AWS Certification Exam Prep

108 flashcards by MentisLibrary

Exam-shaped preparation for the AWS Cloud Practitioner and Solutions Architect Associate: the domain weightings, the six Well-Architected pillars, the shared responsibility model, and secure, resilient, high-performing and cost-optimized design choices with trap answers.

What are the four domains of the AWS Certified Cloud Practitioner exam and their weightings?
Cloud Concepts 24 percent, Security and Compliance 30 percent, Cloud Technology and Services 34 percent, and Billing, Pricing and Support 12 percent.
How many questions does the Cloud Practitioner exam have, how long is it, and what is the passing score?
65 questions in 90 minutes, of which 50 are scored and 15 are unscored pretest items. The result is a scaled score from 100 to 1000 with a passing mark of 700.
What are the four domains of the AWS Certified Solutions Architect Associate exam and their weightings?
Design Secure Architectures 30 percent, Design Resilient Architectures 26 percent, Design High-Performing Architectures 24 percent, and Design Cost-Optimized Architectures 20 percent.
How many questions does the Solutions Architect Associate exam have, how long is it, and what is the passing score?
65 questions in 130 minutes, with 50 scored and 15 unscored. The scaled score runs from 100 to 1000 and the passing mark is 720.
What question formats appear on AWS associate-level exams?
Multiple choice with one correct answer out of four, and multiple response where you select two or three correct answers out of five or more. Multiple response questions state exactly how many to choose.
How long is an AWS certification valid, and how is it renewed?
Three years from the date it is earned. It is renewed by passing the current version of the same exam or, in most cases, by passing a higher-level exam in the same or a related path.
Name the six pillars of the AWS Well-Architected Framework.
Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.
What does the Operational Excellence pillar cover?
Running and monitoring systems to deliver business value, and continuously improving processes and procedures: infrastructure as code, small reversible changes, frequent refinement, anticipating failure and learning from every operational event.
What does the Reliability pillar cover?
A workload's ability to perform its intended function correctly and consistently, including automatic recovery from failure, horizontal scaling to reduce shared points of failure, stopping guessing at capacity, and testing recovery procedures.
What are the design principles of the Performance Efficiency pillar?
Democratise advanced technology by consuming it as a service, go global in minutes, use serverless architectures, experiment more often because experiments are cheap, and consider mechanical sympathy by matching the technology to the access pattern.
What are the design principles of the Cost Optimization pillar?
Implement cloud financial management, adopt a consumption model, measure overall efficiency, stop spending on undifferentiated heavy lifting, and analyse and attribute expenditure.
What does the Sustainability pillar ask you to optimise?
The environmental impact of running a workload: maximising utilisation, adopting more efficient hardware and managed services, reducing the downstream impact of the workload, and setting long-term improvement goals.
What is the AWS Well-Architected Tool?
A free service that reviews a workload against the pillars using a structured questionnaire, produces a list of identified risks by severity, and tracks improvement over time as the workload changes.
State the AWS shared responsibility model in one sentence each.
AWS is responsible for security OF the cloud: the hardware, facilities, network and the software of managed services. The customer is responsible for security IN the cloud: their data, identity and access management, operating system and network configuration where applicable, and their encryption choices.
Who patches what on Amazon EC2 versus Amazon RDS?
On EC2, AWS maintains the hypervisor and hardware while the customer patches the guest operating system and everything above it. On RDS, AWS patches the underlying operating system and the database engine, while the customer manages schemas, users, parameter groups, network access and encryption choices.
Where does responsibility sit for Amazon S3 and for AWS Lambda?
For S3, AWS operates the storage infrastructure and durability, while the customer controls bucket policies, access settings, encryption choices and object lifecycle. For Lambda, AWS manages the runtime environment and its patching, while the customer owns the function code, its dependencies and its execution role.
What is AWS Artifact?
A self-service portal for downloading AWS compliance reports such as SOC and PCI documents, and for reviewing and accepting agreements such as a business associate addendum.
How does IAM evaluate a request when several policies apply?
An explicit deny anywhere always wins. Otherwise the request needs an explicit allow from some applicable policy. With no explicit allow, the implicit deny applies. Service control policies, permissions boundaries and session policies each cap the maximum, and none of them grants anything.
What is a service control policy, and what can it not do?
An Organizations policy attached to an organizational unit or account that sets the maximum available permissions for principals in that account. It never grants permissions, it only filters what IAM policies may allow.
How should the AWS account root user be handled?
Enable multi-factor authentication on it, remove any access keys, use it only for the small set of tasks that require it, and perform all other work through IAM identities or federated roles.
Why is an IAM role preferable to an access key for an application on EC2?
A role attached through an instance profile delivers temporary, automatically rotated credentials through the instance metadata service, so no long-lived secret is stored on disk or in code.
How is cross-account access granted safely, and what is an external ID for?
By creating a role in the target account that trusts the other account's principal, which then calls sts:AssumeRole for temporary credentials. When a third party assumes the role on your behalf, an external ID in the trust policy prevents the confused deputy problem.
What is a permissions boundary?
An advanced IAM feature that sets the maximum permissions an identity-based policy can grant to a user or role. The effective permission is the intersection of the boundary and the attached policies.
How do a security group and a network ACL differ?
A security group is stateful, attaches to an elastic network interface, and supports allow rules only, with all rules evaluated together. A network ACL is stateless, applies at the subnet boundary, supports allow and deny rules, and evaluates numbered rules in order until one matches.
What is the difference between a gateway VPC endpoint and an interface endpoint?
A gateway endpoint adds a route to the route table for S3 and DynamoDB and carries no hourly charge. An interface endpoint, powered by PrivateLink, places an elastic network interface with a private IP in your subnets and works with most AWS services and with partner services, billed per hour and per data processed.
When would you choose AWS CloudHSM over AWS KMS?
When you need single-tenant, dedicated hardware security modules under your exclusive control, FIPS 140-2 Level 3 validation, or support for algorithms and operations KMS does not expose. KMS is the managed, multi-tenant default for almost everything else.
What is envelope encryption in KMS?
KMS generates a data key, returns it in plaintext and in encrypted form, the client encrypts the data with the plaintext key and stores the encrypted key alongside the ciphertext. The plaintext key is discarded from memory, and decryption asks KMS to unwrap the stored key.
When should Secrets Manager be used instead of SSM Parameter Store?
Secrets Manager when you need built-in, scheduled rotation with native integration for supported databases, or cross-account secret sharing. Parameter Store when you need free storage of configuration and secrets and are willing to build rotation yourself.
What do GuardDuty, Inspector, Macie and Security Hub each do?
GuardDuty continuously detects threats from log and network telemetry. Inspector scans EC2 instances, container images and Lambda functions for known vulnerabilities. Macie discovers and classifies sensitive data in S3. Security Hub aggregates findings from all of them against standards.
What is the difference between CloudTrail, CloudWatch and AWS Config?
CloudTrail records WHO made which API call and when. CloudWatch collects metrics, logs and alarms about how resources are performing. AWS Config records how each resource was CONFIGURED over time and evaluates it against rules.