Practice Test AWS Solutions Architect Associate SAA C03

Explore public vs private IPs, CIDR notation, and subnets, and learn how routers, firewalls, and AWS VPCs secure and route traffic across private networks.

Discover how to deploy a multi-tier app on AWS with a VPC, public and private subnets across multiple availability zones, and elastic load balancers, routing, and internet gateway.

Configure security groups as stateful, instance-level firewalls to restrict traffic in a VPC. Allow web servers http/https from anywhere and databases only from app servers.

Learn how the network ACL provides subnet-level firewalling, is stateless, handles inbound and outbound traffic, and requires both allow and deny rules while evaluating numbered rules from lowest to highest.

Explore ip types in aws—private, public, and elastic—and how they attach to vpc. Learn about private ip assignment from subnet cidr, and how public and elastic ips enable internet access.

Explore how private subnets access AWS services via NAT gateways or NAT instances, and how gateway and interface endpoints enable private, region-local access to S3, DynamoDB, and other services.

Learn how to connect multiple VPCs with peering connections and transit gateway to enable private AWS network communication, with non-overlapping CIDRs, bidirectional traffic, and scalable routing.

Share your application with third parties privately via an endpoint service for a network load balancer and interface endpoints, or rely on internet access for non-AWS partners.

Securely access public and private subnets using a bastion host or AWS Systems Manager session manager. IAM-based access via session manager avoids exposing SSH and RDP ports.

Explore site-to-site VPN, cloud hub, and client VPN, and learn how transit gateway enables scalable, secure connections between on-premises networks and AWS VPCs.

Link your on-premises data center to AWS with direct connect for a dedicated, consistent throughput connection; enable VPC access via direct connect gateway or transit gateway for multi-VPC.

Amazon elastic compute cloud provides infrastructure as a service to launch and manage virtual instances on a multi-tenant platform, with ephemeral storage and persistent EBS.

Explore aws ec2 virtualization with Nitro, a custom hardware-accelerated platform, and bare metal instances that support running other virtualization software or direct hardware access.

Explore Amazon machine images (AMI) for launching EC2 instances, including Linux, Windows, deep learning, and custom AMIs; learn about sharing, marketplace, licensing, and regional AMI IDs.

Map your application needs to the right EC2 instance family and size. Test performance across general purpose, burstable, compute, memory, storage, and accelerated instances.

Placement groups in ec2 provide low latency, high throughput for HPC and machine learning workloads by combining cluster, partition, and spread configurations across availability zones, with on-demand capacity reservations needed.

Learn how IAM roles enable an EC2 instance to access S3 with temporary credentials via the EC2 metadata service, eliminating long-term keys and enabling automatic rotation.

Explore EC2 storage options, including block, file, and object storage, and compare instance store with Elastic Block Store for high-performance, temporary versus durable storage.

Elastic Block Store (EBS) provides persistent network-attached block volumes for EC2, with snapshots stored in S3, availability zone replication, and volume types for IOPS and throughput.

Discover gp3, io2, and io2 Block Express as new EBS volume types. Compare gp3's lower cost and higher baseline IOPs with io2's durability and performance, and io2 Block Express throughput.

Explore elastic file system options for AWS EC2: EFS, FSx for Windows, and FSx for Lustre, including their use cases, access methods, and integration with S3 and on-premises networks.

Explore how EBS volume encryption uses KMS data keys and envelope encryption to secure volumes, snapshots, and data at rest and in transit, with key management by region.

Master CloudWatch for metrics, logs, alarms, and custom metrics; use events for automation, CloudTrail for API auditing, and Athena to query logs.

Explore CloudWatch metrics and alarms across ELB and EC2 health, autoscaling actions, alerts, and alarm states, using one-minute data points, thresholds, and evaluation intervals.

Consolidate and monitor logs with CloudWatch logs using agents or SDK, configure log groups, streams, retention, and metric filters to trigger alarms.

Enable CloudWatch detailed monitoring on an EC2 instance, track one-minute CPU utilization, and set a p90 alarm to stop idle instances after 15 minutes of low usage.

Distribute traffic across EC2 instances using Elastic Load Balancer, with health checks and auto scaling. Learn about internet-facing and internal modes, cross-zone load balancing, and SSL offload.

Explore the three elastic load balancers - classic, application, and network - and their roles for layer 4 and layer 7 traffic. Private link powered service enables private communication across VPCs.

Maintain compute capacity with Amazon auto scaling by managing a fleet and replacing failed instances. Implement dynamic and predictive scaling across availability zones to improve fault tolerance and reduce costs.

Explore AWS’s shared responsibility model, detailing security in the cloud versus security of the cloud, and how IAM, least privilege, cross-account access, and zero-trust authentication secure EC2 and S3.

Enforce least privilege by creating separate user accounts, managing password rules, credentials, and MFA, and using identity-based and resource-based policies with IAM roles for cross-account access and S3.

Explore policy types, inline and managed, and how they attach to users, groups, resources, and roles, plus arn convention and policy generator and simulator tools.

Explore the elements of an AWS policy document—version, statement, action, resource, and principal. Compare identity-based and resource-based policies, session names, and the Not actions mechanism.

Leverage conditional access with implicit denial, explicit denies and permission boundaries, and adopt attribute-based access control using request context variables to enforce least-privilege, scalable policies.

Attach an IAM role to an EC2 instance to obtain temporary credentials via the EC2 metadata service, eliminating long-term keys and enabling on-demand access to S3.

Explore how corporate and internet identities access AWS via single sign-on. Use SAML 2.0, AD, AWS Organizations, Cognito, OAuth 2.0, and OpenID Connect to map identities to roles and grant access.

Explore decoupled architectures with messaging services, comparing tightly and loosely coupled designs, and learn how queues, notification services, event buses, and streams enable scalable, resilient communication.

Explain SQS features, compare standard and FIFO queues, describe ordering semantics and message groups, and outline the message lifecycle driven by visibility timeout.

Explore SQS features including duplicate handling on standard queues and deduplication on FIFO queues. Learn about long polling, batching, retention, dead-letter queues, and encryption of message bodies.

Publish and fanout messages with SNS topics, choosing standard or FIFO topics, and apply message filtering, retry, and dead letter queue to ensure reliable delivery and logging for event-driven applications.

EventBridge provides near real-time events from AWS services and SaaS partners via a common event bus, enabling filters and targets to trigger workflows on state changes or on schedules.

Compare SNS and EventBridge to decide when to use them for event-driven solutions, noting EventBridge handles events from AWS services and SaaS partners with a schema registry and auto-discovery.

Compare streaming and batch processing: streaming analyzes data as it arrives for routing and alerts, while batch processing gathers data for periodic analytics using tools such as Spark on EMR.

Explore Amazon Kinesis real-time streaming with video streams, data streams, Kinesis Data Firehose, and data analytics, and see how they enable secure ingestion and SQL-based analytics to S3 and Redshift.

Learn how to configure Kinesis data streams with shards and partition keys, manage throughput and retention, read with shard iterators, and use KCL and KPL for producers and consumers.

Manage permissions for producers and consumers across SQS and SNS using resource-based and identity-based policies, cross-account access, and publish or receive rights for endpoints.

Compare SQS, Kinesis data streams, SNS, and EventBridge by highlighting polling vs. push delivery, time-ordered retention, and each service's consumer processing and retry behavior.