AWS Certified Solutions Architect – Associate Flashcards

Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, and Design Cost-Optimized Architectures. Together they map to the pillars of the AWS Well-Architected Framework.

It keeps multiple variants of an object in the same bucket so accidental overwrites or deletes can be recovered by restoring a prior version, rather than being permanently lost.

Use an ALB for HTTP/HTTPS traffic that needs Layer 7 routing (path- or host-based rules, WebSocket, redirects). Use an NLB when you need ultra-low latency, static IPs, or must handle non-HTTP TCP/UDP traffic at Layer 4.

A Security Group is stateful and attaches to instances/ENIs, evaluating only allow rules. A Network ACL is stateless, applies at the subnet level, and supports both allow and deny rules evaluated in order.

A synchronously replicated standby database in a different Availability Zone that RDS automatically fails over to for high availability; it is for durability/availability, not for read scaling.

They provide asynchronously replicated copies of a database for offloading read traffic and improving read scalability; they can also be promoted to standalone instances for disaster recovery.

S3 Standard-Infrequent Access (S3 Standard-IA) — lower storage cost than S3 Standard with a retrieval fee, but data stays instantly accessible, unlike Glacier tiers.

It automatically moves objects between access tiers based on changing access patterns, without performance impact or operational overhead, optimizing storage cost when access patterns are unpredictable.

A dedicated private network connection from an on-premises location to AWS, bypassing the public internet for more consistent bandwidth and lower latency than a VPN.

A VPC endpoint lets resources in a VPC privately connect to supported AWS services without traversing the public internet or requiring a NAT gateway or internet gateway, improving security and reducing data transfer cost.

Gateway endpoints support only S3 and DynamoDB and use route table entries; Interface endpoints (powered by AWS PrivateLink) support most other AWS services and use an ENI with a private IP in your subnet.

Scaling policies driven by CloudWatch metrics (such as target tracking on CPU utilization or a custom metric), scheduled actions, or predictive scaling based on historical load patterns.

Avoiding unnecessary costs by right-sizing resources, using appropriate pricing models (Reserved, Spot, Savings Plans), and continuously monitoring and adjusting spend as workload needs change.

For fault-tolerant, flexible workloads (batch processing, big data, CI/CD) that can tolerate interruption, since Spot offers steep discounts off On-Demand pricing in exchange for AWS being able to reclaim capacity.

It improves availability and performance for global users by routing traffic over the AWS global network using static anycast IP addresses and directing users to the optimal healthy endpoint.

It is a content delivery network (CDN) that caches content at edge locations close to users, reducing latency and offloading traffic from origin servers such as S3 or EC2.

SQS is a message queue for decoupling and buffering point-to-point communication between producers and consumers; SNS is a pub/sub service that pushes messages to multiple subscribers (including SQS queues, Lambda, email) simultaneously.

DynamoDB is a fully managed NoSQL key-value/document database suited for high-throughput, low-latency workloads with flexible schemas, while RDS is a managed relational database suited for structured data needing complex queries and transactions across tables.

It acts as a central hub that simplifies network connectivity by letting you connect multiple VPCs and on-premises networks through a single gateway, instead of managing many point-to-point VPC peering connections.

AWS is responsible for security 'of' the cloud (physical infrastructure, hardware, host OS/virtualization), while the customer is responsible for security 'in' the cloud (data, IAM configuration, guest OS patching, network configuration, encryption choices).

IAM users represent a person or application with long-term credentials; IAM roles are assumed temporarily (via STS) by trusted entities such as EC2 instances, Lambda functions, or federated users, granting temporary credentials without storing long-term secrets.

A managed service for creating and controlling encryption keys used to encrypt data across AWS services, supporting key rotation, granular access policies, and integration with CloudTrail for audit logging.

To allow instances in a private subnet to initiate outbound traffic to the internet (e.g., for updates) while preventing unsolicited inbound connections from the internet.

Route 53 can monitor endpoint health and automatically route traffic away from unhealthy resources to a healthy backup, supporting active-passive disaster recovery architectures.

S3 Standard is designed for frequently accessed data with millisecond retrieval; S3 Glacier classes are designed for long-term archival at much lower cost, with retrieval times ranging from minutes to hours depending on the tier.

A fully managed, scalable NFS file system that can be mounted concurrently by multiple EC2 instances across Availability Zones, useful for shared file storage workloads unlike EBS, which attaches to a single instance at a time.

It lets you define infrastructure as code in templates, enabling repeatable, version-controlled, and automated provisioning and updates of AWS resources as a single managed stack.

AWS Organizations centrally manages multiple AWS accounts, while SCPs set maximum permission guardrails across accounts or organizational units, restricting what actions IAM principals can perform even if their IAM policies would otherwise allow it.

A placement group influences how EC2 instances are placed on underlying hardware; a cluster placement group packs instances close together in a single AZ for low-latency, high-throughput networking, ideal for tightly coupled HPC workloads.

High availability minimizes downtime by rapidly recovering from failure (e.g., Multi-AZ failover), while fault tolerance means the system continues operating with no perceptible interruption even during a component failure, typically at higher cost and complexity.