David Clinton - AWS Certified Solutions Architect Study Guide

1 Cover

2 Title Page AWS Certified Solutions Architect Study Guide Associate (SAA-C02) Exam Third Edition Ben Piper David Clinton

3 Copyright

4 Acknowledgments

5 About the Authors

6 Table of Exercises

7 Introduction What Does This Book Cover? Interactive Online Learning Environment and Test Bank Exam Objectives Objective Map Assessment Test Answers to Assessment Test

8 PART I: The Core AWS Services Chapter 1: Introduction to Cloud Computing and AWS Cloud Computing and Virtualization The AWS Cloud AWS Platform Architecture AWS Reliability and Compliance Working with AWS Summary Exam Essentials Review Questions Chapter 2: Amazon Elastic Compute Cloud and Amazon Elastic Block Store Introduction EC2 Instances EC2 Storage Volumes Accessing Your EC2 Instance Securing Your EC2 Instance EC2 Auto Scaling AWS Systems Manager AWS CLI Example Summary Exam Essentials Review Questions Chapter 3: AWS Storage Introduction S3 Service Architecture S3 Durability and Availability S3 Object Lifecycle Accessing S3 Objects Amazon S3 Glacier Other Storage‐Related Services AWS CLI Example Summary Exam Essentials Review Questions Chapter 4: Amazon Virtual Private Cloud Introduction VPC CIDR Blocks Subnets Elastic Network Interfaces Internet Gateways Route Tables Security Groups Network Access Control Lists Public IP Addresses Elastic IP Addresses AWS Global Accelerator Network Address Translation Network Address Translation Devices VPC Peering Hybrid Cloud Networking High‐Performance Computing Summary Exam Essentials Review Questions Chapter 5: Database Services Introduction Relational Databases Amazon Relational Database Service Amazon Redshift Nonrelational (NoSQL) Databases DynamoDB Summary Exam Essentials Review Questions Chapter 6: Authentication and Authorization—AWS Identity and Access Management Introduction IAM Identities Authentication Tools AWS CLI Example Summary Exam Essentials Review Questions Chapter 7: CloudTrail, CloudWatch, and AWS Config Introduction CloudTrail CloudWatch AWS Config Summary Exam Essentials Review Questions Chapter 8: The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront Introduction The Domain Name System Amazon Route 53 Amazon CloudFront AWS CLI Example Summary Exam Essentials Review Questions Chapter 9: Simple Queue Service and Kinesis Introduction Simple Queue Service Kinesis Summary Exam Essentials Review Questions

9 PART II: The Well‐Architected Framework Chapter 10: The Reliability Pillar Introduction Calculating Availability EC2 Auto Scaling Data Backup and Recovery Creating a Resilient Network Designing for Availability Summary Exam Essentials Review Questions Chapter 11: The Performance Efficiency Pillar Introduction Optimizing Performance for the Core AWS Services Infrastructure Automation Reviewing and Optimizing Infrastructure Configurations Optimizing Data Operations Summary Exam Essentials Review Questions Chapter 12: The Security Pillar Introduction Identity and Access Management Detective Controls Protecting Network Boundaries Data Encryption Summary Exam Essentials Review Questions Chapter 13: The Cost Optimization Pillar Introduction Planning, Tracking, and Controlling Costs Cost‐Optimizing Compute Summary Exam Essentials Review Questions Chapter 14: The Operational Excellence Pillar Introduction CloudFormation CodeCommit CodeDeploy CodePipeline AWS Systems Manager AWS Landing Zone Summary Exam Essentials Review Questions

10 Appendix: Answers to Review Questions Chapter 1: Introduction to Cloud Computing and AWS Chapter 2: Amazon Elastic Compute Cloud and Amazon Elastic Block Store Chapter 3: AWS Storage Chapter 4: Amazon Virtual Private Cloud Chapter 5: Database Services Chapter 6: Authentication and Authorization—AWS Identity and Access Management Chapter 7: CloudTrail, CloudWatch, and AWS Config Chapter 8: The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront Chapter 9: Simple Queue Service and Kinesis Chapter 10: The Reliability Pillar Chapter 11: The Performance Efficiency Pillar Chapter 12: The Security Pillar Chapter 13: The Cost Optimization Pillar Chapter 14: The Operational Excellence Pillar

11 Index

12 Online Test Bank Register and Access the Online Test Bank

13 End User License Agreement

1 Chapter 1 TABLE 1.1 AWS service categories TABLE 1.2 Core AWS services (by category) TABLE 1.3 A list of publicly accessible AWS regions

2 Chapter 2 TABLE 2.1 EC2 instance type family and their top‐level designations TABLE 2.2 Pricing estimates comparing on‐demand with reserve costs TABLE 2.3 A sample key/value tagging convention TABLE 2.4 Sample costs for each of the four EBS storage volume types TABLE 2.5 The three IP address ranges used by private networks

3 Chapter 3 TABLE 3.1 Guaranteed availability standards for S3 storageTABLE 3.2 Sample retrieval costs for Glacier data in the US East regionTABLE 3.3 Sample storage costs for data in the US East region

4 Chapter 4TABLE 4.1 Subnets in different availability zonesTABLE 4.2 The local routeTABLE 4.3 Route table with default routeTABLE 4.4 Inbound rules allowing SSH and HTTPS access from any IP addressTABLE 4.5 Outbound rule allowing Internet accessTABLE 4.6 Default NACL inbound rulesTABLE 4.7 Blocking ruleTABLE 4.8 Default NACL outbound rulesTABLE 4.9 IP address configuration when using a NAT deviceTABLE 4.10 Default routes for the Private and Public subnetsTABLE 4.11 Routes for VPC peeringTABLE 4.12 Route table entries for using a transit gateway

5 Chapter 5TABLE 5.1 The Employees tableTABLE 5.2 The Departments tableTABLE 5.3 The Employees tableTABLE 5.4 Item in an unstructured databaseTABLE 5.5 Composite primary keys

6 Chapter 8TABLE 8.1 The data categories contained in a resource record from a zone fileTABLE 8.2 Some common DNS record typesTABLE 8.3 Permitted CloudFront origins

7 Chapter 9TABLE 9.1 Comparison of SQS and Kinesis services

8 Chapter 10TABLE 10.1 The relationship between annual availability percentage and time u...

9 Chapter 11TABLE 11.1 Instance type parameter descriptionsTABLE 11.2 Common use cases for compute categoriesTABLE 11.3 Third‐party data warehousing and management tools

1 Chapter 1 FIGURE 1.1 A virtual machine host FIGURE 1.2 Copies of a machine image are added to new VMs as they're launche... FIGURE 1.3 The AWS Shared Responsibility Model

2 Chapter 2 FIGURE 2.1 A multi‐VPC infrastructure for a development environment FIGURE 2.2 A NAT gateway providing network access to resources in private su... FIGURE 2.3 Scheduled action setting the desired capacity to 2 every Saturday... FIGURE 2.4 Scheduled action setting the desired capacity to 4 every Friday

3 Chapter 4FIGURE 4.1 VPC with subnets and instancesFIGURE 4.2 Network address translation using a NAT device

4 Chapter 6FIGURE 6.1 The Security Status checklist from the IAM page of an AWS account...FIGURE 6.2 The six action items displayed on the Your Security Credentials p...

5 Chapter 7FIGURE 7.1 CPU utilizationFIGURE 7.2 The sum of network bytes sent out over a one‐hour periodFIGURE 7.3 Combining metric math functions

6 Chapter 8FIGURE 8.1 A simple DNS domain broken down to its partsFIGURE 8.2 A sample Traffic Flow policy

7 Chapter 9FIGURE 9.1 SQS workflow

8 Chapter 10FIGURE 10.1 Scheduled action setting the desired capacity to 2 every Saturda...FIGURE 10.2 Scheduled action setting the desired capacity to 4 every Friday...

9 Chapter 11FIGURE 11.1 The data flow of a typical load balancing operationFIGURE 11.2 A typical ElastiCache configuration with an ElastiCache cluster ...

10 Chapter 12FIGURE 12.1 CloudWatch Logs showing AttachVolume, DetachVolume, and DeleteVo...FIGURE 12.2 Athena query resultsFIGURE 12.3 AWS Config showing an EBS volume as noncompliantFIGURE 12.4 Configuration timeline for an EBS volumeFIGURE 12.5 EBS volume configuration and relationship changesFIGURE 12.6 GuardDuty finding showing a possible malware infectionFIGURE 12.7 Inspector finding showing that root users can log in via SSH