AWS Certified Solutions Architect Core AWS Services and Global Infrastructure Syllabus

Core AWS Services and Global Infrastructure syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Core AWS Services and Global Infrastructure in AWS Certified Solutions Architect, not a summary of it.

1. 1

   AWS Global Infrastructure

   3 topics

   • Regions, AZs, and Edge Locations
     • Region selection criteria (latency, cost, compliance)
     • Availability Zone isolation and fault domains
     • Edge locations and Local Zones / Outposts / Wavelength
   • Shared Responsibility and Well-Architected
     • AWS Shared Responsibility Model
     • Well-Architected Framework six pillars
     • Well-Architected Tool reviews
   • Service Categories Overview
     • Compute, storage, database, and networking families
     • Managed vs unmanaged service trade-offs
2. 2

   Amazon VPC Networking Foundations

   3 topics

   • VPC Building Blocks
     • CIDR blocks, subnets, and route tables
     • Internet Gateway and NAT Gateway
     • Elastic IPs and elastic network interfaces
   • DNS and IP Addressing
     • Route 53 routing policies (weighted, latency, geolocation)
     • Private hosted zones and Route 53 Resolver
     • IPv6 in VPC design
   • Hybrid Connectivity Foundations
     • VPN and Direct Connect basics
     • Transit Gateway hub-and-spoke topology
3. 3

   Compute and Storage Services

   3 topics

   • EC2 and AMIs
     • Instance lifecycle, AMIs, and user data
     • Key pairs and metadata service (IMDSv2)
   • Storage Service Selection
     • Object vs block vs file storage decision framework
     • Storage Gateway hybrid modes
   • Database Service Selection
     • Relational vs NoSQL workload mapping
     • Migration with AWS DMS and SCT

Core AWS Services and Global Infrastructure flashcards for AWS Certified Solutions Architect

23 of 52 cards from the Core AWS Services and Global Infrastructure deck — real questions with worked answers.

1. What is an AWS Region?

   A separate geographic area containing a cluster of data centers; each Region is isolated and independent, and you choose Regions based on latency, cost, compliance, and service availability.

2. What is an AWS Availability Zone (AZ)?

   One or more discrete data centers within a Region, each with redundant power, networking, and connectivity, physically separated but connected via low-latency, high-bandwidth private links.

3. What is the minimum number of Availability Zones in an AWS Region?

   At least 3 AZs per Region (most Regions have 3 or more).

4. What is an AWS Edge Location?

   A site used by CloudFront and other services to cache content and terminate connections close to users; there are far more Edge Locations than Regions, used for low-latency content delivery.

5. How do you achieve high availability for an application within a single Region?

   Deploy resources across multiple Availability Zones so the failure of one AZ does not take down the whole application.

6. What is a Local Zone in AWS?

   An extension of an AWS Region that places compute, storage, and select services closer to large population/industry centers to deliver single-digit-millisecond latency to nearby users.

7. Under the AWS Shared Responsibility Model, what is AWS responsible for?

   Security 'of' the cloud: the physical hardware, global infrastructure (Regions, AZs, edge), and the underlying compute, storage, database, and networking services.

8. Under the AWS Shared Responsibility Model, what is the customer responsible for?

   Security 'in' the cloud: customer data, IAM, OS/network/firewall configuration, application security, encryption settings, and client/server-side data protection.

9. On a managed service like Amazon RDS, who patches the underlying operating system?

   AWS patches the OS and database engine for managed services like RDS; the customer manages data, access, and configuration. (On EC2, the customer patches the guest OS.)

10. What are the pillars of the AWS Well-Architected Framework?

    Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability (six pillars).

11. Which Well-Architected pillar focuses on minimizing the environmental impact of running cloud workloads?

    The Sustainability pillar.

12. Which Well-Architected pillar covers the ability to recover from failures and meet demand?

    The Reliability pillar.

13. What are the three main service category types in AWS compute, storage, and networking overview?

    AWS services group broadly into Compute (e.g., EC2, Lambda), Storage (e.g., S3, EBS, EFS), and Networking (e.g., VPC, Route 53, CloudFront), plus Databases, Security, and Management categories.

14. What is the difference between IaaS, PaaS, and SaaS examples in AWS?

    IaaS = EC2/VPC (you manage OS and up); PaaS = Elastic Beanstalk/RDS (AWS manages platform); SaaS = fully managed apps like Amazon WorkMail/Chime.

15. Which AWS compute service is serverless and event-driven?

    AWS Lambda runs code in response to events without provisioning or managing servers, billing per request and execution duration.

16. What is a VPC (Virtual Private Cloud)?

    A logically isolated virtual network within an AWS Region where you launch resources, defined by a CIDR block and divided into subnets across AZs.

17. What is the difference between a public and a private subnet?

    A public subnet has a route to an Internet Gateway (resources can reach/be reached from the internet); a private subnet has no direct route to an Internet Gateway.

18. What is an Internet Gateway (IGW) in a VPC?

    A horizontally scaled, redundant VPC component that allows communication between resources in the VPC and the internet; one IGW attaches to one VPC.

19. What is a NAT Gateway used for?

    It lets instances in a private subnet initiate outbound traffic to the internet (e.g., for updates) while preventing the internet from initiating inbound connections to them.

20. What is the difference between a Security Group and a Network ACL?

    A Security Group is stateful and operates at the instance/ENI level (allow rules only); a Network ACL is stateless and operates at the subnet level (allow and deny rules).

21. Are Security Groups stateful or stateless?

    Stateful — if you allow inbound traffic, the response is automatically allowed outbound regardless of outbound rules.

22. What is a route table in a VPC?

    A set of rules (routes) that determines where network traffic from subnets or gateways is directed; each subnet must be associated with one route table.

23. What is a VPC Endpoint?

    A component that lets you privately connect your VPC to supported AWS services without using an Internet Gateway, NAT, or public IPs; types are Gateway endpoints (S3, DynamoDB) and Interface endpoints (powered by PrivateLink).

See more Core AWS Services and Global Infrastructure flashcards →

Planning Core AWS Services and Global Infrastructure for AWS Certified Solutions Architect

Core AWS Services and Global Infrastructure (AWS Certified Solutions Architect) FAQ