AWS Certified Solutions Architect Operational Excellence, Monitoring, and Governance Syllabus

What is an AWS Config conformance pack?

A collection of Config rules and remediation actions packaged together as a single deployable entity, used to enforce a compliance/governance baseline across accounts and regions.

How can you automatically remediate a non-compliant resource detected by AWS Config?

Attach an automatic remediation action to the Config rule, which invokes an AWS Systems Manager Automation document (runbook) to fix the resource.

What AWS pattern provides event-driven automated response to operational events?

Amazon EventBridge (CloudWatch Events) rules match events (or scheduled triggers) and route them to targets such as Lambda functions, SSM Automation, SNS, or Step Functions to take automated action.

What is EC2 Auto Recovery and when does it apply?

A CloudWatch alarm action that automatically recovers an impaired instance (migrating it to new hardware while keeping its instance ID, private IP, and EBS volumes) when a system status check fails due to underlying hardware issues.

What is the difference between an EC2 system status check and an instance status check?

System status check monitors the underlying AWS host/hardware and network (AWS must fix or you recover the instance). Instance status check monitors the software/OS/network config of your instance (you must fix, e.g., reboot).

What is AWS CloudFormation and what core problem does it solve?

CloudFormation is AWS's Infrastructure as Code service: you declare resources in a JSON/YAML template, and it provisions and manages them as a single stack, enabling repeatable, version-controlled deployments.

What are the major sections of a CloudFormation template, and which is the only required one?

Sections include Parameters, Mappings, Conditions, Resources, and Outputs (plus Metadata, Transform). The Resources section is the only required section.

What is a CloudFormation Change Set?

A preview of how proposed changes to a stack will affect running resources (including which will be modified or replaced) before you execute the update.

What are CloudFormation StackSets used for?

To deploy and manage a single CloudFormation stack across multiple AWS accounts and regions from one operation, enabling centralized multi-account governance.

What is the AWS Cloud Development Kit (CDK)?

A framework to define cloud infrastructure using familiar programming languages (TypeScript, Python, Java, etc.); it synthesizes the code into CloudFormation templates for deployment.

How does AWS Elastic Beanstalk relate to CloudFormation?

Beanstalk is a higher-level PaaS that handles provisioning, capacity, load balancing, and health for your app, and it uses CloudFormation under the hood to create the underlying resources.

What is AWS Systems Manager (SSM) and what overarching purpose does it serve?

A unified service for operational management of AWS and on-premises resources, providing visibility and control for configuration, patching, automation, secure access, and parameter storage.

What is the difference between SSM Parameter Store and AWS Secrets Manager?

Both store configuration/secrets. Parameter Store is general config storage (free standard tier, can store SecureStrings) without automatic rotation; Secrets Manager is purpose-built for secrets with built-in automatic rotation, at a per-secret cost.

What does SSM Session Manager provide and what's its key security benefit?

Browser/CLI-based shell access to EC2 and on-prem instances without opening inbound SSH/RDP ports, without bastion hosts, and without managing SSH keys; all access can be logged and audited.

What is an SSM Document, and name the two most common types.

A JSON/YAML definition of actions Systems Manager performs. Command documents (Run Command) run actions on instances; Automation documents (runbooks) orchestrate multi-step operational workflows.

What is SSM Patch Manager?

A Systems Manager capability that automates patching of OS and applications across instances using patch baselines and maintenance windows to control approval rules and timing.

Define the three classic deployment strategies: in-place, blue/green, and canary.

In-place updates the existing servers directly (downtime/risk). Blue/green deploys a parallel new (green) environment and switches traffic from old (blue). Canary releases the change to a small subset of traffic first, then ramps up.

What is the key rollback advantage of a blue/green deployment?

Because the old (blue) environment stays intact while the new (green) runs in parallel, rollback is fast and low-risk: you simply shift traffic back to the unchanged blue environment.

What deployment configurations does AWS CodeDeploy support for Lambda and ECS traffic shifting?

Canary (shift a percentage, wait, then shift the rest), Linear (shift equal increments at set intervals), and All-at-once (shift everything immediately).

What is the difference between a rolling deployment and a blue/green deployment?

A rolling deployment updates instances in batches within the same environment (capacity temporarily reduced, gradual). Blue/green stands up a whole separate environment and cuts traffic over, allowing instant rollback.

In a CI/CD pipeline, what roles do AWS CodeCommit, CodeBuild, CodeDeploy, and CodePipeline play?

CodeCommit = source/Git repo; CodeBuild = compile/test/build artifacts; CodeDeploy = deploy to compute targets; CodePipeline = orchestrates the end-to-end source-build-deploy workflow.

How many questions are on the AWS Certified Solutions Architect – Associate (SAA-C03) exam, and how many are scored?

65 questions total; 50 are scored and 15 are unscored evaluation questions that do not affect your result.

What are the two question formats on the AWS SAA-C03 exam?

Multiple choice (one correct answer of four options) and multiple response (two or more correct answers from five or more options).

What is the passing score and scoring range for the AWS SAA-C03 exam?

A scaled score of 720 out of a range of 100–1000 is required to pass; it is a scaled, compensatory score (you don't need to pass each domain individually).

How long is the AWS SAA-C03 exam, and is there a penalty for guessing?

130 minutes. There is no penalty for wrong answers, so you should answer every question—never leave one blank.

List the four domains of the AWS SAA-C03 exam and their weightings.

Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), and Design Cost-Optimized Architectures (20%).

What is an effective exam strategy for long scenario-based questions with similar answer choices?

Read the actual question (last line) first to know what's being asked, identify the key requirement/constraint, then eliminate options that violate it (e.g., cost, latency, 'most secure', 'least operational overhead').

In scenario questions, how do qualifier keywords like 'most cost-effective', 'least operational overhead', or 'highest availability' change your answer?

They are the deciding filter: multiple options may be technically valid, so you must pick the one that best satisfies that specific qualifier (e.g., managed/serverless for least ops overhead; Multi-AZ for availability).

For a scenario requiring decoupling and resilience between application tiers, which AWS services should signal the right answer?

Amazon SQS (queues) for asynchronous decoupling and buffering, and Amazon SNS for pub/sub fan-out—both increase fault tolerance by removing direct, synchronous dependencies.

When a scenario asks for the 'least operational overhead', which type of AWS service should you favor?

Fully managed and serverless services (e.g., Lambda, Fargate, S3, DynamoDB, Aurora Serverless) because AWS handles provisioning, patching, scaling, and maintenance for you.

Why is practicing full-length timed mock exams considered essential preparation for the SAA exam?

It builds time management (roughly 2 minutes per question), exposes weak knowledge domains via score breakdowns, and trains the read-and-eliminate technique under realistic pressure so you can review and close gaps before the real exam.