AWS SAA

EC2 purchasing options?

On-Demand: no commitment. Reserved Instances: 1 or 3 yr, Standard (can be sold on the RI Marketplace) or Convertible. Savings Plans: commit to $ per hour. Spot: up to 90% off, 2 minute interruption notice. Dedicated Hosts: whole physical server, BYOL licenses. Dedicated Instances: single tenant hardware. Capacity Reservations: reserve capacity in one AZ

Decommissioned a Reserved Instance, how to stop paying?

Terminate the instance AND sell the reservation on the AWS Reserved Instance Marketplace (Standard RIs only, not Convertible). TRAP: stopping or terminating alone does not end the RI billing, and Amazon.com is not the marketplace

What happens to an EC2 instance on stop and start?

Instance may move to a different host. Instance store data is LOST. EBS data stays. Elastic IP and ENI stay attached. A regular auto-assigned public IP changes. A reboot keeps the same host and instance store data

EC2 launch requests fail after some instances succeed?

On-Demand vCPU quota per Region (by instance family) is reached. Request an increase in Service Quotas. TRAP: the old 20 instances per Region or per AZ limit is outdated

How does an EC2 instance read its own IPs and info?

curl http://169.254.169.254/latest/meta-data/ (local-ipv4, public-ipv4, instance-id). IMDSv2 adds a session token. TRAP: /latest/user-data/ is the launch script, not instance info

Run commands on many EC2 instances without SSH or RDP?

Systems Manager Run Command (via SSM Agent, target by tags or IDs, central logs). Related SSM tools: Session Manager (shell access with no open ports), Patch Manager, State Manager, Parameter Store, Automation

Enhanced networking options?

ENA: up to 100 Gbps, the current standard, higher PPS and lower latency, no extra cost, works on Windows. Intel 82599 VF: legacy, up to 10 Gbps, older instance types. EFA: ENA plus OS-bypass for tightly coupled HPC and ML, mainly Linux

HPC networking on AWS?

Cluster placement group (same AZ, low latency) plus ENA or EFA. AWS ParallelCluster deploys HPC clusters on Linux. FSx for Lustre is the usual shared HPC file system

Auto Scaling group: what can it do?

Min/desired/max across AZs, replaces unhealthy instances, launch template, policies: target tracking, step, simple, scheduled, predictive. Uses EC2 health checks by default, ELB health checks are optional

Auto Scaling policy types?

Target tracking: keep a metric at a target value (ASG manages the alarms). Step: your alarm thresholds with different adjustments by breach size. Simple: one adjustment then cooldown. Scheduled: time based. Predictive: ML forecast of load

ASG scaling in and out too often?

Flapping. Increase the cooldown period and widen alarm thresholds. Cooldown stops a new scaling activity from starting too soon after the last one. TRAP: raising the minimum size or the instance size just raises cost

Scale SQS consumers in an Auto Scaling group?

Use queue based metrics: ApproximateAgeOfOldestMessage (ties to an SLA) or backlog per instance (ApproximateNumberOfMessagesVisible divided by instances). TRAP: CPU is a poor signal for I/O-bound workers

Lambda: what can it do?

Serverless code, event driven, auto scales, max 15 min runtime, pay per ms. Permissions come from the execution role, the resource policy only controls who can invoke it. Triggers: API Gateway, S3, SQS, SNS, DynamoDB Streams, Kinesis, EventBridge, ALB

Run many parallel batch or simulation jobs with least overhead?

AWS Batch: job queues, scheduler, auto provisions and scales EC2, Spot or Fargate compute. Use Spot inside Batch for lower cost. TRAP: Lambda max runtime is 15 minutes, Fargate alone has no job scheduler

ECS vs EKS vs Fargate?

ECS: AWS container orchestration. EKS: managed Kubernetes. Fargate: serverless compute for containers (no EC2 to manage), works with ECS and EKS

EKS autoscaling layers?

Pods: HPA adds or removes replicas (needs Metrics Server), VPA changes pod CPU and memory requests. Nodes: Karpenter adds right-sized nodes for unschedulable pods without node groups (least overhead), Cluster Autoscaler also scales nodes but through node groups and ASGs

EKS access for IAM users and roles?

Cluster Access Management (CAM) API: access entries plus access policies map IAM principals to Kubernetes permissions. Replaces the older aws-auth ConfigMap approach. IRSA gives pods IAM roles

Elastic Beanstalk: what is it?

PaaS: upload code and it provisions EC2, ELB, Auto Scaling for you. Not serverless

Edge and on-prem infrastructure options?

Wavelength: AWS compute inside telecom 5G networks, single-digit ms latency to mobile devices (no Fargate). Local Zones: AWS compute in metro areas near users. Outposts: AWS hardware in your own data center. Snow Family: offline transfer and edge compute. Agents that run on-prem: Storage Gateway appliance, DataSync agent

S3: what can it do?

Object storage, 11 nines durability, versioning, lifecycle policies, static website hosting, Object Lock (WORM), replication (CRR/SRR needs versioning on both buckets), event notifications, pre-signed URLs, Transfer Acceleration, max object 5 TB

What is an S3 object key?

The full name (path) of an object in a bucket, like 2025/q3/revenue.csv. S3 is flat, folders are just key prefixes. Bucket + key (+ version ID) identifies one object

S3 request rate limits and tuning?

Per prefix: 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD per second, unlimited prefixes, so S3 scales on its own. Byte-range fetches speed up big downloads. TRAP: random key prefixes are no longer needed

Uploading very large files (up to 1 TB) to S3?

Multipart Upload: parts uploaded in parallel and retried individually, up to 10,000 parts. Recommended above 100 MB, required above 5 GB (single PUT max). Max object size 5 TB. TRAP: Transfer Acceleration only adds speed, it does not lift the 5 GB PUT limit

Rarely read data that must be instantly available and multi-AZ?

S3 Standard-IA (millisecond access, 3 or more AZs, retrieval fee, 30 day minimum). One Zone-IA is cheaper but a single AZ (only for re-creatable data). Intelligent-Tiering is for unknown access patterns. Deep Archive takes 12 to 48 hours

Make the other party pay S3 request and data transfer costs?

Requester Pays on the bucket: the requester pays request and transfer costs, owner pays storage. Requester must be an authenticated AWS account (no anonymous access) and sends the x-amz-request-payer header. TRAP: cross-account access alone only grants permission, the owner still pays the transfer

Where can S3 event notifications be sent?

SNS, SQS, Lambda or EventBridge. New objects use s3:ObjectCreated:*. TRAP: NOT Amazon MQ, and s3:ObjectAdded is not a real event

S3 event for a permanent delete of a versioned object?

s3:ObjectRemoved:Delete (delete with a version ID). A normal delete in a versioned bucket only creates a delete marker: ObjectRemoved:DeleteMarkerCreated

Filter or transform S3 data on the way out, without downloading the whole object?

S3 Object Lambda: a Lambda function processes the object on retrieval, identified by bucket name and object key. Older option for CSV rows: S3 Select (closed to new customers)

EBS: what can it do?

Block storage for one EC2 in ONE AZ. Elastic Volumes (live resize, type, IOPS), incremental snapshots to S3, KMS encryption. Multi-Attach only for io1/io2 in the same AZ

EBS volume types and when to use them?

gp2/gp3: general purpose, boot, dev/test, small DBs. io1/io2: provisioned IOPS, I/O intensive databases, Multi-Attach. st1: throughput HDD, big data and logs. sc1 or Magnetic: cheapest, infrequent access

Which EBS types can be a boot volume?

gp2, gp3, io1, io2 and Magnetic (standard). NOT st1 and sc1 (HDD throughput and cold types cannot boot)

Max IOPS for a Provisioned IOPS io1 volume by size?

50 IOPS per GiB (10 GiB = 500 max). io2 allows 500 IOPS per GiB. Use provisioned IOPS SSD for transaction intensive, low latency workloads

EBS queue length and latency?

Queue length = pending I/O requests. Low queue length keeps latency low (transaction workloads). High queue length suits throughput heavy workloads that tolerate latency

Can you use an EBS volume during a snapshot?

Yes. Snapshots run in the background, are point-in-time and incremental, and stored in S3. Volume stays attached and writable, only data written before the snapshot started is captured. Performance may dip slightly. Snapshots can be copied across Regions

Fake EBS options seen in exam answers?

SR-IOV is enhanced networking for EC2 instances (ENA, Intel 82599 VF), not a volume type. There are no spot volumes. Multi-Attach is only for io1/io2 in the same AZ, not gp3, and EBS is never multi-AZ

EFS: what can it do?

Shared NFS for Linux, POSIX, many EC2 across AZs at once, auto scales, Standard, Infrequent Access and Archive classes. TRAP: NOT for Windows (use FSx for Windows)

FSx: which flavors exist?

Windows File Server (SMB + Active Directory), Lustre (HPC, linked to S3), NetApp ONTAP (NFS, SMB, iSCSI), OpenZFS

Storage Gateway types and protocols?

On-prem bridge with a local cache. File Gateway: NFS or SMB, files stored as S3 objects. FSx File Gateway: SMB cache for FSx for Windows. Volume Gateway: iSCSI block volumes, backed up as EBS snapshots. Tape Gateway: virtual tape library (VTL) for backup software, to S3 and Glacier

Volume Gateway cached vs stored mode?

Cached: all data in S3, only recently accessed data cached locally (saves on-prem storage). Stored: all data kept locally, async snapshots to AWS (full local copy, backup and DR use). Both present iSCSI volumes

AWS Backup: what can it do?

Central backup plans across EC2, EBS, RDS, DynamoDB, EFS and more, cross-region and cross-account copies, Vault Lock

RDS: what can it do?

Managed MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2. Multi-AZ = HA. Read replicas = read scaling. Automated backups, IAM DB authentication (token from the EC2 role, no stored password), RDS Proxy

RDS Multi-AZ vs read replica?

Multi-AZ: synchronous standby in another AZ, automatic failover, same endpoint, for HA (standby cannot serve reads in the classic setup). Read replica: asynchronous, for read scaling or cross-region DR, promoted manually, new endpoint

RDS used only occasionally, cheapest way to keep it?

Snapshot then terminate, restore from the snapshot when needed (pay only for snapshot storage). TRAP: stopping an RDS instance still bills storage and it auto restarts after 7 days. Downsizing changes test results

RDS Enhanced Monitoring vs standard CloudWatch metrics?

Standard: from the hypervisor (CPU utilization, freeable memory, database connections). Enhanced: agent inside the instance, down to 1 second, adds OS processes, RDS child processes, file system and disk stats, sent to CloudWatch Logs

Which RDS tool finds expensive queries?

Performance Insights: database load dashboard showing top SQL, waits and hosts. Enhanced Monitoring shows OS level metrics, not queries

RDS Proxy: what does it do?

Connection pooling, faster failover, IAM auth, protects the DB from Lambda connection storms

Aurora: what can it do?

MySQL/PostgreSQL compatible, 6 copies across 3 AZs, up to 15 replicas, storage auto grows to 128 TiB, Global Database, Serverless v2 (move to it by adding a v2 reader and failing over), native Lambda calls from DB triggers. Endpoints: cluster (writer), reader (load balances replicas), custom, instance

Which database fits which workload?

OLTP relational (ACID, joins, large and growing): Aurora (storage up to 128 TiB) or RDS (up to 64 TiB for most engines). OLAP analytics: Redshift. Key-value or document at any scale: DynamoDB. In memory cache: ElastiCache. Graph: Neptune

DynamoDB: what can it do?

Serverless NoSQL, single digit ms, on-demand or provisioned with Auto Scaling, Streams, Global Tables, TTL, point in time recovery, transactions, eventually consistent reads by default (strong optional), item max 400 KB. Auto Scaling is on by default only when created in the console

DAX: what is it?

In-memory cache for DynamoDB, microsecond reads, API compatible client. Read cache only, no change events (for change events use DynamoDB Streams)

ElastiCache: Redis vs Memcached?

Redis: replication, Multi-AZ, persistence, pub/sub, complex types. Memcached: simple, multi-threaded, no persistence or replication

Redshift: what is it?

Columnar data warehouse for analytics (OLAP). Redshift Spectrum queries S3 directly without loading the data

Athena: what is it?

Serverless SQL on data in S3 (JSON, CSV, Parquet), pay per query, uses the Glue Data Catalog. With Redshift Spectrum and Glue: analytics on S3 without moving data

Athena federated query vs live app queries?

Athena Federated Query (DynamoDB connector) is for analytics SQL reads. It is not for application writes and can load live tables. Use AppSync or the SDK for app reads and writes

What is AWS AppSync?

Managed serverless GraphQL (and pub/sub) API service. Resolvers connect fields to data sources (DynamoDB, Lambda, RDS, HTTP). Pipeline resolvers run several steps in order, each on a different data source, in one request without custom code

Serverless GraphQL API with a custom HTTPS domain?

AWS AppSync with a custom domain name and an ACM certificate. For REST or HTTP APIs the equivalent is API Gateway. TRAP: DNSSEC signs DNS records and does not enable HTTPS

NAT Gateway vs Internet Gateway?

NAT Gateway: lets private subnets reach the internet. Replies to connections they start come back (stateful), but the internet cannot start a connection in. Lives in a public subnet, needs an EIP, AZ scoped. Internet Gateway: two way internet for public subnets, VPC level. IPv6 version of NAT: egress-only internet gateway

NACL vs security group?

NACL: subnet level, stateless (need inbound AND outbound rules), allow and deny rules, rule number order. Security group: instance level, stateful, allow rules only, all rules evaluated

How are NACL rules evaluated?

In ascending rule number order, first match wins and evaluation stops. Put specific DENY rules at a lower number than broad ALLOW rules. The final * rule denies everything else

VPC endpoints: Gateway vs Interface, and vs VPC peering?

Gateway endpoint: S3 and DynamoDB only, free, route table entry. Interface endpoint (PrivateLink): ENI with private IP, most other services, hourly cost. Both reach AWS services privately. VPC peering instead connects two VPCs

Connect two VPCs privately, including across Regions?

VPC peering: cross-account and inter-Region supported, uses the AWS backbone, no overlapping CIDRs, non-transitive. Then add routes in each route table: destination = other VPC CIDR, target = peering connection (pcx). Many VPCs: use Transit Gateway

Transit Gateway: what can it do?

Hub and spoke for many VPCs and on-prem, transitive routing, shareable with RAM. TRAP: it does not move IPs or fail over instances

Direct Connect: what can it do?

Dedicated private line, consistent bandwidth, VIFs: private, public, transit. Not encrypted by default (run a VPN over it). Takes weeks to set up

Site-to-Site VPN: what can it do?

IPsec over the internet, 2 tunnels, fast to set up. AWS side: VGW or TGW. Outside the VPC: a customer gateway with a static public IP. TRAP: you cannot attach an EIP to a VGW

Inspect and filter traffic in and out of a VPC?

AWS Network Firewall: managed stateful firewall and IPS at the VPC level, rule groups, firewall endpoints, route table changes. TRAP: not Reachability Analyzer or Network Access Analyzer (configuration analysis), not Traffic Mirroring (copies EC2 ENI traffic, no filtering)

ALB: what can it do?

Layer 7. Routes by path, host, header, query string. HTTP/HTTPS, gRPC, WebSockets, Lambda targets, weighted target groups, SNI with multiple certs, Cognito/OIDC auth, WAF. NO static IP

NLB: what can it do?

Layer 4 (TCP/UDP/TLS), static IP or Elastic IP per AZ (firewall whitelisting), millions of requests per second, ultra low latency, keeps client source IP, PrivateLink. No path routing

Gateway Load Balancer: what is it for?

Layer 3. Send traffic through third party virtual appliances (firewalls, inspection). Uses GENEVE on port 6081

Cross-zone load balancing defaults?

ALB: on by default, no inter-AZ charge. NLB and GWLB: off by default (enabling NLB cross-zone has data charges)

ELB features and limits to remember?

Sticky sessions, connection draining (deregistration delay), health checks, SSL termination, access logs. ELB is regional and cannot span regions

Gradually shift traffic during a migration (50/50, then 100%)?

Route 53 weighted routing (DNS level) or ALB weighted target groups (load balancer level, on-prem servers added as IP targets over Direct Connect or VPN). TRAP: failover routing is active-passive, not a percentage split

Route 53: what can it do?

DNS, domain registration, health checks, alias records (work at the zone apex, free queries to AWS targets). Hosted zones are global

Route 53 routing policies?

Simple: one record. Weighted: percentage split. Latency: lowest latency Region. Failover: active-passive with health checks. Geolocation: by user country or continent. Geoproximity: by distance, with a bias. Multi-value answer: several healthy records. IP-based: by client IP range

Route 53 active-active vs active-passive?

Active-active: all resources answer queries (weighted, latency, geo or multivalue records) with health checks removing unhealthy ones. Active-passive: failover routing policy, secondary used only when primary fails

Point the zone apex (example.com) to an ALB, CloudFront or S3 website?

Route 53 alias record (type A, or AAAA for IPv6) pointing to the AWS resource. Alias queries to AWS resources are free and follow IP changes. TRAP: CNAME is not allowed at the zone apex, ALB has no fixed IP, and "alias for CNAME" is not a record type

ACM certificate Region for an API Gateway custom domain?

Regional API: certificate in the same Region as the API. Edge-optimized API: certificate in us-east-1 (CloudFront). Steps: ACM public cert, custom domain name with the cert, Route 53 alias to the API Gateway domain name

CloudFront: what can it do?

CDN caching at edge, origins S3/ALB/custom, signed URLs and cookies, OAC for private S3, HTTPS, WAF, geo restriction, Lambda@Edge and CloudFront Functions. Best for global downloads (S3 Transfer Acceleration is for uploads)

CloudFront + S3 private content, no direct S3 access and only authorized clients?

OAC (only CloudFront can read the bucket) + signed URLs or signed cookies (only authorized clients can use CloudFront). TRAP: not S3 presigned URLs (bypass CloudFront), not Origin Shield (caching only)

CloudFront signed URL vs signed cookie?

Signed URL: one file, or clients that do not support cookies. Signed cookie: many files at once without changing URLs

Run code close to users at CloudFront edge locations?

Lambda@Edge (also CloudFront Functions for lightweight tasks). TRAP: Route 53 latency or geoproximity routing only chooses where to send requests, it does not process data

Global Accelerator: what can it do?

2 static anycast IPs, AWS backbone, TCP and UDP (gaming, IoT, VoIP), fast health based failover. No caching, no S3 integration

Global Accelerator endpoints?

ALB, NLB, EC2 instances and Elastic IPs in AWS only. No on-premises endpoints. Traffic dials control the split between endpoint groups (Regions)

API Gateway: what can it do?

Managed front door for REST, HTTP and WebSocket APIs. Response caching (default TTL 300 s), throttling, usage plans + API keys, Lambda and Cognito authorizers, request validation, canary deployments

SQS: what can it do?

Queue to decouple workers. Standard: at least once, unordered, huge throughput. FIFO: ordered, exactly once. Visibility timeout, DLQ, long polling, retention up to 14 days. TRAP: NO message priority setting (use two queues, workers poll the priority one first)

SQS short vs long polling?

Short (default, ReceiveMessageWaitTimeSeconds = 0): returns immediately, may be empty, more requests and cost. Long (1 to 20 seconds): waits for a message, fewer empty responses, lower cost. Set on the queue or per request

SQS consumer dies before finishing a message?

The message was never deleted, so it becomes visible again after the visibility timeout (default 30 s, max 12 h) and another consumer processes it. At-least-once delivery, make processing idempotent. After max receives, it moves to the DLQ

SNS: what can it do?

Pub/sub topics. Subscribers: email, SMS, HTTP, Lambda, SQS. Fan-out (SNS to many SQS queues), message filtering, FIFO topics. SES is for bulk or marketing email, not system notifications

EventBridge: what can it do?

Event bus, rules, schedules, AWS and SaaS events (including AWS Health and Config compliance), many targets (Lambda, SQS, SNS, Step Functions)

Step Functions: what is it?

Orchestrates workflows as state machines across Lambda and other services, with retries and error handling

Kinesis Data Streams vs Firehose?

Data Streams: real time, shards, retention 24 h up to 365 days, custom consumers, replay. Firehose: near real time delivery to S3, Redshift, OpenSearch, no code. TRAP: Athena queries data already stored in S3, it is not a stream processor

Kinesis vs SQS?

Kinesis: streaming, ordered per shard, many consumers can re-read and replay recent data. SQS: queue for decoupling, message deleted once processed, no replay. Kinesis clues even without the word streaming: ordered records, replay, multiple consumers, big data (EMR). If SQS FIFO is an option and throughput is modest, it is the simpler ordered queue

Which AWS messaging options keep order?

SQS FIFO (ordered, exactly once, per message group), SNS FIFO, Kinesis Data Streams (ordered per shard, replayable). SQS standard and SNS standard: no ordering guarantee, duplicates possible

IAM: what can it do?

Users, groups, roles, policies (identity based and resource based), permission boundaries, MFA, instance profiles give roles to EC2. Global service

Manage permissions for many IAM users in one account?

IAM group per team with a least privilege policy attached, new users just join the group. TRAP: roles are assumed, not attached to groups. SCPs apply to accounts and OUs, never to IAM users

Force MFA with an IAM policy?

Deny actions unless aws:MultiFactorAuthPresent is true, attached to the user's group. Permissions boundary only caps permissions, it never grants any

How to read an IAM policy ARN?

arn:aws:service:region:account-ID:resource-type/resource-ID. For Directory Service the resource ID is d-xxxxxxxxxx. The 12-digit number is the account ID

What is the Sid in an IAM policy statement?

Statement ID: an optional label to describe the statement. It does not affect permissions

Cognito: user pools vs identity pools?

User pools: sign up, sign in, JWT tokens for app users. Identity pools: swap a login for temporary AWS credentials

IAM Identity Center: what is it?

Workforce single sign on to multiple AWS accounts and apps. TRAP: NOT for customers of your app (use Cognito), and cannot read a plain LDAP directory

Directory Service options?

AWS Managed Microsoft AD (real AD in AWS), AD Connector (proxy to on-prem AD), Simple AD (basic, Samba based)