AWS Certified Solutions Architect Associate (SAA-C03) - Scalable Cloud Architecture Flashcards

Question 1

VPC Public Subnet vs. Private Subnet

Accepted Answer

A **Public Subnet** contains a route in its Route Table directing external traffic (`0.0.0.0/0`) to an **Internet Gateway (IGW)**. A **Private Subnet** lacks a direct route to an IGW and uses a **NAT Gateway** or NAT Instance to initiate outbound internet connections without accepting inbound connections.

Question 2

Security Groups vs. Network ACLs (NACLs)

Accepted Answer

- **Security Groups**: Operate at the *instance level*, are **stateful** (return traffic automatically allowed), and support `ALLOW` rules only.
- **Network ACLs**: Operate at the *subnet level*, are **stateless** (return traffic must be explicitly allowed), and support both `ALLOW` and `DENY` rules processed in numerical order.

Question 3

NAT Gateway vs. NAT Instance

Accepted Answer

- **NAT Gateway**: AWS-managed service, auto-scales up to 100 Gbps, provides high availability within an AZ, and requires no security group maintenance.
- **NAT Instance**: Self-managed EC2 instance running a Linux NAT AMI; requires manual scaling, OS patching, and disabling **Source/Destination Checks** on the EC2 instance.

Question 4

EC2 Auto Scaling: Target Tracking vs. Step Scaling Policies

Accepted Answer

- **Target Tracking Scaling**: Automatically adjusts capacity to maintain a specified metric at a target value (e.g., keep average CPU utilization at 50%).
- **Step Scaling**: Increases or decreases capacity based on a set of threshold step adjustments (e.g., add 2 instances if CPU is 60–70%, add 4 if CPU > 70%).

Question 5

EC2 Launch Templates vs. Launch Configurations

Accepted Answer

- **Launch Templates**: Modern replacement supporting versioning, parameter inheritance, T2/T3 Unlimited, and Spot/On-Demand mix in Auto Scaling.
- **Launch Configurations**: Legacy resource that cannot be edited or versioned (must create a new one every time) and does not support multi-instance type Auto Scaling Groups.

Question 6

Application Load Balancer (ALB) vs. Network Load Balancer (NLB)

Accepted Answer

- **ALB**: Layer 7 (HTTP/HTTPS) load balancer; supports path-based, host-based, and query-string routing, container targets, and TLS termination.
- **NLB**: Layer 4 (TCP/UDP/TLS) load balancer; capable of handling millions of requests/sec with ultra-low latency, static IP addresses, and Elastic IPs.

Question 7

RDS Multi-AZ vs. RDS Read Replicas

Accepted Answer

- **Multi-AZ**: **Synchronous** replication to a passive standby in a different AZ for High Availability and Disaster Recovery (automatic failover via DNS endpoint change).
- **Read Replicas**: **Asynchronous** replication to up to 15 read-only instances (can be cross-AZ or cross-Region) for scaling read-heavy workloads.

Question 8

Amazon Aurora Architecture & Read Replicas

Accepted Answer

Aurora uses a custom, self-healing storage volume striping data 6-way across 3 AZs (requires $4/6$ for writes, $3/6$ for reads). It supports up to 15 Read Replicas with sub-10ms replication lag, sharing the underlying storage layer without duplicating data.

Question 9

Amazon S3 Storage Tiers Summary

Accepted Answer

- **S3 Standard**: Frequent access, high availability.
- **S3 Intelligent-Tiering**: Auto-chooses cost-optimal tier based on access patterns without operational overhead or retrieval fees.
- **S3 Standard-IA**: Infrequent access, immediate retrieval, lower storage cost, retrieval fee applies.
- **S3 One Zone-IA**: Non-critical data, single AZ (20% cheaper than Standard-IA).
- **S3 Glacier Instant / Flexible / Deep Archive**: Long-term archive with retrieval times from milliseconds to 12 hours.

Question 10

Amazon S3 Lifecycle Policies

Accepted Answer

Automated rules that manage object storage over time by defining:
1. **Transition Actions**: Moving objects to cheaper storage tiers (e.g., `Standard` -> `Standard-IA` after 30 days -> `Glacier` after 90 days).
2. **Expiration Actions**: Permanently deleting objects or noncurrent version tags after a designated period.

Question 11

Amazon EBS General Purpose SSD (`gp3`) vs. Provisioned IOPS (`io2`)

Accepted Answer

- **`gp3`**: Cost-effective baseline SSD providing baseline 3,000 IOPS and 125 MiB/s throughput independently of storage capacity.
- **`io2` / `io2 Block Express`**: High-performance SSD designed for mission-critical databases requiring up to 256,000 IOPS, $99.999\%$ durability, and sub-millisecond latency.

Question 12

Amazon Elastic File System (EFS) Features

Accepted Answer

POSIX-compliant Network File System (NFSv4) that scales automatically. Allows thousands of concurrent EC2 instances across multiple AZs to mount simultaneously. Features **EFS Infrequent Access (EFS IA)** and Lifecycle Management for automatic cost optimization.

Question 13

AWS Lambda Limits: Timeout and Ephemeral Storage

Accepted Answer

- **Maximum Timeout**: 15 minutes (900 seconds) per invocation.
- **Ephemeral Storage (`/tmp`)**: Ranges from 512 MB to 10,240 MB (10 GB) of temporary disk space.
- **Memory Range**: 128 MB to 10,240 MB (allocates proportional vCPU power).

Question 14

AWS Lambda: Reserved Concurrency vs. Provisioned Concurrency

Accepted Answer

- **Reserved Concurrency**: Guarantees a maximum allocated pool of concurrent executions for a specific function while preventing it from exhausting the unreserved account concurrency pool.
- **Provisioned Concurrency**: Pre-warms hyper-initialized execution environments to eliminate **cold starts** for latency-sensitive applications.

Question 15

IAM Policy Evaluation Logic

Accepted Answer

AWS evaluates policies using the following priority order:
1. Default decision is an **Implicit Deny**.
2. An **Explicit Deny** in *any* applicable policy immediately overrides all allows.
3. If no explicit deny exists, an **Explicit Allow** permits the action.
4. If no explicit allow exists, the access request is denied.

Question 16

IAM Roles & AWS Security Token Service (STS)

Accepted Answer

IAM Roles do not have permanent credentials. Instead, entities (EC2, Lambda, cross-account users) assume a role using **AWS STS** to receive temporary security credentials consisting of an `AccessKeyId`, `SecretAccessKey`, and `SessionToken` with configurable expiration.

Question 17

Amazon Route 53 Routing Policies Overview

Accepted Answer

- **Simple**: Single resource endpoint.
- **Weighted**: Distribute traffic by percentage (e.g., $80\%$ / $20\%$ A/B testing).
- **Latency-Based**: Directs traffic to the region with lowest network latency.
- **Failover**: Active-Passive disaster recovery using health checks.
- **Geolocation**: Routes based on user's geographic location (continent/country).
- **Geoproximity**: Routes based on geographic distance with optional bias adjustment.

Question 18

Amazon CloudFront with Origin Access Control (OAC)

Accepted Answer

Prevents users from bypassing CloudFront CDN and accessing Amazon S3 buckets directly. S3 bucket policies are configured to only allow access when requests originate from CloudFront using OAC signatures, ensuring perimeter security and caching efficiency.

Question 19

AWS Transit Gateway vs. VPC Peering

Accepted Answer

- **VPC Peering**: Direct point-to-point connection between 2 VPCs. Non-transitive; setting up a mesh network for $N$ VPCs requires $\frac{N(N-1)}{2}$ peering connections.
- **AWS Transit Gateway**: Central hub-and-spoke router connecting thousands of VPCs, AWS Direct Connect, and VPNs with transitive routing capabilities.

Question 20

AWS Gateway Load Balancer (GWLB)

Accepted Answer

Combines a transparent Layer 3 gateway with network load balancing. Used to deploy, scale, and manage 3rd-party inline virtual network appliances (firewalls, deep packet inspection, IDS/IPS) without altering the source or destination IP headers of network traffic.

AWS Certified Solutions Architect Associate (SAA-C03) - Scalable Cloud Architecture

Cards in this deck

Related Flashcard Sets

JLPT N2 - Upper-Intermediate Japanese Kanji, Grammar & Expressions

CompTIA Network+ (N10-008) - Networking Fundamentals & Subnetting

HSK 4 - Intermediate Chinese Vocabulary & Grammar

CompTIA Network+ (N10-008) - Networking Fundamentals & Protocols