150 practice questions and 100 flashcards for the AWS Solutions Architect Associate (SAA-C03) exam. Covers all exam domains: Design Secure Architectures, Resilient Architectures, High-Performing Architectures, and Cost-Optimised Architectures.
The AWS Solutions Architect Associate (SAA-C03) is the most sought-after cloud certification for infrastructure roles in South Africa. It tests your ability to design architectures that are secure, resilient, high-performing, and cost-optimised. Tour practice set covers all four exam domains with scenario-based questions — the same style used in the actual exam. Every answer explanation walks through the architectural reasoning, not just the correct option.
Focus on VPC design, storage selection (S3 vs EBS vs EFS), the difference between Multi-AZ and Read Replicas, and IAM roles vs policies. These are the building blocks of most scenario questions.
150 practice questions and 100 flashcards for the AWS Solutions Architect Associate (SAA-C03) exam. Covers all exam domains: Design Secure Architectures, Resilient Architectures, High-Performing Architectures, and Cost-Optimised Architectures.
0/150
correct answers
Question 01 of 150
What is the AWS Well-Architected Framework?
Explanation: The Well-Architected Framework provides a consistent approach for evaluating architectures. The five pillars guide decision-making. A sixth pillar — Sustainability — was added in 2021. The Well-Architected Tool in the console helps assess workloads against these pillars.
Question 02 of 150
What is Amazon VPC?
Explanation: VPC gives you control over your virtual networking environment. Key components: subnets (public/private), route tables, Internet Gateway (public access), NAT Gateway (private subnet internet access), security groups, NACLs, VPC peering.
Question 03 of 150
What is the difference between a public and private subnet?
Explanation: Public subnet: route table has 0.0.0.0/0 → Internet Gateway. Resources can have public IPs. Private subnet: no IGW route. Resources use NAT Gateway for outbound internet. Private subnets are used for databases, application servers that shouldn't be directly accessible from the internet.
Question 04 of 150
What is Amazon RDS?
Explanation: RDS handles: provisioning, patching, backup, recovery, scaling, replication. Multi-AZ: synchronous standby for high availability. Read Replicas: asynchronous copies for read scaling. Aurora: AWS-native, 5x performance of MySQL, 3x PostgreSQL. RDS Proxy: connection pooling.
Question 05 of 150
What is Amazon CloudFront?
Explanation: CloudFront distributes content globally from 400+ Edge Locations. Origins: S3, EC2, ALB, HTTP servers. Behaviours: path-based routing. Cache invalidation. Lambda@Edge: run code at edge. Signed URLs/cookies: restrict access. Shield integration: DDoS protection.
Question 06 of 150
What is the difference between horizontal and vertical scaling?
Explanation: Vertical scaling requires downtime and has hardware limits. Horizontal scaling: Auto Scaling Groups add/remove instances based on metrics. Stateless applications scale horizontally easily. Stateful applications need session management (ElastiCache, sticky sessions) for horizontal scaling.
Question 07 of 150
What is Amazon Route 53?
Explanation: Route 53 routing policies: Simple (single resource), Weighted (A/B testing, gradual rollout), Latency-based (route to lowest latency region), Failover (active-passive), Geolocation (route by user location), Geoproximity (route by distance), Multivalue Answer (multiple healthy endpoints).
Explanation: ElastiCache reduces latency and improves throughput. Redis: supports persistence, complex data types, pub/sub, Lua scripts, replication, cluster mode. Memcached: simpler, multi-threaded, no persistence. Use case: session storage, database query caching, real-time leaderboards.
Question 10 of 150
What is AWS Lambda?
Explanation: Lambda: event-driven (API Gateway, S3, DynamoDB, SNS, SQS triggers). Up to 15-minute timeout. 10GB memory max. Cold starts: initialisation latency on first invocation. Concurrency: up to 1000 concurrent executions default. Layers: shared code. Pricing: per request + duration.
Question 11 of 150
What is Amazon DynamoDB?
Explanation: DynamoDB: partition key (and optional sort key) for primary key. No schema for non-key attributes. Streams: capture item changes. DAX (DynamoDB Accelerator): in-memory cache with microsecond latency. Global Tables: multi-region active-active. Capacity: provisioned or on-demand.
Question 12 of 150
What is the difference between S3 and EBS?
Explanation: S3: durable (11 nines), scalable, web-accessible, good for static files, backups, data lakes. EBS: low-latency block storage for EC2 OS, databases (high IOPS). EFS: managed NFS file system that can be mounted by multiple EC2 instances simultaneously.
Question 13 of 150
What is AWS Auto Scaling?
Explanation: Auto Scaling Groups: min, max, desired capacity. Scaling policies: target tracking (maintain metric like 50% CPU), step scaling (react to alarm thresholds), scheduled scaling (predictable patterns). Health checks: EC2 status, ELB health checks. Launch templates define instance configuration.
Question 14 of 150
What is Amazon SQS?
Explanation: SQS: Standard queue (at-least-once, best-effort order, high throughput) vs FIFO queue (exactly-once, strict order, 300 TPS). Message retention: up to 14 days. Visibility timeout: time other consumers can't see message being processed. Dead letter queue: failed messages after max retries.
Question 15 of 150
What is Amazon SNS?
Explanation: SNS: publisher pushes to a topic, all subscribers receive it. Fan-out pattern: SNS → multiple SQS queues. Protocols: HTTP/S, email, SMS, Lambda, SQS, mobile push. Compare SQS (one consumer processes message) vs SNS (all subscribers receive it).
Question 16 of 150
What is the difference between Security Groups and NACLs?
Explanation: Security Groups: allow rules only, stateful (connection tracking). NACLs: allow and deny rules, stateless (must allow both inbound AND outbound for a connection), subnet level. Security groups are primary defence; NACLs provide additional subnet-level protection. NACLs process rules in number order.
Question 17 of 150
What is Amazon ECS?
Explanation: ECS: Fargate launch type (serverless, no infrastructure management) vs EC2 launch type (you manage instances). Task definitions: Docker container configuration. Services: maintain desired count, integrate with ALB. Compare: EKS (managed Kubernetes), Lambda (functions, not containers).
Question 18 of 150
What is AWS IAM best practice for root account?
Explanation: Root account has unrestricted access to all AWS services. Best practices: enable MFA, use only for tasks that require root (account-level billing, closing account), never create access keys for root, use IAM users with least privilege for all other tasks.
Question 19 of 150
What is an IAM Role?
Explanation: Roles use temporary credentials (via STS). EC2 instance roles: grant EC2 permissions to access AWS services without embedding credentials. Cross-account access. Service roles: Lambda, ECS task roles. Compared to IAM users (long-term credentials). Use roles instead of access keys whenever possible.
Explanation: AWS: physical security, hardware, hypervisor, networking, managed services. Customer: data classification/encryption, IAM, OS patching (IaaS), application security, network/security group configuration. The split shifts based on service type — more managed services = more AWS responsibility.
Question 22 of 150
What is S3 Versioning?
Explanation: S3 Versioning: when enabled, every PUT creates a new version. Delete adds a delete marker (object not immediately removed). Permanently delete: specify version ID. MFA Delete: requires MFA to delete versions. Versioning is required for S3 replication.
Question 23 of 150
What is AWS CloudFormation?
Explanation: CloudFormation: templates define resources declaratively. Stacks: a collection of resources managed as a unit. Change sets: preview changes before applying. Drift detection: identify manual changes outside CloudFormation. Nested stacks: modular templates. Alternative: AWS CDK (code → CloudFormation), Terraform.
Question 24 of 150
What is Amazon Aurora?
Explanation: Aurora: 6 copies of data across 3 AZs (storage is shared and self-healing). Auto-scaling storage up to 128TB. Aurora Replicas: up to 15 with automatic failover. Serverless v2: auto-scales compute. Global Database: cross-region primary and read replicas. Aurora DSQL: serverless distributed SQL.
Question 25 of 150
What is AWS Direct Connect?
Explanation: Direct Connect: dedicated 1Gbps or 10Gbps connections. More consistent network performance and lower latency than VPN. Higher cost. Hosted connections: through AWS Direct Connect partners for lower bandwidth. Combine with VPN for encrypted backup connection. BGP routing required.
Question 26 of 150
What is VPC Peering?
Explanation: VPC Peering: same region or cross-region. Same or different accounts. No transitive peering (A-B-C doesn't mean A-C can communicate). No overlapping CIDR blocks. Route tables must be updated. Compare Transit Gateway: hub-and-spoke, supports transitive routing for many VPCs.
Question 27 of 150
What is S3 Lifecycle Policy?
Explanation: Lifecycle rules: transition actions (move to cheaper storage class after N days) and expiration actions (delete after N days). Example: Standard → Standard-IA (30 days) → Glacier (90 days) → delete (365 days). Reduces storage costs automatically.
Question 28 of 150
What is Amazon Kinesis?
Explanation: Kinesis Data Streams: real-time, custom consumers, 1-365 day retention, shards (1MB/s in, 2MB/s out each). Kinesis Firehose: managed delivery to S3, Redshift, Elasticsearch, Splunk. Use case: clickstream analysis, IoT telemetry, log analytics, real-time dashboards.
Question 29 of 150
What is AWS Elastic Beanstalk?
Explanation: Elastic Beanstalk: supports Node.js, Python, Java, .NET, PHP, Ruby, Go, Docker. You retain full control over underlying EC2, RDS, etc. Environments: Web Server (ALB + EC2) and Worker (SQS + EC2). Free — you pay only for underlying resources. Good for simple deployments.
Question 30 of 150
What is Amazon EKS?
Explanation: EKS manages the Kubernetes control plane (API server, etcd). Worker nodes: EC2 node groups or Fargate. Integrates with: IAM (RBAC), VPC networking, ALB Ingress, EBS/EFS for storage, CloudWatch for logs. Use EKS when you need Kubernetes (existing workloads, cross-cloud portability).
Question 31 of 150
What is AWS WAF?
Explanation: WAF attaches to: CloudFront, ALB, API Gateway, AppSync. Rule groups: AWS Managed Rules (OWASP Top 10, known bad IPs), Custom Rules, Rate-based rules. Web ACL: collection of rules applied to a resource. Compare Shield (volumetric DDoS protection), Network Firewall (VPC-level).
Question 32 of 150
What is the purpose of an Elastic IP?
Explanation: Elastic IPs: your account's IP that doesn't change when instance stops/starts. Associates with: EC2 instances or ENIs. Free when in use; charged when allocated but not associated. Use case: IP whitelisting requirements, DNS pointing. For most cases, use Route 53 instead of depending on Elastic IP.
Question 33 of 150
What is Amazon Cognito?
Explanation: Cognito User Pools: user directory, sign-up/sign-in, MFA, hosted UI, social federation (Google, Facebook). Identity Pools: exchange tokens for temporary AWS credentials. Use case: mobile/web app authentication, federated access to AWS resources. Compare: IAM (internal AWS users, not end-users).
Question 34 of 150
What is AWS Step Functions?
Explanation: Step Functions: state machines with states (Task, Choice, Wait, Parallel, Map). Standard workflows (long-running, up to 1 year, exactly-once). Express workflows (high-volume, up to 5 minutes, at-least-once). Integrates with Lambda, ECS, DynamoDB, SQS, SNS. Handles retries, errors, and branching.
Question 35 of 150
What is Amazon EMR?
Explanation: EMR: runs open-source analytics frameworks at petabyte scale. Clusters: master + core (HDFS) + task nodes. Storage: HDFS (temporary) or S3 (persistent). Use case: log analysis, machine learning, ETL, clickstream analysis. Spot instances for task nodes to reduce costs by 60-90%.
Question 36 of 150
What is the difference between multi-AZ and Read Replicas in RDS?
Explanation: Multi-AZ: standby in different AZ, synchronous replication, automatic failover (60-120 seconds), same endpoint. Read Replicas: async replication, separate endpoint, can be promoted, up to 5 (15 for Aurora), can be cross-region. Use both: multi-AZ for HA, read replicas for read scaling.
Question 37 of 150
What is AWS Glue?
Explanation: Glue: Data Catalogue (metadata repository for S3, RDS, Redshift). Crawlers: auto-discover schema. ETL Jobs: Python or Scala (PySpark). Glue DataBrew: visual data transformation, no code. Use case: prepare data for Athena, Redshift, EMR. Serverless — no infrastructure management.
Question 38 of 150
What is Amazon Athena?
Explanation: Athena: no infrastructure to manage. Supports: CSV, JSON, ORC, Avro, Parquet. Partitioning: reduce data scanned = reduce cost. Price: $5/TB scanned. Use with Glue Data Catalogue. Common use: ad-hoc analysis of S3 data lakes, CloudTrail logs, ALB access logs, VPC flow logs.
Question 39 of 150
What is Amazon Redshift?
Explanation: Redshift: columnar storage (queries read only needed columns). Massive Parallel Processing (MPP). Leader node + compute nodes. Redshift Spectrum: query S3 directly from Redshift. Snapshots: automated and manual. AQUA: hardware-accelerated cache. RA3 nodes: separate storage (S3) from compute.
Question 40 of 150
What is a NAT Gateway?
Explanation: NAT Gateway: AWS managed, highly available within AZ, 5-100Gbps. Placed in public subnet with Elastic IP. Private subnet route: 0.0.0.0/0 → NAT Gateway. For HA: deploy NAT Gateway in each AZ. Outbound only. Compare NAT Instance: EC2 you manage yourself (cheaper but less scalable).
Explanation: Secrets Manager: stores secrets encrypted with KMS. Automatic rotation: Lambda function rotates credentials on schedule (e.g., RDS password every 30 days). Fine-grained IAM access control. Versions: AWSCURRENT, AWSPREVIOUS. Compare: Parameter Store (simpler, free, no auto-rotation built-in).
Question 43 of 150
What is Amazon SageMaker?
Explanation: SageMaker: Studio (unified IDE), Notebooks (managed Jupyter), Training (distributed, spot instances), Endpoints (real-time inference), Batch Transform, Feature Store, Model Monitor, Pipelines (MLOps). Ground Truth: data labelling. Autopilot: AutoML. Use SageMaker for custom ML models; Rekognition/Comprehend for pre-built AI services.
Question 44 of 150
What is the difference between AWS Config and CloudTrail?
Explanation: CloudTrail: API activity log (who called DeleteBucket, when, from where). Config: resource configuration history and compliance rules. Example: Config rule 'S3 buckets must be private' — continuously evaluates and flags violations. Use both: CloudTrail for security audit, Config for compliance.
Question 45 of 150
What is Amazon GuardDuty?
Explanation: GuardDuty: findings categorised as High/Medium/Low severity. Finding types: Reconnaissance, Trojan, UnauthorizedAccess, Cryptocurrency mining, Backdoor. No agents required. Multi-account with AWS Organisations. Malware Protection: scans EBS volumes for malware. Enable for every account/region.
Question 46 of 150
What is AWS Transit Gateway?
Explanation: Transit Gateway: attach VPCs, VPNs, Direct Connect. Supports transitive routing (A→TGW→B→TGW→C works). Route tables: control which attachments can communicate. Inter-region peering: connect Transit Gateways across regions. Multicast support. Replaces complex mesh of VPC peering connections.
Question 47 of 150
What is Amazon API Gateway?
Explanation: API Gateway: REST APIs, HTTP APIs (cheaper, simpler), WebSocket APIs. Features: authentication (Cognito, IAM, Lambda authoriser), throttling, caching, CORS, SDK generation, custom domain names. Usage plans: API keys, throttle/quota by consumer. Stage variables: different backend per stage.
Explanation: Inspector v2: continuous scanning (not on-demand). Findings: prioritised by risk score combining CVSS + exploitability + network reachability. EC2 agent: SSM agent. ECR: scan on push. Lambda: function code and dependencies. Integrates with Security Hub for centralised view.
Question 50 of 150
What is the difference between S3 Standard and S3 Glacier?
Explanation: S3 storage classes: Standard (frequently accessed), Standard-IA (infrequent, same retrieval), One Zone-IA (one AZ), Glacier Instant Retrieval (ms retrieval), Glacier Flexible Retrieval (minutes-hours), Glacier Deep Archive (12-48 hours, cheapest). Use Lifecycle policies to automate transitions.
Question 51 of 150
What is AWS Systems Manager?
Explanation: SSM Session Manager: browser-based SSH, no open port 22, no bastion host, audited sessions. Parameter Store: configuration and secrets storage (free tier). Patch Manager: automate OS patching. Run Command: execute scripts across fleet. Inventory: collect instance metadata. OpsCenter: operations issue management.
Question 52 of 150
What is Amazon EventBridge?
Explanation: EventBridge: default bus (AWS service events), custom buses (your app events), partner buses (SaaS). Rules: match events → send to targets (Lambda, SQS, SNS, Step Functions, API Gateway, etc.). Event patterns: match on specific fields. Schedule: cron-based events. Replaced CloudWatch Events.
Question 53 of 150
What is Amazon FSx?
Explanation: FSx for Windows: SMB protocol, integrates with Active Directory, NTFS permissions. FSx for Lustre: high-performance computing, ML training, hundreds of GB/s throughput, integrates with S3. FSx for NetApp ONTAP: multi-protocol (NFS, SMB, iSCSI), data management features. FSx for OpenZFS: NFS, consistent performance.
Question 54 of 150
What is Amazon SES?
Explanation: SES: SMTP or API. Verify domains. Integrates with Lambda, S3, SNS. Bounce handling critical for deliverability.
Question 55 of 150
What is AWS Organisations?
Explanation: SCPs set maximum permissions. Consolidated billing: single invoice, volume discounts. Account vending: automated account creation.
Question 56 of 150
What is VPC Flow Logs?
Explanation: Captures: source/dest IP, ports, protocol, action (ACCEPT/REJECT). Stored in CloudWatch Logs or S3. Analyse with Athena.
Question 57 of 150
What is Amazon Macie?
Explanation: Discovers PII, credentials, financial data in S3. Risk scoring. Findings to Security Hub or EventBridge.
Question 58 of 150
What is AWS Certificate Manager?
Explanation: Free for ALB, CloudFront, API Gateway. Wildcard certificates. Domain validation via DNS or email.
Question 59 of 150
What is the difference between S3 and EFS?
Explanation: EFS: POSIX file system, auto-scales, Multi-AZ. Much more expensive than S3. FSx for Windows: EFS equivalent for Windows.
Question 60 of 150
What is AWS Fargate?
Explanation: Specify CPU and memory per task. Pay per vCPU/memory per second. Each task has own kernel — strong isolation.
Question 61 of 150
What is Amazon Rekognition?
Explanation: Object/scene detection, facial analysis, celebrity recognition, text in images, content moderation, PPE detection.
Question 62 of 150
What is Amazon Comprehend?
Explanation: Sentiment: positive/negative/neutral/mixed. Entities: people, places, organisations. No ML expertise needed.
Question 63 of 150
What is AWS X-Ray?
Explanation: Traces requests across services. Service map: visualise bottlenecks. Sampling reduces cost. Essential for microservices.
Question 64 of 150
What is AWS Trusted Advisor?
Explanation: Full checks require Business/Enterprise support. Security: MFA, open security groups, public S3. Cost: idle resources.
Question 65 of 150
What is the CAP theorem?
Explanation: Network partitions inevitable — choose CP or AP. DynamoDB: AP (eventual) or CP (strong). RDS Multi-AZ: CP.
Question 66 of 150
What is blue/green deployment?
Explanation: Zero-downtime. Switch via Route 53 weighted routing, ALB, or CodeDeploy. Cost: double infrastructure temporarily.
Explanation: Data providers: Esri, HERE. GDPR-compliant. Geofences trigger events when devices enter/exit boundaries.
Question 101 of 150
What is the AWS Well-Architected Framework?
Explanation: The Well-Architected Framework provides a consistent approach for evaluating architectures. The five pillars guide decision-making. A sixth pillar — Sustainability — was added in 2021. The Well-Architected Tool in the console helps assess workloads against these pillars.
Question 102 of 150
What is Amazon VPC?
Explanation: VPC gives you control over your virtual networking environment. Key components: subnets (public/private), route tables, Internet Gateway (public access), NAT Gateway (private subnet internet access), security groups, NACLs, VPC peering.
Question 103 of 150
What is the difference between a public and private subnet?
Explanation: Public subnet: route table has 0.0.0.0/0 → Internet Gateway. Resources can have public IPs. Private subnet: no IGW route. Resources use NAT Gateway for outbound internet. Private subnets are used for databases, application servers that shouldn't be directly accessible from the internet.
Question 104 of 150
What is Amazon RDS?
Explanation: RDS handles: provisioning, patching, backup, recovery, scaling, replication. Multi-AZ: synchronous standby for high availability. Read Replicas: asynchronous copies for read scaling. Aurora: AWS-native, 5x performance of MySQL, 3x PostgreSQL. RDS Proxy: connection pooling.
Question 105 of 150
What is Amazon CloudFront?
Explanation: CloudFront distributes content globally from 400+ Edge Locations. Origins: S3, EC2, ALB, HTTP servers. Behaviours: path-based routing. Cache invalidation. Lambda@Edge: run code at edge. Signed URLs/cookies: restrict access. Shield integration: DDoS protection.
Question 106 of 150
What is the difference between horizontal and vertical scaling?
Explanation: Vertical scaling requires downtime and has hardware limits. Horizontal scaling: Auto Scaling Groups add/remove instances based on metrics. Stateless applications scale horizontally easily. Stateful applications need session management (ElastiCache, sticky sessions) for horizontal scaling.
Question 107 of 150
What is Amazon Route 53?
Explanation: Route 53 routing policies: Simple (single resource), Weighted (A/B testing, gradual rollout), Latency-based (route to lowest latency region), Failover (active-passive), Geolocation (route by user location), Geoproximity (route by distance), Multivalue Answer (multiple healthy endpoints).
Explanation: ElastiCache reduces latency and improves throughput. Redis: supports persistence, complex data types, pub/sub, Lua scripts, replication, cluster mode. Memcached: simpler, multi-threaded, no persistence. Use case: session storage, database query caching, real-time leaderboards.
Question 110 of 150
What is AWS Lambda?
Explanation: Lambda: event-driven (API Gateway, S3, DynamoDB, SNS, SQS triggers). Up to 15-minute timeout. 10GB memory max. Cold starts: initialisation latency on first invocation. Concurrency: up to 1000 concurrent executions default. Layers: shared code. Pricing: per request + duration.
Question 111 of 150
What is Amazon DynamoDB?
Explanation: DynamoDB: partition key (and optional sort key) for primary key. No schema for non-key attributes. Streams: capture item changes. DAX (DynamoDB Accelerator): in-memory cache with microsecond latency. Global Tables: multi-region active-active. Capacity: provisioned or on-demand.
Question 112 of 150
What is the difference between S3 and EBS?
Explanation: S3: durable (11 nines), scalable, web-accessible, good for static files, backups, data lakes. EBS: low-latency block storage for EC2 OS, databases (high IOPS). EFS: managed NFS file system that can be mounted by multiple EC2 instances simultaneously.
Question 113 of 150
What is AWS Auto Scaling?
Explanation: Auto Scaling Groups: min, max, desired capacity. Scaling policies: target tracking (maintain metric like 50% CPU), step scaling (react to alarm thresholds), scheduled scaling (predictable patterns). Health checks: EC2 status, ELB health checks. Launch templates define instance configuration.
Question 114 of 150
What is Amazon SQS?
Explanation: SQS: Standard queue (at-least-once, best-effort order, high throughput) vs FIFO queue (exactly-once, strict order, 300 TPS). Message retention: up to 14 days. Visibility timeout: time other consumers can't see message being processed. Dead letter queue: failed messages after max retries.
Question 115 of 150
What is Amazon SNS?
Explanation: SNS: publisher pushes to a topic, all subscribers receive it. Fan-out pattern: SNS → multiple SQS queues. Protocols: HTTP/S, email, SMS, Lambda, SQS, mobile push. Compare SQS (one consumer processes message) vs SNS (all subscribers receive it).
Question 116 of 150
What is the difference between Security Groups and NACLs?
Explanation: Security Groups: allow rules only, stateful (connection tracking). NACLs: allow and deny rules, stateless (must allow both inbound AND outbound for a connection), subnet level. Security groups are primary defence; NACLs provide additional subnet-level protection. NACLs process rules in number order.
Question 117 of 150
What is Amazon ECS?
Explanation: ECS: Fargate launch type (serverless, no infrastructure management) vs EC2 launch type (you manage instances). Task definitions: Docker container configuration. Services: maintain desired count, integrate with ALB. Compare: EKS (managed Kubernetes), Lambda (functions, not containers).
Question 118 of 150
What is AWS IAM best practice for root account?
Explanation: Root account has unrestricted access to all AWS services. Best practices: enable MFA, use only for tasks that require root (account-level billing, closing account), never create access keys for root, use IAM users with least privilege for all other tasks.
Question 119 of 150
What is an IAM Role?
Explanation: Roles use temporary credentials (via STS). EC2 instance roles: grant EC2 permissions to access AWS services without embedding credentials. Cross-account access. Service roles: Lambda, ECS task roles. Compared to IAM users (long-term credentials). Use roles instead of access keys whenever possible.
Explanation: AWS: physical security, hardware, hypervisor, networking, managed services. Customer: data classification/encryption, IAM, OS patching (IaaS), application security, network/security group configuration. The split shifts based on service type — more managed services = more AWS responsibility.
Question 122 of 150
What is S3 Versioning?
Explanation: S3 Versioning: when enabled, every PUT creates a new version. Delete adds a delete marker (object not immediately removed). Permanently delete: specify version ID. MFA Delete: requires MFA to delete versions. Versioning is required for S3 replication.
Question 123 of 150
What is AWS CloudFormation?
Explanation: CloudFormation: templates define resources declaratively. Stacks: a collection of resources managed as a unit. Change sets: preview changes before applying. Drift detection: identify manual changes outside CloudFormation. Nested stacks: modular templates. Alternative: AWS CDK (code → CloudFormation), Terraform.
Question 124 of 150
What is Amazon Aurora?
Explanation: Aurora: 6 copies of data across 3 AZs (storage is shared and self-healing). Auto-scaling storage up to 128TB. Aurora Replicas: up to 15 with automatic failover. Serverless v2: auto-scales compute. Global Database: cross-region primary and read replicas. Aurora DSQL: serverless distributed SQL.
Question 125 of 150
What is AWS Direct Connect?
Explanation: Direct Connect: dedicated 1Gbps or 10Gbps connections. More consistent network performance and lower latency than VPN. Higher cost. Hosted connections: through AWS Direct Connect partners for lower bandwidth. Combine with VPN for encrypted backup connection. BGP routing required.
Question 126 of 150
What is VPC Peering?
Explanation: VPC Peering: same region or cross-region. Same or different accounts. No transitive peering (A-B-C doesn't mean A-C can communicate). No overlapping CIDR blocks. Route tables must be updated. Compare Transit Gateway: hub-and-spoke, supports transitive routing for many VPCs.
Question 127 of 150
What is S3 Lifecycle Policy?
Explanation: Lifecycle rules: transition actions (move to cheaper storage class after N days) and expiration actions (delete after N days). Example: Standard → Standard-IA (30 days) → Glacier (90 days) → delete (365 days). Reduces storage costs automatically.
Question 128 of 150
What is Amazon Kinesis?
Explanation: Kinesis Data Streams: real-time, custom consumers, 1-365 day retention, shards (1MB/s in, 2MB/s out each). Kinesis Firehose: managed delivery to S3, Redshift, Elasticsearch, Splunk. Use case: clickstream analysis, IoT telemetry, log analytics, real-time dashboards.
Question 129 of 150
What is AWS Elastic Beanstalk?
Explanation: Elastic Beanstalk: supports Node.js, Python, Java, .NET, PHP, Ruby, Go, Docker. You retain full control over underlying EC2, RDS, etc. Environments: Web Server (ALB + EC2) and Worker (SQS + EC2). Free — you pay only for underlying resources. Good for simple deployments.
Question 130 of 150
What is Amazon EKS?
Explanation: EKS manages the Kubernetes control plane (API server, etcd). Worker nodes: EC2 node groups or Fargate. Integrates with: IAM (RBAC), VPC networking, ALB Ingress, EBS/EFS for storage, CloudWatch for logs. Use EKS when you need Kubernetes (existing workloads, cross-cloud portability).
Question 131 of 150
What is AWS WAF?
Explanation: WAF attaches to: CloudFront, ALB, API Gateway, AppSync. Rule groups: AWS Managed Rules (OWASP Top 10, known bad IPs), Custom Rules, Rate-based rules. Web ACL: collection of rules applied to a resource. Compare Shield (volumetric DDoS protection), Network Firewall (VPC-level).
Question 132 of 150
What is the purpose of an Elastic IP?
Explanation: Elastic IPs: your account's IP that doesn't change when instance stops/starts. Associates with: EC2 instances or ENIs. Free when in use; charged when allocated but not associated. Use case: IP whitelisting requirements, DNS pointing. For most cases, use Route 53 instead of depending on Elastic IP.
Question 133 of 150
What is Amazon Cognito?
Explanation: Cognito User Pools: user directory, sign-up/sign-in, MFA, hosted UI, social federation (Google, Facebook). Identity Pools: exchange tokens for temporary AWS credentials. Use case: mobile/web app authentication, federated access to AWS resources. Compare: IAM (internal AWS users, not end-users).
Question 134 of 150
What is AWS Step Functions?
Explanation: Step Functions: state machines with states (Task, Choice, Wait, Parallel, Map). Standard workflows (long-running, up to 1 year, exactly-once). Express workflows (high-volume, up to 5 minutes, at-least-once). Integrates with Lambda, ECS, DynamoDB, SQS, SNS. Handles retries, errors, and branching.
Question 135 of 150
What is Amazon EMR?
Explanation: EMR: runs open-source analytics frameworks at petabyte scale. Clusters: master + core (HDFS) + task nodes. Storage: HDFS (temporary) or S3 (persistent). Use case: log analysis, machine learning, ETL, clickstream analysis. Spot instances for task nodes to reduce costs by 60-90%.
Question 136 of 150
What is the difference between multi-AZ and Read Replicas in RDS?
Explanation: Multi-AZ: standby in different AZ, synchronous replication, automatic failover (60-120 seconds), same endpoint. Read Replicas: async replication, separate endpoint, can be promoted, up to 5 (15 for Aurora), can be cross-region. Use both: multi-AZ for HA, read replicas for read scaling.
Question 137 of 150
What is AWS Glue?
Explanation: Glue: Data Catalogue (metadata repository for S3, RDS, Redshift). Crawlers: auto-discover schema. ETL Jobs: Python or Scala (PySpark). Glue DataBrew: visual data transformation, no code. Use case: prepare data for Athena, Redshift, EMR. Serverless — no infrastructure management.
Question 138 of 150
What is Amazon Athena?
Explanation: Athena: no infrastructure to manage. Supports: CSV, JSON, ORC, Avro, Parquet. Partitioning: reduce data scanned = reduce cost. Price: $5/TB scanned. Use with Glue Data Catalogue. Common use: ad-hoc analysis of S3 data lakes, CloudTrail logs, ALB access logs, VPC flow logs.
Question 139 of 150
What is Amazon Redshift?
Explanation: Redshift: columnar storage (queries read only needed columns). Massive Parallel Processing (MPP). Leader node + compute nodes. Redshift Spectrum: query S3 directly from Redshift. Snapshots: automated and manual. AQUA: hardware-accelerated cache. RA3 nodes: separate storage (S3) from compute.
Question 140 of 150
What is a NAT Gateway?
Explanation: NAT Gateway: AWS managed, highly available within AZ, 5-100Gbps. Placed in public subnet with Elastic IP. Private subnet route: 0.0.0.0/0 → NAT Gateway. For HA: deploy NAT Gateway in each AZ. Outbound only. Compare NAT Instance: EC2 you manage yourself (cheaper but less scalable).
Explanation: Secrets Manager: stores secrets encrypted with KMS. Automatic rotation: Lambda function rotates credentials on schedule (e.g., RDS password every 30 days). Fine-grained IAM access control. Versions: AWSCURRENT, AWSPREVIOUS. Compare: Parameter Store (simpler, free, no auto-rotation built-in).
Question 143 of 150
What is Amazon SageMaker?
Explanation: SageMaker: Studio (unified IDE), Notebooks (managed Jupyter), Training (distributed, spot instances), Endpoints (real-time inference), Batch Transform, Feature Store, Model Monitor, Pipelines (MLOps). Ground Truth: data labelling. Autopilot: AutoML. Use SageMaker for custom ML models; Rekognition/Comprehend for pre-built AI services.
Question 144 of 150
What is the difference between AWS Config and CloudTrail?
Explanation: CloudTrail: API activity log (who called DeleteBucket, when, from where). Config: resource configuration history and compliance rules. Example: Config rule 'S3 buckets must be private' — continuously evaluates and flags violations. Use both: CloudTrail for security audit, Config for compliance.
Question 145 of 150
What is Amazon GuardDuty?
Explanation: GuardDuty: findings categorised as High/Medium/Low severity. Finding types: Reconnaissance, Trojan, UnauthorizedAccess, Cryptocurrency mining, Backdoor. No agents required. Multi-account with AWS Organisations. Malware Protection: scans EBS volumes for malware. Enable for every account/region.
Question 146 of 150
What is AWS Transit Gateway?
Explanation: Transit Gateway: attach VPCs, VPNs, Direct Connect. Supports transitive routing (A→TGW→B→TGW→C works). Route tables: control which attachments can communicate. Inter-region peering: connect Transit Gateways across regions. Multicast support. Replaces complex mesh of VPC peering connections.
Question 147 of 150
What is Amazon API Gateway?
Explanation: API Gateway: REST APIs, HTTP APIs (cheaper, simpler), WebSocket APIs. Features: authentication (Cognito, IAM, Lambda authoriser), throttling, caching, CORS, SDK generation, custom domain names. Usage plans: API keys, throttle/quota by consumer. Stage variables: different backend per stage.
Disclaimer: All questions are original, independently authored content for educational study purposes only. Not affiliated with any official examination body or certification authority.
Flashcards
Tap a card to reveal the answer. Use the buttons to navigate.
1 / 100
Question
Loading...
Answer
Tap card to flip • Navigate with buttons below
Study Resources
Curated official and free resources to complement your practice.