are not the best solutions for this requirement. An Aurora Multi-AZ deployment is a configuration that creates one or more Aurora Replicas within the same AWS Region as the primary Aurora cluster, and provides automatic failover in case of an Availability Zone outage. However, this does not provide cross-Region disaster recovery. Creating Amazon EBS volume snapshots for Aurora and copying them to another Region is a manual process that requires stopping the database, creating the snapshots, copying them to the target Region, and restoring them to a new Aurora cluster. This process can cause significant downtime and data loss. Deploying Aurora Replicas is a configuration that creates one or more secondary Aurora clusters within the same AWS Region as the primary Aurora cluster, and provides read scaling and high availability. However, this does not provide cross-Region disaster recovery.

Amazon Simple Notification Service (Amazon SNS) is the AWS service or feature that is used to send both text and email messages from distributed applications. Amazon SNS is a fully managed pub/sub messaging service that enables the user to send messages to multiple subscribers or endpoints, such as email addresses, phone numbers, HTTP endpoints, AWS Lambda functions, and more. Amazon SNS can be used to send notifications, alerts, confirmations, and reminders from applications to users or other applications4.

The Amazon S3 Intelligent-Tiering storage class offers automatic cost savings by moving objects between tiers based on access pattern changes. This storage class is designed for data with unknown or changing access patterns. It has two access tiers: frequent access and infrequent access. Objects are stored in the frequent access tier by default, and are moved to the infrequent access tier after 30 consecutive days of no access. If an object in the infrequent access tier is accessed, it is moved back to the frequent access tier. There are no retrieval fees in S3 Intelligent-Tiering, and no additional tiering fees when objects are moved between access tiers within the S3 Intelligent-Tiering storage class1.

AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of an AWS account. It logs, continuously monitors, and retains account activity related to actions across an AWS infrastructure.

For auditing purposes:

CloudTrail records AWS API calls made in the account, including details about who made the request, the services used, the actions performed, and the response elements returned by AWS.

This information is critical for understanding user activity, detecting anomalous behavior, and performing security analysis and compliance auditing.

Why other options are not suitable:

A. AWS Config: AWS Config provides a detailed view of the configuration of AWS resources, including how resources are related and their compliance with internal policies, but it does not provide a comprehensive audit trail of user actions.

B. Amazon Rekognition: A service for image and video analysis, not relevant to auditing AWS account activity.

D. Amazon SNS: A notification service for sending alerts and messages, not used for auditing purposes.

 IAM roles are a secure way to grant permissions to applications running on an Amazon EC2 instance to make calls to other AWS services. IAM roles are entities that have specific permissions policies attached to them. You can create an IAM role and associate it with an EC2 instance when you launch it or later. The applications on the instance can then use the temporary credentials provided by the role to access AWS resources that the role allows. This way, you do not have tostore any long-term credentials or access keys on the instance, which reduces the risk of compromise or misuse12.

The other options are not correct, because:

Security groups are virtual firewalls that control the inbound and outbound traffic for your EC2 instances. Security groups do not grant permissions to access other AWS services, but rather filter the network traffic based on rules that you define3.

AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources. AWS Firewall Manager works with AWS WAF, AWS Shield Advanced, and Amazon VPC security groups. AWS Firewall Manager does not grant permissions to access other AWS services, but rather helps you enforce consistent security policies across your AWS infrastructure4.

IAM user SSH keys are credentials that allow you to connect to your EC2 instance using SSH. SSH keys do not grant permissions to access other AWS services, but rather authenticate your identity when you log in to your instance5.

Using an IAM role to grant permissions to applications running on Amazon EC2 instances - AWS Identity and Access Management

IAM roles for Amazon EC2 - Amazon Elastic Compute Cloud

Security groups for your VPC - Amazon Virtual Private Cloud

What is AWS Firewall Manager? - AWS Firewall Manager

Connecting to your Linux instance using SSH - Amazon Elastic Compute Cloud

Amazon CloudWatch alarm is an AWS service or feature that can initiate an Amazon EC2 Auto Scaling action based on CPU utilization. Amazon CloudWatch is a monitoring and observability service that collects and tracks metrics, logs, events, and alarms for your AWS resources and applications. Amazon CloudWatch alarms are actions that you can configure to send notifications or automatically make changes to the resources you are monitoring based on rules that you define67.

Amazon EC2 Auto Scaling is a service that helps you maintain application availability and allows you to automatically add or remove EC2 instances according to definable conditions. You can create dynamic scaling policies that track a specific CloudWatch metric, such as CPU utilization, and define what action to take when the associated CloudWatch alarm is in ALARM. When the policy is in effect, Amazon EC2 Auto Scaling adjusts the group’s desired capacity up or down when the threshold of an alarm is breached89. References: 6: Cloud Monitoring - Amazon CloudWatch - AWS, 7: Amazon CloudWatch Documentation, 8: Dynamic scaling for Amazon EC2 Auto Scaling, 9: Amazon EC2 Auto Scaling Documentation

One of the key advantages of cloud computing is the ability totrade fixed expenses (like data centers and physical servers) for variable expenses. With AWS, companies pay only for the compute power, storage, and other resources they use, rather than investing heavily in on-premises infrastructure upfront. This reduces capital expenditure and helps lower overall costs.

Why other options are not suitable:

A. Go global in minutes: Refers to the ability to quickly deploy applications around the world, but does not directly reduce upfront costs.

B. Increase speed and agility: Refers to the ability to quickly scale and deploy resources, but is not directly related to cost reduction.

C. Benefit from massive economies of scale: Refers to AWS's ability to lower costs by leveraging its scale, but the primary advantage for reducing upfront costs is moving from fixed to variable expenses.

A Network Access Control List (ACL) is a stateless network filtering mechanism provided by AWS for controlling traffic in and out of subnets within a VPC. Unlike security groups, which are stateful, network ACLs are stateless. This means that they do not automatically allow responses to inbound traffic unlessexplicitly specified. Network ACLs allow you to set rules for both inbound and outbound traffic, making them suitable for stateless filtering. Security groups, on the other hand, are stateful, while AWS WAF is primarily for web application-level security. AWS PrivateLink is used for privately connecting VPCs to AWS services without using an internet gateway. Therefore, for stateless network filtering, Network ACL is the correct choice.

TheAWS Developer Supportplan is the lowest-cost AWS Support plan that provides basic guidance and technical support for running production workloads. It offers 24/7 access to AWS customer service, documentation, whitepapers, and access to a limited set of Trusted Advisor checks. This plan is ideal for non-critical workloads or early development phases but provides lower levels of support compared to the Business, Enterprise On-Ramp, and Enterprise plans.

B. Enterprise On-Ramp: Incorrect, as it is a higher-cost support plan designed for production workloads needing more guidance and technical support.

C. Enterprise: Incorrect, as it is the most expensive support plan, providing a Technical Account Manager and other premium support features.

D. Business: Incorrect, as it provides comprehensive support for production workloads but is more expensive than the Developer plan.

AWS Cloud References:

AWS Support Plans

AWS Cloud Development Kit (AWS CDK) is an open source software development framework that allows you to model and provision your cloud infrastructure using familiar programming languages such as TypeScript, Python, Java, and .NET. AWS CDK enables you to use the expressive power of your favorite language to define your cloud resources, such as compute, storage, network, and application services. AWS CDK also provides a library of high-level constructs that represent AWS services and best practices. AWS CDK uses AWS CloudFormation in the background to deploy your resources in a safe and repeatable manner12. References:

AWS Cloud Development Kit (CDK) – TypeScript and Python are Now Generally Available

AWS Cloud Development Kit (AWS CDK) - Introduction to DevOps on AWS

TheAWS Developer Forumsare always free to use, regardless of the user's AWS Support plan. They provide a platform for users to ask questions, share knowledge, and collaborate with the AWS community.

A. AWS Developer Support: Incorrect, as it is a paid support plan option.

C. Programmatic case management: Incorrect, as this feature is available only with certain AWS Support plans (Business and Enterprise).

D. AWS Technical Account Manager (TAM): Incorrect, as a TAM is provided only under the AWS Enterprise Support plan, which is a paid support option.

AWS Cloud References:

AWS Support Plans

AWS Key Management Service (AWS KMS) is designed to integrate with various AWS services to encrypt data at rest. It provides a secure and highly available service to create, control, and manage encryption keys used to encrypt your data. AWS Certificate Manager (ACM) is for managing SSL/TLS certificates, AWS Identity and Access Management (IAM) is for managing user access and permissions, and AWS Security Hub is for security monitoring and compliance, but none of these services provide data encryption at rest like AWS KMS.QUESTION NO: 298

A company has an AWS Business Support plan. The company needs to gain access to the AWS DDoS Response Team (DRT) to help mitigate DDoS events.

Which AWS service or resource must the company use to meet these requirements?

A. AWS Shield Standard

B. AWS Enterprise Support

C. AWS WAF

D. AWS Shield Advanced

Answer: D

AWS Shield Advanced provides enhanced protection against DDoS attacks and includes access to the AWS DDoS Response Team (DRT) to help mitigate complex DDoS events. AWS Shield Standard offers basic DDoS protection, which is included with AWS services, but does not provide access to the DRT. AWS WAF is a web application firewall, and AWS Enterprise Support is a premium support plan but does not specifically provide DDoS mitigation services or access to the DRT.

On-Demand Instances are the most flexible and cost-effective pricing model for short-term, experimental, or unpredictable workloads on AWS. On-Demand Instances let you pay only for the resources you use, without any long-term commitments or upfront fees. You can easily start and stop instances as needed, and scale up or down depending on your demand.

Savings Plans, Reserved Instances, and Dedicated Hosts are all pricing models that require a commitment for a certain amount of usage or capacity for a one- or three-year term. These pricing models offer lower prices than On-Demand Instances, but they are not suitable for workloads that only run for 3 to 6 months or have variable usage patterns. Savings Plans and Reserved Instances also offer flexibility to change instance types, sizes, or regions within the same family or pool, while Dedicated Hosts are physical servers that can only run specific instance types.

AWS CloudFormation is a service that allows you to model and provision your AWS resources using templates. You can define your infrastructure as code and automate the creation and update of your resources. AWS CloudFormation also supports nested stacks, change sets, and rollback features to help you manage complex and dynamic environments34. References:

AWS CloudFormation

AWS Certified Cloud Practitioner Exam Guide

EC2 Instance Savings Plans are a flexible pricing model that offer discounted hourly rates on Amazon EC2 instance usage for a 1 or 3 year term. EC2 Instance Savings Plans provide savings up to 72% off On-Demand rates, in exchange for a commitment to a specific instance family in a chosen AWS Region (for example, M5 in Virginia). These plans automatically apply to usage regardless of size (for example, m5.xlarge, m5.2xlarge, etc.), OS (for example, Windows, Linux, etc.), and tenancy (Host, Dedicated, Default) within the specified family in a Region. With an EC2Instance Savings Plan, you can change your instance size within the instance family (for example, from c5.xlarge to c5.2xlarge) or the operating system (for example, from Windows to Linux), or move from Dedicated tenancy to Default and continue to receive the discounted rate provided by your EC2 Instance Savings Plan4567. References: 4: Compute Savings Plans – Amazon Web Services, 5: What are Savings Plans? - Savings Plans, 6: How To Cut Your AWS Bill With Savings Plans (and avoid some common …, 7: AWS Savings Plans vs Reserved Instances - GorillaStack

AWS Organizationsis a service that helps users centrally manage and govern multiple AWS accounts. With AWS Organizations, a company can consolidate billing and receive a single bill for all AWS accounts under an organization, making it easier for the finance team to track costs.

Why other options are not suitable:

B. AWS Trusted Advisor: Provides real-time guidance to help optimize AWS resources, not for consolidated billing.

C. Cost Explorer: A tool for visualizing and managing AWS costs and usage, but it does not consolidate billing.

D. AWS Budgets: Allows setting custom budgets and alerts but does not consolidate billing across accounts.

AWS IAM Identity Center (AWS Single Sign-On) is a cloud-based service that makes it easy to centrally manage single sign-on (SSO) access to multiple AWS accounts and business applications. You can use AWS SSO to enable your users to sign in to the AWS Management Console or the AWS Command Line Interface (AWS CLI) with their existing corporate credentials2. You can also manage SSO access and user permissions across all your AWS accounts in AWS Organizations3. References: AWS Single Sign-On - AWS Documentation, AWS Organizations - AWS Documentation

AWS Application Migration Service (AWS MGN) is the primary service for migrating Amazon EC2 instances and on-premises servers to AWS, and it supports migration from one AWS Region to another. It automates the process of replicating and converting the source servers (including their applications, configurations, and data) to run natively on AWS. AWS Database Migration Service (DMS) is for migrating databases, AWS DataSync is for data transfer, and AWS Migration Hub provides a single location to track migration tasks across multiple AWS services but does not perform the migration itself.

According to the AWS shared responsibility model, customers are responsible for managing their data, applications, operating systems, security groups, and other aspects of their AWS environment. This includes installing updates and security patches of the guest operating system and any application software or utilities installed by the customer on the instances. AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, such as data centers, hardware, software, networking, and facilities. This includes the physical connectivity among Availability Zones, the network switch maintenance, and the hardware updates and firmware patches. Therefore, option D is the correct answer, and options A, B, and C are AWS responsibilities, not customer responsibilities. References: : AWS Well-Architected Framework - Elasticity; : Reactive Systems on AWS - Elastic

Users can change their own IAM user password using:

AWS Management Console: The graphical interface allows users to navigate to the "My Security Credentials" page and change their password.

AWS Command Line Interface (CLI): Users with the appropriate permissions can use theaws iam change-passwordcommand to change their password.

Why other options are not suitable:

B. AWS Key Management Service (AWS KMS): Used for creating and managing encryption keys, not for managing user passwords.

D. AWS Resource Access Manager (AWS RAM): Used for resource sharing between accounts, not for password management.

E. AWS Secrets Manager: A service for securely storing and managing secrets, not for changing IAM user passwords.

AWS Management Console is a web application that allows you to manage and monitor your AWS Cloud resources through a user-friendly interface. You can use the AWS Management Console to access and experiment with over 150 AWS services, view and modify your account and billing information, get in-console help from AWS Support, and customize your dashboard with widgets that display key metrics and information for your applications567. You can also use the AWS Management Console to launch and configure AWS resources using wizards andtemplates, without writing any code5. References: 5: Manage AWS Resources - AWS Management Console - AWS, 6: Getting Started with the AWS Management Console, 7: Manage AWS Resources - AWS Management Console Features - AWS

Amazon CloudFront and AWS Global Accelerator are two AWS services that make use of global edge locations. Edge locations are AWS sites that are deployed worldwide in major cities and places with a high population. Edge locations are used to cache data and reduce latency for end-user access1.

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. Amazon CloudFront uses a global network of over 200 edge locations and 13 regional edge caches to cache your content closer to your viewers, improving performance and reducing costs23.

AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint based on health, performance, and policies. AWS Global Accelerator uses over 100 edge locations to bring your application endpoints closer to your users, reducing networkhops and improving user experience45. References: 1: AWS for the Edge - Amazon Web Services (AWS), 2: Content Delivery Network (CDN) - Amazon CloudFront - AWS, 3: Amazon CloudFront Documentation, 4: AWS Global Accelerator - Amazon Web Services, 5: AWS Global Accelerator Documentation

AWS App Runneris a fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs at scale. It can automatically build container images from source code or directly from a container registry, and then deploy the application without requiring deep container knowledge or expertise.

AWS App Runner meets the requirements of:

Automatically creating container images from source code.

Managing the deployment of the containerized application with minimal operational overhead.

Why other options are not suitable:

A. AWS Elastic Beanstalk: While it simplifies deploying and scaling web applications, it does not automatically create container images from source code.

B. Amazon Elastic Container Service (Amazon ECS): ECS is a container orchestration service that requires more manual setup for creating and managing container images and deployments.

D. Amazon EC2: This service provides virtual servers but does not offer managed container image creation or deployment.

The AWS Support plan that provides the full set of AWS Trusted Advisor checks at the lowest cost is theAWS Business Supportplan. The AWS Business Support plan includes access to the complete set of Trusted Advisor checks, which cover areas such as cost optimization, security, performance, fault tolerance, and service limits. This plan is specifically designed to support production workloads and includes 24/7 access to cloud support engineers, response times for impaired systems, and other enhanced technical support features.

AWS Developer Support, while more affordable, only provides limited Trusted Advisor checks, specifically around Service Limits and basic Security checks. Full access to all Trusted Advisor checks is only available with Business Support and higher-tier plans, such as Enterprise On-Ramp and Enterprise Support

AWS CodeDeployis a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Lambda, and on-premises servers. CodeDeploy makes it easy to release new features, helps avoid downtime during application deployment, and handles the complexity of updating applications in a scalable and reliable manner.

Why other options are not suitable:

A. Amazon AppFlow: A service to automate data flows between AWS and SaaS applications, not for application deployment.

C. AWS PrivateLink: A service to securely access AWS services from your virtual private cloud (VPC), not related to application deployments.

D. Amazon EKS Distro: A Kubernetes distribution for running Kubernetes clusters, not specifically designed for automated deployments.

Amazon Elastic Transcoder is a media transcoding service that enables companies to convert video and audio files into formats optimized for playback on various devices, including smartphones. It automates the transcoding process and supports a wide array of video and audio formats, making it ideal for converting files into mobile-friendly formats. Services like Amazon Comprehend, Rekognition, and Polly do not perform media transcoding functions.

AWS Service Catalog enables companies to create, manage, and distribute catalogs of approved infrastructure as code (IaC) templates and software configurations. This service supports infrastructure automation by allowing users to deploy resources using predefined templates, which align with the company's policies and best practices. It helps in managing cloud resources at scale by utilizing IaC principles, enabling consistent deployments, and enforcing governance across AWS resources. AWS Service Catalog is an excellent choice for organizations implementing IaC.

AWS Glue is a serverless data integration service that makes it easy to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning, and application development. You can use various data integration engines, such as ETL, ELT, batch, and streaming, and manage your data in a centralized data catalog. AWS Glue is designed specifically for extract, transform, and load (ETL) data, whereas the other options are not.

Understanding Availability Zones (AZs): An Availability Zone is a distinct location within an AWS region that is engineered to be isolated from failures in other AZs.

Characteristics of Availability Zones:

Data Centers: Each AZ consists of one or more discrete data centers with redundant power, networking, and connectivity.

High Availability: AZs are designed for high availability, providing low-latency network connections to other zones in the same region.

Fault Isolation: They provide fault isolation and are used to deploy applications and services to ensure high availability and reliability.

Use Cases for Availability Zones:

Multi-AZ Deployments: For services like RDS, deploying in multiple AZs ensures fault tolerance.

Disaster Recovery: Setting up resources in multiple AZs helps in quick recovery from failures.

Load Balancing: Distributing traffic across AZs using Elastic Load Balancing ensures optimal performance and availability.

AWS Global Infrastructure

Understanding AWS Regions and Availability Zones

AWS SDKs are a set of tools that allow users to connect with AWS and deploy resources programmatically. AWS SDKs provide libraries, code samples, documentation, and other resources to help users write code that interacts with AWS APIs. AWS SDKs support various programming languages, such as Java, Python, Ruby, .NET, Node.js, Go, and more. AWS SDKs make it easier for users to access AWS services, such as Amazon S3, Amazon EC2, Amazon DynamoDB, AWS Lambda, and more, from their applications. AWS SDKs also handle tasks such as authentication, error handling, retries, and data serialization, so users can focus on their application logic .

The other options are not AWS services or tools that give users the ability to connect with AWS and deploy resources programmatically. Amazon QuickSight is a business intelligence service that lets users create and share interactive dashboards and visualizations1. AWS PrivateLink is a service that enables users to securely access services hosted on AWS in a scalable and cost-effective manner2. AWS Direct Connect is a service that establishes a dedicated network connection between a user’s premises and AWS3.

According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while customers are responsible for the security in the cloud. This means that AWS is responsible for the physical servers, networking, and operating system that run Lambdafunctions, while customers are responsible for the security of their code and AWS IAM to the Lambda service and within their function1. Customers need to manage the code within the Lambda function, such as writing, testing, debugging, deploying, and updating the code, as well as ensuring that the code does not contain any vulnerabilities or malicious code that could compromise the security or performance of the function23. References: 2: AWS Lambda - Amazon Web Services (AWS), 3: AWS Lambda Documentation, 1: Amazon CLF-C02: What is customer responsibility under AWS … - PUPUWEB

AWS Trusted Advisor is the service that can meet these requirements. AWS Trusted Advisor is a service that helps you optimize your AWS environment by providing recommendations based on AWS best practices. Trusted Advisor continuously evaluates your AWS resources and services across five categories: cost optimization, performance, service limits, fault tolerance, and security. You can view the recommendations on the Trusted Advisor console or access them programmatically using the Trusted Advisor API. You can also set up notifications and alerts for any changes in the status of your checks. Trusted Advisor can help you improve your AWS environment by reducing costs, enhancing performance, increasing security, and ensuring reliability12. The other services are not designed to provide best practice recommendations in five categories. AWS Shield is a service that protects your AWS resources from distributed denial-of-service (DDoS) attacks. AWS WAF is a service that helps you protect your web applications from common web exploits. AWS Service Catalog is a service that enables you to create and manage catalogs of IT services that are approved for use on AWS34 . References: AWS Trusted Advisor, Achieve operational excellence with AWS Trusted Advisor, AWS Shield, AWS WAF, [AWS Service Catalog]

AWS Systems Manager is a service that enables users to centralize and automate the management of their AWS resources. It provides a unified user interface to view operational data, such as inventory, patch compliance, and performance metrics. It also allows users to automate common and repetitive tasks, such as patching, backup, and configuration management, across all of their Amazon EC2 instances1. AWS Trusted Advisor is a service that provides best practices and recommendations to optimize the performance, security, and cost of AWS resources2. AWS CodeDeploy is a service that automates the deployment of code and applications to Amazon EC2 instances or other compute services3. AWS Elastic Beanstalk is a service that simplifies the deployment andmanagement of web applications using popular platforms, such as Java, PHP, and Node.js4.

 The combination of AWS services that the application can use to migrate to a microservices-based application are Amazon Simple Queue Service (Amazon SQS) and AWS Lambda. Amazon SQS is a fully managed message queuing service that enables customers to decouple and scale microservices, distributed systems, and serverless applications. The application can use Amazon SQS to send, store, and receive messages between the microservices, ensuring that each message is processed only once and in the right order. AWS Lambda is a serverless compute service that allows customers to run code without provisioning or managing servers. The application can use AWS Lambda to create and deploy microservices as functions that are triggered by events, such as messages from Amazon SQS. AWS Migration Hub, AWS AppSync, and AWS Application Migration Service are not the best services to use for migrating to a microservices-based application. AWS Migration Hub is a service that provides a single location to track the progress of application migrations across multiple AWS and partner solutions. AWS AppSync is a service that simplifies the development of GraphQL APIs for real-time and offline data synchronization. AWS Application Migration Service is a service that enables customers to migrate their on-premises applications to AWS without making any changes to the applications, servers, or databases.

Amazon Route 53 is the AWS service that provides DNS resolution. DNS (Domain Name System) is a service that translates domain names into IP addresses. Amazon Route 53 is a highly available and scalable cloud DNS service that offers domain name registration, DNS routing, and health checking. Amazon Route 53 can route the traffic to various AWS services, such as Amazon EC2, Amazon S3, and Amazon CloudFront. Amazon Route 53 can also integrate with other AWS services, such as AWS Certificate Manager, AWS Shield, and AWS WAF. For more information, see [What is Amazon Route 53?] and [Amazon Route 53 Features].