AWS Solutions Architect Associate (SAA-C03) - Core Services & Architecture Flashcards

Question 1

What are the primary considerations when choosing an EC2 instance type?

Accepted Answer

When selecting an EC2 instance type, key considerations include: 
*   **Compute**: CPU cores, clock speed.
*   **Memory**: RAM capacity.
*   **Storage**: Instance store (ephemeral) vs. EBS-optimized.
*   **Networking**: Network performance, dedicated bandwidth.
*   **Cost**: Pricing model (On-Demand, Reserved, Spot).
*   **Workload**: General purpose, compute-optimized, memory-optimized, storage-optimized, accelerated computing.

Question 2

Differentiate between AWS Security Groups and Network ACLs (NACLs).

Accepted Answer

Both `Security Groups` and `Network ACLs` act as firewalls for your VPC, but at different layers:
*   **Security Groups**: Operate at the instance level, are stateful (return traffic is automatically allowed), and support `allow` rules only.
*   **NACLs**: Operate at the subnet level, are stateless (return traffic must be explicitly allowed), and support both `allow` and `deny` rules. They are processed in order by rule number.

Question 3

Explain the use cases for Application Load Balancers (ALB) and Network Load Balancers (NLB).

Accepted Answer

*   **Application Load Balancer (ALB)**: Best suited for HTTP/HTTPS traffic, offering advanced routing features based on URL path, host header, or query string. Ideal for microservices and container-based applications.
*   **Network Load Balancer (NLB)**: Best suited for extreme performance, static IP addresses, and handling TCP/UDP/TLS traffic. Ideal for high-throughput, low-latency applications where preserving client IP is critical.

Question 4

Describe the core components of an AWS Auto Scaling Group.

Accepted Answer

An `Auto Scaling Group` (ASG) ensures you have the correct number of EC2 instances available to handle your application's load. Its core components are:
*   **Launch Template/Configuration**: Defines how new EC2 instances are launched (AMI, instance type, security groups, user data).
*   **Scaling Policies**: Dictate when to scale out (add instances) or scale in (remove instances) based on metrics (e.g., CPU utilization, network I/O).
*   **Minimum/Maximum/Desired Capacity**: Sets the boundaries for the number of instances in the group.
*   **Health Checks**: Monitors instance health and replaces unhealthy instances.

Question 5

Compare and contrast S3 Standard, S3 Standard-IA, and S3 One Zone-IA storage classes.

Accepted Answer

*   **S3 Standard**: For frequently accessed data, offering high durability (11 nines) and availability, stored redundantly across multiple Availability Zones (AZs).
*   **S3 Standard-IA (Infrequent Access)**: For less frequently accessed data that requires rapid access when needed. Lower storage cost than Standard but higher retrieval fees. Stored across multiple AZs.
*   **S3 One Zone-IA**: For infrequently accessed, non-critical data that can be recreated. Lower storage cost than Standard-IA but data is stored in a single AZ, making it vulnerable to AZ loss.

Question 6

How do S3 Versioning and S3 Cross-Region Replication contribute to data durability and disaster recovery?

Accepted Answer

*   **S3 Versioning**: Protects against accidental deletions and overwrites by keeping multiple versions of an object. It allows you to restore previous versions, enhancing data durability.
*   **S3 Cross-Region Replication (CRR)**: Automatically replicates objects to a destination bucket in a different AWS Region. This provides a robust disaster recovery strategy by maintaining a geographically separate copy of your data, ensuring business continuity even in the event of a regional outage.

Question 7

Explain the difference in purpose between RDS Multi-AZ deployments and Read Replicas.

Accepted Answer

*   **RDS Multi-AZ**: Primarily for **high availability and disaster recovery**. It creates a synchronous standby replica in a different Availability Zone. If the primary instance fails, RDS automatically fails over to the standby, minimizing downtime. It does *not* improve read performance.
*   **RDS Read Replicas**: Primarily for **read scalability and performance improvement**. They are asynchronous copies of the primary database that can handle read traffic, offloading the primary instance. They can also be promoted to a standalone database for disaster recovery, but with potential data loss due to asynchronous replication.

Question 8

List and briefly describe the essential components required to launch an EC2 instance in a public subnet within a custom VPC.

Accepted Answer

To launch an EC2 instance in a public subnet within a custom VPC, you need:
*   **VPC**: The isolated virtual network.
*   **Subnet**: A range of IPs within the VPC, designated as 'public' (meaning it has a route to an Internet Gateway).
*   **Internet Gateway (IGW)**: Allows communication between instances in your VPC and the internet.
*   **Route Table**: Contains rules (routes) that determine where network traffic from your subnet is directed (e.g., 0.0.0.0/0 to the IGW for public subnets).
*   **Security Group**: Acts as a virtual firewall for the EC2 instance, controlling inbound and outbound traffic.
*   **EC2 Instance**: The virtual server itself.

Question 9

What is the primary function of a NAT Gateway in a VPC, and how does it differ from an Internet Gateway?

Accepted Answer

A `NAT Gateway` allows instances in a **private subnet** to initiate outbound connections to the internet or other AWS services, while preventing unsolicited inbound connections from the internet. It's a highly available and managed service.

An `Internet Gateway` (IGW) allows **public subnets** to communicate directly with the internet. Instances in a public subnet have public IP addresses and can be directly accessed from the internet if allowed by security rules. The NAT Gateway provides outbound internet access for private instances, whereas the IGW enables both inbound and outbound internet access for public instances.

Question 10

Provide an example of a common use case for AWS Lambda in a serverless architecture.

Accepted Answer

A common use case for AWS Lambda is **image processing**. When a new image is uploaded to an S3 bucket, an S3 event can trigger a Lambda function. This function can then resize the image, apply watermarks, convert formats, or generate thumbnails, storing the processed images back into S3, all without provisioning or managing any servers.

Question 11

Explain the two types of primary keys available in DynamoDB.

Accepted Answer

DynamoDB supports two types of primary keys:
*   **Partition Key (Hash Attribute)**: A simple primary key composed of one attribute. DynamoDB uses this value as input to an internal hash function to determine the partition (physical storage) where the item will be stored.
*   **Partition Key and Sort Key (Composite Primary Key)**: Composed of two attributes. DynamoDB uses the partition key to determine the partition and the sort key to order items within that partition. This allows for efficient querying of items within a partition based on the sort key (e.g., all orders for a customer sorted by date).

Question 12

What are the key differences and use cases for SQS Standard Queues versus SQS FIFO Queues?

Accepted Answer

*   **SQS Standard Queues**: Offer maximum throughput, best-effort ordering, and at-least-once delivery. Ideal for scenarios where message order is not critical, and occasional duplicate messages are acceptable (e.g., event notifications, task queues).
*   **SQS FIFO Queues (First-In, First-Out)**: Guarantee strict message ordering and exactly-once processing. They have lower throughput compared to Standard queues. Ideal for scenarios where the order of operations and preventing duplicates is critical (e.g., financial transactions, order processing).

Question 13

Describe the 'fanout' pattern using AWS SNS and SQS.

Accepted Answer

The `fanout` pattern involves publishing a message to an `SNS Topic`, which then delivers copies of that message to multiple subscribed endpoints simultaneously. A common implementation uses `SQS Queues` as subscribers. When a message is published to the SNS topic, it's delivered to all attached SQS queues. Each queue can then be processed independently by different applications, allowing for parallel processing and decoupling of services.

Question 14

How can you achieve high availability for an application running on EC2 instances?

Accepted Answer

To achieve high availability for an EC2-based application:
1.  **Distribute instances across multiple Availability Zones (AZs)** using an `Auto Scaling Group`.
2.  Place an `Elastic Load Balancer` (ALB/NLB) in front of the ASG to distribute traffic and perform health checks.
3.  Use `Route 53` for DNS failover or weighted routing across regions if aiming for multi-region HA/DR.
4.  Ensure data persistence is handled by highly available services like `S3`, `RDS Multi-AZ`, or `DynamoDB`.

Question 15

Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) in the context of disaster recovery.

Accepted Answer

*   **Recovery Time Objective (RTO)**: The maximum acceptable delay between the interruption of service and restoration of service. It defines the target time for recovery after a disaster.
*   **Recovery Point Objective (RPO)**: The maximum acceptable amount of data loss measured in time. It defines the point in time to which data must be recovered (e.g., 1 hour of data loss means RPO is 1 hour).

Question 16

Explain the AWS Shared Responsibility Model.

Accepted Answer

The `Shared Responsibility Model` defines what AWS is responsible for (`Security *of* the Cloud`) and what the customer is responsible for (`Security *in* the Cloud`).
*   **AWS's Responsibility**: Global infrastructure (regions, AZs, edge locations), foundational services (compute, storage, database, networking), and the physical security of the data centers.
*   **Customer's Responsibility**: Customer data, operating systems, network and firewall configurations (e.g., Security Groups), platform, applications, identity and access management (IAM), and client-side data encryption.

Question 17

Differentiate between IAM Users and IAM Roles.

Accepted Answer

*   **IAM Users**: Represent a person or service that interacts with AWS. They have long-term credentials (password, access keys) and are typically associated with a specific individual or application.
*   **IAM Roles**: Are meant to be assumed by trusted entities (users, services, or applications) to grant temporary permissions. Roles do not have standard long-term credentials; instead, they provide temporary security credentials when assumed. They are ideal for granting cross-account access or giving EC2 instances permissions to access other AWS services.

Question 18

Briefly describe the use cases for `gp3` and `io2` EBS volume types.

Accepted Answer

*   `gp3` (General Purpose SSD): A cost-effective SSD volume that balances price and performance for a wide variety of transactional workloads. It allows independent provisioning of IOPS and throughput, making it flexible for many applications.
*   `io2` (Provisioned IOPS SSD): Designed for critical, I/O-intensive applications that require sustained high performance and low latency, such as large relational or NoSQL databases. It offers the highest durability and can provision up to 64,000 IOPS and 1,000 MiB/s throughput.

Question 19

What problem do VPC Endpoints solve, and what are the two main types?

Accepted Answer

`VPC Endpoints` allow you to privately connect your VPC to supported AWS services (e.g., S3, DynamoDB) and VPC endpoint services powered by PrivateLink, without requiring an Internet Gateway, NAT device, VPN connection, or AWS Direct Connect. This enhances security by keeping traffic within the AWS network.

There are two main types:
*   **Interface Endpoints**: Powered by AWS PrivateLink, they create an Elastic Network Interface (ENI) with private IPs in your subnets, allowing direct, private access to services.
*   **Gateway Endpoints**: A gateway that you specify as a target for a route in your route table for traffic destined to S3 or DynamoDB. (Note: Only S3 and DynamoDB are supported by Gateway Endpoints).

Question 20

Briefly explain the core difference between a serverless architecture (e.g., Lambda) and a traditional server-based architecture (e.g., EC2).

Accepted Answer

The core difference lies in **server management**. In a `traditional server-based architecture` (e.g., EC2), you are responsible for provisioning, managing, patching, and scaling the underlying servers. In a `serverless architecture` (e.g., Lambda), AWS fully manages the servers, operating system, and scaling. You only focus on writing your code, and AWS automatically executes it in response to events, scaling resources up and down as needed, and you pay only for the compute time consumed.

Question 21

List three strategies to optimize costs for EC2 instances.

Accepted Answer

Three strategies to optimize EC2 costs are:
1.  **Right-sizing**: Continuously analyze instance usage and select the smallest instance type that meets performance requirements.
2.  **Purchasing Options**: Utilize `Reserved Instances` (RIs) for predictable, long-running workloads (1 or 3 years) or `Spot Instances` for fault-tolerant, flexible workloads that can tolerate interruptions.
3.  **Auto Scaling**: Dynamically adjust the number of instances based on demand, ensuring you only pay for what you need and avoiding over-provisioning.
4.  **Stop/Terminate Unused Instances**: Regularly identify and stop or terminate instances that are no longer needed.

Question 22

How can you ensure data is encrypted at rest for S3 buckets and EBS volumes?

Accepted Answer

*   **S3 Buckets**: Data can be encrypted at rest using `Server-Side Encryption` (SSE). Options include:
    *   `SSE-S3`: AWS manages the encryption keys.
    *   `SSE-KMS`: AWS Key Management Service (KMS) manages the encryption keys, offering more control.
    *   `SSE-C`: Customer-provided encryption keys.
*   **EBS Volumes**: Data can be encrypted at rest by enabling `EBS encryption` when creating the volume. This uses `AWS KMS` keys (either AWS-managed or customer-managed) to encrypt the data. Snapshots of encrypted volumes are also encrypted.

AWS Solutions Architect Associate (SAA-C03) - Core Services & Architecture

Card Preview

Related Flashcard Sets

French A1/A2 - Core Vocabulary & Beginner Grammar

SQL Performance Tuning - Indexing, Query Optimization & Execution Plans

Pharmacology - Drug Action, Pharmacokinetics & Pharmacodynamics

CHEM204 - Organic Chemistry II: Spectroscopic Analysis & Synthesis