Luyện AWS Solutions Architect Associate

Spot Instances let you use spare EC2 capacity at discounts of up to 90 percent. AWS can interrupt them with a two-minute warning, so they are best for fault-tolerant and interruption-tolerant workloads. On-Demand and Reserved Instances do not get interrupted, and Dedicated Hosts cost more because they provide physical isolation.

S3 Glacier Deep Archive is the lowest-cost S3 storage class and is designed for long-term archives that are rarely accessed. Its retrieval times can be up to 12 hours, which matches the requirement. S3 Standard and Intelligent-Tiering are for data that needs faster access, and One Zone-IA stores infrequently accessed data in a single Availability Zone.

Amazon RDS manages relational databases such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server, including automated backups and maintenance. A Multi-AZ deployment adds a standby instance for automatic failover. DynamoDB is a NoSQL database, ElastiCache is an in-memory cache, and Neptune is a graph database.

Amazon DynamoDB is a fully managed NoSQL database that supports key-value and document data models. It scales horizontally and provides single-digit millisecond response times. Aurora and RDS are relational databases, and Redshift is a petabyte-scale data warehouse.

Amazon Route 53 is a managed DNS service that maps names to AWS resources and supports multiple routing policies. CloudFront is a content delivery network, Transit Gateway connects networks, and Elastic Load Balancing distributes traffic to registered targets.

An Application Load Balancer operates at Layer 7, the application layer, and can inspect HTTP/HTTPS attributes such as paths and headers. A Network Load Balancer operates at Layer 4 for TCP and UDP traffic. Layers 2 and 3 are not where ALB works.

Amazon EBS provides durable block storage volumes that attach to one EC2 instance in the same Availability Zone. S3 and S3 Glacier are object storage, and EFS is a shared NFS file system.

AWS Lambda executes code in response to events and automatically manages the underlying compute infrastructure. EC2 and EKS require instance or cluster management. EC2 Auto Scaling still runs workloads on EC2 instances.

S3 Standard is designed for 99.999999999 percent, or eleven nines, of object durability across multiple Availability Zones. The 99.99 percent figure is the service-level availability target, not durability. No storage service can guarantee 100 percent durability.

An IAM role attached to an EC2 instance provides temporary credentials through the instance metadata service. This avoids embedding access keys in code or configuration files. IAM groups are permission containers, and the root user should not be used for application access.

AWS KMS creates, stores, and manages cryptographic keys and integrates with many AWS services for encryption at rest. WAF filters web traffic, Shield provides DDoS protection, and Inspector scans workloads for vulnerabilities.

Each AWS Region contains multiple isolated Availability Zones with independent power, cooling, and networking. Distributing a workload across Availability Zones improves availability. Edge locations are part of the content delivery network, not a Region concept.

The Cost optimization pillar covers rightsizing, using appropriate pricing models, and eliminating unused resources. Security protects data and systems, Reliability handles recovery and demand, and Operational excellence improves processes and monitoring.

Amazon EFS is a scalable NFS file system that multiple Linux instances can mount at the same time, including across Availability Zones. EBS volumes attach to a single instance, instance store is ephemeral, and S3 is object storage rather than a shared POSIX file system.

An Auto Scaling scaling policy adds or removes instances when a CloudWatch alarm indicates that a metric crossed a threshold. Route 53 records, VPC endpoints, and EBS snapshots do not change Auto Scaling capacity.

Read replicas receive asynchronous copies of the primary database and serve read traffic, improving read performance. Multi-AZ provides automatic failover, and replicas do not increase write capacity. ElastiCache provides in-memory caching.

Compute Savings Plans offer flexible discounts across EC2, Fargate, and Lambda without locking to a specific instance family. Reserved Instances are more restrictive. On-Demand has no commitment or discount, and Spot Instances can be interrupted.

AWS Secrets Manager stores secrets and supports automatic rotation using an AWS Lambda rotation function. IAM manages identities and permissions, AWS Backup manages backups, and CloudWatch monitors metrics.

AWS CloudTrail captures API calls made in an account and stores them in an event history for auditing. CloudWatch monitors metrics and logs, Trusted Advisor checks best practices, and Cost Explorer analyzes spending.

Amazon CloudWatch collects metrics and log data from AWS resources and can trigger alarms. CloudTrail audits API calls, Config evaluates resource configurations, and Organizations manages multiple accounts.

Security groups are stateful, so if an inbound request is allowed, the return traffic is automatically permitted. Network ACLs are stateless and require explicit rules for return traffic. Security groups act at the instance or elastic network interface level and work together with NACLs.

An S3 bucket policy is a resource-based policy that can grant access to principals in other accounts. Security groups control network traffic, CloudWatch alarms notify on metrics, and Route 53 records handle DNS.

The Fargate launch type is serverless compute for containers, so AWS manages the underlying instances. The EC2 launch type requires the customer to provision and maintain a cluster of instances. Spot Fleet provisions EC2 capacity rather than ECS containers.

Amazon CloudFront is a content delivery network that serves cached content from edge locations close to users. Route 53 is DNS, Direct Connect is a private network connection, and Transfer Acceleration speeds up S3 uploads.

S3 Lifecycle policies transition objects between storage classes and can expire them according to age. Replication copies objects to another bucket, versioning preserves versions, and access points provide named bucket endpoints.

Versioning keeps every version of an object so an accidental overwrite or delete can be undone. It does not change upload performance or object visibility. Encryption settings are separate from versioning.

S3 replication requires versioning on both the source and destination buckets. Replication is asynchronous and typically completes within 15 minutes for most objects. Cross-account replication is supported when the required permissions are configured.

AWS Storage Gateway connects on-premises software to AWS storage through File Gateway, Volume Gateway, and Tape Gateway modes. EFS and S3 are cloud-native storage services, and Snowball Edge is a physical device for moving large datasets.

RDS Multi-AZ maintains a synchronously replicated standby instance and fails over automatically when the primary becomes unhealthy. The standby does not serve reads. Read replicas scale reads, Aurora Global Database handles cross-Region replication, and ElastiCache provides caching.

Aurora replicates each chunk of data across six storage nodes spanning three Availability Zones and can survive the loss of an Availability Zone. Its storage scales automatically up to 128 TiB. Aurora supports up to 15 low-latency read replicas.

DAX is an in-memory cache designed for DynamoDB that can reduce response times to microseconds for repeated reads. ElastiCache caches general application data, CloudFront caches web content, and RDS Proxy pools connections to relational databases.

DynamoDB on-demand mode charges for actual reads and writes and automatically accommodates traffic changes. Provisioned mode requires setting read and write capacity units, even when autoscaling is used. DynamoDB does not use reserved capacity.

A global secondary index contains an alternate key that supports additional query patterns without changing the base table. It is maintained asynchronously and is eventually consistent by default. Global tables provide cross-Region replication, DAX provides caching, and strong consistency is a separate setting.

Reserved concurrency caps the maximum number of concurrent invocations for a function, protecting downstream systems. Memory and timeout change function resources and duration limits. Layers package code dependencies and do not limit concurrency.

Amazon EKS runs Kubernetes clusters with a managed control plane and integrates with AWS services. ECS is AWS's native container orchestration platform, Fargate is a serverless compute option, and ECR is a container image registry.

VPC peering creates a private connection between two VPCs using their private IP ranges, and the CIDR blocks cannot overlap. Peering is not transitive, so a third VPC cannot use the connection. Transit Gateway provides hub-and-spoke routing, while IGW and NAT gateways handle internet traffic.

AWS Transit Gateway connects VPCs, VPNs, and Direct Connect attachments through a central hub, simplifying routing at scale. A peering mesh requires many connections and does not support transitive routing. An IGW provides internet access, and a VPC endpoint connects privately to AWS services.

Gateway VPC endpoints for S3 and DynamoDB use route table entries and do not incur hourly charges. Interface endpoints are elastic network interfaces with per-hour and data processing costs. VPN and NAT traffic still uses network paths outside the gateway endpoint model.

AWS Direct Connect establishes a dedicated physical connection between a data center and AWS, providing consistent performance and bypassing the public internet. Site-to-Site VPN runs encrypted tunnels over the internet. VPC peering connects VPCs, not on-premises data centers.

An ALB registers targets in target groups and uses health checks to detect unhealthy instances. Traffic is only routed to targets that pass the checks. Route 53 and CloudFront are separate services that are not part of ALB health tracking.

Failover routing sends traffic to the primary record and shifts to the secondary record when health checks fail, supporting active-passive disaster recovery. Weighted routing splits traffic by proportion, simple routing maps a name to one resource, and geolocation routes by user location.

Latency-based routing uses measurements of network latency between users and Regions to select the best-performing endpoint. Geolocation routing uses the user's geographic location, weighted routing uses weights, and multivalue answers return several healthy records.

Security groups are stateful, so allowing inbound traffic also permits the corresponding return traffic automatically. Network ACLs are stateless and need explicit rules for both directions. Security groups and NACLs are complementary controls at different layers.

A network ACL is a stateless filter applied to a subnet, so return traffic must be explicitly allowed. Security groups are stateful and act at the instance or ENI level. VPC endpoints and internet gateways provide connectivity rather than filtering.

Customer managed keys give you control over key policies, rotation, aliases, and deletion. AWS managed keys rotate automatically but offer less configuration control. KMS keys can encrypt data for many AWS services and are not tied to an instance.

AWS Secrets Manager stores secrets and supports automatic rotation through a Lambda rotation function, updating the database credential. IAM manages identities, CloudTrail audits API calls, and KMS provides encryption keys rather than secret storage.

AWS WAF inspects HTTP/HTTPS requests and applies managed or custom rules, including protections for SQL injection and XSS. Shield mitigates DDoS attacks, GuardDuty detects threats from account activity, and Inspector scans workloads for vulnerabilities.

AWS Shield Advanced is a paid service that adds access to the DDoS Response Team, expanded protection, and cost protection against scaling charges. Shield Standard is free and automatically protects all AWS customers. WAF filters application-layer requests, and CloudFront is a CDN.

An IAM role attached to an instance provides temporary credentials through the instance metadata service, avoiding hard-coded keys. Storing access keys in code creates a security risk, and root credentials should only be used for account administration.

A presigned URL includes a signature and expiration time, allowing temporary access to a specific object. Bucket policies grant persistent access, lifecycle rules manage storage transitions, and access points provide alternative endpoints for a bucket.

EBS snapshots capture changed blocks incrementally and are stored in S3, so the first snapshot is slower than subsequent ones. Snapshots can be copied across Regions and restored as new volumes in any Availability Zone. They are not tied to a running instance.

Amazon EFS is a scalable NFS file system that can be mounted by many Linux instances at once, including across Availability Zones. EBS volumes attach to a single instance, instance store is ephemeral, and S3 is object storage.

Compute optimized instances provide high CPU performance for compute-intensive tasks such as encoding and batch processing. Memory optimized instances suit in-memory caches, storage optimized instances suit high disk throughput, and burstable instances suit variable low CPU usage.

A mixed instances group can combine On-Demand and Spot Instances, lowering cost while preserving capacity for workloads that can tolerate interruptions. Dedicated Hosts are more expensive, On-Demand-only fleets pay full price, and a single instance creates a single point of failure.

With Fargate, AWS manages the underlying compute infrastructure so the customer only defines tasks. The EC2 launch type requires the customer to provision and manage the cluster instances. Both launch types run containers.

CloudWatch tracks metrics, logs, and alarms, while CloudTrail records API activity for auditing. Route 53 and CloudFront handle DNS and content delivery, IAM and Organizations manage access, and Cost Explorer and Budgets manage spending.

AWS Systems Manager uses the SSM agent to run commands, apply patches, and manage configuration without inbound ports. Inspector scans for vulnerabilities, CloudFormation provisions infrastructure, and CodeCommit hosts Git repositories.

Cost Explorer visualizes past usage, provides forecasts, and allows filtering by service or tag. Budgets complements it by alerting when cost or usage exceeds a threshold. Pricing Calculator estimates planned costs, Trusted Advisor checks best practices, and Compute Optimizer rightsizes instances.

Compute Optimizer analyzes CPU, memory, storage, and network utilization to recommend more cost-effective instance configurations. Trusted Advisor covers broader best-practice checks, CloudWatch monitors resources, and Service Quotas manages limits.

Trusted Advisor inspects resources and reports on five categories, including cost optimization, security, fault tolerance, performance, and service limits. Config evaluates resource configurations against rules, CloudTrail logs API calls, and Artifact provides compliance documents.

S3 Intelligent-Tiering monitors access patterns and moves objects between frequent and infrequent tiers automatically. It charges a small monitoring fee but no retrieval fees. Standard stays in one tier, Deep Archive is for long-term archives, and One Zone-IA stores data in one Availability Zone.

Amazon Aurora is MySQL-compatible and scales storage automatically up to 128 TiB while replicating data across three Availability Zones. RDS for MySQL requires manual storage configuration and has lower storage limits. DynamoDB is NoSQL, and ElastiCache is an in-memory cache.

A Network Load Balancer operates at Layer 4, handles extreme TCP/UDP throughput, preserves source IPs, and can use Elastic IP addresses. An Application Load Balancer operates at Layer 7 and does not expose static IPs by default. Gateway Load Balancer routes third-party virtual appliances.

Signed URLs grant time-limited access to individual objects, and signed cookies can restrict access to multiple files. Origin access control prevents direct origin access but does not create time-limited URLs for users. WAF rules filter traffic, and invalidation removes cached copies.

Deploying across Availability Zones behind an ALB tolerates instance and AZ failures. Route 53 failover routing adds disaster recovery by switching to a standby Region. A single Availability Zone, one instance store volume, and disabled health checks all create availability risks.

Block Public Access keeps the bucket private, while an IAM policy or a scoped bucket policy grants the named user permission. Public ACLs, lifecycle rules that publicize objects, and anonymous write access violate the requirement and expose data.

Amazon SQS provides message queues that buffer work between producers and consumers, and Amazon SNS provides publish/subscribe topics for fan-out. Direct Connect connects networks, Glacier archives data, and VPC peering connects VPCs.

AWS WAF filters HTTP/HTTPS requests to block attacks such as SQL injection, and Shield Advanced adds enhanced DDoS protection and response support. Security groups control ports but not web attack patterns. Latency routing improves performance, and CloudTrail is for auditing.

DAX reduces DynamoDB read latency, global tables replicate data across Regions, and on-demand mode scales automatically. A global secondary index can use a different partition key to support alternate queries. DynamoDB is a NoSQL database and does not support SQL joins.

Multi-AZ provides automatic failover, cross-Region read replicas support disaster recovery, and snapshot copies protect against Region-wide events. A single EBS volume is a single point of failure, and disabling backups reduces recoverability.

Versioning, replication, and Object Lock protect objects from loss, deletion, and modification, which supports compliance. Versioning does not automatically encrypt objects, and disabling encryption increases rather than reduces compliance risk.

Savings Plans, Spot Instances, and rightsizing lower compute spend while preserving capacity for the right workloads. Idle instances waste money, and lifecycle policies should move cold data to lower-cost classes such as Glacier rather than Standard.

S3 Standard is designed for eleven nines of durability by storing objects redundantly across multiple Availability Zones. Its 99.99 percent figure refers to availability, which is a different measure. Durability means the object will not be lost.

A read replica can be promoted to a standalone instance if the primary fails or a new primary is needed. Promotion stops replication from the original primary. This supports recovery scenarios, though Multi-AZ is the automatic failover mechanism.

Security groups are stateful: return traffic for allowed requests is automatically permitted. It is network ACLs that are stateless and require explicit rules in both directions. This distinction is important when designing VPC security.

VPC peering is not transitive, and a third VPC cannot use a peer connection between two other VPCs. Each VPC pair needs its own peering connection. AWS Transit Gateway provides hub-and-spoke routing when transitive connectivity is required.

On-demand mode scales capacity automatically to match traffic and charges per request, which suits unpredictable workloads. Provisioned mode requires configuring capacity units even when autoscaling is used. This makes on-demand simpler for spiky traffic.

Gateway VPC endpoints for S3 and DynamoDB are free and use route table entries rather than elastic network interfaces. Interface VPC endpoints are paid and incur hourly charges. This makes gateway endpoints the lower-cost choice for those two services.

Secrets Manager supports automatic rotation of RDS database credentials, either through a Lambda rotation function or managed rotation for RDS. Rotated secrets are stored securely and can be retrieved by applications without redeployment. This reduces the risk of leaked static passwords.

The Multi-AZ standby is a synchronously replicated instance reserved for automatic failover and does not serve application reads. To offload read traffic, create RDS read replicas. Using read replicas for reads and Multi-AZ for failover follows AWS best practices.