AWS Solutions Architect Certification

John

Notes taken during preparation for the AWS SA Associate Certification.

Purpose

The AWS Solutions Architect Certification is intended for individuals who perform a Solutions Architect role. This exam validates an examinee’s ability to effectively demonstrate knowledge of how to architect and deploy secure and robust applications on AWS technologies.

 

Exam Domains

The exam is broken down into 5 domains. These domains are the 5 pillars of the AWS Well Architected Framework.

  • Design Resilient Architectures (34%)
    • Choose reliable/resilient storage
    • Determine how to design decoupling mechanisms using AWS services
    • Determine how to design a multi-tier architecture solution
    • Determine how to design high availability and/or fault tolerant architectures
  • Define Performant Architectures (24%)
    • Choose performant storage and databases
    • Apply caching to improve performance
    • Design solutions for elasticity and scalability
  • Specify Secure Applications and Architectures (26%)
    • Determine how to secure application tiers
    • Determine how to secure data
    • Define he networking infrastructure for a single VPC application
  • Design Cost-optimized Architectures (10%)
    • Determine how to design cost-optimized storage
    • Determine how to design cost-optimized compute
  • Define Operationally Excellent Architectures (6%)
    • Choose design features in solutions that enable operational excellence

 

AWS Services List

  • Edge Location – endpoints for AWS which used for caching content, typically consists of CloudFront. There are more edge connections than regions. (205 locations as of 2020)
  • Compute
    • EC2
    • EC2 Container Service (ECS)
    • Elastic Beanstalk
    • Lambda
    • Lightsail (easy server provisioning, simple EC2)
    • Batch (EC2)
  • Storage
    • S3 (object based storage)
    • EFS (file store)
    • Glacier
    • Snowball (data transport hardware)
    • Storage Gateway – vm that are stored in your on prem data center that will mimic AWS
  • Databases
    • RDS
    • DynamoDB
    • Elasticache
    • Redshift (warehouse)
  • Data migration
    • AWS Migration Hub (migration service)
    • Application Discovery Service
    • Database Migration Service (DMS)
    • Server Migration Service
    • Snowball
  • Networking
    • VPC
    • CloudFront (CDN)
    • Route53 (DNS)
    • API Gateway
  • Developer Tools
    • Codestar
    • CodeCommit
    • CodeBuild
    • CodeDeploy (to EC2)
    • CodePipeline (CI/CD)
    • X-Ray (analyze serverless apps)
    • Cloud9 (IDE)
  • Management Tools
    • CloudWatch
    • CloudFormation
    • CloudTrail
    • Config
    • OpsWorks (like ELB, uses Chef/Puppet to automate environment)
    • Service Catalog (catalog of IT services approved for use)
    • Systems Manager (manages EC2 for things like patching)
    • Trusted Advisor (analyzes your services to give advice on improvements, like security, cost)
    • Managed Services
  • Media Services
    • Elastic Transcoder – can process video
    • MediaConnect – is a high-quality transport service for live video. Today, broadcasters and content owners rely on satellite networks or fiber connections to send their high-value content into the cloud or to transmit it to partners for distribution.
    • MediaConvert –  file-based video transcoding service with broadcast-grade features. It allows you to easily create video-on-demand (VOD) content for broadcast and multiscreen delivery at scale.
    • MediaLive –  broadcast-grade live video processing service. It lets you create high-quality video streams for delivery to broadcast televisions and internet-connected multiscreen devices, like connected TVs, tablets, smart phones, and set-top boxes. The service works by encoding your live video streams in real-time, taking a larger-sized live video source and compressing it into smaller versions for distribution to your viewers.
    • MediaPackage – reliably prepares and protects your video for delivery over the Internet.
    • MediaStore – AWS storage service optimized for media. It gives you the performance, consistency, and low latency required to deliver live streaming video content.
    • MediaTailor – lets video providers insert individually targeted advertising into their video streams without sacrificing broadcast-level quality-of-service. With AWS Elemental MediaTailor, viewers of your live or on-demand video each receive a stream that combines your content with ads personalized to them.
  • Machine Learning
    • SageMaker – deep learning
    • Comprehend – sentiment analysis
    • DeepLens – camera
    • Lex
    • Machine Learning – unlike SageMaker, its more basic that analysis data sets given
    • Polly
    • Rekognition
    • Amazon Translate (voice translate)
    • Amazon Transcribe (text translate)
  • Analytics
    • Athena – SQL queries against S3
    • Elastic Map Reduce (EMR) – processing large amounts of data (big data)
    • CloudSearch
    • ElasticSearch Service
    • Kinesis
    • Kinesis Video Streams
    • QuickSight
    • Data Pipeline – moving data between AWS services
    • Glue – for ETL (extract transform load)
  • Security and Identity Compliance
    • IAM – Identity Access Management
    • Cognito
    • GuardDuty
    • Inspector – checks for vulnerabilities for EC2
    • Macie – scans S3 for PII (personally identifiable information)
    • Certificate Manager – ssl certs
    • CloudHSM (Hardware Security Module) – dedicated hardware that stores keys
    • Directory Service
    • WAF (Web App Firewall) – layer 7 firewall, stops XSS, SQL injection,
    • Shield – 24/7 DDOS attack protection, expensive
    • Artifact – Service Organization Control, AWS documentation
  • Mobile Services
    • Mobile Hub –
    • Pinpoint
    • AWS AppSync
    • Device Farm
    • Mobile Analytics
  • AR / VR
    • Sumerian – virtual world
  • Application Integration
    • Step Functions
    • SNS
      SQS
    • SWF
    • Amazon MQ
  • IoT
    • Iot Core
    • IoT Device Management
    • IoT Greengrass
  • Customer Engagement
    • Connect – cloud call center
    • Simple Email Service
    • Alex for Business
    • Chime
    • Work Docs
    • WorkMail
    • Workspaces
    • AppStream
  • Gaming
    • GameLift

 

Exam Tips

Kinesis vs Redshift or EMR (Elastic Map Reduce)

  • Kinesis is for consuming large amounts of data, such as streamining social media, news feeds, logs, etc
  • Redshift is for Business Intelligence
  • EMR is for Big Data processing

OpsWorks

  • Orchestration service using Chef
    • Chef consists of recipes to maintain consistent state
  • Any question regarding chef or recipes or cookbooks is related to OpsWorks

Elastic Transcoder

  • Media transcoder in cloud, converts media files to different formats, such as mobile devices.

 

AWS Well Architected Framework

  1. Security
    1. Data Protection – encryption at rest and transit; ELB, EBS, S3
    2. Privilege management – managing root accounts, roles; limit automated access; key management in IAM, MFA
    3. Infrastructure protection – enforce network and host level boundry protection, protect IAAS for patching, monitoring; VPC, Security Groups,
    4. Detective Controls – cloudtrail, AWS Config, auditing
  2. Reliability
    1. Manage Service limits, plan network topology and have escalation path for issues
    2. Change Management in place to adapt to changes, monitor them
    3. Failure Management in place such as backups, DR plans
  3. Performance Efficient
    1. Compute – using appropriate instance types, plans for upgrading; monitor and match demand
    2. Storage – using appropriate storage; monitor and ensure storage is matching throughput required; use proper database solutions; monitor capacity and throughput
    3. Space Time trade off – use proximity and caching solutions, monitoring performance of these;
  4. Cost Optimization
    1. Matched supply and demand – ensure capacity matches need (not below or exceed)
    2. Cost effective resources – use of RI or managed services
    3. Expenditure awareness – monitor costs, set alerts, plan for costing
    4. Optimizing over time
  5. Operational Excellence
    1. Preparation
      1. AWS Config for inventory
      2. AWS Service Catalog for standardized products
      3. Autoscale, SQS
    2. Operation
      1. AWS Codestar and other Code* services, use of SDKs
      2. CloudTrail to monitor
    3. Responses
      1. CloudWatch, set alarms

 

Sample Questions

Following sample questions were gathered from a variety of study sources, but mostly from the AWS training center at aws.training.

When designing a loosely coupled system, which AWS services provide an intermeditate durable storage layer between components?

  1. CloudFront
  2. Kinesis
  3. Route 53
  4. CloudFormation
  5. SQS

Which type of DNS record should you use to resolve a domain name to another domain name?

  1. A record (ip address)
  2. CNAME record (actual name)
  3. D record (dne)
  4. PTR record (pointer record for reverse DNS lookup)

Your application polls an SQS queue frequently and returns immediately, often with empty responses. What is one thing that can be done to reduce SQS costs?

  1. Pricing on SQS does not include a cost for service requests; therefore, there is no concern
  2. Increase the timeout value for short polling to wait for messages longer before returning a response
  3. Change the message visibility value to a higher number
  4. Use long polling by supplying a value for WaitTimeSeconds

Which AWS db service is best suited for traditional Online Transaction Processing (OLTP)?

  1. Redshift (not OLTP)
  2. RDS
  3. ElastiCache (temporary)
  4. Neptune (graph db)

In the basic monitoring package for EC2, what CloudWatch metrics are available?

  1. Web server visible metrics such as number of failed transaction requests (CW cant see this by default)
  2. OS visible metrics such as memory utilization (CW cant see this by default)
  3. DB visible metrics such as number of connections (available in RDS but not in EC2)
  4. Hypervisor visible metrics such as CPU utilization (CW can see CPU)

Which of the following is Amazon side of a VPN connection?

  1. Elastic IP / EIP (not really related to VPC)
  2. Customer Gateway CGW (this is on customer side)
  3. Internet Gateway IGW (it is on AWS side but not related to VPN)
  4. Virtual Private Gateway VPG (this is AWS’s service for setting up VPN connection)

How can you authenticate to a new Amazon Linux instance using SSH?

  1. Decrypt the root password (this is more for Windows)
  2. Provide a username and password (this is not provided by default)
  3. Use the private half of a key pair (the public side is stored into the EC2, the private side provided to user as .pem)
  4. Use MFA (not necessary)
  5. Provide an Access Key and Secret Key (this is IAM permissions)

What is needed to enable cross-region replication between two S3 buckets?

  1. Buckets must be in the same AWS account (no)
  2. Enable versioning on the buckets (this is required for cross-region replication)
  3. Enable static website hosting on the source bucket (not related to replication)
  4. The IAM user must have read access on the source bucket and write on the destination bucket (IAM not necessary for this)
  5. S3 must be attached to an Internet Gateway (not necessary)

You company provides a mobile voting app for popular TV show and 5-25 million viewers all vote in a 15 second timespan. What mechanism can you use to decouple the voting app from your backend services that tally the votes?

  1. ElastiCache (more about performance, not decouple)
  2. SQS
  3. Redshift (BI data warehouse, not really related to this)
  4. Simple Notification Service SNS (may not perform for this scale)

What type of AWS Elastic Beanstalk environment tier provisions resources to support a web app that handles background processing tasks?

  1. Web server environment tier
  2. Worker environment tier (this is the backend processing)
  3. Database environment tier
  4. Batch environment tier (not really related)

Each month your company processes 200TB of data in S3, taking 24hrs to complete. Which method is most cost-effective?

  1. Copy the data to a persistent EMR cluster and run MapReduce jobs
  2. Create an app that reads the information from S3 and runs it through a Kenesis stream
  3. Run a transient EMR cluster and run MapReduce jobs against the data directly in S3
  4. Launch a d2.8xlarge EC2 instance and run an app to read and process each object sequentially

An EC2 instance is being underutilized so you decide to downsize the instance. You stop the instance and change its Instance Type. However, you are unable to start the instance again because it is now in a Terminated state. What caused the instance to Terminate?

  1. It was using Instance Store for the boot volume
  2. It was a Spot Instance (user cannot stop spot)
  3. The instance had been launched using Auto Scaling
  4. It was using a capacity reservation that is no longer available

You have an AWS Lambda function that needs access to a public API on Internet and a RDS instance in a private subnet of a VPC. How do you configure such access?

  1. Associate the Lambda function with a private subnet in the VPC and associate an Elastic IP address to the Elastic Network Interface (networking wont work)
  2. Launch a NAT Gateway in a public subnet and associate the Lambda function with a private subnet in the VPC (NAT provides the Internet access)
  3. Associate the Lambda function with a public subnet in the VPC and create a VPC Endpoint for Amazon RDS (its not giving Internet access)
  4. It is not possible to connect Lambda function simultaneously to a private subnet and Internet

Hundreds of buses are sending realtime coordinates to SQS FIFO queue. The queue has thousands of messages, but after retrieving 10 messages no more messages can be retrieved. What could be the cause?

  1. SQS FIFO queues have a maximum of 10 in flight messages (this can be tuned)
  2. Each bus should use its own MessageGroupID (A way of grouping messages, which applies in this case since there are multiple buses)
  3. Dead Letter Queue is full
  4. Long Polling should be used (not apply)

Your corporate data center was recently flooded, which caused significant outages. Your CIO mandated a move to the cloud but they are still concerned about catastrophic failures in the data center. What can you do to alleviate their concerns?

  1. Distribute the architecture across multiple AZs
  2. Use VPC with subnets
  3. Launch the compute in a placement group
  4. Purchase Reserved Instances for the processing of servers

Which feature of AWS is designed to permit calls to the platform from an EC2 instance without needing access keys placed on the instance?

  1. IAM instance profiles
  2. IAM groups (group is collection of users, not applicable)
  3. IAM roles (roles are not attached directly to the instance but instead to the Instance Profile of EC2)
  4. EC2 key pairs

Your company has 50,000 weather stations that send updates every 2 seconds. What service will enable you to ingest this stream of data and store it in S3 for future processing?

  1. SQS (not the most efficient or performant solution)
  2. Kinesis Data Firehose (made specifically for this)
  3. EC2 (not applicable)
  4. Data Pipeline (more of an ETL engine to move data)

You have an application that for legal reasons must be hosted in US when US citizens access it. The app must be hosted in the EU when citizens of the EU access it. For all other citizens of the world, the app must be hosted in Sydney. Which routing policy should you choose in order to achieve this?

  1. Latency-based routing
  2. Data Governance routing (no such thing)
  3. Gelocation routing 
  4. IP lookup routing (there is no such thing)

How can you grant a different AWS account permission to send messages to your SQS queue?

  1. Have the other account’s app use your account’s credentials to access SQS queue
  2. Create an IAM user for the other account and add an IAM policy that grants access to the queue (this is only for same accounts)
  3. Create an SQS policy that grants the other account access
  4. Use VPC peering between the two accounts (SQS doesnt use VPC, VPC peering is more about network)

You are building a photo management app that maintains metadata on millions of images in a DynamoDB table. When a photo is retrieved, you want to display the metadata next to the image. Which DynamoDB operation will you use to retrieve the metadata attributes from the table?

  1. Query operation 
  2. Scan operation (searches the entire table)
  3. Search operation (dne)
  4. Find operation (dne)

What are some reasons to enable cross region replication on an S3 bucket? (choose 2)

  1. You want to backup your data in case of accidental deletion (can use versioning or policies)
  2. You have a set of users or customers who can access the second bucket with lower latency
  3. For compliance reasons, you need to store the data in a location at least 300 miles away from the first region
  4. Your data needs at least five 9s of durability

Which EC2 feature ensures that your instances will not share a physical host with instances from any other AWS customer?

  1. VPC
  2. Cluster placement groups
  3. Dedicated instances
  4. Reserved instances

Your web app runs on multiple EC2 instances behind an application load balancer. The load balancer is configured to perform health checks on the EC2 instances. If an instance fails to pass health checks, which statement will be true?

  1. The instance is replaced automatically by the load balancer
  2. The instance is terminated automatically by the load balancer
  3. The load balancer stops sending traffic to the instance that failed its health check
  4. The instance is quarantine by the load balancer for root cause analysis

Which of the following actions can be authorized by IAM? (choose 2)

  1. Installing ASP.NET on a Windows Server
  2. Launching an Amazon Linux EC2 instance
  3. Querying an Oracle database
  4. Adding a message to an SQS queue

What aspect of an Amazon VPC is stateful?

  1. Network ACLs (these are just rules)
  2. Security Groups – virtual firewall, rules for inbound dont apply to outbound, therefore its stateful
  3. VPC Peering (just a link, theres no state)
  4. VPC Subnet (these are part of VPC)

From VPC doc:

Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

 

What are characteristics of EC2 Auto Scaling service? (choose 2)

  1. Sends traffic to healthy instances (ELB)
  2. Responds to changing conditions by Stopping/Starting instances (auto scale doesnt stop/start, it creates/destroys)
  3. Responds to changing conditions by Terminating and Launching instances
  4. Enforces a minimum number of running EC2 instances

When using RDS multi-AZ how can you offload read requests from the primary? (choose 2)

  1. Configure the app to connect to the secondary node for reads and the primary node for writes (not possible)
  2. Amazon RDS automatically sends writes to the primary and sends reads to the secondary (primary always does read/write, so this not possible)
  3. Add a read replicca DB instance and configure the clients app logic to use a read-replica
  4. Use ElasticCache to cache frequently used data. Update the app logic to read/write from the cache

Your company has its primary production site in NA and its DR site in Asia. You need to configure DNS so that if your primary site becomes unavailable, you can fail DNS over the secondary site. Which DNS routing policy would best achieve this?

  1. Weighted routing (multiple records with different weights, this is more for auto balancing as both records are active)
  2. Geolocation routing (multiple active records based on location)
  3. Simple routing
  4. Failover routing (multiple records, setup health check, only one record active at a time)

Route 53 is because DNS runs off port 53

What two features are supported with EBS volume snapshot feature?

  1. EBS replication across regions
  2. EBS multi-zone replication
  3. EBS single region only
  4. Full snapshot data only
  5. Unencrypted snapshot only

What two resource tags are supported for an EC2 instance?

  1. VPC endpoint
  2. EIP
  3. Network Interface
  4. Security Group
  5. Flow Log

What two options are available to alert tenants when an EC2 instance is terminated

  1. SNS
  2. CloudTrail
  3. Lambda
  4. SQS
  5. STS

What class of EC2 recommended for data analytics?

  1. Memory
  2. Compute
  3. Storage
  4. General

What class of EC2 instance type is recommended for database servers?

  1. Memory
  2. Compute
  3. Storage
  4. General

What two attributes distinguish each pricing model?

  1. Reliability
  2. Service
  3. Discount
  4. Performance
  5. Redundancy

 

 

 

 

 

 

 

 

 

References

AWS Certification
https://www.aws.training/Certification

AWS Training (Free available)
https://www.aws.training/Details/eLearning?id=20686

AWS Whitepapers
https://aws.amazon.com/whitepapers