AWS Certified Cloud Practitioner (CLF-C02)

Portfolio management is primarily associated with the Business perspective in AWS CAF, covering how to prioritize initiatives, manage investment, and track value across a portfolio of applications. While 120 workloads in 6 months suggests portfolio planning, the question specifically asks for People perspective capabilities and emphasizes leadership alignment and team redesign rather than funding/value management.

Risk management aligns more closely with Governance (and often Security) concerns: identifying, assessing, and mitigating risks through controls and processes. The prompt explicitly says not to change governance or security processes, making this a poor fit. Although migration risk exists, the question is about people capabilities (alignment and org structure), not risk control frameworks.

Modern application development is generally a Platform perspective capability focused on engineering practices and tooling (e.g., CI/CD, microservices, containers, serverless patterns). It can help long-term cloud success, but it does not directly address leadership objective alignment or organizational restructuring to close a skills gap. The question is explicitly scoped to People perspective capabilities.

Amazon QuickSight is a business intelligence and visualization service used to build dashboards and analyze data from sources like S3, Athena, Redshift, and RDS. It is not designed to provision AWS infrastructure or call service control-plane APIs to create EC2 instances or RDS databases. QuickSight is a console-driven analytics tool, not a CI/CD deployment mechanism.

AWS PrivateLink provides private connectivity to AWS services or third-party services via VPC endpoints, keeping traffic within the AWS network. It helps with network isolation and private access, but it does not itself deploy resources or provide a programming interface for creating EC2/RDS. You could use PrivateLink to reach certain endpoints privately, but you still need SDK/CLI/IaC to provision resources.

AWS Direct Connect is a dedicated physical network connection from an on-premises environment to AWS. It is used for consistent bandwidth, lower latency, and private connectivity. The question explicitly says “without using a physical network link,” which rules out Direct Connect. Also, Direct Connect does not provide programmatic resource deployment; it only provides network transport.

Amazon Kinesis is used for real-time streaming data ingestion and processing (e.g., clickstreams, telemetry, live event data pipelines). It helps build real-time analytics and event-driven architectures, but it is not a CDN and does not cache or serve large media files from edge locations to viewers. Kinesis would be relevant for processing sports events metadata, not for delivering images and video with sub-100 ms startup latency.

Amazon SQS is a fully managed message queue that decouples producers and consumers, buffers workloads, and improves reliability in distributed systems. It is not designed to deliver content to end users and provides no edge caching or global media distribution capabilities. SQS might be used behind the scenes to coordinate video processing jobs or notifications, but it cannot meet the requirement to cache and serve media close to viewers worldwide.

Amazon Route 53 is a highly available DNS service that can route users to endpoints using policies like latency-based routing, geolocation, and health checks. While it helps direct users to the best endpoint and can reduce DNS lookup time, it does not cache or deliver the actual media content at edge locations. Route 53 is often used alongside CloudFront, but it cannot replace a CDN for global caching and low-latency delivery.

AWS Config records and evaluates resource configurations for compliance, auditing, and drift detection (e.g., ensuring instances have required tags or security groups). While it can trigger remediation via rules and automation, it does not analyze utilization metrics to recommend smaller EC2 instance types. Config is about “is it configured correctly?” rather than “is it the right size for its workload?”

AWS Cost Anomaly Detection uses machine learning to identify unusual spend patterns and alert when costs deviate from expected baselines. It is useful for catching sudden spikes or unexpected charges, but it does not provide performance-based rightsizing recommendations for EC2. It answers “why did costs jump?” not “which instance type should I use to save money safely?”

AWS Budgets lets teams set cost or usage budgets and receive alerts (or trigger actions) when actual or forecasted spend exceeds thresholds. Budgets can help enforce financial guardrails, but it does not analyze CloudWatch utilization or recommend smaller instance sizes. It is a monitoring/alerting and governance tool, not an optimization recommendation engine.

Reliability is the ability of a system to consistently perform its intended function (e.g., fault tolerance, monitoring, scaling, and change management). Actions to improve reliability often include redundancy, Multi-AZ designs, health checks, and automated recovery. The scenario is primarily about reducing cost by downsizing underutilized instances, not ensuring consistent operation under expected conditions.

Resilience is the ability to recover from disruptions and continue operating, often through strategies like failover, disaster recovery, backups, and multi-region architectures. Resilience improvements typically focus on handling failures and restoring service quickly. The question describes analyzing utilization and reducing instance size to cut spend, which is unrelated to recovery from outages or fault scenarios.

Modernization refers to updating applications and infrastructure to newer architectures or managed services (e.g., migrating from monoliths to microservices, refactoring to serverless, adopting containers, or using managed databases). While modernization can reduce costs, the described action is simply selecting smaller EC2 instances based on utilization—an optimization step, not a modernization initiative.

AWS Cost and Usage Reports (CUR) provide detailed billing and usage line items and can be delivered to S3 (often queried with Athena). While CUR can be exported and analyzed, it is not an IAM security/compliance report and does not include per-user MFA status, password change dates, or access key active/inactive state. It also typically requires setup/delivery configuration, which conflicts with the “directly from the console” constraint.

Detailed Billing Reports are billing-focused artifacts (historically associated with detailed cost breakdowns) and are not intended for identity or credential compliance. They do not contain IAM user attributes like MFA enabled, user creation date, password last changed, or access key status. Even if downloadable, they address financial reporting rather than security posture, so they cannot meet the compliance officer’s requested IAM credential details.

AWS Cost Explorer reports help visualize and analyze costs over time and can export cost data. However, Cost Explorer is strictly about spend and usage allocation, not IAM credential hygiene. It cannot report MFA status, password change dates, or access key activation state for IAM users or the root user. Therefore, it does not satisfy the security review reporting requirements.

AWS Marketplace is a digital catalog for finding, buying, and deploying third-party software, SaaS, and data products that run on AWS. While some listings may include deployment guides or architecture diagrams, Marketplace is not the primary, vetted repository for AWS reference architectures. It’s oriented toward procurement and licensing of solutions rather than quickly locating official AWS design patterns for serverless scale and multi-Region DR.

AWS Service Catalog helps organizations create and manage catalogs of approved IT services (CloudFormation templates, products, portfolios) for internal use. It’s excellent for governance and standardized provisioning, but it does not provide public AWS reference architectures or design diagrams. If the question were about distributing preapproved architectures within a company, Service Catalog could fit, but not for discovering AWS examples.

AWS Trusted Advisor is an account analysis tool that provides recommendations across cost optimization, performance, security, fault tolerance, service limits, and operational excellence. It helps identify risks and improvements in an existing AWS environment, but it does not function as a library of reference architectures or design diagrams. It’s useful after you have an architecture deployed, not for finding example designs.

AWS Billing Conductor is used to customize and allocate AWS billing for multi-account environments (e.g., chargeback/showback, custom rate cards, billing groups). It does not collect on-premises server utilization data and is not intended to build a migration TCO business case. It’s a billing management tool for existing AWS consumption, not a migration assessment service.

The AWS Billing Console provides visibility into current AWS costs, usage, budgets, and billing reports for workloads already running in AWS. It cannot collect utilization data from on-premises servers and does not generate a migration-focused 3-year TCO business case. It’s useful after you are consuming AWS services, not for pre-migration assessment of data centers.

Amazon Forecast is a machine learning service for time-series forecasting (e.g., demand planning, inventory forecasting, staffing). While it can forecast future values from historical time-series data, it is not a migration assessment or TCO modeling tool and does not collect infrastructure utilization from on-premises servers to create a 3-year AWS migration business case.

Amazon Inspector is a managed vulnerability management service that assesses EC2 instances, container images, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. It does not focus on correlating VPC Flow Logs with CloudTrail for investigative pivoting across IPs/users/instance IDs. Inspector is about identifying and prioritizing vulnerabilities and exposure, not building an ML-driven relationship graph for security event investigation.

Amazon QuickSight is a business intelligence (BI) and dashboarding service. While you could ingest CloudTrail and VPC Flow Logs into data stores (e.g., S3/Athena) and build dashboards, that would require building and maintaining datasets, queries, and visualizations—effectively a custom analytics solution. It is not a purpose-built, fully managed security investigation service with automatic ML-based correlation across entities.

Amazon GuardDuty is a managed threat detection service that analyzes CloudTrail events, VPC Flow Logs, and DNS logs to detect suspicious activity and produce findings (e.g., credential compromise, crypto mining, reconnaissance). Although it uses ML and correlates signals for detection, it is not primarily an investigation/pivoting tool. For deep correlation and interactive investigation across entities, Amazon Detective is the intended service.

AWS Organizations is primarily for multi-account governance and consolidated billing. It can help centralize billing and apply tag policies or SCPs to improve tagging compliance, but it does not itself provide cost attribution by product line and owner in Cost Explorer/invoices. Organizations is an enabler for enforcing tags across accounts, not the direct feature that creates the required cost allocation breakdown.

AWS Security Hub aggregates and prioritizes security findings across accounts and services. It is used for security posture management and compliance checks, not for billing allocation, cost reporting, or invoice breakdowns. It cannot attribute spend to product lines or owners and has no integration with Cost Explorer for cost allocation purposes.

The AWS Cost and Usage Report provides highly detailed billing line items and can include activated tag columns, making it useful for advanced custom analysis. However, CUR is a downstream reporting export, not the primary feature used to define and surface allocation dimensions in Cost Explorer. The question asks which feature they should use to attribute costs by product line and owner and view that breakdown in AWS billing tools, which points first to cost allocation tags. CUR may complement the solution, but it is not the best single answer.

Amazon API Gateway is a managed regional/edge service, not a native VPC component. While it can integrate with VPC resources (e.g., via VPC Link to private NLBs, or private APIs with interface endpoints), you do not create API Gateway “in” a VPC nor attach it to a VPC like an IGW. It’s an application-layer front door, not a VPC building block.

Amazon S3 buckets and objects are global/regional storage resources that exist outside your VPC. You can access S3 privately from a VPC using a gateway VPC endpoint (or via interface endpoints for some S3 features), but the bucket itself is not a VPC component. S3 does not get placed into subnets and is not attached to the VPC.

AWS Storage Gateway is a hybrid storage service deployed as a VM/appliance on-premises or in another compute environment to connect to AWS storage (S3, EBS snapshots, FSx, etc.). It is not a native VPC component required to build public/private subnet architecture. Although it communicates over network connectivity that may involve a VPC, it is not created as part of the VPC.

Incorrect for cost-effectiveness. The ability to launch in multiple Regions quickly is an agility and resiliency feature, not primarily a cost advantage. Multi-Region architectures can actually increase cost due to duplicated resources, data transfer, and operational complexity. While speed of deployment is valuable, the question asks specifically about cost-effectiveness versus on-prem hardware economics.

Incorrect for cost-effectiveness. Faster experimentation and agility are key cloud benefits, but they are not the best cost-focused statements here. The scenario’s strongest cost drivers are variable compute demand and limited runway, which map more directly to variable pricing (OpEx) and avoiding overprovisioning. Agility can indirectly reduce costs, but it’s not the primary economic comparison in this question.

Incorrect for cost-effectiveness. AWS does not universally “handle patching” for all infrastructure; patching responsibility depends on the service (e.g., AWS patches underlying hosts for managed services, but customers patch EC2 guest OS). This is more about operational responsibility and security posture than direct cost-effectiveness. It also doesn’t address the core financial comparison of CapEx vs pay-as-you-go.

Rehost (lift-and-shift) moves the application with minimal or no code changes, typically to Amazon EC2 (and possibly a load balancer and managed database). It is chosen for speed and risk reduction, not for redesign. It would keep the Java monolith largely intact and would not achieve decomposition into 12 microservices, independent deployments, or domain-driven boundaries.

Replatform (lift-tinker-and-shift) involves limited changes to gain some cloud benefits (e.g., moving from self-managed middleware to managed services, or adjusting runtime configurations). While you might containerize the monolith or move databases to RDS, replatforming does not imply a major architectural rewrite into multiple microservices with separate deployment lifecycles and CI/CD per service.

Repurchase means replacing the application with a different product, often SaaS (e.g., moving from a custom order system to a commercial platform). This can reduce operational burden but changes business processes and typically does not align with a goal of creating 12 custom microservices in containers. The question states an explicit target architecture rather than adopting a packaged solution.

AWS Trusted Advisor provides recommendations across cost optimization, security, fault tolerance, performance, and service limits. While it can highlight underutilized resources and potential savings, it does not create a payer account, consolidate invoices, or aggregate usage across multiple accounts for tiered pricing. It is an advisory/assessment tool, not an account and billing management service.

AWS Budgets lets you set custom cost and usage budgets and receive alerts when thresholds are exceeded. It supports budget tracking across accounts (especially when used with Organizations), but it does not itself consolidate billing into a single invoice or act as a payer mechanism. Budgets is for monitoring and alerting, not for account linking and consolidated payment.

AWS Service Catalog helps organizations create and manage catalogs of approved IT services (e.g., CloudFormation-based products) so teams can provision standardized resources with guardrails. It is not a billing consolidation or multi-account invoicing tool. While it supports governance and standardization, it does not aggregate usage for pricing discounts or produce a single bill.

IAM Access Analyzer helps identify unintended access to AWS resources by analyzing resource-based policies (for example, S3 bucket policies, KMS key policies, IAM role trust policies). It is useful for detecting public or cross-account access paths, but it does not generate a per-IAM-user CSV showing last password change dates or access key rotation/age. Therefore, it does not meet the auditor’s specific reporting requirement.

AWS Artifact provides on-demand access to AWS compliance documentation (such as SOC reports, ISO certifications) and allows management of some agreements. It is focused on evidence of AWS’s compliance posture, not on reporting your account’s IAM user credential details. It cannot produce a CSV listing each IAM user’s password change date and access key age, so it does not satisfy the requirement.

AWS Audit Manager helps continuously collect evidence from AWS services and map it to compliance frameworks, producing audit-ready reports. While powerful for governance programs, it is not the simplest or most direct tool for generating a per-user CSV of IAM password change dates and access key ages. For this specific, narrowly defined IAM credential inventory requirement, the IAM credential report is the correct tool.