Pustakam Library

Free Exams learning guide

Pass the AWS Solutions Architect Associate Exam

Pass the AWS Solutions Architect Associate Exam — a free intermediate-level guide covering how to pass the aws solutions architect exam. Learn with...

117 min read12 chaptersintermediate

What you will learn

  1. Exam Strategy & the Well-Architected Framework
  2. Compute Services Deep Dive
  3. Storage Solutions & Data Lifecycle
  4. Networking Foundations: VPC Design
  5. Advanced Networking & Content Delivery
  6. Database Services Selection & Configuration
  7. Security, Identity & Compliance
  8. Application Integration & Event-Driven Architecture
  9. High Availability & Disaster Recovery
  10. Cost Optimization & Resource Management
  11. Migration & Hybrid Cloud Architectures
  12. Practice Exams & Final Review

1. Exam Strategy & the Well-Architected Framework

The Architect's Dilemma You are presented with a scenario on the AWS Solutions Architect - Associate (SAA-C03) exam: A rapidly growing e-commerce platform experiences unpredictable traffic spikes during flash sales. The current architecture uses Amazon EC2 instances behind an Application Load Balancer. The company needs to process a sudden surge in user traffic, ensure zero downtime, and keep costs predictable. Which of the following is the MOST cost-effective solution? A. Provision additional EC2 instances of the largest available size. B. Migrate the application to AWS Lambda combined with Amazon API Gateway. C. Implement Amazon EC2 Auto Scaling with a target tracking policy. D. Use Amazon SQS to decouple the frontend from the backend processing. All four options could theoretically handle traffic spikes, but only one represents the best architectural trade-off for this specific scenario. The AWS exam does not test your ability to memorize service acronyms; it tests your ability to make these exact trade-offs. To consistently select the correct answer, you need two things: an understanding of how the exam is constructed, and a mental framework for evaluating architectural decisions. Deconstructing the SAA-C03 Exam The SAA-C03 exam consists of 65 questions to be answered in 130 minutes. You are evaluating intermediate-level architectural concepts, which requires a passing score of 720 out of a scaled score of 1000. The exam is divided into four domains, each carrying a specific weighting that dictates where you should focus your study efforts. The Four Domains and Weightings 1. Domain 1: Design Secure Architectures (30%) This domain tests your ability to design secure access to AWS resources, secure workloads and data, and implement security best practices. Expect questions on IAM policies, resource-based policies, data encryption (in transit and at rest), and network security using VPC components like Security Groups and NACLs. 2. Domain 2: Design Resilient Architectures (26%) Here, the focus is on high availability, scalability, and decoupling. You will be asked to choose multi-AZ or multi-Region architectures, implement decoupling mechanisms (SQS, SNS), and select appropriate storage and database solutions based on durability and availability requirements. 3. Domain 3: Design High-Performing Architectures (24%) This domain evaluates your ability to select optimal compute, storage, and database services for performance. Questions will cover elastic load balancing, caching strategies (ElastiCache, CloudFront), edge computing, and selecting the right instance type or storage class for a specific I/O profile. 4. Domain 4: Design Cost-Optimized Architectures (20%) The smallest but highly critical domain. It tests your knowledge of pricing models (Spot, Reserved, Savings Plans), cost-effective storage tiers, and managed services that reduce operational overhead. Because Domain 1 and Domain 2 make up over half of the exam, your study plan must prioritize security and resilience. However, because questions often blend …

2. Compute Services Deep Dive

The Compute Decision Tree: EC2, Containers, or Serverless? An e-commerce startup launches a flash sale. Traffic spikes to 10x normal volume within minutes. The engineering team had provisioned enough EC2 instances to handle the expected load, but the unexpected surge overwhelms their static fleet. The site goes down for 45 minutes. They lose an estimated $200,000 in revenue. This scenario plays out constantly in the real world, and it is precisely why Domain 2 (Design Resilient Architectures) and Domain 3 (Design High-Performing Architectures) heavily test your ability to select and configure the right compute service. On the AWS Certified Solutions Architect - Associate (SAA-C03) exam, you will rarely be asked to simply define a service. Instead, you will be given a workload profile, a set of constraints, and asked to choose the most resilient, performant, or cost-effective compute solution. To pass, you must internalize a compute decision tree: 1. Do you need OS-level access or custom runtime software? Choose EC2. 2. Is the workload containerized, or do you want to avoid managing underlying infrastructure? Choose Containers (ECS/EKS/Fargate). 3. Is the workload event-driven, short-lived, or highly variable? Choose Lambda. 4. Do you just want to upload code and let AWS handle the provisioning and scaling? Choose Elastic Beanstalk. Let’s break down each branch of this tree, focusing on the specific configurations and nuances that appear on the exam. Amazon EC2: Instance Families and Purchasing Options Amazon EC2 provides resizable virtual machines (instances). While the fundamentals of launching an EC2 instance are straightforward, the exam tests your ability to match instance types and purchasing options to specific workload profiles. Matching Instance Families to Workloads AWS categorizes instances into families based on the ratio of CPU, Memory, and Storage. You don't need to memorize every instance size, but you must know the families and their primary use cases. General Purpose (e.g., M5, M6, T3): Balanced CPU-to-memory ratio. Ideal for web servers, small databases, and development environments. The T-family features "burstable" performance, accumulating CPU credits during idle periods to burst above baseline when needed—perfect for low-throughput, intermittent workloads. Compute Optimized (e.g., C5, C6): High processor-to-memory ratio. Designed for compute-bound applications like batch processing, high-performance web servers, and dedicated gaming servers. Memory Optimized (e.g., R5, X1): High memory-to-CPU ratio. Built for memory-bound workloads like large in-memory databases (SAP HANA), high-performance relational databases, and real-time big data analytics. Accelerated Computing (e.g., P4, Inf1): Uses hardware accelerators (GPUs or FPGAs). Required for machine learning model training, 3D rendering, and computational fluid dynamics. Storage Optimized (e.g., I3, D3): Very high sequential read/write access to local storage. Suited for NoSQL databases (like Cassandra), data warehousing, and distributed file systems. EC2 Purchasing Options Domain 4 (Design Cost-Optimized Architectures) heavily tests …

3. Storage Solutions & Data Lifecycle

The Storage Spectrum: Block, File, and Object A media production company needs to migrate a 500 TB video archive to AWS. Simultaneously, they need a shared file system for their video editing team working on high-resolution footage, and they require a low-latency database volume for their rendering pipeline metadata. If you default to a single storage service for all three, the architecture will either fail technically or bankrupt the company. As we saw in the Compute Services Deep Dive, compute instances require storage to function, but the type of storage you choose dictates your system's performance, scalability, and cost. For the AWS Solutions Architect exam, storage selection falls heavily under Domain 3: Design High-Performing Architectures (24%) and Domain 4: Design Cost-Optimized Architectures (20%). To map the right service to the right workload, you must differentiate between the three foundational storage types: Block Storage (EBS, Instance Store): Data is split into evenly sized blocks. It offers the lowest latency and highest performance. Block storage is tied to a single compute instance at a time (with some multi-attach exceptions). Use case: Boot volumes, databases, enterprise applications requiring low-latency IOPS. File Storage (EFS, FSx): Data is stored as files in a hierarchical directory structure. It allows multiple compute instances to access the shared file system concurrently over standard network protocols (NFS/SMB). Use case: Shared directories, content management systems, home directories, lift-and-shift enterprise applications. Object Storage (S3): Data is stored as flat objects in buckets, accompanied by metadata. It is infinitely scalable, highly durable, and accessed via APIs over HTTP. It cannot be mounted as a drive. Use case: Static assets, backups, data lakes, media files, archives. Amazon S3: Object Storage and Lifecycle Management Amazon S3 (Simple Storage Service) is the backbone of AWS data storage. It provides 11 9s of durability (99.999999999%), meaning if you store 10 million objects, you can expect to lose one every 10,000 years. For the exam, the core challenge is selecting the correct S3 storage class to satisfy Domain 4 (Cost-Optimized Architectures) without violating performance requirements. Selecting S3 Storage Classes Exam questions will present a scenario with specific access patterns and ask you to choose the most cost-effective tier. Memorize the trigger conditions for each class: S3 Standard: For frequently accessed data (millions of requests per month). Low latency, high throughput. Default choice for active workloads. S3 Standard-IA (Infrequent Access): For data accessed less than once a month but requires rapid access when needed. Cheaper storage cost than Standard, but charges a per-GB retrieval fee. S3 One Zone-IA: Data stored in a single Availability Zone. Costs 20% less than Standard-IA. Ideal for easily recreatable data or secondary backups where losing an AZ is an acceptable risk. S3 Glacier …

4. Networking Foundations: VPC Design

Anatomy of a Multi-Tier VPC A leading e-commerce platform launches a flash sale. Within minutes, traffic triples. The application tier scales seamlessly, but the database tier—exposed to the internet via a misconfigured route table—becomes the target of a brute-force DDoS attack. The site goes down. This scenario plays out frequently when architects treat the Virtual Private Cloud (VPC) as a simple connectivity wrapper rather than a primary security boundary. As established in Domain 1: Design Secure Architectures (30%), network isolation is your first line of defense. Designing a robust VPC architecture requires precise control over traffic flow, subnet categorization, and routing. CIDR Block Strategy and Subnet Design Before provisioning anything, you must define your IP addressing strategy. A VPC requires a primary IPv4 CIDR block (ranging from /16 to /28). Subnet Tiers To achieve layered security, subnets are categorized by their traffic routing capabilities: Public Subnets: Contain resources that must be directly accessible from the internet (e.g., Application Load Balancers, NAT Gateways, bastion hosts). Private Subnets: Contain resources that initiate outbound internet traffic but should not accept inbound connections (e.g., application servers, API endpoints). Isolated Subnets: Have no path to or from the internet. Traffic is strictly contained within the VPC or routed via specific endpoints (e.g., databases, backend message queues). Multi-AZ Resilience To satisfy Domain 2: Design Resilient Architectures (26%), you must distribute these tiers across at least two Availability Zones (AZs). A VPC spans all AZs in a region, but a subnet is inherently bound to a single AZ. The Context: A company is deploying a three-tier web application. The Constraint: The architecture must survive the loss of a single data center. The Solution: Deploy public, private, and isolated subnets across two AZs (e.g., us-east-1a and us-east-1b), ensuring Auto Scaling groups for the application and database layers span both AZs. Exam tip: AWS reserves the first four IP addresses and the last one in every subnet (the .0, .1, .2, .3, and .255 for a /24). Do not size your subnets too tightly if you expect high-density EC2 deployments. Controlling Traffic Flow: Gateways and Route Tables A subnet becomes "public" or "private" not by a checkbox, but by its route table configuration. Route tables dictate where network traffic from a subnet is directed. Internet Gateways (IGW) An IGW is a highly available VPC component that allows communication between instances in your VPC and the public internet. It performs 1:1 NAT mapping for instances with public IP addresses. A VPC only has one IGW, but it serves all AZs. NAT Gateways For instances in private subnets to reach the internet for patching or external API calls, you need a NAT Gateway. Placement: Deploy the NAT Gateway in the public …

5. Advanced Networking & Content Delivery

Global DNS Routing with Amazon Route 53 Your users in Tokyo are complaining about slow application response times. Your users in London are reporting the same. You have application instances running in both regions, but traffic is unevenly distributed, causing some servers to be overwhelmed while others sit idle. This is a classic Domain 3 (Design High-Performing Architectures) scenario. In Networking Foundations: VPC Design, we built isolated networks within a single region. Now, we scale that architecture globally. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. While it performs standard DNS translation (routing user requests to the correct IP address), its true power for the Solutions Architect exam lies in its routing policies. Choosing the correct routing policy is a frequent exam challenge. The key to answering these questions is identifying the specific Constraint in the prompt. Let’s break down the policies you must know. Simple and Weighted Routing Simple routing is the default. You use it when you have a single resource that performs a given function for your domain (e.g., a single web server). You can route to multiple IP addresses, but Route 53 will randomly return one of those IPs, and you cannot specify health checks for individual records. Weighted routing allows you to assign a relative weight to your DNS records. Route 53 sends traffic to resources based on those ratios. Exam Application: Weighted routing is the go-to answer for A/B testing. If you want to test a new application version, you can send 10% of your traffic to the new stack and 90% to the stable stack. It is also used for phased migrations, gradually shifting traffic from an on-premises environment to AWS. Latency-Based Routing If your application is hosted in multiple AWS regions, latency routing ensures that users are routed to the region that provides the lowest latency. Exam Application: Do not confuse latency routing with geolocation. Latency routing does not care where the user is physically located; it cares about which AWS region responds fastest to them. A user in New York might be routed to the us-east-1 region, while a user in London is routed to eu-west-2. If the prompt emphasizes "fastest response time" or "minimizing delay" across global regions, this is your answer. Failover Routing Failover routing is explicitly designed for high availability (Domain 2: Design Resilient Architectures). You configure an active record and a passive record. The active record is associated with a health check. As long as the active resource passes the health check, Route 53 routes all traffic there. If it fails, Route 53 automatically routes traffic to the passive, standby resource. Exam Application: Look for keywords like "disaster recovery," …

6. Database Services Selection & Configuration

The Database Crossroads: Relational vs. NoSQL vs. Purpose-Built Imagine you are architecting a new high-traffic e-commerce platform. The checkout process requires strict ACID compliance to ensure no double-charges occur, while the product catalog needs to handle massive read volumes with sub-millisecond latency. If you try to force both workloads into a single traditional relational database, you will either bottleneck the checkout transactions or cripple the catalog's read performance. For the AWS Solutions Architect exam, your primary task in Domain 3 (Design High-Performing Architectures) is selecting the right tool for the right job. AWS offers a spectrum of database services, and passing the exam requires you to quickly differentiate between them based on data structure, scalability needs, consistency models, and operational overhead. Relational Databases: RDS and Aurora Amazon Relational Database Service (RDS) is the managed service for traditional SQL databases like MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. It handles patching, backups, and OS maintenance, reducing the operational overhead compared to running databases on EC2. Amazon Aurora is AWS’s proprietary, cloud-native relational database. It is MySQL and PostgreSQL compatible, but under the hood, it decouples the compute layer from the storage layer. High Availability vs. Read Scaling A common exam trap is confusing Multi-AZ deployments with Read Replicas. Understanding the distinction is critical for Domain 2 (Design Resilient Architectures): Multi-AZ (Disaster Recovery & High Availability): RDS provisions a synchronous standby replica in a different Availability Zone. If the primary database fails, RDS automatically fails over to the standby with no manual intervention. The standby is not used for read traffic; it simply sits there waiting to take over. Read Replicas (Performance & Scaling): Read replicas are asynchronous copies of your primary database. You can deploy them in the same AZ, across AZs, or even cross-region. Because they are asynchronous, replication lag can occur. Applications can route read-heavy queries (like generating reports) to read replicas, leaving the primary database free to handle write operations. Aurora's Unique Architecture: Because Aurora separates compute from storage, it handles high availability differently than standard RDS. Aurora stores 6 copies of your data across 3 Availability Zones. Aurora Replicas: Up to 15 low-latency replicas that share the same underlying storage volume as the primary instance. If the primary fails, an Aurora Replica is promoted in seconds—typically 10 to 30 seconds—without requiring a DNS change or storage re-synchronization. Automated Backups: Aurora performs continuous backups to S3 with no performance impact. You can restore to any point in time within the backup retention period (up to 35 days). Exam Application: RDS vs. Aurora The Context: A company is running a MySQL database on RDS. During peak hours, users experience latency when generating complex sales reports. The database must maintain …

7. Security, Identity & Compliance

Identity and Access Management (IAM) Deep Dive In Chapter 1, we established that Domain 1: Design Secure Architectures (30%) carries the heaviest weight on the exam. Security in AWS begins with identity. By now, you know the difference between an IAM user, group, and role. For the Solutions Architect exam, the focus shifts from "what is an IAM policy?" to "how do we architect IAM at scale across complex environments while enforcing least privilege?" Least-Privilege Policy Design Writing a least-privilege policy is straightforward in a single-service architecture, but it becomes complex when services interact. The exam will frequently test your ability to identify when a policy grants too much access or when an implicit deny is overriding an explicit allow. Consider a scenario where an EC2 instance needs to read objects from an Amazon S3 bucket. A junior architect might attach a policy granting s3:GetObject on arn:aws:s3:::data-bucket/. However, if the bucket is encrypted using a customer-managed AWS Key Management Service (KMS) key, the EC2 instance also needs kms:Decrypt permissions. If the policy only grants S3 access, the application fails. The architect must understand the chain of permissions required across services. When evaluating IAM policies on the exam, remember these evaluation rules: 1. Default Deny: No access is allowed by default. 2. Explicit Allow: An allow in an identity-based or resource-based policy grants access. 3. Explicit Deny: A deny in any policy overrides all allows. Cross-Account Access and Resource-Based Policies When resources live in one AWS account and identities live in another, you have two architectural choices: Assume Role or Resource-Based Policies. Assume Role (STS): Account A creates an IAM Role with a trust policy allowing Account B's IAM user to assume it. Account B's user uses AWS Security Token Service (STS) to get temporary credentials. This is the standard approach for cross-account access. Resource-Based Policies: Some services (like S3, SQS, and SNS) support resource-based policies directly attached to the resource. You can attach a policy to an S3 bucket in Account A that explicitly allows an IAM role in Account B to read objects. The critical architectural distinction: when a principal assumes a role in another account, they "switch hats" and drop their original permissions. When a principal accesses a resource via a resource-based policy, they retain their original permissions. If you need a user in Account A to read an S3 bucket in Account B and then write that data to a DynamoDB table in Account A, using a resource-based policy on the S3 bucket is the better architecture, because the user retains their DynamoDB write permissions. Permission Boundaries Permission boundaries are an advanced feature designed for delegation. If you are an administrator and you want to grant a …

8. Application Integration & Event-Driven Architecture

The Decoupling Imperative Imagine an e-commerce platform during a flash sale. A sudden surge of traffic hits the checkout service. If the payment processing service is synchronous and tightly coupled to the checkout service, a slowdown in payment processing will cause thread pools in the checkout service to exhaust, eventually bringing down the entire user-facing application. In Domain 2: Design Resilient Architectures (26%), the exam tests your ability to prevent this exact scenario. The solution is decoupling. By introducing asynchronous messaging, the checkout service can offload payment requests to a queue and immediately return a "processing" response to the user. The payment service processes these requests at its own pace, scaling independently. AWS provides distinct services for decoupling and event-driven architectures. Choosing the right tool requires understanding whether you need point-to-point communication, publish/subscribe fanout, massive real-time data ingestion, or complex workflow orchestration. Message Queues and Pub/Sub: SQS and SNS Amazon Simple Queue Service (SQS) and Amazon Simple Notification Service (SNS) are the foundational building blocks for decoupling microservices. SQS: Standard vs. FIFO SQS is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. The exam will test your knowledge of the two queue types: Standard and FIFO (First-In-First-Out). Standard Queues offer maximum throughput, best-effort ordering, and at-least-once delivery. - Throughput: Nearly unlimited number of transactions per second per API action. - Ordering: Messages are occasionally delivered out of order. If your system requires a strict sequence (e.g., "Insert DB record" before "Update DB record"), Standard queues will eventually cause a race condition. - Delivery: A message might be delivered more than once. Your consumer must be designed to handle duplicates (idempotency). FIFO Queues guarantee exactly-once processing and strict message ordering, but at the cost of throughput. - Throughput: Without batching, limited to 300 transactions per second (TPS). With batching, up to 3,000 messages per second. - Ordering: Strictly preserved. - Delivery: Exactly-once processing. If a consumer successfully processes a message and deletes it, it will never receive it again. - Message Groups: FIFO queues use Message Group IDs to allow parallel processing of multiple ordered streams within the same queue. Messages with the same Group ID are strictly ordered; messages with different Group IDs can be processed concurrently. SNS and the Fanout Pattern While SQS is point-to-point (one producer, one consumer), Amazon SNS is a pub/sub messaging service. A producer publishes messages to an SNS Topic, and multiple Subscribers receive those messages simultaneously. The most tested SNS architecture is the Fanout Pattern. 1. A producer sends a message to a single SNS Topic. 2. The SNS Topic has multiple SQS queues subscribed to it. 3. SNS pushes the message to …

9. High Availability & Disaster Recovery

RTO and RPO: The Core Metrics of Resilience At 02:14 AM, an entire Availability Zone in us-east-1 suffers a catastrophic fiber cut, taking your primary database and compute fleet offline. Your pager goes off. The first question the CTO asks isn't "What broke?" but "When will we be back online, and how much data did we lose?" Disaster Recovery (DR) and High Availability (HA) are not about preventing failures—an impossible task in distributed systems. They are about managing the blast radius of those failures. As we established in the AWS Well-Architected Framework, reliability is about expecting failure and planning for it. To plan effectively, you must quantify your tolerance for downtime and data loss using two critical metrics: - Recovery Time Objective (RTO): The maximum acceptable delay between the interruption of a service and its restoration. It answers: How fast do we need to be back online? - Recovery Point Objective (RPO): The maximum acceptable amount of data loss, measured in time. It answers: How much recent data can we afford to lose? On the AWS Solutions Architect exam, mapping RTO and RPO to specific architectural patterns is a recurring fixture in Domain 2: Design Resilient Architectures (26%). You must be able to look at an RTO/RPO requirement and immediately identify the corresponding DR strategy. The Four DR Strategies AWS defines four primary DR strategies, ranging from lowest cost/complexity to highest cost/complexity. As RTO and RPO approach zero, the cost and complexity of the architecture increase exponentially. 1. Backup and Restore (High RPO, High RTO) Suitable for non-critical workloads where downtime of hours or even days is acceptable. - RPO: Hours to Days. - RTO: Hours to Days. - Mechanism: You regularly back up data to durable storage (like Amazon S3) and only provision infrastructure after a disaster occurs. - Exam Application: Look for scenarios involving AWS Backup, EBS snapshots, and cross-region snapshot replication. If the question mentions restoring from a tape gateway or S3 Glacier, it’s this strategy. 2. Pilot Light (Low RPO, Medium RTO) The core data is replicated to the DR region, but the compute infrastructure is not running. - RPO: Minutes to Hours. - RTO: Hours. - Mechanism: You maintain a scaled-down version of your environment in the DR region. The "pilot light" is typically the database (replicated via cross-region read replicas) and critical data. When a disaster hits, you rapidly provision EC2 instances, Auto Scaling groups, and route traffic to them. - Exam Application: The key clue here is a cross-region read replica for a database combined with AMIs copied to the secondary region, but no running application servers. 3. Warm Standby (Low RPO, Low RTO) A scaled-down, fully functional version of your environment is …

10. Cost Optimization & Resource Management

The $12,000 Midnight Typo A development team launches a 50-node Amazon EC2 cluster to test a distributed database. The test completes successfully at 4:00 PM on a Friday. The engineer meant to tear down the cluster but got distracted, leaving the instances running over the weekend. On Monday morning, the cloud finance lead notices an unexpected spike in compute spend. Because the instances were launched using On-Demand pricing, that single distraction cost the company thousands of dollars. Cloud infrastructure is inherently elastic, but elasticity without governance leads to waste. In Domain 4: Design Cost-Optimized Architectures (20%) of the AWS Solutions Architect exam, you are tested on your ability to design systems that are not just highly available and performant, but financially sustainable. Building on the resiliency requirements of High Availability & Disaster Recovery and the service selections from Compute Services Deep Dive, we now turn to the financial mechanics of AWS. Compute Pricing Models: Matching Spend to Workload Choosing the right pricing model is the fastest way to optimize compute costs. AWS offers four primary models, each mapped to a specific workload behavior. On-Demand On-Demand pricing allows you to pay for compute capacity by the hour or second with no long-term commitments. The Application: Ideal for short-term, spiky, or unpredictable workloads that cannot be interrupted. It is the default for development environments and new applications where usage patterns are unknown. The Anti-Pattern: Using On-Demand for steady-state, 24/7 production workloads. This is the most expensive way to consume AWS compute. Reserved Instances (RIs) Reserved Instances provide a significant discount (up to 72% compared to On-Demand) in exchange for a commitment to a specific instance type, in a specific Availability Zone, for a 1- or 3-year term. Standard RIs: Offer the highest discount but cannot be changed. You are locked into the instance family, size, OS, and tenancy. Convertible RIs: Offer a lower discount but allow you to exchange the RI for another RI with different attributes (e.g., changing from m5.large to m5.xlarge) as long as the new RI is of equal or greater value. The Application: Steady-state production workloads, like the primary nodes of a relational database or a continuous enterprise ERP application. Exam tip: RIs are a billing mechanism, not a physical instance. If you have an RI for an m5.large in us-east-1a, the billing system automatically applies that discount to any matching On-Demand instance you run in that AZ. Savings Plans Savings Plans offer discounts similar to RIs (up to 72%) but provide flexibility. You commit to a specific amount of compute usage (measured in dollars per hour) for a 1- or 3-year term, rather than a specific instance type. Compute Savings Plans: Automatically apply to EC2, Fargate, and …

11. Migration & Hybrid Cloud Architectures

The 6 R's Migration Strategy A global financial services company operates hundreds of applications across two on-premises data centers. Their lease is expiring in 18 months, and leadership has mandated a complete move to AWS. If they simply "lift and shift" everything, they will inherit all their existing technical debt, and their cloud bill will likely double their on-premises costs. To avoid this, they must assess their portfolio using the 6 R's migration strategy. For the AWS Solutions Architect exam, you must be able to map specific application scenarios to the correct migration strategy. The 6 R's provide a standardized framework for portfolio assessment. 1. Rehost ("Lift and Shift"): Moving the application to AWS with little to no modification. Exam trigger: Tight deadlines, migrating legacy systems, or a need to exit a data center quickly. Trade-off: Fastest route to the cloud, but you retain technical debt and may not see immediate cost savings. 2. Replatform ("Lift, Tinker, and Shift"): Making a few targeted cloud optimizations to achieve tangible benefits without rewriting the core architecture. Exam trigger: Moving an on-premises database to Amazon RDS to reduce administrative overhead, or moving an application to AWS Elastic Beanstalk to automate deployments. 3. Repurchase ("Drop and Shop"): Moving from a traditional perpetual license to a Software-as-a-Service (SaaS) model. Exam trigger: Migrating an on-premises CRM to Salesforce, or moving an HR system to Workday. 4. Refactor / Re-architect: Reimagining how the application is architected, often using cloud-native features like microservices and serverless computing. Exam trigger: A strong business need to add new features, scale exponentially, or improve performance that cannot be achieved in the current monolithic architecture. This is the most expensive and time-consuming strategy. 5. Retain: Keeping certain applications on-premises or in their current state. Exam trigger: Applications requiring deep regulatory compliance not yet cleared for the cloud, applications recently rewritten, or applications with dependencies that cannot be migrated yet. 6. Retire: Decommissioning applications that are no longer useful. Exam trigger: Discovery processes often reveal 10-20% of an enterprise IT portfolio is obsolete. Retiring these saves money and reduces the migration scope. Exam Application: Mapping Scenarios to the 6 R's The Context: An enterprise is assessing its application portfolio. One application is a monolithic legacy billing system running on outdated hardware. It is heavily utilized but difficult to maintain. Another application is an internal timesheet tool that the company no longer uses because they adopted a SaaS alternative. The Constraint: The legacy billing system must be migrated within three months to avoid hardware failure, but the business wants to eventually break it down into microservices. The timesheet tool must be dealt with immediately. The Question Stem: Which combination of migration strategies should be applied …

12. Practice Exams & Final Review

The Final Mile: Translating Knowledge into Exam Readiness You have successfully architected a VPC from scratch, navigated the intricacies of IAM policies, mapped out disaster recovery strategies, and optimized multi-tier applications for cost. You know the difference between EBS, EFS, and S3. Yet, despite this hard-earned knowledge, there is a specific type of panic that sets in around question 45 of a 65-question exam when you realize you only have 30 minutes left. Knowing AWS is only half the battle. The other half is endurance, pacing, and psychological stamina. The AWS Solutions Architect exam is as much a test of your reading comprehension and time management under pressure as it is of your cloud architecture skills. This final module is not about learning new AWS services. Instead, it is about pressure-testing the knowledge you have accumulated across the previous eleven chapters, systematically eliminating your weak points, and mastering the logistics of exam day. Building Endurance Through Full-Length Practice Exams A full-length AWS Solutions Architect exam consists of 65 questions to be answered in 130 minutes. This breaks down to exactly two minutes per question. However, questions vary wildly in complexity. A simple recall question about S3 storage classes might take 30 seconds, while a multi-faceted scenario involving a hybrid network migration with specific latency and cost constraints could easily consume four minutes. To build the necessary cognitive endurance, you must complete multiple full-length practice exams under strict, timed conditions. Simulating the Real Environment When you sit down for a practice exam, replicate the actual test environment as closely as possible. Eliminate distractions: No music, no phone, no interruptions. Enforce the clock: Set a timer for 130 minutes. Do not pause it if you need a bathroom break. Use only allowed resources: No Google, no AWS documentation, no notes. Take it at the right time: If your actual exam is scheduled for 9:00 AM, take your practice exams at 9:00 AM to understand how your brain functions at that hour. Your goal in the first practice exam is not necessarily to pass, but to experience the fatigue that sets in around the one-hour mark. Reading dense architectural scenarios requires intense concentration. If you do not build this stamina beforehand, you will find yourself skimming questions during the real exam, missing vital constraints hidden in the text. The Anatomy of a Wrong Answer Taking practice exams builds endurance, but analyzing them builds competency. The most common mistake learners make is taking a practice exam, looking at the score, reading the brief explanation for the questions they missed, and immediately moving on to the next test. This cycle reinforces existing knowledge gaps rather than closing them. Every incorrect answer must be categorized. When …

Continue learning