All You Need to Know for AWS Solutions Architect - Associate Exam

Exam Anatomy

The AWS Solutions Architect - Associate exam consists of 65 total questions, including 15 unscored items. The format includes multiple choice (one correct answer from four options) and multiple response questions (two or more correct answers from five options). Most questions follow a scenario-based format, presenting real-world situations that require architectural decision-making.

To pass, candidates need a minimum score of 720, with each question weighted at 15-16 points depending on exam difficulty. There is no penalty for incorrect answers, making it important to attempt all questions.

The exam is divided into four domains:

• Design Resilient Architectures (30%)
• Design High-Performing Architectures (28%)
• Design Secure Applications and Architectures (24%)
• Design Cost-Optimized Architectures (18%)

AWS Global Infrastructure

When selecting regions, consider latency, pricing, service availability, and compliance requirements.

Security and Shared Responsibility Model

AWS maintains "Security of the cloud" while customers are responsible for "Security in the cloud." This distinction clarifies that AWS secures infrastructure while customers must secure their applications and data.

Role-Based Access Control Best Practices

1. Lock down the AWS root user
2. Follow the principle of least privilege
3. Use IAM appropriately
4. Use IAM roles when possible
5. Consider using an identity provider
6. Consider AWS SSO

Compute Services

AWS offers multiple compute options:

Virtual Machines (EC2) — default limit of 20 instances per region; instance types identified by family (e.g. c5) and capacity size (e.g. large); consider vCPU, memory, storage, and network bandwidth when selecting instances.

Container Services — ECS and EKS support both EC2 and Fargate deployment options.

Serverless (Lambda) — best for short-running automation tasks.

EC2 Instance Lifecycle

Instances progress through states: pending, running, stopping, stopped, shutting-down, and terminated. Billing begins when an instance reaches the running state. Rebooting spawns instances on new underlying hardware, clearing instance store data. Stopping instances retains private IPs but assigns new public IPs. Terminated instances lose all associated IPs and storage.

Reserved and Spot Instances

Reserved Instances provide discounts with commitment periods of 1 or 3 years, from All Upfront (highest discount) to No Upfront (lowest discount). Spot pricing includes nuances: AWS-terminated instances in the first hour incur no charges, but user-initiated terminations always result in payment.

Networking

VPCs function at the regional level and support up to five /16 IPv4 ranges plus one IPv6 block per VPC. Network ACLs operate at the subnet level and are stateless; Security Groups operate at the instance level, are stateful, and cannot create deny rules.

Storage Solutions

EBS optimizes for low-latency operations with a 99.99% uptime SLA; SSD volumes support 4GB-64TB with superior IOPS for random access, HDD volumes range 125GB-16TB with good throughput for sequential access.

S3 implements strong consistency for new objects and offers storage classes from Standard through Glacier Deep Archive, with lifecycle policies to automate tier transitions.

Databases

RDS excels at complex transactions, joins, and ACID compliance — ERP, CRM, financial applications. DynamoDB provides key-value storage with millisecond latency; DocumentDB suits content/catalog/profile workloads; Neptune (graph) excels at recommendation/fraud detection; QLDB maintains immutable ledgers.

Monitoring, HA, and Load Balancing

CloudWatch handles metrics, logs, and alarms. High availability keeps systems operational but possibly degraded; fault tolerance ensures zero user impact — a higher standard. ALB routes at Layer 7 with path/host rules and TLS offloading; NLB handles TCP/UDP/TLS at massive scale with source IP preservation.

Auto Scaling

Components: launch template, Auto Scaling group (VPC, subnets, on-demand/spot mix, capacity), and scaling policies (simple, step, or target tracking).

Security Deep Dive

Shared responsibility: AWS secures the cloud, customers secure what's in it. Data in transit uses HTTPS/SSL, VPN/IPSec; data at rest uses SSE-S3, SSE-KMS, SSE-C, or client-side encryption. AWS KMS integrates broadly; CloudHSM is hardware-based and FIPS 140-2 compliant.

Cost Optimization

Reserved Instances offer up to ~75% discount versus on-demand for steady workloads; Spot Instances offer 30-45% discount for interruption-tolerant workloads. Match pricing models to workload patterns and avoid paying for idle capacity.

Six Migration Strategies

Rehosting (lift-and-shift), Replatforming (lift-tinker-and-shift), Refactoring/Re-architecting, Repurchasing (move to SaaS), Retire, and Retain.

Closing Remarks

After studying, validate knowledge through mock questions and scenario-based practice. AWS Partner Network offers free courses (business email required). Trust your preparation and approach the exam with confidence.