Question 1

What is a Multi-AZ deployment in RDS?

Accepted Answer

Multi-AZ creates a synchronous standby replica in a different Availability Zone. If the primary fails, RDS automatically fails over to the standby with minimal downtime. Multi-AZ is for high availability, not read scaling.

Question 2

What is an RDS Read Replica?

Accepted Answer

An RDS Read Replica is an asynchronous copy of the primary database used to offload read traffic. Unlike Multi-AZ, it is not for failover it improves read performance and can be promoted to a standalone instance if needed.

Question 3

What is the difference between RDS Multi-AZ and Read Replicas?

Accepted Answer

Multi-AZ provides synchronous replication for automatic failover and high availability. Read Replicas use asynchronous replication for read scaling. Multi-AZ standby cannot serve read traffic; Read Replicas can.

Question 4

What is Amazon Aurora?

Accepted Answer

Amazon Aurora is a MySQL/PostgreSQL-compatible relational database built for the cloud. It replicates data 6 ways across 3 AZs, supports up to 15 read replicas, and provides automatic failover in under 30 seconds.

Question 5

What is Aurora Serverless?

Accepted Answer

Aurora Serverless automatically starts, scales, and shuts down capacity based on application demand. It is ideal for infrequent, intermittent, or unpredictable workloads where you want to avoid managing database instances.

Question 6

What is Amazon S3 Cross-Region Replication (CRR)?

Accepted Answer

CRR automatically replicates objects from an S3 bucket in one region to a bucket in another region. It requires versioning enabled on both buckets and is used for compliance, lower latency access, and disaster recovery.

Question 7

What is S3 Versioning?

Accepted Answer

S3 Versioning keeps multiple variants of an object in the same bucket. Once enabled, every overwrite or delete creates a new version rather than destroying the previous one, enabling recovery from accidental deletions or overwrites.

Question 8

What is Amazon S3 MFA Delete?

Accepted Answer

MFA Delete requires an additional authentication factor to permanently delete object versions or suspend versioning on an S3 bucket. It adds a strong layer of protection against accidental or malicious deletion.

Question 9

What is an S3 Lifecycle Policy?

Accepted Answer

An S3 Lifecycle Policy automates transitioning objects between storage classes (e.g., Standard → Glacier) or expiring them after a defined period. It reduces storage costs without manual intervention.

Question 10

What is Elastic Load Balancing (ELB)?

Accepted Answer

ELB automatically distributes incoming traffic across multiple targets in one or more AZs. It decouples clients from individual instances, enabling fault tolerance and seamless scaling. Types include ALB, NLB, and GLB.

Question 11

What is the difference between ALB, NLB, and GLB?

Accepted Answer

ALB (Application Load Balancer) Layer 7, HTTP/HTTPS, path/host-based routing, best for web apps. NLB (Network Load Balancer) Layer 4, TCP/UDP, ultra-low latency, static IP support. GLB (Gateway Load Balancer) Layer 3, routes traffic to third-party virtual appliances (firewalls, IDS/IPS).

Question 12

What is Auto Scaling and what are its components?

Accepted Answer

AWS Auto Scaling adjusts EC2 capacity automatically. Key components: Launch Template defines instance configuration. Auto Scaling Group (ASG) manages the fleet with min, max, and desired capacity. Scaling Policies define when and how to scale (target tracking, step, scheduled).

Question 13

What is a target tracking scaling policy?

Accepted Answer

Target tracking automatically adjusts capacity to keep a specific metric (e.g., average CPU at 50%) at a target value. It is the simplest and recommended scaling policy, similar to a thermostat.

Question 14

What is a step scaling policy?

Accepted Answer

Step scaling adjusts capacity in steps based on the magnitude of a CloudWatch alarm breach. For example, add 2 instances if CPU > 70%, add 4 if CPU > 90%. It gives more control than target tracking.

Question 15

What is a scheduled scaling action?

Accepted Answer

Scheduled scaling pre-emptively changes the min/max/desired capacity of an ASG at a specific time. It is useful for predictable load patterns, such as scaling up before business hours or a known traffic event.

Question 16

What is an EC2 placement group?

Accepted Answer

Placement groups control how EC2 instances are physically placed: Cluster packs instances in a single AZ for low latency, high throughput (HPC). Spread each instance on distinct hardware, max 7 per AZ, for critical instances. Partition instances in partitions on separate racks, for large distributed systems (Hadoop, Kafka).

Question 17

What is Amazon SQS and how does it aid resilience?

Accepted Answer

SQS is a managed message queue that decouples producers and consumers. If a consumer fails, messages remain in the queue until processed. This prevents data loss and allows components to scale independently.

Question 18

What is SQS visibility timeout?

Accepted Answer

When a consumer picks up a message, it becomes invisible to other consumers for the visibility timeout period. If not deleted within that time, it reappears for reprocessing. This prevents duplicate processing while allowing retry on failure.

Question 19

What is an SQS Dead Letter Queue (DLQ)?

Accepted Answer

A DLQ is a separate SQS queue where messages that fail processing a configured number of times (maxReceiveCount) are moved. It isolates problem messages for debugging without blocking the main queue.

Question 20

What is Amazon Route 53 failover routing?

Accepted Answer

Failover routing directs traffic to a primary resource when it is healthy and automatically switches to a secondary (standby) resource when the primary fails a health check. It enables DNS-based disaster recovery.

Question 21

What are Route 53 routing policies?

Accepted Answer

Simple single resource, no health checks. Weighted split traffic by percentage across resources. Latency route to the region with lowest latency. Failover active/passive disaster recovery. Geolocation route based on user's geographic location. Geoproximity route based on geographic distance with bias. Multivalue Answer return multiple healthy records.

Question 22

What is AWS Global Accelerator?

Accepted Answer

AWS Global Accelerator routes user traffic through the AWS global network to the nearest healthy endpoint using static anycast IP addresses. It improves availability and performance by avoiding the public internet.

Question 23

What is the difference between CloudFront and Global Accelerator?

Accepted Answer

CloudFront is a CDN that caches content at edge locations best for static assets and HTTP(S). Global Accelerator routes TCP/UDP traffic over the AWS backbone to application endpoints best for dynamic, latency-sensitive, or non-HTTP workloads.

Question 24

What is AWS Backup?

Accepted Answer

AWS Backup is a fully managed, centralized backup service for AWS resources (EC2, EBS, RDS, DynamoDB, EFS, S3). You define backup plans with schedules and retention policies, and AWS handles execution and storage.

Question 25

What is an EBS snapshot?

Accepted Answer

An EBS snapshot is a point-in-time backup of an EBS volume stored in S3. Snapshots are incremental only changed blocks since the last snapshot are stored. They can be used to create new volumes or replicate data across regions.

Question 26

What is EC2 instance store?

Accepted Answer

Instance store provides temporary block storage physically attached to the host server. It delivers very high IOPS but is ephemeral data is lost when the instance stops, hibernates, or terminates. Not suitable for persistent data.

Question 27

What is Amazon ElastiCache and when should you use it?

Accepted Answer

ElastiCache is a managed in-memory caching service (Redis or Memcached). Use it to cache database query results, session data, or frequently read objects to reduce latency from milliseconds to microseconds and decrease database load.

Question 28

What is the difference between ElastiCache Redis and Memcached?

Accepted Answer

Redis supports persistence, replication, pub/sub, sorted sets, and Multi-AZ with automatic failover suited for complex data structures and durability. Memcached is simpler, multi-threaded, and suited for pure horizontal caching with no persistence needed.

Question 29

What is Amazon DynamoDB and when is it the right choice?

Accepted Answer

DynamoDB is a fully managed, serverless NoSQL key-value/document database delivering single-digit millisecond performance at any scale. Choose it for high-traffic applications with simple key-based access patterns, gaming leaderboards, IoT, and session stores.

Question 30

What is DynamoDB DAX?

Accepted Answer

DAX (DynamoDB Accelerator) is an in-memory cache for DynamoDB that delivers microsecond read latency. It is fully compatible with DynamoDB APIs and requires no application code changes. Ideal for read-heavy workloads.

Question 31

What is DynamoDB Global Tables?

Accepted Answer

DynamoDB Global Tables is a fully managed, multi-region, multi-active replication solution. Any write in any region is replicated to all other regions within seconds, enabling low-latency reads and writes for global applications.

Question 32

What is Amazon Redshift?

Accepted Answer

Amazon Redshift is a fully managed petabyte-scale data warehouse. It uses columnar storage and massively parallel processing (MPP) to run complex analytical queries fast. It integrates with S3, Glue, and QuickSight for analytics pipelines.

Question 33

What is Amazon Athena?

Accepted Answer

Amazon Athena is a serverless interactive query service for analyzing data in S3 using standard SQL. No infrastructure to manage you pay per query scanned. Ideal for ad-hoc analysis on data lakes.

Question 34

What is Amazon Kinesis Data Streams?

Accepted Answer

Kinesis Data Streams is a real-time data streaming service for ingesting large volumes of data (logs, clickstreams, IoT telemetry). Consumers process records in real time. Data is retained for up to 365 days.

Question 35

What is Amazon Kinesis Data Firehose?

Accepted Answer

Kinesis Data Firehose is the easiest way to reliably load streaming data into data stores like S3, Redshift, OpenSearch, and Splunk. It is fully managed, auto-scales, and can transform data with Lambda before delivery.

Question 36

What is the difference between Kinesis Data Streams and Firehose?

Accepted Answer

Data Streams is for real-time processing where you write custom consumer applications (low latency, ~70ms). Firehose is for near-real-time delivery to storage destinations with no consumer code needed (~60s buffer). Streams is more flexible; Firehose is simpler.

Question 37

What is Amazon CloudFront and how does it improve performance?

Accepted Answer

CloudFront is a global CDN that caches static and dynamic content at 450+ edge locations. It reduces latency by serving content from the nearest edge, decreases origin load, and supports HTTPS, compression, and Lambda@Edge.

Question 38

What is Lambda@Edge?

Accepted Answer

Lambda@Edge lets you run Lambda functions at CloudFront edge locations in response to viewer/origin requests and responses. It enables content personalization, A/B testing, authentication, and URL rewrites without round-tripping to the origin.

Question 39

What is Amazon EFS performance modes?

Accepted Answer

EFS offers two performance modes: General Purpose low latency, ideal for web serving and CMS (default). Max I/O higher throughput and IOPS for parallelized workloads like big data and media processing, with slightly higher latency.

Question 40

What are EBS volume types and their use cases?

Accepted Answer

gp3/gp2 General Purpose SSD, balanced price/performance, boot volumes. io2/io1 Provisioned IOPS SSD, high-performance databases requiring consistent IOPS. st1 Throughput Optimized HDD, big data, data warehouses, log processing. sc1 Cold HDD, lowest cost, infrequently accessed data.

Question 41

What is Amazon S3 Transfer Acceleration?

Accepted Answer

S3 Transfer Acceleration speeds up uploads to S3 by routing data through CloudFront edge locations over the optimized AWS backbone, rather than the public internet. Best for transfers over long distances.

Question 42

What is AWS DataSync?

Accepted Answer

AWS DataSync is a managed data transfer service for moving large amounts of data between on-premises storage and AWS (S3, EFS, FSx) or between AWS services. It automates and accelerates transfers, handling scheduling, monitoring, and encryption.

Question 43

What is Amazon FSx?

Accepted Answer

Amazon FSx provides fully managed third-party file systems: FSx for Windows File Server SMB-based, integrates with Active Directory. FSx for Lustre high-performance parallel file system for HPC and ML, integrates with S3. FSx for NetApp ONTAP enterprise NAS with multi-protocol support. FSx for OpenZFS ZFS-based, low-latency workloads.

Question 44

What is read replica cross-region for RDS?

Accepted Answer

You can create RDS Read Replicas in a different AWS Region. This reduces read latency for globally distributed users and can serve as a disaster recovery target the cross-region replica can be promoted to a standalone DB if the primary region fails.

Question 45

What is connection pooling and how does RDS Proxy help?

Accepted Answer

RDS Proxy manages a pool of database connections, allowing many application clients to share fewer actual database connections. It reduces the overhead of constantly opening/closing connections, improving scalability and reducing failover time for Lambda and ECS workloads.

Question 46

What is Amazon SQS long polling?

Accepted Answer

Long polling reduces the number of empty responses by making SQS wait (up to 20 seconds) for a message to arrive before returning an empty response. It lowers costs and reduces CPU usage compared to short polling.

Question 47

What is Amazon MQ?

Accepted Answer

Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ. Use it when migrating existing applications that use standard messaging protocols (AMQP, MQTT, STOMP, OpenWire) and cannot be re-architected to use SQS/SNS.

Question 48

What is AWS Step Functions?

Accepted Answer

AWS Step Functions is a serverless workflow orchestration service. It coordinates multiple AWS services into visual state machines, handling retries, error catching, parallel execution, and conditional branching without custom coordination code.

Question 49

What is Amazon OpenSearch Service?

Accepted Answer

Amazon OpenSearch Service (formerly Elasticsearch) is a managed search and analytics engine. It is used for log analytics, full-text search, real-time application monitoring, and clickstream analysis, often fed by Kinesis or CloudWatch Logs.

Question 50

What is the IAM policy evaluation logic?

Accepted Answer

AWS evaluates IAM policies in this order: 1. Explicit Deny always wins, regardless of any allow. 2. Explicit Allow grants access if no deny exists. 3. Default Deny all actions are denied by default unless explicitly allowed. An explicit deny in any attached policy overrides any allow.

Question 51

What is an IAM Permission Boundary?

Accepted Answer

A Permission Boundary is a managed policy that sets the maximum permissions an IAM user or role can have. Even if broader permissions are granted via identity policies, the boundary caps what is actually allowed. Used to delegate permission management safely.

Question 52

What is AWS STS (Security Token Service)?

Accepted Answer

AWS STS issues temporary, limited-privilege credentials for IAM users or federated identities. Common use cases include cross-account access, identity federation (SAML, web identity), and assuming roles from EC2 or Lambda.

Question 53

What is IAM federation?

Accepted Answer

IAM federation allows users authenticated by an external identity provider (corporate AD, Okta, Google) to access AWS resources without creating IAM users. AWS supports SAML 2.0 and web identity federation (OAuth/OIDC).

Question 54

What is AWS Cognito and its two main components?

Accepted Answer

Amazon Cognito provides identity management for apps: User Pools user directories for authentication (sign-up, sign-in, MFA). Identity Pools grant authenticated/unauthenticated users temporary AWS credentials to access AWS services directly.

Question 55

What is an S3 bucket policy vs ACL?

Accepted Answer

A bucket policy is a JSON resource-based policy attached to an S3 bucket defining access for AWS accounts, IAM principals, or anonymous users recommended for most use cases. ACLs are legacy per-object or per-bucket access controls; AWS now recommends disabling ACLs and using bucket policies and IAM.

Question 56

What is S3 Block Public Access?

Accepted Answer

S3 Block Public Access is a set of settings (at account or bucket level) that prevent S3 buckets from being made publicly accessible. It overrides bucket policies and ACLs, providing a safety net against accidental public exposure.

Question 57

What is S3 Object Lock?

Accepted Answer

S3 Object Lock prevents objects from being deleted or overwritten for a fixed period or indefinitely. It supports WORM (Write Once, Read Many) compliance. Modes include Governance (users with special permissions can override) and Compliance (no one, including root, can override).

Question 58

What is server-side encryption in S3?

Accepted Answer

S3 supports three SSE options: SSE-S3 AWS manages keys using AES-256. SSE-KMS keys managed in AWS KMS, with audit trail and key rotation. SSE-C customer provides and manages the encryption keys.

Question 59

What is AWS KMS and key rotation?

Accepted Answer

AWS KMS manages encryption keys used across AWS services. Automatic key rotation can be enabled for customer-managed keys AWS generates a new key version annually while keeping old versions available to decrypt existing data.

Question 60

What is AWS Secrets Manager?

Accepted Answer

AWS Secrets Manager stores, rotates, and retrieves secrets (database passwords, API keys) programmatically. It integrates with RDS to automatically rotate credentials without manual intervention or application downtime.

Question 61

What is the difference between Secrets Manager and SSM Parameter Store?

Accepted Answer

Secrets Manager is purpose-built for secrets with automatic rotation and costs ~$0.40/secret/month. SSM Parameter Store is a configuration store that also supports secrets (SecureString) at lower cost but without native automatic rotation. Use Secrets Manager for credentials requiring rotation.

Question 62

What is a VPC Security Group vs NACL?

Accepted Answer

Security Group stateful, instance-level firewall. Return traffic is automatically allowed. Only allow rules. NACL (Network ACL) stateless, subnet-level firewall. Return traffic must be explicitly allowed. Supports both allow and deny rules, evaluated in order.

Question 63

What is a VPC Flow Log?

Accepted Answer

VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC. They can be published to CloudWatch Logs or S3, and are used for security analysis, troubleshooting, and compliance.

Question 64

What is AWS PrivateLink?

Accepted Answer

AWS PrivateLink provides private connectivity between VPCs and AWS services (or your own services) without traffic traversing the public internet. It uses VPC Endpoints Interface Endpoints (ENI-based) for most services and Gateway Endpoints for S3 and DynamoDB.

AWS Solutions Architect Associate Flashcards (SAA-C03)

You might also enjoy

AWS Certified Developer Associate Flashcards (DVA-C02)

AWS Cloud Practitioner Flashcards (CLF-C02)

AWS SysOps Administrator Associate Flashcards (SOA-C02)

AWS Beginner Flashcards

LPIC-2 Linux Engineer Flashcards

Red Hat System Administration I Flashcards (RH124)