--- title: "AWS Solutions Architect Associate Flashcards (SAA-C03)" description: "Full exam coverage for the AWS Certified Solutions Architect – Associate (SAA-C03) exam. Covers all four domains Resilient, High-Performing, Secure, and Cost-Optimized Architectures." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/aws-solutions-architect-associate-flashcards --- # AWS Solutions Architect Associate Flashcards (SAA-C03) ## Flashcards ### 1. What is a Multi-AZ deployment in RDS? Multi-AZ creates a synchronous standby replica in a different Availability Zone. If the primary fails, RDS automatically fails over to the standby with minimal downtime. Multi-AZ is for high availability, not read scaling. ### 2. What is an RDS Read Replica? An RDS Read Replica is an asynchronous copy of the primary database used to offload read traffic. Unlike Multi-AZ, it is not for failover it improves read performance and can be promoted to a standalone instance if needed. ### 3. What is the difference between RDS Multi-AZ and Read Replicas? Multi-AZ provides synchronous replication for automatic failover and high availability. Read Replicas use asynchronous replication for read scaling. Multi-AZ standby cannot serve read traffic; Read Replicas can. ### 4. What is Amazon Aurora? Amazon Aurora is a MySQL/PostgreSQL-compatible relational database built for the cloud. It replicates data 6 ways across 3 AZs, supports up to 15 read replicas, and provides automatic failover in under 30 seconds. ### 5. What is Aurora Serverless? Aurora Serverless automatically starts, scales, and shuts down capacity based on application demand. It is ideal for infrequent, intermittent, or unpredictable workloads where you want to avoid managing database instances. ### 6. What is Amazon S3 Cross-Region Replication (CRR)? CRR automatically replicates objects from an S3 bucket in one region to a bucket in another region. It requires versioning enabled on both buckets and is used for compliance, lower latency access, and disaster recovery. ### 7. What is S3 Versioning? S3 Versioning keeps multiple variants of an object in the same bucket. Once enabled, every overwrite or delete creates a new version rather than destroying the previous one, enabling recovery from accidental deletions or overwrites. ### 8. What is Amazon S3 MFA Delete? MFA Delete requires an additional authentication factor to permanently delete object versions or suspend versioning on an S3 bucket. It adds a strong layer of protection against accidental or malicious deletion. ### 9. What is an S3 Lifecycle Policy? An S3 Lifecycle Policy automates transitioning objects between storage classes (e.g., Standard → Glacier) or expiring them after a defined period. It reduces storage costs without manual intervention. ### 10. What is Elastic Load Balancing (ELB)? ELB automatically distributes incoming traffic across multiple targets in one or more AZs. It decouples clients from individual instances, enabling fault tolerance and seamless scaling. Types include ALB, NLB, and GLB. ### 11. What is the difference between ALB, NLB, and GLB? ALB (Application Load Balancer) Layer 7, HTTP/HTTPS, path/host-based routing, best for web apps. NLB (Network Load Balancer) Layer 4, TCP/UDP, ultra-low latency, static IP support. GLB (Gateway Load Balancer) Layer 3, routes traffic to third-party virtual appliances (firewalls, IDS/IPS). ### 12. What is Auto Scaling and what are its components? AWS Auto Scaling adjusts EC2 capacity automatically. Key components: Launch Template defines instance configuration. Auto Scaling Group (ASG) manages the fleet with min, max, and desired capacity. Scaling Policies define when and how to scale (target tracking, step, scheduled). ### 13. What is a target tracking scaling policy? Target tracking automatically adjusts capacity to keep a specific metric (e.g., average CPU at 50%) at a target value. It is the simplest and recommended scaling policy, similar to a thermostat. ### 14. What is a step scaling policy? Step scaling adjusts capacity in steps based on the magnitude of a CloudWatch alarm breach. For example, add 2 instances if CPU > 70%, add 4 if CPU > 90%. It gives more control than target tracking. ### 15. What is a scheduled scaling action? Scheduled scaling pre-emptively changes the min/max/desired capacity of an ASG at a specific time. It is useful for predictable load patterns, such as scaling up before business hours or a known traffic event. ### 16. What is an EC2 placement group? Placement groups control how EC2 instances are physically placed: Cluster packs instances in a single AZ for low latency, high throughput (HPC). Spread each instance on distinct hardware, max 7 per AZ, for critical instances. Partition instances in partitions on separate racks, for large distributed systems (Hadoop, Kafka). ### 17. What is Amazon SQS and how does it aid resilience? SQS is a managed message queue that decouples producers and consumers. If a consumer fails, messages remain in the queue until processed. This prevents data loss and allows components to scale independently. ### 18. What is SQS visibility timeout? When a consumer picks up a message, it becomes invisible to other consumers for the visibility timeout period. If not deleted within that time, it reappears for reprocessing. This prevents duplicate processing while allowing retry on failure. ### 19. What is an SQS Dead Letter Queue (DLQ)? A DLQ is a separate SQS queue where messages that fail processing a configured number of times (maxReceiveCount) are moved. It isolates problem messages for debugging without blocking the main queue. ### 20. What is Amazon Route 53 failover routing? Failover routing directs traffic to a primary resource when it is healthy and automatically switches to a secondary (standby) resource when the primary fails a health check. It enables DNS-based disaster recovery. ### 21. What are Route 53 routing policies? Simple single resource, no health checks. Weighted split traffic by percentage across resources. Latency route to the region with lowest latency. Failover active/passive disaster recovery. Geolocation route based on user's geographic location. Geoproximity route based on geographic distance with bias. Multivalue Answer return multiple healthy records. ### 22. What is AWS Global Accelerator? AWS Global Accelerator routes user traffic through the AWS global network to the nearest healthy endpoint using static anycast IP addresses. It improves availability and performance by avoiding the public internet. ### 23. What is the difference between CloudFront and Global Accelerator? CloudFront is a CDN that caches content at edge locations best for static assets and HTTP(S). Global Accelerator routes TCP/UDP traffic over the AWS backbone to application endpoints best for dynamic, latency-sensitive, or non-HTTP workloads. ### 24. What is AWS Backup? AWS Backup is a fully managed, centralized backup service for AWS resources (EC2, EBS, RDS, DynamoDB, EFS, S3). You define backup plans with schedules and retention policies, and AWS handles execution and storage. ### 25. What is an EBS snapshot? An EBS snapshot is a point-in-time backup of an EBS volume stored in S3. Snapshots are incremental only changed blocks since the last snapshot are stored. They can be used to create new volumes or replicate data across regions. ### 26. What is EC2 instance store? Instance store provides temporary block storage physically attached to the host server. It delivers very high IOPS but is ephemeral data is lost when the instance stops, hibernates, or terminates. Not suitable for persistent data. ### 27. What is Amazon ElastiCache and when should you use it? ElastiCache is a managed in-memory caching service (Redis or Memcached). Use it to cache database query results, session data, or frequently read objects to reduce latency from milliseconds to microseconds and decrease database load. ### 28. What is the difference between ElastiCache Redis and Memcached? Redis supports persistence, replication, pub/sub, sorted sets, and Multi-AZ with automatic failover suited for complex data structures and durability. Memcached is simpler, multi-threaded, and suited for pure horizontal caching with no persistence needed. ### 29. What is Amazon DynamoDB and when is it the right choice? DynamoDB is a fully managed, serverless NoSQL key-value/document database delivering single-digit millisecond performance at any scale. Choose it for high-traffic applications with simple key-based access patterns, gaming leaderboards, IoT, and session stores. ### 30. What is DynamoDB DAX? DAX (DynamoDB Accelerator) is an in-memory cache for DynamoDB that delivers microsecond read latency. It is fully compatible with DynamoDB APIs and requires no application code changes. Ideal for read-heavy workloads. ### 31. What is DynamoDB Global Tables? DynamoDB Global Tables is a fully managed, multi-region, multi-active replication solution. Any write in any region is replicated to all other regions within seconds, enabling low-latency reads and writes for global applications. ### 32. What is Amazon Redshift? Amazon Redshift is a fully managed petabyte-scale data warehouse. It uses columnar storage and massively parallel processing (MPP) to run complex analytical queries fast. It integrates with S3, Glue, and QuickSight for analytics pipelines. ### 33. What is Amazon Athena? Amazon Athena is a serverless interactive query service for analyzing data in S3 using standard SQL. No infrastructure to manage you pay per query scanned. Ideal for ad-hoc analysis on data lakes. ### 34. What is Amazon Kinesis Data Streams? Kinesis Data Streams is a real-time data streaming service for ingesting large volumes of data (logs, clickstreams, IoT telemetry). Consumers process records in real time. Data is retained for up to 365 days. ### 35. What is Amazon Kinesis Data Firehose? Kinesis Data Firehose is the easiest way to reliably load streaming data into data stores like S3, Redshift, OpenSearch, and Splunk. It is fully managed, auto-scales, and can transform data with Lambda before delivery. ### 36. What is the difference between Kinesis Data Streams and Firehose? Data Streams is for real-time processing where you write custom consumer applications (low latency, ~70ms). Firehose is for near-real-time delivery to storage destinations with no consumer code needed (~60s buffer). Streams is more flexible; Firehose is simpler. ### 37. What is Amazon CloudFront and how does it improve performance? CloudFront is a global CDN that caches static and dynamic content at 450+ edge locations. It reduces latency by serving content from the nearest edge, decreases origin load, and supports HTTPS, compression, and Lambda@Edge. ### 38. What is Lambda@Edge? Lambda@Edge lets you run Lambda functions at CloudFront edge locations in response to viewer/origin requests and responses. It enables content personalization, A/B testing, authentication, and URL rewrites without round-tripping to the origin. ### 39. What is Amazon EFS performance modes? EFS offers two performance modes: General Purpose low latency, ideal for web serving and CMS (default). Max I/O higher throughput and IOPS for parallelized workloads like big data and media processing, with slightly higher latency. ### 40. What are EBS volume types and their use cases? gp3/gp2 General Purpose SSD, balanced price/performance, boot volumes. io2/io1 Provisioned IOPS SSD, high-performance databases requiring consistent IOPS. st1 Throughput Optimized HDD, big data, data warehouses, log processing. sc1 Cold HDD, lowest cost, infrequently accessed data. ### 41. What is Amazon S3 Transfer Acceleration? S3 Transfer Acceleration speeds up uploads to S3 by routing data through CloudFront edge locations over the optimized AWS backbone, rather than the public internet. Best for transfers over long distances. ### 42. What is AWS DataSync? AWS DataSync is a managed data transfer service for moving large amounts of data between on-premises storage and AWS (S3, EFS, FSx) or between AWS services. It automates and accelerates transfers, handling scheduling, monitoring, and encryption. ### 43. What is Amazon FSx? Amazon FSx provides fully managed third-party file systems: FSx for Windows File Server SMB-based, integrates with Active Directory. FSx for Lustre high-performance parallel file system for HPC and ML, integrates with S3. FSx for NetApp ONTAP enterprise NAS with multi-protocol support. FSx for OpenZFS ZFS-based, low-latency workloads. ### 44. What is read replica cross-region for RDS? You can create RDS Read Replicas in a different AWS Region. This reduces read latency for globally distributed users and can serve as a disaster recovery target the cross-region replica can be promoted to a standalone DB if the primary region fails. ### 45. What is connection pooling and how does RDS Proxy help? RDS Proxy manages a pool of database connections, allowing many application clients to share fewer actual database connections. It reduces the overhead of constantly opening/closing connections, improving scalability and reducing failover time for Lambda and ECS workloads. ### 46. What is Amazon SQS long polling? Long polling reduces the number of empty responses by making SQS wait (up to 20 seconds) for a message to arrive before returning an empty response. It lowers costs and reduces CPU usage compared to short polling. ### 47. What is Amazon MQ? Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ. Use it when migrating existing applications that use standard messaging protocols (AMQP, MQTT, STOMP, OpenWire) and cannot be re-architected to use SQS/SNS. ### 48. What is AWS Step Functions? AWS Step Functions is a serverless workflow orchestration service. It coordinates multiple AWS services into visual state machines, handling retries, error catching, parallel execution, and conditional branching without custom coordination code. ### 49. What is Amazon OpenSearch Service? Amazon OpenSearch Service (formerly Elasticsearch) is a managed search and analytics engine. It is used for log analytics, full-text search, real-time application monitoring, and clickstream analysis, often fed by Kinesis or CloudWatch Logs. ### 50. What is the IAM policy evaluation logic? AWS evaluates IAM policies in this order: 1. Explicit Deny always wins, regardless of any allow. 2. Explicit Allow grants access if no deny exists. 3. Default Deny all actions are denied by default unless explicitly allowed. An explicit deny in any attached policy overrides any allow. ### 51. What is an IAM Permission Boundary? A Permission Boundary is a managed policy that sets the maximum permissions an IAM user or role can have. Even if broader permissions are granted via identity policies, the boundary caps what is actually allowed. Used to delegate permission management safely. ### 52. What is AWS STS (Security Token Service)? AWS STS issues temporary, limited-privilege credentials for IAM users or federated identities. Common use cases include cross-account access, identity federation (SAML, web identity), and assuming roles from EC2 or Lambda. ### 53. What is IAM federation? IAM federation allows users authenticated by an external identity provider (corporate AD, Okta, Google) to access AWS resources without creating IAM users. AWS supports SAML 2.0 and web identity federation (OAuth/OIDC). ### 54. What is AWS Cognito and its two main components? Amazon Cognito provides identity management for apps: User Pools user directories for authentication (sign-up, sign-in, MFA). Identity Pools grant authenticated/unauthenticated users temporary AWS credentials to access AWS services directly. ### 55. What is an S3 bucket policy vs ACL? A bucket policy is a JSON resource-based policy attached to an S3 bucket defining access for AWS accounts, IAM principals, or anonymous users recommended for most use cases. ACLs are legacy per-object or per-bucket access controls; AWS now recommends disabling ACLs and using bucket policies and IAM. ### 56. What is S3 Block Public Access? S3 Block Public Access is a set of settings (at account or bucket level) that prevent S3 buckets from being made publicly accessible. It overrides bucket policies and ACLs, providing a safety net against accidental public exposure. ### 57. What is S3 Object Lock? S3 Object Lock prevents objects from being deleted or overwritten for a fixed period or indefinitely. It supports WORM (Write Once, Read Many) compliance. Modes include Governance (users with special permissions can override) and Compliance (no one, including root, can override). ### 58. What is server-side encryption in S3? S3 supports three SSE options: SSE-S3 AWS manages keys using AES-256. SSE-KMS keys managed in AWS KMS, with audit trail and key rotation. SSE-C customer provides and manages the encryption keys. ### 59. What is AWS KMS and key rotation? AWS KMS manages encryption keys used across AWS services. Automatic key rotation can be enabled for customer-managed keys AWS generates a new key version annually while keeping old versions available to decrypt existing data. ### 60. What is AWS Secrets Manager? AWS Secrets Manager stores, rotates, and retrieves secrets (database passwords, API keys) programmatically. It integrates with RDS to automatically rotate credentials without manual intervention or application downtime. ### 61. What is the difference between Secrets Manager and SSM Parameter Store? Secrets Manager is purpose-built for secrets with automatic rotation and costs ~$0.40/secret/month. SSM Parameter Store is a configuration store that also supports secrets (SecureString) at lower cost but without native automatic rotation. Use Secrets Manager for credentials requiring rotation. ### 62. What is a VPC Security Group vs NACL? Security Group stateful, instance-level firewall. Return traffic is automatically allowed. Only allow rules. NACL (Network ACL) stateless, subnet-level firewall. Return traffic must be explicitly allowed. Supports both allow and deny rules, evaluated in order. ### 63. What is a VPC Flow Log? VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC. They can be published to CloudWatch Logs or S3, and are used for security analysis, troubleshooting, and compliance. ### 64. What is AWS PrivateLink? AWS PrivateLink provides private connectivity between VPCs and AWS services (or your own services) without traffic traversing the public internet. It uses VPC Endpoints Interface Endpoints (ENI-based) for most services and Gateway Endpoints for S3 and DynamoDB. ### 65. What is a VPC Gateway Endpoint vs Interface Endpoint? A Gateway Endpoint is a target in a route table for traffic to S3 or DynamoDB free to use, no ENI. An Interface Endpoint creates a private ENI in your subnet for other AWS services incurs hourly and data transfer charges but works with on-premises traffic via Direct Connect/VPN. ### 66. What is VPC Peering? VPC Peering connects two VPCs so instances in each can communicate as if on the same network. It is not transitive if VPC A peers with B and B peers with C, A cannot reach C through B without a direct peer. ### 67. What is AWS Transit Gateway? AWS Transit Gateway is a hub-and-spoke network transit service connecting VPCs and on-premises networks through a central hub. It replaces complex VPC peering meshes and supports thousands of VPCs, transitive routing, and multicast. ### 68. What is AWS WAF? AWS WAF is a web application firewall that filters HTTP(S) traffic to CloudFront, ALB, API Gateway, and AppSync. You create rules to block common threats like SQL injection, XSS, rate-based attacks, and IP-based blocks. ### 69. What is AWS Shield Advanced? AWS Shield Advanced provides enhanced DDoS protection, 24/7 access to the AWS DDoS Response Team (DRT), cost protection for DDoS-related scaling charges, and advanced attack diagnostics for EC2, ELB, CloudFront, and Route 53. ### 70. What is Amazon GuardDuty? GuardDuty is a managed threat detection service that continuously analyzes CloudTrail events, VPC Flow Logs, and DNS logs using ML to identify suspicious activity like unusual API calls, cryptocurrency mining, or compromised instances. ### 71. What is AWS Security Hub? Security Hub aggregates and prioritizes security findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools into a centralized dashboard, providing a unified view across multiple AWS accounts. ### 72. What is Amazon Macie? Macie uses machine learning to automatically discover and protect sensitive data (PII, financial data, credentials) stored in S3. It generates findings when sensitive data is found in publicly accessible or unencrypted buckets. ### 73. What is AWS Certificate Manager (ACM)? ACM provisions, manages, and deploys public and private SSL/TLS certificates for use with AWS services like CloudFront, ALB, and API Gateway. Public certificates are free, and ACM handles automatic renewal. ### 74. What is encryption in transit for AWS services? Encryption in transit protects data as it moves between clients and AWS services using TLS. You enforce HTTPS on ALB listeners, API Gateway, and CloudFront. For databases, you enable SSL/TLS connections. Data in transit between AWS services within a region is encrypted by default on AWS backbone. ### 75. What are EC2 Spot Instances and when should you use them? Spot Instances use spare EC2 capacity at up to 90% discount. AWS can reclaim them with a 2-minute warning. Use them for fault-tolerant, stateless, or checkpointable workloads batch jobs, data processing, CI/CD workers, and HPC. ### 76. What is an EC2 Spot Fleet? A Spot Fleet is a collection of Spot Instances (and optionally On-Demand instances) that meets a target capacity. It selects from multiple instance types and AZs to maximize availability and minimize cost, automatically replacing interrupted instances. ### 77. What is an EC2 Reserved Instance vs Savings Plan? Reserved Instances commit to a specific instance type and region for 1 or 3 years (up to 72% savings). Savings Plans commit to a $/hour spend across any instance type/region (Compute Savings Plans) for similar savings with more flexibility. ### 78. What is an EC2 Convertible Reserved Instance? A Convertible RI allows you to exchange for a different instance type, OS, or tenancy during the term. It offers less discount than Standard RIs (~54% vs ~72%) but provides flexibility if your compute needs change. ### 79. What is S3 Intelligent-Tiering? S3 Intelligent-Tiering automatically moves objects between access tiers (Frequent, Infrequent, Archive) based on changing access patterns, with no retrieval fees and no performance impact. It is ideal when access patterns are unknown or unpredictable. ### 80. What is S3 cost optimization strategy? Key strategies: Use Lifecycle Policies to move cold data to cheaper tiers (IA, Glacier). Enable Intelligent-Tiering for unpredictable access. Use S3 Inventory to identify large/redundant objects. Delete incomplete multipart uploads. Avoid inter-region data transfer where possible. ### 81. What is AWS Cost Explorer? Cost Explorer visualizes, understands, and forecasts AWS spending. It offers built-in reports by service, tag, or account, and provides Reserved Instance and Savings Plan recommendations based on past usage. ### 82. What are AWS Budgets? AWS Budgets allows you to set custom cost, usage, and reservation budgets with alerts when thresholds are breached or forecasted to be exceeded. You can also use Budget Actions to automatically apply IAM policies or stop EC2/RDS instances. ### 83. What is AWS Compute Optimizer? AWS Compute Optimizer uses ML to analyze utilization metrics and recommend optimal AWS resource configurations (EC2 instance types, EBS volumes, Lambda memory) to reduce cost and improve performance. ### 84. What is rightsizing in AWS? Rightsizing means selecting the most cost-effective EC2 instance type and size that meets your workload requirements. Compute Optimizer and Cost Explorer both provide rightsizing recommendations based on actual CloudWatch utilization data. ### 85. What is the benefit of using Lambda for cost optimization? Lambda charges only for execution time (per millisecond) and number of requests, with no charge when idle. For spiky or infrequent workloads, it is far cheaper than running EC2 instances 24/7. The 1 million requests/month free tier makes it nearly free for low-traffic functions. ### 86. What is AWS Fargate cost model vs EC2? Fargate charges for vCPU and memory per second no idle capacity cost. EC2-backed ECS requires you to pay for running instances whether or not containers are using them. Fargate is cost-efficient for variable or unpredictable container workloads; EC2 is cheaper for steady, high-utilization workloads. ### 87. What is data transfer cost optimization in AWS? Key strategies: Use CloudFront to reduce origin data transfer costs. Keep traffic within the same AZ/region where possible. Use VPC Endpoints (Gateway) for S3/DynamoDB to avoid NAT Gateway charges. Use Direct Connect for high-volume on-premises to AWS transfers. Choose S3 storage classes to minimize retrieval costs. ### 88. What is NAT Gateway cost and how to reduce it? NAT Gateway charges per hour and per GB processed. To reduce costs use VPC Gateway Endpoints for S3 and DynamoDB (free), consolidate NAT Gateways per AZ, and evaluate whether workloads in private subnets truly need internet access. ### 89. What is AWS Trusted Advisor for cost optimization? Trusted Advisor's cost optimization checks identify idle EC2 instances, underutilized EBS volumes, unassociated Elastic IPs, low-utilization Reserved Instances, and over-provisioned resources. Full checks require Business or Enterprise support. ### 90. What is a serverless architecture on AWS? A serverless architecture uses managed services where AWS handles capacity, patching, and scaling. Typical stack API Gateway (front door) → Lambda (compute) → DynamoDB (database) → S3 (storage) → SNS/SQS (messaging). You pay only for actual usage. ### 91. What is the strangler fig pattern? The strangler fig pattern incrementally migrates a monolithic application to microservices by routing specific functionality to new services one piece at a time, while the monolith continues to handle everything else. It reduces migration risk compared to a big-bang rewrite. ### 92. What is a blue/green deployment? Blue/green deployment runs two identical environments blue (current) and green (new). Traffic is shifted to green after testing. If issues arise, you instantly roll back by switching traffic back to blue. AWS CodeDeploy, Elastic Beanstalk, and Route 53 support this pattern. ### 93. What is a canary deployment? A canary deployment gradually shifts a small percentage of traffic to a new version (e.g., 5%) while the rest goes to the old version. It validates the new version with real traffic before a full rollout, minimizing blast radius. ### 94. What is event-driven architecture on AWS? Event-driven architecture decouples services using events. A producer emits an event to EventBridge, SNS, or SQS; consumers react independently. This improves scalability, resilience, and loose coupling components can evolve or fail without affecting others. ### 95. What is the CQRS pattern? CQRS (Command Query Responsibility Segregation) separates read and write operations into different models. On AWS writes go to RDS or DynamoDB (command), and data is asynchronously replicated to a read-optimized store like ElastiCache or Elasticsearch (query), improving performance and scalability. ### 96. What is the saga pattern? The saga pattern manages distributed transactions across microservices by splitting them into a sequence of local transactions, each publishing events or messages to trigger the next step. AWS Step Functions is commonly used to orchestrate sagas with built-in error handling and compensation. ### 97. What is Amazon EventBridge? Amazon EventBridge is a serverless event bus for building event-driven applications. It routes events from AWS services, SaaS apps, and custom sources to targets like Lambda, SQS, Step Functions, and API Gateway based on rules. ### 98. What is AWS AppSync? AWS AppSync is a managed GraphQL API service. It connects to DynamoDB, Lambda, RDS, HTTP APIs, and other data sources. It supports real-time data with subscriptions and offline sync for mobile apps. ### 99. What is Amazon API Gateway and its endpoint types? API Gateway manages REST, HTTP, and WebSocket APIs. Edge-Optimized routed through CloudFront, best for globally distributed clients. Regional deployed in a specific region, best for same-region clients or custom CloudFront setups. Private accessible only within a VPC via Interface Endpoint. ### 100. What is AWS CloudFormation StackSets? CloudFormation StackSets extend stacks to multiple AWS accounts and regions with a single operation. They are used to deploy baseline infrastructure (IAM roles, GuardDuty, CloudTrail) consistently across an entire AWS Organization. ### 101. What is AWS Service Catalog? AWS Service Catalog lets organizations create and manage approved CloudFormation-based product portfolios. Users can self-provision only from pre-approved, compliant templates, enforcing governance without blocking agility. ### 102. What is Amazon EKS? Amazon EKS (Elastic Kubernetes Service) is a managed Kubernetes service. AWS manages the control plane; you manage worker nodes (EC2 or Fargate). It integrates with IAM, VPC, ELB, and ECR for production-grade Kubernetes deployments. ### 103. What is Amazon ECR? Amazon ECR (Elastic Container Registry) is a fully managed Docker container image registry. It integrates with ECS, EKS, and Lambda. Images are stored in private repositories, encrypted at rest with KMS, and scanned for vulnerabilities. ### 104. What is AWS Outposts? AWS Outposts brings AWS infrastructure, services, and APIs to on-premises data centers. It allows you to run EC2, ECS, RDS, S3, and other services locally while connecting to the AWS Region for management and additional services. ### 105. What is AWS Local Zones? AWS Local Zones extend AWS infrastructure to metro areas closer to large populations, providing single-digit millisecond latency for workloads that need to be near end users (media rendering, gaming, real-time applications) while remaining managed by AWS. ### 106. What is AWS Wavelength? AWS Wavelength embeds AWS compute and storage at the edge of 5G networks inside telecom providers' data centers. It enables ultra-low latency applications (AR/VR, connected vehicles, real-time gaming) by keeping traffic within the 5G network. ### 107. What is Amazon CloudWatch Logs Insights? CloudWatch Logs Insights is an interactive log analytics service. You write SQL-like queries to search and analyze log data across log groups in near real time, making it easy to troubleshoot operational issues and identify trends. ### 108. What is AWS X-Ray? AWS X-Ray helps developers analyze and debug distributed applications. It traces requests as they travel through microservices, identifying performance bottlenecks, errors, and throttling. It integrates with Lambda, ECS, EKS, and API Gateway. ### 109. What is infrastructure as code (IaC) and AWS tools for it? IaC manages infrastructure through machine-readable configuration files rather than manual processes. AWS tools include CloudFormation (declarative JSON/YAML), AWS CDK (code-first using TypeScript/Python), and Terraform (third-party, multi-cloud). ### 110. What is AWS CodePipeline? AWS CodePipeline is a fully managed CI/CD service that automates build, test, and deploy phases. It integrates with CodeCommit, CodeBuild, CodeDeploy, CloudFormation, and third-party tools like GitHub and Jenkins. ### 111. What is AWS CodeDeploy? AWS CodeDeploy automates application deployments to EC2, on-premises servers, Lambda, and ECS. It supports in-place and blue/green deployment strategies, with configurable rollback on failure. ### 112. What is AWS Systems Manager (SSM)? AWS Systems Manager provides a suite of tools for managing EC2 instances and on-premises servers patch management, parameter storage (Parameter Store), session management (no SSH needed), run commands, and automation. It requires the SSM Agent installed on instances.