AWS Certified Solutions Architect – Associate Storage Services Syllabus

Compare S3 bucket policies, IAM policies, and ACLs as access-control mechanisms.

Bucket policies are resource-based JSON policies attached to a bucket (good for cross-account and public access rules). IAM policies are identity-based, attached to users/roles. ACLs are a legacy fine-grained mechanism at bucket/object level (AWS now recommends disabling ACLs and using policies).

What are the two main categories of S3 server-side encryption and their key managers?

SSE-S3 (keys managed entirely by S3, AES-256, default), SSE-KMS (keys managed in AWS KMS with audit trail and access control), and SSE-C (customer-provided keys). DSSE-KMS provides dual-layer KMS encryption.

What is the default encryption behavior for new S3 objects since 2023?

All new objects are automatically encrypted at rest with SSE-S3 (AES-256) by default at no additional cost, unless another encryption option is specified.

What is an S3 Presigned URL?

A time-limited URL generated with an authorized user's credentials that grants temporary permission to download (GET) or upload (PUT) a specific object, allowing access without making the object public.

What is S3 Transfer Acceleration and how does it speed up transfers?

It speeds up uploads/downloads over long distances by routing traffic through the nearest CloudFront edge location, which then travels to the bucket over the optimized AWS backbone network instead of the public internet.

What S3 request rate performance can a single prefix sustain?

At least 3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per prefix, and performance scales horizontally by using multiple prefixes.

What is S3 Byte-Range Fetch and when is it useful?

Fetching only a specific byte range of an object, enabling parallelized downloads of different parts for speed, or retrieving just the start of a file (e.g., a header) without downloading the whole object.

What is the smallest part size allowed in an S3 multipart upload (except the last part), and the maximum number of parts?

Each part must be at least 5 MB (the last part can be smaller), and an upload can have up to 10,000 parts.

What is Amazon EBS and what is its key scope limitation?

Elastic Block Store provides persistent block-level storage volumes for EC2 instances. A volume can only be attached to instances in the same Availability Zone as the volume (it is AZ-scoped, not Region-wide).

Name the EBS SSD volume types and their primary use cases.

gp3 and gp2 (General Purpose SSD) for boot volumes and general workloads; io2 Block Express and io1 (Provisioned IOPS SSD) for high-performance, latency-sensitive databases requiring sustained high IOPS.

Name the EBS HDD volume types and their use cases.

st1 (Throughput Optimized HDD) for big data, data warehouses, and log processing (throughput-intensive); sc1 (Cold HDD) for infrequently accessed, lowest-cost workloads. HDD types cannot be boot volumes.

How is an EBS snapshot stored and what is its key benefit for portability?

EBS snapshots are stored incrementally in Amazon S3 (managed by AWS). They can be copied across Regions and used to create new volumes in any AZ, making them the mechanism to move EBS data between AZs/Regions.

What is EBS Multi-Attach and which volume types support it?

A feature allowing a single Provisioned IOPS volume (io1/io2) to be attached to up to 16 EC2 instances in the same AZ simultaneously, used for clustered applications that manage concurrent writes.

What is an EC2 Instance Store and why is it called ephemeral?

It is high-performance, physically attached local block storage on the host. It is ephemeral because data is lost when the instance is stopped, terminated, or the underlying hardware fails. It cannot be detached or persisted via snapshots.

When would you choose an EC2 Instance Store over EBS?

When you need very high random I/O performance / low latency for temporary data such as buffers, caches, scratch data, or replicated data where loss on stop/terminate is acceptable.

What is Amazon EFS and what protocol does it use?

Elastic File System is a fully managed, elastic NFS (Network File System v4) file system that can be mounted concurrently by thousands of Linux EC2 instances across multiple Availability Zones in a Region.

Which storage service should you use for a shared file system accessible by many Linux EC2 instances across AZs simultaneously?

Amazon EFS, because it is a regional, multi-AZ shared file system. EBS is single-AZ and (except Multi-Attach io1/io2) attaches to one instance; Instance Store is local and ephemeral.

What are the two EFS storage classes / tiers for cost optimization?

EFS Standard (frequently accessed) and EFS Infrequent Access (EFS-IA), plus archive tiers. EFS Lifecycle Management automatically moves files not accessed for a set period to the cheaper IA/Archive tiers.

What does the Amazon FSx family provide, and name its main members?

Fully managed third-party and high-performance file systems: FSx for Windows File Server (SMB/NTFS), FSx for Lustre (HPC/high throughput), FSx for NetApp ONTAP, and FSx for OpenZFS.

When would you choose Amazon FSx for Windows File Server versus FSx for Lustre?

FSx for Windows File Server when you need Windows-native SMB shares with Active Directory integration and NTFS. FSx for Lustre when you need a high-performance parallel file system for HPC, machine learning, or media processing, often integrated with S3.

What is the difference between FSx for Lustre Scratch and Persistent deployment types?

Scratch is for temporary, short-term processing with no replication (data lost on failure) and highest burst throughput. Persistent replicates data within an AZ, auto-heals failures, and is used for long-term, fault-tolerant storage.

What is AWS Storage Gateway and what is its primary purpose?

A hybrid cloud storage service that connects on-premises environments to AWS cloud storage, giving local applications seamless, low-latency access to virtually unlimited cloud storage (backed by S3, Glacier, EBS, FSx).

Name the three main types of AWS Storage Gateway and their interfaces.

File Gateway (NFS/SMB access to objects stored in S3), Volume Gateway (iSCSI block volumes backed by S3 with EBS snapshots, in cached or stored modes), and Tape Gateway (Virtual Tape Library / VTL replacing physical tape backups, stored in S3/Glacier).

What is the difference between Volume Gateway 'cached' mode and 'stored' mode?

Cached mode stores the primary data in S3 and keeps only frequently accessed data cached on-premises. Stored mode keeps the entire dataset on-premises (low latency) and asynchronously backs it up to S3 as EBS snapshots.

What is AWS DataSync and what does it primarily move?

An online data transfer service that automates and accelerates moving large amounts of data between on-premises storage (NFS, SMB, HDFS, object) and AWS services (S3, EFS, FSx), or between AWS storage services. It preserves metadata and can run scheduled, incremental syncs.

When would you use AWS DataSync instead of the AWS Snow Family?

DataSync for online transfers over a network connection (one-time or recurring/ongoing replication) when you have sufficient bandwidth. Snow Family for offline/physical transfer of very large datasets when network bandwidth is insufficient or too slow/costly.

Name the members of the AWS Snow Family and a rough capacity for each.

Snowcone (small, portable, ~8 TB usable, with DataSync agent), Snowball Edge (Storage Optimized ~80 TB and Compute Optimized variants), and Snowmobile (exabyte-scale, up to 100 PB via a shipping container truck — now retired/legacy).

What two capabilities does Snowball Edge offer beyond storage, and how is data secured?

It offers local compute (EC2 instances and Lambda) for edge processing in addition to storage. All data is automatically encrypted with 256-bit keys managed via AWS KMS, and the device is tamper-resistant.

What is AWS Backup and what problem does it solve?

A fully managed, centralized backup service that automates and consolidates backups across AWS services (EBS, EC2, RDS, DynamoDB, EFS, FSx, Storage Gateway, S3, and more) using backup plans, policies, and a central backup vault.

What AWS Backup features support compliance and immutability?

Backup plans with scheduled policies and retention/lifecycle rules, cross-Region and cross-account copy, AWS Backup Vault Lock (WORM, immutable backups that cannot be deleted before retention expires), and tag-based resource assignment for centralized governance.