AWS Certified Developer - Associate

true

SNS

20 seconds

Enable SQS long polling

30 seconds

ChangeMessageVisibility

Use 2 SQS queues. Poll that payment queue first.

False, SQS messages can be delivered multiple times

30 seconds

Messages can contain up to 256 KB of text in any format

False, SQS was the first

False, they are measured in 1 KB per write.

Eventually Consistent and Strongly consistent

True

Calculate read capacity units (items up to 4 KB in size)
Multiply number of items by read capacity units
Do NOT divide by 2 because strongly consistent
Answer: 100

True

True

True

One strongly consistent read per second. Two eventually consistent reads per second. For items up to 4 KB in size.

Calculate read capacity units (items up to 4 KB in size).
Multiply number of items by read capacity units.
Divide by two because EVENTUALLY consistent.
Answer: 50

True

False, local secondary indexes are fixed at 5 per table.

True

One read capacity unit represents one strongly consistent read per second, for items up to 4 KB in size.
One read capacity unit represents two eventually consistent reads per second, for items up to 4 KB in size.
One write capacity unit represents one write per second for items up to 1 KB in size.

Provisioned throughput limits

Write capacity units are 1 KB per write.
Calculate items per second.
Multiply items per second by writes per item.

Calculate items per second.
Multiply items per second by write capacity units per item.
Answer: 50 provisioned write capacity units

BatchGetItem

Calculate items per second.
Calculate read capacity units per item.
Strongly consistent reads are up to 4 KB per read.
Multiply items per second by read capacity units per item.
Answer: 20 provisioned read capacity units

Calculate items per second.
Calculate read capacity units per item.
Eventually consistent reads give 2 reads for items up to 4 KB.
Answer: 10 provisioned read capacity units

Calculate items per second.
Calculate read capacity units per item (4 KB).
Multiply items per second by read capacity units per item.
If eventually consistent, divide by two.

False, a query is more efficient that a scan in terms of performance.

You have exceeded your maximum allowed provisioned throughput

Tru

Online Transaction Processing (OLTP)

Online analytics processing (OLAP)

False, RDS is Online Transaction Processing (OLTP)

True

True

True

Online Transaction Processing (OLTP) because it is similar to a traditional query. Online Analytics Processing (OLAP) is more of a management tool used at the end of a day.
NoSQL Notes:

NoSQL : RDS
collection: table
document: row
key value pair: fields

_id is required
can embed key value pairs (KVP)

Not a question

No, DynamoDB allow embedded data structures; however, MongoDB does.

Aurora

Yes, developers store session data in Elasticache.

Memcached and Redis

Elasticache

No, they are not public by default

No, the largest is 5GB. After 5 GB you must use multipart upload

5TB

Yes

Cross Origin Resource Sharing (CORS)

ap-southeast-2

Asian Pacific

ap-southeast-1

ap-northwest-1

Tee phrase "s3-website" followed by the region name

https://s3-ap-northeast-1.amazonaws.com/sitename/

No, static hosted websites on S3 do NOT have www in their names

http://eric.s3-website-ap-northeast-1.amazonaws.com

Advanced encryption standard (AES) 256

1 byte

No, the resources they use are.

Yes, ELB is chargeable because it is a service

Yes, you can have multiple certs on an elastic load balancer

No, used to be the case, but now you can encrypt upon creation

Configure encryption when creating the EBS volume

ipconfig (windows)
ifconfig (linux)

True, An EC2 which needs its private and public ip address should Retrieve the instance metadata from http://169.254.169.254.

The request was successful.

There has been a server side error

The resource being accessed is not available on the server

python, ruby, nodejs, php, java

us-east-1

Redshift

1) user auths with facebook first. Theyt are given an id token by facebook

2) an api call to AssumeRoleWithWebIdentity is then used in conjunction with the ID token

3) the user gains temporary credentials

True, The AWS sign in endpoint is https://signin.aws.amazon.com/saml

1) User navigates to Active Directory Federation Services (ADFS)

2) user enters Single Sign On (SSO) credentials

3) user's web browser receives SAML assertion from the AD server

4) user's web browser receives Security Assertion Markup Language (SAML) assertion to AWS SAML endpoint: AssumeRoleWithSAML api request is used to request temporary credentials

5)user is then able to access the AWS console

AssumeRoleWithSAML


Security Assertion Markup Language (SAML)

AssumeRoleWithWebIdentity

Web Identity Ferderation

False, use IAM roles
IAM allows:

1) centralized control of account?
2) integrates with active directory?
3) Fine grained access control to AWS resources?

IAM allows centralized control of account
IAM integrates with active directory
IAM give Fine grained access control to AWS resources
IAM, does NOT do Biometric Auth

True, IAM allows you to manage these 3 things: Users, Groups, Roles

IAM

S3

No, EBS uses block storage

Elastic Block Storage

File based storage

DNS port is 53

Route53

False, there are more edge locations than regions

No, not in terms of EBS and EC2

Availability Zones (AZ)

11

us-east-1 US East (N. Virginia)
us-west-2 US West (Oregon)
us-west-1 US West (N. California)
eu-west-1 EU (Ireland)
eu-central-1 EU (Frankfurt)
ap-southeast-1 Asia Pacific (Singapore)
ap-northeast-1 Asia Pacific (Tokyo)
ap-southeast-2 Asia Pacific (Sydney)
ap-northeast-2 Asia Pacific (Seoul)
ap-south-1 Asia Pacific (Mumbai)
sa-east-1 South America (São Paulo)

Quicksight

Kinesis firehose
Kinesis streams
Kinesis analysis

Elastic Map Reduce (EMR) (Hadoop and spark)
Elasticsearch service

Elastic Map reduce (EMR)

Compute and Networking
Storage and Content delivery
Security and Identity
Database
Analytics
Application
Management tools

Networking Service

Cloudfront

Cloudwatch

An Availability Zone (AZ)

An AWS region

Region is a geographic area.
Availability Zone is an isolated area inside of a region
Regions have multiple Availability Zones

10 items per seconds.
2 reads per item (8 kb).
Eventually consistent, so divide by 2.
Read throughput = 10

5 GB

False, there is no hard limit on how much data you can store on s3.

Cross Origin Resource Sharing (CORS) is not enabled

http://eric.s3-website-ap-southeast-2.amazonaws.com

Disable the source/destination checks on the NAT

Add an elastic ip address to the new instance

1

Get the instance metedata by visiting http://169.254.169.254/latest/meta-data/

True.

EBS is persistent and if an ec2 instance is stopped with an ebs volume attached, there will be no data lost.

Instance store is ephemeral and if the ec2 is stopped, all data will be lost.

False, If you make an ami public, the AMI is NOT immediately available across all regions by default (t/f)

restricting access to data centers
proper destruction of decommissioned disks
patching of firmware

advanced encryption standard (AES) 256

200

route53

C++

us-east-1

true, you can have multiple ssl certs (for multiple domain names) on a single ELB
you run a website which hosts videos and you have 2 types of members, premium and free.

all videos uploaded by both types are processed by a fleet of ec2 instances which will poll sqs as videos are uploaded; however, you need to ensure that premium members have a higher priority.

Create two queues.
program ec2 to poll the premium queue first.

false, you can NOT select a specific availability zone in which to place your dynamo DB table

Configure encryption when creating the ebs volume

False, it provides unlimited storage, but there is a maximum file size

False, amazon s3 buckets in all other regions (other than us standard) DO provide eventual consistency for overwrite PUTS and DELETES (t/f)

false, amazon s3 buckets in all other regions (other than us standard) do NOT provide read after write consistency for PUTS of new objects (t/f)

http://169.254.169.254

retrieve instance metadata from http://169.254.169.254/latest/metadata/

true, it is possible to transfer a reserved instasnce from one availability zone to another

true, every subnet created is automatically associated with the VPCs default network ACL

False, You can have more than 1 subnet attached across multiple availability zones

True, In identity access management (IAM), using security access markup language (SAML) 2.0, you can give federated users single sing on (SSO) access to the aws console.

False, Amazon S3 buckets in the US standard region do provide eventual consistency

Restricting access to datacenters
Proper destruction of decommisioned disks
Patching of firmware for the hardware on which your AWS resources reside

Amazon Relational Database Services (RDS)

False, You are NOT required to patch the operating system (OS) and application in Amazon Relational Database Service (RDS)

Network Access Control List

False, A VPC can only have one internet gateway attached to it

1

5

false, 5 is the default number of VPCs allowed in each AWS region

False, you may have more than one internet gateway (IG) per Virtual Private Cloud (VPC)

True, it is possible to have private subnets in VPC

False, it retains its IP address (weird question)

True, You can associate a network ACL with multiple subnets; however, a subnet can be associated with only one network ACL at a time. When you associate a network ACL with a subnet, the previous association is removed.

False, a subnet can be associated with only one network ACL at a time.

Access Conrtol List (ACL)

True, Network ACLs are an additional layer of security that act at the subnet level?

True, Security groups act like a firewall at the instance level

Virtual Private Cloud

False, both Elastic Beanstalk and Cloud Formation are free, but you must pay for the underlying resources.

Jetty for JBoss application (weird question)

AWS Elastic Beanstalk supports Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker web applications.

False.

An application version points to an Amazon Simple Storage Service (Amazon S3) object that contains the deployable code such as a Java WAR file.

JSON

FN::GetAtt

False, The intrinsic function Fn::GetAZs returns an array that lists Availability Zones for a specified region. Because customers have access to different Availability Zones, the intrinsic function Fn::GetAZs enables template authors to write templates that adapt to the calling user's access. That way you don't have to hard-code a full list of Availability Zones for a specified region.

It will terminate and rollback all resources created on failure.

True, Cloud formation is free; however, the resources it provisioned will be charged at the usual rates

JSON

The decider is a program that controls the coordination of tasks, i.e. their ordering, concurrency, and scheduling according to the application logic.

Workers are programs that interact with amazon SWF to get tasks, process received tasks, and return the results.

True

True

True

True, Messages CAN be customized for each protocol used in SNS.

True, SNS is push based.

True, You can use SNS in conjunction iwth SQS to fan a single message out to multiple SQS Queries

A topic.

False, Messages can NOT be customized for each protocol used in SNS.

FPS.

SNS supported protocols are: Amazon SQS, HTTP/S, email, SMS, Lambda

Amazon SQS, HTTP/S, email, SMS, Lambda

False, SNS is PUSH based.

False, SQS was the first.

Since December 2020, Amazon S3 provides strong read‑after‑write consistency for PUT, overwrite, and DELETE of objects in all regions; new reads reflect successful writes immediately.

When you must transform or filter S3 object data on the fly for a requesting application (e.g., PII redaction, format transformation) without modifying the object at rest.

CloudFront Functions run lightweight JavaScript at viewer requestesponse for ultra‑low latency; Lambda@Edge supports full runtimes, origin events, and richer logic but with higher latency and cold starts.

A single global endpoint that routes to the nearest bucket replica, accelerating cross‑region access and providing automatic failover policies.

When many short‑lived Lambda invocations would otherwise exhaust database connections; RDS Proxy pools and reuses connections, improving scalability and resilience.

Provisioned (predictable traffic, control cost via auto scaling) vs On‑Demand (spikynknown traffic, pay‑per‑request); switch based on traffic patterns and cost control.

In‑memory, microsecond‑latency caching for DynamoDB reads; it offloads read traffic and reduces latency without code changes beyond using the DAX client.

They provide ACID semantics across multiple items and tables via TransactWriteItems/TransactGetItems; operations succeed or fail atomically, often with conditional checks.

Choose Kinesis for ordered, high‑throughput streaming with multiple consumers and replay; choose SQS for at‑least‑once, pull‑based work queues to decouple producers/consumers.

A per‑consumer dedicated 2 MB/s/shard push stream that bypasses shared polling limits, lowering latency for each consumer application.

SNS is topic‑based pub/sub fan‑out; EventBridge is rule‑based event bus with content‑based filtering, schema registry, and routing to many AWS/SaaS targets.

Managed point‑to‑point links from a source (e.g., SQS, Kinesis) to a target (e.g., Lambda, Step Functions) with built‑in filtering, enrichment, and batching.

Use Step Functions for long‑running, stateful, or human‑in‑the‑loop workflows, complex branching, retries, and service integrations without custom orchestration code.

Task, Choice, Parallel, Map (including Distributed Map), Wait, Succeed, Fail, Pass.

Use Provisioned Concurrency, minimize init code, keep packages slim, choose faster runtimes, and keep connections warm (e.g., via RDS Proxy).

15 minutes (900 seconds) per invocation.

More memory proportionally increases vCPU; higher memory often reduces duration (at a higher per‑ms cost).

Place it in private subnets with a NAT Gateway route for 0.0.0.0/0 (or use VPC endpoints to reach AWS services privately).

Mount Amazon EFS via an access point; /tmp is ephemeral and not shared across concurrent invocations.

Grant only the minimum permissions required to perform a task—no more.

Use IAM roles (instance profiles for EC2, execution roles for Lambda) to obtain temporary credentials via STS.

Use AWS Secrets Manager (or SSM Parameter Store) and retrieve at runtime; avoid embedding secrets in code or AMIs.

Customer‑managed symmetric KMS keys can auto‑rotate annually; AWS‑managed keys rotate approximately every 3 years (service‑managed).

Use a Cognito User Pool authorizer to validate JWTs per request; optionally combine with scopes/claims‑based authorization.

HTTP API offers lower latency and cost for most use cases; REST API provides advanced features like usage plans, API keys, and request validation.

A managed GraphQL service with real‑time subscriptions and resolvers for DynamoDB, Lambda, HTTP, and more.

Publish to SNS (or EventBridge) with multiple subscriptions/targets; use filter policies or rules to route selectively.

Subscribers receive only messages whose message attributes match their filter policy, reducing unnecessary processing.

SQS for decoupling with at‑least‑once delivery per consumer; Kinesis for ordered, high‑throughput streams with replay across consumers.

QUERY uses key conditions and indexes and is efficient; SCAN reads every item and is expensive—avoid in hot paths.

LSI (same partition key, different sort key; define at table creation) vs GSI (different partition/sort keys; can add anytime).

Up to 20 GSIs and 5 LSIs per table (limits may evolve; check current docs).

A fully managed, in‑memory cache that reduces read latency from milliseconds to microseconds for DynamoDB workloads.

Choose On‑Demand for unpredictable/spiky workloads; choose Provisioned with auto scaling for predictable workloads and tight cost control.

Standard, Standard‑IA, One Zone‑IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive.

Enable default encryption and add a bucket policy that denies unencrypted PUTs or requires a specific KMS key.

By caching content at edge locations near users; it supports TLS, WAF, custom headers, and origin failover.

Read‑through, write‑through, lazy loading, and TTLs; use ElastiCache (Redis/Memcached) or DynamoDB DAX as appropriate.

CodeCommit (source), CodeBuild (build/test), CodeDeploy (deploy), CodePipeline (orchestration).

Use Lambda aliases with CodeDeploy to shift a small percentage of traffic to a new version, monitor, then increase if healthy.

Phases (install, pre_build, build, post_build), commands, environment variables, artifacts, and caching.

Serverless Application Model—an IaC framework built on CloudFormation that simplifies defining and deploying serverless apps.

Infrastructure as Code framework to define resources in TypeScript/Python/Java/C#/Go; it synthesizes to CloudFormation.

Create a Change Set to see addspdates/deletes before executing the stack.

A query engine for CloudWatch Logs to search, filter, and aggregate logs using a SQL‑like syntax.

Distributed tracing with service maps, segment/subsegment timelines, and per‑request latency/error analysis.

A structured log format that CloudWatch automatically turns into metrics for dashboards and alarms.

One IGW attached per VPC (you can detach/attach, but only one at a time).

An ENI in your subnets that privately connects to supported AWS services without internet/NAT.

A route table target for S3/DynamoDB that keeps traffic on the AWS network without using an IGW/NAT.

Attach AWS WAF to CloudFront/ALB/API Gateway and use managed rule groups (e.g., SQLi/XSS) plus custom rules.

User Pools handle user sign‑up/sign‑in and issue JWTs; Identity Pools exchange identities for temporary AWS credentials via IAM roles.

Safely rolling out application configuration/feature flags with validation, monitoring, and automatic rollback.

A receive operation that waits up to a configured time for messages to arrive (reduces empty responses and cost).

20 seconds (WaitTimeSeconds).

30 seconds (the message is hidden from other consumers during this period).

Call ChangeMessageVisibility for that message to increase the visibility timeout.

Use separate queues (e.g., premium vs standard) and poll the priority queue first; or use priority metadata with multiple consumers.

Yes for Standard queues (at‑least‑once). Build idempotent consumers or use FIFO queues for exactly‑once processing and ordering within a group.

4 days (configurable up to 14 days).

256 KB; use the SQS Extended Client Library to store large payloads in S3 and send pointers.

A queue for messages that fail processing repeatedly; attach via a redrive policy with maxReceiveCount.

One strongly consistent read per second for an item up to 4 KB; eventually consistent reads count as half (two reads per RCU).

One write per second for an item up to 1 KB.

Your DynamoDB request rate or item size exceeded provisioned capacity; implement backoff, optimize access patterns, or use On‑Demand/auto scaling.

Compute items/sec × ceil(itemSize/4 KB) RCUs; if using eventual consistency, divide by 2.

Compute items/sec × ceil(itemSize/1 KB) WCUs.

5 TB.

Required for single uploads larger than 5 GB; recommended for anything over ~100 MB for reliability/performance.

Cross‑Origin Resource Sharing—allowing a browser from one origin to access resources in another bucket/origin per configured rules.

http://<bucket>.s3-website-<region>.amazonaws.com (or regional equivalent).

No—buckets are private by default; use Block Public Access and bucket policies to control access.

SSE‑S3 (AES‑256), SSE‑KMS (with KMS keys and auditability), and SSE‑C (customer‑provided keys).

HTTP 200 OK (or 204 in some SDKs for specific operations).

http://169.254.169.254/latest/meta-data/ (use IMDSv2 where possible).

If you still use a NAT instance, disable source/destination checks; best practice is to use a managed NAT Gateway for availability and scale.

A public IP (or Elastic IP), a default route to an IGW, and security group rules permitting outbound traffic.

NACLs are stateless, evaluated on both inbound and outbound; Security Groups are stateful and evaluated only on the relevant direction.

Each subnet can be associated with only one NACL at a time (though a NACL can associate with multiple subnets).

EBS volumes persist across instance stops; Instance Store is ephemeral and data is lost on stop/terminate.

No—AMIs are regional; copy the AMI to other regions to make it available there.

DNS uses port 53.

AWS's serverless BI service for interactive dashboards and visual analysis.

Metrics, logs, alarms, and dashboards for AWS services and custom apps; use Logs Insights and metrics filters for analysis.

Kinesis Data Streams (streaming), Kinesis Data Firehose (delivery/ETL), Kinesis Data Analytics (SQL/Flink processing).

Managed Hadoop/Spark clusters for large‑scale batch and iterative analytics.

A Region is a geographic area containing multiple AZs; an AZ is one or more discrete data centers within a Region.

Subnets are scoped to a single Availability Zone.

Java, JavaScript/TypeScript (Node.js and browser), Python (boto3), .NET, Go, PHP, Ruby, Kotlin; region/credentials are provided via configuration and the default provider chain.

Specify encryption at volume or snapshot creation (or set accountegion defaults); encryption uses KMS keys.

2xx: success; 4xx: client error (e.g., 404 Not Found); 5xx: server error.

Push‑based; it can fan out to SQS, HTTP/S endpoints, email/SMS, and Lambda.

Publish messages to an SNS topic and subscribe multiple SQS queues to that topic.

Through the IAM instance profile; the instance retrieves temporary credentials from IMDS and the SDKs automatically refresh and use them.

JSON and YAML are both supported; YAML is often preferred for readability and comments.

Returns the value of an attribute from a resource in the same template (e.g., LoadBalancer DNSName).

An array of Availability Zones for the specified region (not regions); helps avoid hard‑coding AZ names.

The stack rolls back and deletes resources created so far unless rollback is disabled.

Elastic Beanstalk is free; you pay for the underlying resources it provisions (EC2, RDS, etc.).

Java, .NET, Node.js, Python, Ruby, Go, PHP, and Docker.

The decider controls task coordination (ordering/concurrency/scheduling); workers poll SWF for tasks, process them, and return results. Step Functions is now preferred for most new workflows.

Grant time‑limited access to private S3 objects without making the bucket public or sharing long‑term credentials.

Use a bucket policy that denies s3:PutObject unless x‑amz‑server‑side‑encryption is present (or requires a specific KMS key).

Simplify managing access for shared datasets with distinct network and policy controls per consumer/application.

Keep traffic private on the AWS network, reduce NAT data processing cost, and remove internet dependencies for S3/DynamoDB/API endpoints that support endpoints.

Usage plans and API keys are for throttling/quota and identifying callers—not authentication/authorization (use Cognito or IAM authorizers for auth).

An architecture where components communicate via events. Instead of direct calls, one component emits events (e.g., messages) that others consume, allowing loose coupling and asynchronous processing.

Microservices break an application into small, independent services that communicate over APIs, whereas a monolithic architecture is a single, unified codebase. Microservices offer better modularity and scalability, while monoliths can be simpler but less flexible.

Orchestration uses a central coordinator (like a workflow engine) to manage service interactions, whereas choreography has each service react to events and coordinate through decentralized event exchanges. Orchestration centralizes control; choreography is more distributed and decoupled.

Fanout is a messaging pattern where a single message is sent to multiple receivers. In AWS, this can be achieved by publishing to an SNS topic that delivers the message to multiple subscribers (such as SQS queues or Lambda functions), thereby 'fanning out' one event to many destinations.

Idempotency is the property of an operation that can be applied multiple times without changing the result beyond the initial application. It's important for fault-tolerant applications, ensuring that retrying a failed request (due to timeouts or errors) doesn't cause unintended side effects (like duplicate processing).

A stateful application maintains data (state) across sessions or requests (often in memory or local storage), whereas a stateless application does not retain data between requests. Stateless applications treat each request independently, which makes them easier to scale horizontally and recover from failures.

Tightly coupled components depend directly on each other's implementations or availability, so a change or failure in one often impacts the other. Loosely coupled components interact through well-defined interfaces or messaging, minimizing dependencies. Looser coupling leads to more resilient and flexible architectures, as components can be changed or replaced with minimal impact.

Using an event queue or topic between services promotes loose coupling. For example, an order processing service can place messages onto an Amazon SQS queue or an SNS topic, and downstream services consume those messages. This way, services don't call each other directly and can operate independently.

They are a fault tolerance strategy for calling services. If a request fails, the client retries it, waiting for increasingly longer intervals (exponential backoff) between retries, and adding a random delay (jitter) to avoid synchronized retries. This reduces load on the service and increases the chance of a successful retry.

A dead-letter queue is a secondary queue to which messages are sent if they cannot be processed successfully by the primary consumer. For example, an AWS Lambda function subscribed to an SQS queue can send failed messages to an Amazon SQS DLQ after exceeding retry attempts, allowing developers to inspect or reprocess them later.

In synchronous processing, a caller waits for an operation to complete and typically receives a response immediately. In asynchronous processing, the caller initiates an operation and continues without waiting; the result is delivered later, e.g., via a callback or message. In AWS, a synchronous example is an API call that returns a result, whereas an asynchronous example is sending a message to a queue to be processed later.

Synchronous example: A client calls an API Gateway endpoint which invokes a Lambda function and returns the result immediately in the HTTP response. Asynchronous example: A client sends a message to an Amazon SQS queue; a Lambda function processes it sometime later, and the client is not blocked waiting for the result.

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You write your function code and Lambda executes it on-demand in response to events, scaling automatically and charging only for the compute time consumed.

Many AWS services can trigger Lambda. Common triggers include Amazon API Gateway (HTTP requests), S3 (object uploads), DynamoDB (table updates via streams), Amazon SQS & SNS (messages), Amazon EventBridge (scheduled or event rules), and more. These event sources either push events to Lambda or are polled by Lambda via event source mappings.

An event source mapping is a configuration that tells Lambda to poll a specific source (such as an SQS queue, Kinesis stream, or DynamoDB stream) and feed events to a Lambda function. It continuously reads new events from the source and invokes the Lambda with those events automatically.

By configuring the Lambda function to connect to the VPC. You assign the Lambda to specific VPC subnets and security groups. Lambda then creates elastic network interfaces (ENIs) in that VPC. This allows it to communicate with resources in private subnets (e.g., RDS databases), though you may need a NAT gateway or VPC endpoints for the function to reach the internet or other AWS services.