AWS Certified Solutions Architect Operational Excellence, Monitoring, and Governance Syllabus

Operational Excellence, Monitoring, and Governance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Operational Excellence, Monitoring, and Governance in AWS Certified Solutions Architect, not a summary of it.

1. 1

   Monitoring and Observability

   3 topics

   • Metrics, Logs, and Alarms
     • CloudWatch metrics, dashboards, and alarms
     • CloudWatch Logs and Logs Insights
     • Custom metrics and metric filters
   • Tracing and Auditing
     • AWS X-Ray distributed tracing
     • AWS CloudTrail event history and trails
     • AWS Config resource compliance tracking
   • Automated Response
     • EventBridge-driven remediation
     • CloudWatch alarms triggering Auto Scaling and SNS
2. 2

   Infrastructure as Code and Automation

   3 topics

   • Provisioning Infrastructure
     • CloudFormation stacks, templates, and change sets
     • Nested stacks and StackSets across accounts
     • AWS CDK overview
   • Configuration and Operations Management
     • Systems Manager (Run Command, Patch Manager, Session Manager)
     • Elastic Beanstalk managed deployments
   • Deployment Strategies
     • Blue/green and canary deployments
     • Rolling updates and immutable infrastructure
3. 3

   Exam Readiness and Scenario Analysis

   3 topics

   • Exam Structure and Strategy
     • SAA-C03 domains and weightings
     • Question types and elimination techniques
     • Time management and flagging questions
   • Scenario-Based Decision Making
     • Mapping requirements to the right AWS service
     • Balancing cost, performance, security, and resilience
     • Identifying least-privilege and most-cost-effective answers
   • Practice and Review
     • Working through full-length practice exams
     • Reviewing AWS whitepapers and FAQs

Operational Excellence, Monitoring, and Governance flashcards for AWS Certified Solutions Architect

22 of 51 cards from the Operational Excellence, Monitoring, and Governance deck — real questions with worked answers.

1. In Amazon CloudWatch, what is the difference between a standard metric and a custom metric?

   Standard metrics are published automatically by AWS services (e.g., EC2 CPUUtilization). Custom metrics are application-defined values you publish via PutMetricData (e.g., memory usage, queue depth, business KPIs).

2. What is the default (standard) resolution and the high-resolution granularity for CloudWatch custom metrics?

   Standard resolution metrics have 1-minute granularity. High-resolution custom metrics support down to 1-second granularity (1, 5, 10, 30, or 1 second periods).

3. Why are EC2 memory and disk-space utilization not available as standard CloudWatch metrics, and how do you collect them?

   They live inside the guest OS and are invisible to the hypervisor, so AWS cannot see them. You collect them by installing the CloudWatch Agent (or legacy scripts) to publish them as custom metrics.

4. What are the three states of a CloudWatch alarm?

   OK (metric within threshold), ALARM (threshold breached), and INSUFFICIENT_DATA (not enough data to determine state, e.g., the metric just started or data is missing).

5. What does a CloudWatch alarm's 'Evaluation Period' and 'Datapoints to Alarm' (M out of N) control?

   The evaluation range is N consecutive periods; the alarm triggers when M of those N datapoints breach the threshold. This 'M out of N' setting reduces false alarms from transient spikes.

6. What three action types can a CloudWatch alarm invoke when it changes state?

   Notification actions (publish to an SNS topic), Auto Scaling actions (scale a group), and EC2 actions (stop, terminate, reboot, or recover the instance).

7. In CloudWatch Logs, what is the relationship between a log group and a log stream?

   A log group is a container that shares retention, monitoring, and access settings; a log stream is a sequence of log events from the same source (e.g., one EC2 instance or container) within that group.

8. What is a CloudWatch Logs metric filter used for?

   It scans incoming log events for a pattern (e.g., 'ERROR' or a status code) and converts matches into a numeric CloudWatch metric, which you can then alarm on.

9. What is CloudWatch Logs Insights?

   An interactive query service that lets you search and analyze log group data using a purpose-built query language with commands like fields, filter, stats, and sort.

10. What is the default retention period for CloudWatch Logs if you do not configure it?

    Logs are retained indefinitely (Never Expire) by default; you must explicitly set a retention policy (1 day to 10 years) to control storage cost.

11. What is AWS X-Ray and what problem does it solve?

    X-Ray is a distributed tracing service that traces requests as they travel through microservices, helping you analyze performance bottlenecks, latency, and errors across a distributed application.

12. In AWS X-Ray, what is the difference between a segment and a subsegment?

    A segment records data about the work done by a single service/resource for a request; subsegments break that segment into finer-grained units (e.g., individual downstream calls like a DynamoDB query).

13. What is the X-Ray service map?

    A visual graph of your application's services and their connections, showing latency, request rates, and error/fault rates between nodes to help locate problem areas.

14. What does AWS CloudTrail record?

    CloudTrail records API calls and account activity (who did what, when, from where) across your AWS account for governance, compliance, and operational/security auditing.

15. Compare AWS CloudTrail and Amazon CloudWatch in one sentence each.

    CloudTrail answers 'who made which API call' (auditing/governance). CloudWatch answers 'how is my resource performing' (metrics, logs, alarms / monitoring).

16. What are CloudTrail management events vs. data events?

    Management events log control-plane operations (e.g., creating an EC2 instance, configuring security). Data events log data-plane, high-volume operations (e.g., S3 GetObject, Lambda Invoke) and are not logged by default.

17. For an organization-wide, tamper-evident audit trail of all regions, what CloudTrail configuration do you use?

    Create an organization trail that is multi-region, delivering to a centralized S3 bucket with log file validation enabled (and ideally SSE-KMS and MFA delete).

18. What is AWS Config and what does it track?

    AWS Config records the configuration of your AWS resources over time, giving a configuration history and timeline, and continuously evaluates resources against desired-state rules for compliance.

19. What is the difference between AWS Config and AWS CloudTrail?

    AWS Config tracks the state/configuration of resources and whether it complies with rules; CloudTrail tracks the API actions/events that changed them. Config = 'what does it look like now/over time', CloudTrail = 'who changed it'.

20. What is an AWS Config rule, and what are the two evaluation trigger types?

    A Config rule represents desired configuration settings. It can be triggered by configuration changes (evaluated when a resource changes) or periodically (evaluated on a fixed schedule).

21. What is an AWS Config conformance pack?

    A collection of Config rules and remediation actions packaged together as a single deployable entity, used to enforce a compliance/governance baseline across accounts and regions.

22. How can you automatically remediate a non-compliant resource detected by AWS Config?

    Attach an automatic remediation action to the Config rule, which invokes an AWS Systems Manager Automation document (runbook) to fix the resource.

See more Operational Excellence, Monitoring, and Governance flashcards →

Planning Operational Excellence, Monitoring, and Governance for AWS Certified Solutions Architect

Operational Excellence, Monitoring, and Governance (AWS Certified Solutions Architect) FAQ