AWS SysOps Administrator Associate - 2019

Begin the section by introducing the virtual private cloud and elastic compute cloud, review regions and availability zones, and cover VPC basics and troubleshooting from a system administrator perspective.

Learn how AWS regions and availability zones distribute data centers worldwide to optimize latency and enable failover by placing resources closer to users.

Understand how VPC and EC2 create isolated networks within the cloud, hosting resources in your account. See how regions map VPCs to data centers and enable connections to the internet.

Explore how a virtual private cloud uses subnets and CIDR blocks to assign private IP addresses to instances, enabling structured network design for web and database components.

An availability zone groups data centers within a region to provide fault isolation, while subnets map to zones so workloads stay available if a data center goes down.

Explore the components of a VPC, including Internet gateway, public and private IPs, and routing tables. Learn how a default VPC and subnet ease EC2 provisioning.

Explore how the default VPC automatically creates three subnets per region, plus an internet gateway, route table, security groups, and network access controls for quick testing.

Launch and manage virtual servers on the internet with the elastic compute cloud. On-demand billing lets you pay only for running servers and terminate them anytime, avoiding upfront capital investment.

Launch and configure an EC2 instance in the EU Frankfurt region, selecting an AMI, choosing an instance type, configuring a VPC, storage, tags, security group, and a key pair.

Understand EC2 key pairs by generating a public and private key, storing the public on the server, keeping the private key secure, and logging in with the correct username.

Connect to an EC2 instance by generating and saving the private key, log in from Windows to Ubuntu using that key and the public DNS or IP, and monitor health.

Learn practical EC2 instance operations, including stopping and starting to cut costs, reviewing system logs and boot diagnostics, and configuring networking and CloudWatch monitoring for the exam.

Learn the AWS instance types, including general-purpose, compute-optimized, memory-optimized, graphics-oriented, and storage-optimized, with guidance on workload choices, CPU and memory, SSD storage, and pricing considerations.

Security groups in AWS act as a firewall for EC2 instances, controlling inbound traffic with rules that specify ports and sources, with default deny.

Learn how security groups control inbound and outbound traffic by default denying access and requiring explicit rules to allow web traffic to an Apache server on a Ubuntu instance.

Understand how network access control lists serve as a subnet firewall with inbound and outbound rules, contrasting them with security groups and noting default deny and default allow behavior.

Explore how network access control lists attached to subnets regulate inbound and outbound traffic, evaluate rules in order, and block a specific IP to protect all resources in the subnet.

Demonstrates establishing EC2 communication between instances in different subnets of a VPC, enabling ICMP ping via security group rules and highlighting local routing through the VPC round table.

Create a custom VPC from scratch, configure DNS resolution and names, set up a subnet and internet gateway, modify routes, and launch an Ubuntu instance to verify connectivity.

Define private and public subnets with a web server in a public subnet accessible via an internet gateway, and a database in a private subnet controlled by routing tables.

learn to add a private subnet to a VPC, create and attach a private route table, and verify the private subnet lacks internet access while the public subnet remains internet-enabled.

Explore internal communication between EC2 instances in a VPC, using private and public subnets, and configure bastion hosts to securely administer private servers via a public jump box.

Connect to a bastion host in the public subnet, then access the private instance via its private IP using the private key, showcasing a jump server workflow in a VPC.

Explore network address translation in a private subnet: choose NAT instance or NAT gateway, configure routing and security groups, and enable outbound internet access for updates.

Learn to provide internet access for a private subnet using a NAT instance in the public subnet, updating route tables and security groups, and comparing NAT with an internet gateway.

NAT gateway is a fully managed AWS service for private subnet internet access, created in a public subnet with automatic elastic IP allocation, and security groups are not applied.

Explore the AWS simple storage service, a cloud storage solution that scales automatically, requires no upfront capacity planning, and keeps files highly durable while enabling access from anywhere.

Create a bucket in the simple storage service with a unique name, upload files or folders, and generate a public link to access and download the file.

Explore Amazon Glacier as a cost-effective archive storage option and how lifecycle policies transition S3 objects to Glacier, with standard retrieval in 3–5 hours and expedited options at extra cost.

Explore elastic block storage volumes (EBS) for EC2, including size, encryption, and detaching/attaching, plus volume types: general purpose SSD, provisioned IOPS SSD, and throughput-optimized HDD.

Understand elastic block storage volumes on EC2, the EBS volume types for high input-output and throughput, and how reads, writes, and database queries drive performance.

Understand when to use each EBS volume type, from provisioned IOPS SSDs for high I/O workloads to throughput optimized and cold HDDs for large data transfers and archive storage.

Create, attach, detach, and mount an EBS volume for EC2 instances, ensuring the volume stays in the same availability zone and can be mapped to a different instance.

Create and manage EBS snapshots—point-in-time, read-only copies—for backing up, restoring, and creating new volumes across availability zones and regions to support disaster recovery.

Explore how to optimize EC2 and EBS with burstable T2 instances and CPU credits, and boost EBS IOPS and throughput with provisioned IOPS, SSD-backed volumes, and rate zero configuration.

Explore elastic file system, a highly available and scalable shared file system that lets multiple instances access a central file store, while AWS manages storage and backups.

Demonstrates creating an AWS elastic file system with elastic network interfaces in multiple availability zones, mounting it on Linux instances via IP or DNS to share files.

Discover how the relational database service automates infrastructure and engine setup for quick database use, with support for MySQL, Oracle, SQL Server, MariaDB, PostgreSQL, Aurora, and automated backups.

Launch a relational database using the relational database service, choosing engine, version, instance type, storage, and backups. View monitoring metrics and connect via the database endpoint.

Enable AWS RDS multi-AZ to create a standby replica in another availability zone with synchronous replication, enabling automatic failover and DNS name switching when the primary fails.

Learn how relational database read replicas create an exact copy of the primary, enabling you to connect to both databases and offload read-only queries to improve performance.

Learn how to modify a relational database service for high availability, adjust the underlying instance and storage, and create read replicas in another region, with potential downtime.

Explore identity and access management in AWS, creating users, roles, groups, and policies, enabling console and programmatic access, and applying multifactor authentication for secure, explicit permissions.

Learn to set up the aws command line interface. Configure credentials and region, and use PowerShell to list buckets with json output for scriptable resource management.

Explore IAM policies as JSON-based documents that grant or deny access to AWS resources, detailing effect, actions, resources, and optional conditions for fine-grained control.

Learn to create a fine-grained IAM policy for S3, granting a user read access to a specific bucket, including get object, list buckets, and get bucket location.

Explore how iam roles grant permissions from trusted sources such as ec2, other aws accounts, or identity providers, using policies and temporary credentials for secure access to s3 buckets.

Create and attach an IAM role to a Lambda function to grant read-only access to DynamoDB, demonstrating secure role-based access in AWS.

Explore the AWS load balancer service, covering the classic, network, and application load balancers, with emphasis on the classic type due to exam focus.

Discover how the elastic load balancer distributes requests across backend servers, such as multiple EC2 instances in different availability zones, to ensure high availability.

Explore the three elastic load balancer options—classic, application, and network—for AWS, detailing their layer 4 vs layer 7 routing, traffic distribution, and suitability for containers and microservices.

Learn classic load balancer concepts, including backend servers across availability zones, DNS name and Route 53 mapping, internal and external load balancers, listener ports, security groups, and health checks.

Demonstrates configuring a classic load balancer with two Apache servers, health checks, and security groups, then verifies traffic distribution via the load balancer’s DNS.

Enable access logs for a classic load balancer by configuring the log interval and an S3 bucket, then review log files in the bucket for IP addresses and requests.

Explore how to monitor a classic load balancer by tracking back-end connection errors, healthy back-end instances, request queues, response codes, and latency, and set alarms in CloudWatch.

This lab demonstrates deploying an application load balancer with target groups, routing requests to servers by path and host rules via listeners, including a default route and health checks.

Explore the network load balancer's TCP traffic handling, target groups, and scales to millions of requests per second, including static IPs for firewall whitelisting and ports like 80 and 8090.

Learn to create an internet facing network load balancer with a target group, register a Windows instance on ports 80 and 8090, and assign an elastic ip.

Explore Route 53 as a domain name system service, map a domain to an elastic load balancer, use hosted zones, resource records, health checks, and simple, failover, and weighted routing.

Demonstrates configuring Route 53 simple routing policy by linking a GoDaddy domain to an Apache server via a hosted zone, name servers, and an A record with TTL.

Use Route 53 alias records to point a domain to your application load balancer, linking to S3 websites, CloudFront distributions, classic load balancers, or Elastic Beanstalk environments.

Learn how to scale a two-component architecture with auto scaling that spins up or down compute instances based on CPU thresholds for on-demand video processing stored in S3.

Learn how to create a launch configuration and an auto scaling group, configure scaling policies with CloudWatch alarms, and distribute instances across multiple subnets and availability zones.

Learn how VPC peering enables secure cross-VPC communication in AWS. Configure routing tables and security groups, and understand transitive routing limitations and the need for a full mesh.

Learn to set up a VPC peering connection between staging and test VPCs, routing tables and security groups, and enable private IP traffic between a web server and a database.

Learn how hybrid connections link private clouds to on-prem data centers using VPNs, Direct Connect, and gateways, with cost minimization and encrypted regional connectivity options.

Learn practical troubleshooting for the sysops environment, covering instance limits and capacity errors, connectivity issues, and load balancer health checks, with steps on zone choice, key files, and security groups.

Learn how the simple notification service delivers messages to multiple endpoints through topics; publish messages to a topic and subscribe endpoints like email or applications to receive updates.

Learn how AWS CloudWatch collects metrics and logs from AWS resources, including setting up the unified agent for OS metrics, custom metrics, alarms with SNS, and dashboards.

Explore CloudWatch metrics in AWS by enabling detailed monitoring, viewing namespace-based metrics, tagging instances, and graphing CPU utilization and CPU credits for T2 instances.

learn to create CloudWatch dashboards, add widgets (line, stacked area, number, text), enable auto refresh, and combine metrics from namespaces like network load balancer to monitor applications.

Create a CloudWatch alarm for the load balancer using request count. Trigger when the sum exceeds 1000 per minute and notify via an existing SNS topic with email.

Learn to aggregate cpu utilization metrics across all instances and across regions in CloudWatch, ensure detailed monitoring is enabled, and add regional metrics to a demo dashboard.

Install and configure the cloud watch agent on instances and on-premise servers to send logs to cloud watch logs, creating log groups and streams with proper IAM policies.

Learn how to monitor memory utilization on EC2 instances by publishing custom metrics to CloudWatch with a Linux script, including setting up IAM roles and cron-based data collection.

Learn to send custom metrics to CloudWatch using the metric data API by specifying a namespace, metric name, unit, and value, with an orders metric example.

Learn how VPC flow logs capture traffic for network interfaces, with logs sent to CloudWatch and fields like source, destination, protocol, ports, and status to diagnose accepted or rejected traffic.

Master encryption at rest and encryption in transit to secure data in AWS data centers, including EBS volumes and S3 objects. Guard against unauthorized access and transit threats.

Learn how encryption at rest works across AWS services: enable S3 bucket or object encryption seamlessly, while RDS, EFS, and EBS require creation-time encryption and careful data migration with KMS.

Enable encryption at rest by applying default bucket encryption or using KMS with customer keys for objects. Encrypt EBS volumes, RDS databases, and EFS, and verify server-side encryption on uploads.

Understand the AWS shared responsibility model by distinguishing customer duties from AWS maintenance across EC2, EBS, S3, RDS, and Elastic Beanstalk, including patching, backups, encryption, and access controls.

Explore how AWS Organizations centralizes management of multiple accounts, uses organizational units and service control policies to enforce access, and consolidates billing under a master account.

Learn how AWS Cognito manages sign-up and sign-in with own credentials or external identity providers like Facebook and Google, and stores profiles in user pools.

Explore AWS CloudTrail governance and auditing, learn how CloudTrail records all calls across users, roles, services, and how to publish events to an S3 bucket and monitor with CloudWatch logs.

Explore how to create and manage CloudTrail trails, view event histories, and store API call logs in S3 buckets across regions for analysis and dashboards.

Aws config provides a detailed view of resources and tracks changes, including global resources. It stores data in s3 and lets you review resource timelines in the config dashboard.

Explore how AWS Config rules enforce security and compliance by defining constraints, monitoring instance types and unused resources, and triggering CloudWatch events or Lambda to remediate noncompliance.

Learn how AWS inspector detects vulnerabilities on EC2 instances by installing an agent, applying rule packages, and generating reports with high, medium, low, and informational findings.

Explore how AWS mitigates distributed denial of service attacks using application load balancer, CloudFront, WAF, Shield Advanced, and border network protections, with cost protections and incident response.

Protect your web applications with the AWS web application firewall, configure marketplace rules, and attach them to an application load balancer or CloudFront distribution.

Explore the AWS trusted advisor in the management console, covering cost optimization, performance, security, tolerance, and service limits with practical security group examples.

Learn how to use S3 pre-signed URLs to grant temporary access with expiration to bucket objects for uploading or downloading, without exposing credentials, including creation via SDK and AWS toolkit.

learn how the key management service creates and manages master keys (customer master keys), generates data keys to encrypt data, and controls key lifecycle with disable, delete, and region-based policies.

Learn how cloud HSM provides dedicated hardware to store encryption keys. Compare symmetric and asymmetric keys, achieve full key control, and secure on-premise to cloud key transfer with compliant standards.

Learn how AWS Systems Manager enables patch management and configuration at scale across Windows and Linux instances, in the cloud or on premise data center, with inventory and run commands.

Explore how to use aws systems manager run command to remotely install a web server, run scripts, and manage multiple ec2 instances from the console, with outputs and timeouts.

Automate software installation on EC2 instances using user data scripts and boot-time configuration, speeding deployments with AMI golden images, and leverage services like Elastic Beanstalk and OpsWorks.

Create an amazon machine image (ami) from a running instance so instances automatically have Apache installed. Launch an instance from the ami to support high availability and disaster recovery.

Use AWS CloudFormation to provision infrastructure as code with JSON or YAML templates. Define resources like EC2 in a VPC with subnets, including required properties such as the image.

Design a cloud formation template, validate it, and deploy a stack to spin up an EC2 instance in the Oregon region, then monitor events and delete the stack.

Learn how AWS OpsWorks, a configuration management service, uses stacks, layers, and recipes (chef and puppet) to provision, configure, and deploy web and application servers across development and production environments.

Provision web environments quickly with elastic beanstock service, which automatically handles instances, auto scaling, load balancing, and DNS so developers focus on code.

Create an Elastic Beanstalk application and multiple environments (development, staging, production), select a web server and Tomcat platform, deploy a sample Java app, and monitor health and logs.