AWS Solutions Architect Associate (SAA-C03) - Cloud Architecture & VPC Design Flashcards

Question 1

What is AWS VPC Peering and its primary limitation?

Accepted Answer

`VPC Peering` connects two VPCs, allowing them to communicate as if they are on the same network. Its primary limitation is that it is **non-transitive**, meaning VPC A peered with VPC B, and VPC B peered with VPC C, does not allow VPC A to communicate with VPC C directly. It also requires non-overlapping CIDR blocks.

Question 2

When should you use AWS Transit Gateway instead of VPC Peering?

Accepted Answer

Use `AWS Transit Gateway` when you need a central hub to connect multiple VPCs and on-premises networks, especially when dealing with a large number of VPCs. It overcomes the non-transitive limitation of VPC peering, simplifying network management and routing.

Question 3

Describe the key benefits of using AWS Transit Gateway.

Accepted Answer

Key benefits of `AWS Transit Gateway` include:
*   **Transitivity:** Allows any attached VPC or VPN to communicate with any other attached VPC or VPN.
*   **Scalability:** Simplifies network architecture for many VPCs.
*   **Centralized Management:** Provides a single point of control for network connectivity.
*   **Reduced Operational Overhead:** Eliminates the need for complex, mesh-like peering connections.

Question 4

How do you ensure private connectivity between an on-premises data center and multiple AWS VPCs using Transit Gateway?

Accepted Answer

You can establish private connectivity by attaching a `Direct Connect Gateway` or `VPN connection` (Site-to-Site VPN) to the `Transit Gateway`. All VPCs attached to the same Transit Gateway can then route traffic to the on-premises network through this single connection.

Question 5

Which S3 storage class is best for frequently accessed data with high durability and availability?

Accepted Answer

`Amazon S3 Standard` is ideal for frequently accessed data, offering high durability, availability, and performance for a wide range of use cases, including cloud applications, dynamic websites, content distribution, and big data analytics.

Question 6

When would you choose S3 Intelligent-Tiering?

Accepted Answer

Choose `S3 Intelligent-Tiering` when data access patterns are unknown or changing. It automatically moves objects between two access tiers (frequent and infrequent) based on access patterns, optimizing storage costs without performance impact or operational overhead.

Question 7

Differentiate between S3 Standard-IA and S3 One Zone-IA.

Accepted Answer

*   `S3 Standard-IA` (Infrequent Access): For data that is accessed less frequently but requires rapid access when needed. It stores data in a minimum of three Availability Zones, offering high durability and availability.
*   `S3 One Zone-IA`: For data that is accessed less frequently and can be recreated if lost. It stores data in a single Availability Zone, offering lower cost but less resilience compared to Standard-IA. Suitable for secondary backups or easily reproducible data.

Question 8

For long-term archival with the lowest cost and flexible retrieval times (minutes to hours), which S3 storage class is most suitable?

Accepted Answer

`Amazon S3 Glacier Flexible Retrieval` (formerly S3 Glacier) is designed for long-term archival, offering the lowest storage cost for data that is rarely accessed. It provides retrieval options ranging from minutes to hours.

Question 9

Which S3 storage class is designed for the lowest-cost archival of data that can tolerate retrieval times of several hours?

Accepted Answer

`Amazon S3 Glacier Deep Archive` is the lowest-cost S3 storage class, ideal for long-term archival of data that is accessed once or twice a year and can tolerate retrieval times of 12-48 hours.

Question 10

Summarize the S3 storage class decision process based on access frequency and durability requirements.

Accepted Answer

*   **Frequent Access:** `S3 Standard`
*   **Unknown/Changing Access:** `S3 Intelligent-Tiering`
*   **Infrequent Access, Rapid Retrieval, High Durability:** `S3 Standard-IA`
*   **Infrequent Access, Rapid Retrieval, Tolerates AZ loss:** `S3 One Zone-IA`
*   **Archival, Immediate Retrieval (milliseconds):** `S3 Glacier Instant Retrieval`
*   **Archival, Flexible Retrieval (minutes-hours):** `S3 Glacier Flexible Retrieval`
*   **Archival, Lowest Cost, Long Retrieval (hours):** `S3 Glacier Deep Archive`

Question 11

What is the primary purpose of Amazon RDS Multi-AZ deployments?

Accepted Answer

The primary purpose of `Amazon RDS Multi-AZ` deployments is **high availability and disaster recovery**. It synchronously replicates data to a standby instance in a different Availability Zone, providing automatic failover in case of an outage of the primary instance or its AZ. It does **not** improve read performance.

Question 12

How do Amazon RDS Read Replicas improve database performance?

Accepted Answer

`Amazon RDS Read Replicas` improve database performance by offloading read-heavy workloads from the primary database instance. They allow you to scale out your database's read capacity, distributing read requests across multiple replica instances. They use **asynchronous replication**.

Question 13

When would you use both RDS Multi-AZ and Read Replicas for a database?

Accepted Answer

You would use both `RDS Multi-AZ` and `Read Replicas` when you need both **high availability/disaster recovery** (Multi-AZ) AND **read scalability** (Read Replicas). The Multi-AZ setup ensures your primary database is resilient, while Read Replicas handle read traffic, preventing the primary from becoming a bottleneck.

Question 14

Explain the difference between Simple Scaling and Step Scaling policies in AWS Auto Scaling.

Accepted Answer

*   `Simple Scaling`: Adjusts capacity based on a single CloudWatch alarm. After scaling, it waits for a `cooldown period` before responding to further alarms. It's less granular and can lead to "flapping" if not configured carefully.
*   `Step Scaling`: Adjusts capacity based on a CloudWatch alarm, but can apply different scaling adjustments based on the size of the alarm breach. It's more granular and can respond more quickly to varying load conditions without waiting for a full cooldown.

Question 15

Which Auto Scaling policy is generally recommended for maintaining a desired level of resource utilization?

Accepted Answer

`Target Tracking Scaling` is generally recommended. You specify a target value for a metric (e.g., 70% average CPU utilization), and Auto Scaling automatically adjusts the group's capacity to maintain that target, adding or removing instances as needed.

Question 16

Describe a scenario where Scheduled Scaling would be the most appropriate Auto Scaling policy.

Accepted Answer

`Scheduled Scaling` is most appropriate for predictable load changes. For example, if an e-commerce website consistently experiences a surge in traffic every weekday morning between 9 AM and 11 AM, you can schedule Auto Scaling to increase capacity before 9 AM and decrease it after 11 AM.

Question 17

What is the purpose of a cooldown period in Auto Scaling policies?

Accepted Answer

The `cooldown period` is a configurable setting that prevents an Auto Scaling group from launching or terminating additional instances before the previous scaling activity has taken effect and the new instances have started processing traffic. This helps to stabilize the group and prevent rapid, unnecessary scaling actions.

Question 18

What is the default behavior of IAM policy evaluation?

Accepted Answer

The default behavior of `IAM policy evaluation` is **explicit deny**. Unless a specific `Allow` statement grants permission, any action is implicitly denied.

Question 19

In IAM policy evaluation, what happens if a policy contains both an `Allow` and an `Explicit Deny` for the same action?

Accepted Answer

An `Explicit Deny` always overrides an `Allow`. If a policy contains both an `Allow` and an `Explicit Deny` for the same action, the action will be **denied**. Deny statements take precedence.

Question 20

How do Service Control Policies (SCPs) in AWS Organizations interact with IAM policies?

Accepted Answer

`Service Control Policies (SCPs)` are guardrails that define the maximum available permissions for all IAM users and roles in an AWS account within an Organization. An `SCP` acts as a filter; if an action is denied by an `SCP`, no IAM policy (identity-based or resource-based) in that account can grant permission for that action, even if it explicitly allows it. SCPs do not grant permissions, they only restrict them.

Question 21

Explain the evaluation order for IAM policies when a user tries to perform an action on a resource.

Accepted Answer

The evaluation order is:
1.  **Default Deny:** All requests are implicitly denied.
2.  **Explicit Deny:** If any policy (identity-based, resource-based, SCP, permissions boundary) explicitly denies the action, the request is denied. This takes precedence over all allows.
3.  **Explicit Allow:** If no explicit deny applies, and at least one policy explicitly allows the action, the request is allowed.
Essentially: **Explicit Deny > Explicit Allow > Implicit Deny**.

AWS Solutions Architect Associate (SAA-C03) - Cloud Architecture & VPC Design

Cards in this deck

Related Flashcard Sets

AWS Certified Solutions Architect Associate (SAA-C03) - Scalable Cloud Architecture

TypeScript - Advanced Type Systems, Generics & Design Patterns

Harvard ECON1011 - Intermediate Microeconomics: Game Theory & Market Structures

MIT 18.03 - Differential Equations: Ordinary Differential Equations, Laplace & Fourier