Practice Test AWS Solutions Architect Associate SAA C03

Explore public vs private IPs, CIDR notation, and subnets, and learn how routers, firewalls, and AWS VPCs secure and route traffic across private networks.

Discover how to deploy a multi-tier app on AWS with a VPC, public and private subnets across multiple availability zones, and elastic load balancers, routing, and internet gateway.

Configure security groups as stateful, instance-level firewalls to restrict traffic in a VPC. Allow web servers http/https from anywhere and databases only from app servers.

Learn how the network ACL provides subnet-level firewalling, is stateless, handles inbound and outbound traffic, and requires both allow and deny rules while evaluating numbered rules from lowest to highest.

Explore ip types in aws—private, public, and elastic—and how they attach to vpc. Learn about private ip assignment from subnet cidr, and how public and elastic ips enable internet access.

Explore how private subnets access AWS services via NAT gateways or NAT instances, and how gateway and interface endpoints enable private, region-local access to S3, DynamoDB, and other services.

Learn how to connect multiple VPCs with peering connections and transit gateway to enable private AWS network communication, with non-overlapping CIDRs, bidirectional traffic, and scalable routing.

Share your application with third parties privately via an endpoint service for a network load balancer and interface endpoints, or rely on internet access for non-AWS partners.

Securely access public and private subnets using a bastion host or AWS Systems Manager session manager. IAM-based access via session manager avoids exposing SSH and RDP ports.

Explore site-to-site VPN, cloud hub, and client VPN, and learn how transit gateway enables scalable, secure connections between on-premises networks and AWS VPCs.

Link your on-premises data center to AWS with direct connect for a dedicated, consistent throughput connection; enable VPC access via direct connect gateway or transit gateway for multi-VPC.

Amazon elastic compute cloud provides infrastructure as a service to launch and manage virtual instances on a multi-tenant platform, with ephemeral storage and persistent EBS.

Explore aws ec2 virtualization with Nitro, a custom hardware-accelerated platform, and bare metal instances that support running other virtualization software or direct hardware access.

Learn how IAM roles enable an EC2 instance to access S3 with temporary credentials via the EC2 metadata service, eliminating long-term keys and enabling automatic rotation.

Discover gp3, io2, and io2 Block Express as new EBS volume types. Compare gp3's lower cost and higher baseline IOPs with io2's durability and performance, and io2 Block Express throughput.

Explore elastic file system options for AWS EC2: EFS, FSx for Windows, and FSx for Lustre, including their use cases, access methods, and integration with S3 and on-premises networks.

Master CloudWatch for metrics, logs, alarms, and custom metrics; use events for automation, CloudTrail for API auditing, and Athena to query logs.

Explore CloudWatch metrics and alarms across ELB and EC2 health, autoscaling actions, alerts, and alarm states, using one-minute data points, thresholds, and evaluation intervals.

Consolidate and monitor logs with CloudWatch logs using agents or SDK, configure log groups, streams, retention, and metric filters to trigger alarms.

Enable CloudWatch detailed monitoring on an EC2 instance, track one-minute CPU utilization, and set a p90 alarm to stop idle instances after 15 minutes of low usage.

Maintain compute capacity with Amazon auto scaling by managing a fleet and replacing failed instances. Implement dynamic and predictive scaling across availability zones to improve fault tolerance and reduce costs.

Explore AWS’s shared responsibility model, detailing security in the cloud versus security of the cloud, and how IAM, least privilege, cross-account access, and zero-trust authentication secure EC2 and S3.

Explore the elements of an AWS policy document—version, statement, action, resource, and principal. Compare identity-based and resource-based policies, session names, and the Not actions mechanism.

Leverage conditional access with implicit denial, explicit denies and permission boundaries, and adopt attribute-based access control using request context variables to enforce least-privilege, scalable policies.

Attach an IAM role to an EC2 instance to obtain temporary credentials via the EC2 metadata service, eliminating long-term keys and enabling on-demand access to S3.

Explore decoupled architectures with messaging services, comparing tightly and loosely coupled designs, and learn how queues, notification services, event buses, and streams enable scalable, resilient communication.

Explain SQS features, compare standard and FIFO queues, describe ordering semantics and message groups, and outline the message lifecycle driven by visibility timeout.

Explore SQS features including duplicate handling on standard queues and deduplication on FIFO queues. Learn about long polling, batching, retention, dead-letter queues, and encryption of message bodies.

Publish and fanout messages with SNS topics, choosing standard or FIFO topics, and apply message filtering, retry, and dead letter queue to ensure reliable delivery and logging for event-driven applications.

EventBridge provides near real-time events from AWS services and SaaS partners via a common event bus, enabling filters and targets to trigger workflows on state changes or on schedules.

Compare SNS and EventBridge to decide when to use them for event-driven solutions, noting EventBridge handles events from AWS services and SaaS partners with a schema registry and auto-discovery.

Compare streaming and batch processing: streaming analyzes data as it arrives for routing and alerts, while batch processing gathers data for periodic analytics using tools such as Spark on EMR.

Learn how to configure Kinesis data streams with shards and partition keys, manage throughput and retention, read with shard iterators, and use KCL and KPL for producers and consumers.

Manage permissions for producers and consumers across SQS and SNS using resource-based and identity-based policies, cross-account access, and publish or receive rights for endpoints.

Compare SQS, Kinesis data streams, SNS, and EventBridge by highlighting polling vs. push delivery, time-ordered retention, and each service's consumer processing and retry behavior.