AWS Certified Solutions Architect – Associate Compute Services Syllabus

What is the difference between IMDSv1 and IMDSv2?

IMDSv1 is a request/response model that is vulnerable to SSRF attacks. IMDSv2 is session-oriented and token-based: you first PUT to obtain a token, then send it in subsequent requests, mitigating SSRF. AWS recommends enforcing IMDSv2.

What is an EC2 Auto Scaling Group (ASG)?

An ASG automatically launches and terminates EC2 instances to maintain a desired capacity across one or more AZs, replacing unhealthy instances and scaling in/out based on demand. It uses a Launch Template (or Launch Configuration) to define instances.

What are the three capacity settings of an Auto Scaling Group?

Minimum (never go below), Desired (target number to maintain), and Maximum (never exceed). The ASG keeps the running count at desired, bounded by min and max.

What are the main Auto Scaling policy types?

Target Tracking (keep a metric like average CPU at a target value), Step Scaling (add/remove capacity in steps based on alarm breach size), Simple Scaling (single adjustment per alarm), and Scheduled Scaling (scale at known times). Predictive Scaling uses ML to forecast demand.

How do ASG health checks and instance replacement work?

The ASG monitors instances via EC2 status checks and optionally ELB health checks. When an instance is marked unhealthy, the ASG terminates it and launches a replacement to maintain desired capacity, enabling self-healing.

What is a launch template and how does it differ from a launch configuration?

Both define instance parameters (AMI, type, key pair, security groups, user data) for an ASG. Launch templates are newer, support versioning, mixed instance types/purchase options, and more features; launch configurations are legacy, immutable, and less capable. AWS recommends launch templates.

What are the three types of Elastic Load Balancers and their OSI layers?

Application Load Balancer (ALB) at Layer 7 (HTTP/HTTPS), Network Load Balancer (NLB) at Layer 4 (TCP/UDP/TLS), and Gateway Load Balancer (GWLB) at Layer 3/4 for third-party virtual appliances. (Classic Load Balancer is the legacy option.)

When should you choose an ALB versus an NLB?

Choose ALB for HTTP/HTTPS with advanced routing (path-based, host-based, headers), microservices, and containers. Choose NLB for ultra-low latency, extreme throughput, static/Elastic IPs, TCP/UDP traffic, or millions of requests per second.

What ALB routing features support microservices architectures?

ALB supports path-based routing (/api vs /images), host-based routing (different domains), HTTP header/method/query-string conditions, and target groups, allowing one ALB to route to multiple services/containers.

What is a target group in Elastic Load Balancing?

A target group is a logical set of registered targets (EC2 instances, IP addresses, Lambda functions, or containers) that an ALB/NLB routes to. It has its own health check configuration, and listeners forward traffic to target groups via rules.

How do health checks enable self-healing with ELB and ASG together?

The load balancer health-checks targets and stops routing to unhealthy ones; when ELB health checks are enabled on the ASG, an unhealthy target is terminated and replaced. Combined with multi-AZ deployment, this creates a fault-tolerant, self-healing tier.

What are the core design principles for a fault-tolerant, self-healing application tier on AWS?

Deploy across multiple Availability Zones, front instances with a load balancer, use an Auto Scaling Group for redundancy and replacement, keep instances stateless (externalize state to RDS/DynamoDB/ElastiCache/S3), and use health checks to detect and replace failures automatically.

What is connection draining (deregistration delay) in ELB?

Connection draining keeps existing in-flight requests to a deregistering or unhealthy target alive for a configured period (default 300s) before fully removing it, preventing dropped connections during scale-in or deployments.

What is Amazon ECS?

Amazon Elastic Container Service is a fully managed container orchestration service that runs, schedules, and scales Docker containers. It uses task definitions, tasks, and services, and can run on EC2 launch type or serverless AWS Fargate.

In ECS, what is the difference between a task definition, a task, and a service?

A task definition is a blueprint (JSON) describing containers, images, CPU/memory, ports, and IAM roles. A task is a running instantiation of a task definition. A service maintains a desired number of running tasks, replaces failures, and integrates with a load balancer.

Compare ECS EC2 launch type vs Fargate launch type.

EC2 launch type: you manage the cluster of EC2 instances (patching, scaling, capacity), giving more control and possibly lower cost. Fargate launch type: serverless, AWS manages the underlying infrastructure; you just specify CPU/memory per task and pay for what tasks consume.

What is Amazon EKS?

Amazon Elastic Kubernetes Service is a managed Kubernetes service. AWS runs and scales the Kubernetes control plane across multiple AZs; you run worker nodes on EC2 (managed/self-managed node groups) or serverless with Fargate. Use it when you want standard Kubernetes/portability.

When would you choose EKS over ECS?

Choose EKS when you need open-source Kubernetes compatibility, portability across clouds/on-prem, the Kubernetes ecosystem (Helm, operators), or existing K8s expertise. Choose ECS for simpler, AWS-native orchestration with less operational overhead.

What is Amazon ECR?

Amazon Elastic Container Registry is a fully managed Docker/OCI container image registry. It stores, manages, and deploys images with integration to ECS/EKS, IAM-based access control, image scanning for vulnerabilities, encryption, and lifecycle policies.

What is AWS Fargate?

AWS Fargate is a serverless compute engine for containers used with ECS and EKS. You define container CPU and memory; AWS provisions, scales, and manages the underlying servers. You pay per vCPU and memory used, with no EC2 instances to manage.

What is AWS Lambda and its core execution model?

AWS Lambda is a serverless, event-driven compute service that runs your code (functions) in response to triggers without provisioning servers. You pay only for compute time consumed. AWS handles scaling automatically by running concurrent function instances.

How is AWS Lambda priced?

Lambda charges based on the number of requests and on duration (GB-seconds): allocated memory multiplied by execution time billed per millisecond. CPU power scales proportionally with allocated memory. There is a perpetual free tier of 1M requests and 400,000 GB-seconds per month.

What are key AWS Lambda limits to remember?

Maximum timeout is 15 minutes; memory ranges from 128 MB to 10,240 MB; /tmp ephemeral storage is 512 MB up to 10 GB; deployment package is 50 MB zipped (250 MB unzipped) or up to 10 GB as a container image; default concurrency limit is 1,000 per region (adjustable).

What is the difference between synchronous and asynchronous Lambda invocation?

Synchronous (e.g. API Gateway, ALB) waits for the function result and returns it to the caller; errors are returned to the caller. Asynchronous (e.g. S3, SNS, EventBridge) queues the event, returns immediately, retries automatically (twice), and can send failures to a dead-letter queue or destination.

How does Lambda integrate with API Gateway and S3 as common patterns?

API Gateway + Lambda builds serverless REST/HTTP APIs (synchronous request/response backends). S3 event notifications trigger Lambda asynchronously on object create/delete for processing like thumbnail generation or data ingestion.

How does Lambda process streams from Kinesis or DynamoDB Streams?

Lambda uses an event source mapping to poll the stream and invoke the function in batches (poll-based). Records are processed in order per shard; on error the batch is retried until success or expiry, which can block the shard unless failure handling (bisect, on-failure destination) is configured.

What is Lambda provisioned concurrency and why use it?

Provisioned concurrency pre-initializes a set number of execution environments so they are ready to respond immediately, eliminating cold-start latency for latency-sensitive applications. You pay for the provisioned capacity whether used or not.

What is the difference between Lambda@Edge and CloudFront Functions?

Both run code at CloudFront edge locations. CloudFront Functions are lightweight, ultra-low-latency JavaScript for high-volume viewer request/response manipulation (header/URL rewrites, sub-millisecond, no network access). Lambda@Edge supports Node.js/Python, longer execution, network and origin access, and runs at all four CloudFront trigger points for heavier logic.

What are the four CloudFront trigger events Lambda@Edge can use?

Viewer Request (before cache lookup), Origin Request (before request to origin on cache miss), Origin Response (after origin responds), and Viewer Response (before returning to viewer). CloudFront Functions only run on Viewer Request and Viewer Response.

What is AWS Batch and when is it used?

AWS Batch is a fully managed service for running batch computing jobs at any scale. It dynamically provisions the optimal compute (EC2, including Spot, or Fargate) based on job requirements, handling queuing, scheduling, and scaling. Use it for large-scale parallel/HPC batch workloads like simulations and data processing.

What is AWS Elastic Beanstalk and what is its key benefit?

Elastic Beanstalk is a Platform-as-a-Service that automatically handles deployment, capacity provisioning, load balancing, auto scaling, and health monitoring for web apps. You upload code and Beanstalk provisions the underlying EC2, ELB, and ASG, while you retain full control of the AWS resources it creates and pay only for those resources (Beanstalk itself is free).