Required Knowledge To Pass AWS Certified Solutions Architect — Professional Exam

Disclaimer: All the views and opinions expressed in the blog belong solely to the author and not necessarily to the author's employer or any other group or individual. This article is not a promotion for any course or training platform. The sole objective of this article is to help the AWS community to successfully pass this difficult exam. Also, this article is based on my exam experience, which may differ from any other individual's exam experience.

I am a certified AWS Professional Architect, and with this article, I would like to share my experience and the preparations I took to pass this certification exam. I don't want to share the details that you can get from the AWS Professional Architect Certification page; rather, I would share the topics that you would need to know to pass the exam and the type of questions that you can expect during the exam.

My Experience at the Exam

1. All the questions in the exam were scenario based.
2. This exam covers lots of services, and you can get the question on any of the services in AWS that is generally available for 6 months. So, there is a lot of ground to cover especially considering the number of services in the AWS platform. In my experience, the exam expects you to know a lot of services at a high level but doesn't go very deep except for a few core services like VPC, EC2, S3, DynamoDB, etc.

3.  Most of the questions and answers were complex, verbose, and wordy. Roughly you get 2 minutes to answer each question. Time management is the biggest challenge for this exam. So have a clear strategy and complete at least a few practice exams before sitting on the exam. 

4.  I built a strategy for those questions that has a lot of words in both question and answer. I answered very big wordy questions at the end of my exam. Also, once I am confident about an answer, I skipped reading other choices.

5. You must learn to pick the keywords (e.g., high availability/cost-effectiveness/ reliability/scalability/security, etc.) in a question and try to match that in an answer. If you are running out of time, just read the last few sentences of the question and try to understand what is the ask, and then go to the answers directly and try to find out which one is aligned with the ask in the question.
6. I highly recommend requesting a 30-minute exam extension for non-native English speakers when taking an exam in English. Please see the Requesting Accommodations section on the page.

My Preparation for the Exam

1. I went through the A Cloud Gurucourse for the exam. 
   1. The course was good. It had 8 hrs of training videos, sample questions, and pro tips. 
   2. The course was a little bit high level; it assumes that you already know a lot of things that are in the Associate level exams. If you just go through this training, then it might not be enough to pass the exam. 
   3. A Cloud Guru also has Exam Simulator. The questions were extremely difficult in the simulator, but those were a good indication of the questions that you might get in the real exam. Although the exam questions I got were less hard than the ones in the A Cloud Guru Simulator.
2. I have taken AWS Solutions Architect Professional Practice Test by Jon Bonso on Udemy the Practice Tests.
   1. It had 4 Practice exams. 
   2. Questions in this course are good, and very detailed explanations are provided. Also, it helps you in terms of gaining knowledge & overall understanding of the AWS platform. But the questions that will come in the actual exam are a lot more complex and tougher. 
   3. If you buy this practice test, then try to complete these exams between 2-2.5 hrs and try to get more than 90% marks.
3. I sat in as many time-based practice tests as I could. There are many practice tests available over the internet for free.
4. I have gone through all the AWS White papers suggested by A Cloud Guru trainer.
5. I have watched many “This is my Architecture” videos on YouTube in the AWS channel on daily basis. It helped me in understanding how you can solve complex business problems using AWS services.

Required AWS Service Knowledge

You need to know the below topics in order to pass the exam. 

Virtual Private Cloud (VPC)

VPC is basic for passing any AWS exam. You need to know all the components, routing, security, and inner workings of a VPC. Below are some of the key topics that you absolutely need to cover for the exam.

1. Gateway and Interface endpoints, VPC Flow Logs, IPV4 vs. IPV6
2. Internet Gateway vs. Egress Only Internet Gateway
3. NAT Gateway vs. NAT instances
4. NACL vs. Security Groups
5. Private vs. Public Subnets
6. Route Tables and how routes work in an AWS VPC. What is the default route? How different route configurations can impact network path.
7. How to create cost-effective, highly available infrastructure using VPC and subnets.

Amazon Simple Storage Service (S3)

S3 will appear in most of the questions. So, you need to understand S3 and all the features
related to S3 very well.

1. Understand the S3 storage use case and anti-patterns. Also, different storage classes and Lifecycle management.
2. Different encryption levels (SSE-S3 vs. SSE-KMS vs. SSE-C vs. client-side encryption)
3. IAM policy vs. Bucket Policy vs. Object ACL
4. Other S3 features like Versioning, Replication, Static Website hosting, Transfer Acceleration,
   S3 Events, Requester Pays, Cross-origin resource sharing (CORS).

Amazon Elastic Compute Cloud (EC2)

Same as S3, EC2 will appear in many questions. Understanding EC2 is key to passing the exam.

1. Different Instance types and their use cases(On-demand vs. Reserve Instances(RI) vs. Spot Instances). Dedicated Host vs. Dedicated Instance
2. Spot fleet and Spot diversified allocation strategy
3. Regional RI vs. Zonal RI. Standard vs. Convertible vs. Scheduled RI
4. EC2 authentication and regenerating a new key pair and associating with an existing instance.
5. How can you guarantee the capacity reservation in DR or scale-out scenarios
6. What is Elastic IP, and what purpose it solves?
7. How EC2 instance can serve multiple domains on Secure Sockets Layer (SSL)
8. Different Load balancer types, their differences, and their use cases. How Elastic Load Balancer(ELB) supports Server Name Indication (SNI), SSL termination, and cross-zone load balancing.
9. How to build a highly available, scalable, and resilient architecture using Autoscaling Groups. Different scaling policies and their use cases. Cool Down period vs. Warm-up period vs. Health check grace period.
10. Launch Configuration vs. Launch Template

AWS Identity and Access Management (IAM)

1. Difference between resource-based policy and identity-based policy
2. Secure way to perform cross-account access and understand the IAM role usage both in the context of human or service interactions.
3. STS (AssumeRole vs. AssumeRoleWithWebIdentity vs. GetFederationToken)
4. IAM vs. Amazon Cognito and IAM SAML Identity Provider

Amazon Relational Database Service (RDS)

1. Different RDS options are supported.
2. Difference between multi-AZ vs. read replica.
3. You need to know Aurora in great detail and how Aurora is different than other RDS offerings
4. How and why to use database snapshots and database migration using snapshots
5. Why use Reserve Instances for RDS
6. RDS integration with Secrets Manager

Dynamo DB

The key exam topics are below

1. Primary key and sort key, partitioning, and hotkey issue, GSI vs. LSI, scan vs. query performance
2. Auto-scaling vs. on-demand scaling
3. DynamoDB Streams and Dynamo DB Global Database

Networking

The key exam topics are below:

1. VPC to VPC connectivity, VPC to on-prem connectivity
2. VPN vs. Direct Connect(including Direct Connect Gateway) vs. Transit VPC vs. Cloudhub VPN vs. Software VPN vs. Transit Gateway
3. How to build redundant and performance architecture using AWS networking components
4. BGP vs. Static route

AWS Organization

1. What is AWS Organization, and how AWS organization can help in consolidated Billing and RI credit sharing
2. Service Control Policy (SCP Allow Policy vs. SCP Deny Policy) vs. IAM policy

AWS Lambda

1. Supported runtimes, Lambda triggers
2. Lambda basic and VPC settings
3. Concurrency limits and Provision Concurrency
4. SAM in the context of Lambda
5. Lambda logging and troubleshooting using X-Ray (any serverless app)

CloudTrail

1. What is CloudTrail? What details can be logged by CloudTrail, and where can the logs be stored?
2. What are the Digest files? What purpose it is solving?
3. CloudTrail vs. CloudWatch vs. Config

CloudWatch

You need to know CloudWatch in detail, which includes Logs, Events (triggers, actions), Metric, and Alarms.

AWS Config

1. How does config work? What are the use cases and triggers?
2. How can config be used with other AWS services to identify, notify and rectify any non-
   compliant AWS resources?
3. How AWS config can track changes in all the resources in AWS cloud?

Kinesis

1. Different types of Kinesis services and their use cases
2. Kinesis Data Stream vs. Delivery Stream (buffer, storage, ingestion, delivery)
3. Kinesis Analytics and its source and target. How Lambda can be used with Kinesis Analytics?

AWS Migration Services

You need to know different migration services with little depth, understand their use cases, and how you can use them to perform a cloud migration in a secure, reliable, cost-effective way without impacting business.

1. Storage migration (Snowball, Snowball edge, Storage Gateways, S3 sync, Data sync)
2. Server migration (Server Migration Service, Application Discovery Service, VMWare & Hyper-V VM migration to AWS Cloud)
3. Network Migration
4. Database Migration (Database Migration Service and Schema Conversion Tool vs. Native utilities, e.g., mysqldump) considering all different scenarios (heterogeneous vs. homogeneous and on-prem to RDS, on-prem to DB on EC2, RDS to Aurora, EC2 DB to Aurora, etc.)
5. You need to know about the Cloud Adoption Framework and how it can help to formulate a successful cloud migration strategy.
6. Also, know there is a service named AWS Migration Hub where you can discover, assess, plan & track your cloud migration initiatives centrally.

Elastic Beanstalk

1. Understand different deployment methods and list of platforms supported by the service
2. Suitable scenarios to use Elastic Beanstalk compared to other deployment services (code deploy, Cloudformation, etc.)
3. How Blue/Green deployment can be achieved using Elastic Beanstalk

CloudFormation

1. Different sections of a CloudFormation template and their purpose
2. Change Set (what and why), Stack Set (what and why)
3. What is DeletePolicy, and what possible values

CloudFront

You need to know the below topics for CloudFront

1. Use case and anti-pattern
2. SNI on CloudFront, SSL and custom certificate on CloudFront
3. Lambda@Edge (what and why)
4. Origin policy and origin access identity (OAI)
5. Field-level encryption
6. CloudFront signed cookies vs. signed URLs
7. Invalidation and origin Cache-Control max-age or Cache-Control s-max-age directive
8. Match Viewer policy

Route 53

1. Different types of Route53 records(e.g., alias vs. CNAME and their usage)
2. Different types of Routing policies and Route53 health checks
3. Difference between private hosted zone and private hosted zone
4. What is DNSSEC?
5. How a domain transfer works and auto-renewal using Route53

Different Types of Storage Solutions on AWS, Their Usage, High Availability, Durability, and Anti-Patterns

The exam will test you on different storage services on AWS, such as Glacier, Amazon Elastic File System (Amazon EFS), FSx, Amazon Elastic Block Store (Amazon EBS), Instance Store, and In-memory cache (Redis vs. Memcached)

AWS Service Catalog

1. Use case of AWS Service Catalog service, how it is used. What are Portfolios and products?
2. Different types of constraints can be applied in the service catalog
3. How Service Catalog can be used in AWS Organization having a Publishing Account model

Cost Management

1. Difference between Cost Explorer and Budget. How to set automatic notifications using Budget
2. What are the Cost allocation tags? Usage of tags and Resource Groups in terms of cost and resource management
3. AWS Cost Management tools and strategy

Systems Manager

You need to know different offerings under the Systems Manager umbrella at a high level, such as the Parameter Store(how it’s different from Secrets Manager), Session Manager, Automation, Run Command, and State Manager. Also, know Patch Manager in conjunction with Maintenance Window

AWS Directory Services

1. SAML-based Single Sign-On (SSO) using AWS SSO for corporate accounts using on-prem AD
2. Difference between AD Connector and Simple AD and AWS Managed Microsoft AD

AWS Developer Services(at a high level)

You need to understand the different DevOps services available in the AWS platform and their use cases. Services include Code Build, Code Deploy (differences with Elastic Beanstalk, OpsWorks and CloudFormation), Code Pipeline, Code Commit, and Code Star

Amazon Elastic Container Service (ECS)

1. You need to know both of the ECS offerings for EC2 and Fargate
2. Understand what is Task role, Task definition, network modes, and container definition
3. Understand scenarios on when to use ECS vs. EC2 with Auto Scaling vs. Lambda

Amazon Simple Queue Service (SQS) and Amazon Simple Notification Service (SNS)

You need to know SQS with a little more depth than SNS for the exam. 

1. For SQS, know the difference between the standard queue and the FIFO queue. Also, how SQS helps decouple application components, buffer-based integration, smooth application spikes, and how you can build a cost-effective, fault-tolerant architecture using SQS.
2. For SNS, understand what it is and the different types of notification channels available in SNS

Other AWS Services

You need to have some idea about the below services(use cases, what they do etc.) so that if they appear in a question/answer, you have an idea about them.

1. High availability in the context of Storage, Compute, Database & Network
2. DDoS attack mitigation techniques, common network and application layer attacks, and mitigation techniques
3. Difference between AWS Shield Advance vs. Macie vs. Guard Duty vs. Inspector vs. Trusted advisor (understand all different Trusted advisor notifications) in the context of security
4. Different IDS and IPS techniques available in AWS
5. How to implement in-transit and at-rest encryption in AWS. Have an overview of AWS KMS and Certificate Manager
6. API Gateway and its integration/timeout in context with Lambda
7. OpsWorks (focus on OpsWorks Stacks)
8. Difference between Step Function vs. Simple Workflow service vs. AWS Batch
9. AWS IOT landscape (especially AWS Greengrass, IOT Core, and its integration with Kinesis and
   other durable storage and analytics solutions)
10. Data & Analytics services
    1. Have an overview and understanding of the use cases for Amazon EMR, AWS Glue, Athena, Redshift and QuickSight
11. AWS AI and ML services (specially Rekognition, Lex, Poly, and SageMaker at a high level)
12. Other Enterprise Apps on AWS at a high-level
    1. Alexa for Business
    2. AWS AppStream
    3. AWS Workspace
    4. Amazon Worklink
    5. AWS Pinpoint
    6. Amazon Connect
    7. Amazon Mechanical Turk (MTurk)