Details

<p>Introduction xxv</p> <p>Assessment Test xxxi</p> <p>Answers to Assessment Test xxxvii</p> <p><b>Part I The Core AWS Services 1</b></p> <p><b>Chapter 1 Introduction to Cloud Computing and AWS 3</b></p> <p>Cloud Computing and Virtualization 4</p> <p>Cloud Computing Architecture 4</p> <p>Cloud Computing Optimization 5</p> <p>The AWS Cloud 6</p> <p>AWS Platform Architecture 10</p> <p>AWS Reliability and Compliance 13</p> <p>The AWS Shared Responsibility Model 13</p> <p>The AWS Service Level Agreement 14</p> <p>Working with AWS 14</p> <p>AWS Organizations 14</p> <p>AWS Control Tower 15</p> <p>AWS Service Catalog 15</p> <p>AWS License Manager 16</p> <p>AWS Artifact 16</p> <p>The AWS CLI 16</p> <p>AWS SDKs 17</p> <p>Technical Support and Online Resources 17</p> <p>Support Plans 17</p> <p>Other Support Resources 18</p> <p>Migrating Existing Resources to AWS 18</p> <p>AWS Migration Hub 19</p> <p>AWS Application Migration Service 19</p> <p>AWS Database Migration Service 19</p> <p>AWS Application Discovery Service 20</p> <p>Summary 20</p> <p>Exam Essentials 21</p> <p>Review Questions 22</p> <p><b>Chapter 2 Compute Services 25</b></p> <p>Introduction 26</p> <p>EC2 Instances 27</p> <p>Provisioning Your Instance 27</p> <p>Configuring Instance Behavior 32</p> <p>Placement Groups 33</p> <p>Instance Pricing 33</p> <p>Instance Life Cycle 34</p> <p>Resource Tags 35</p> <p>Service Limits 36</p> <p>EC2 Storage Volumes 36</p> <p>Elastic Block Store Volumes 36</p> <p>Instance Store Volumes 38</p> <p>Accessing Your EC2 Instance 39</p> <p>Securing Your EC2 Instance 41</p> <p>Security Groups 41</p> <p>IAM Roles 41</p> <p>NAT Devices 42</p> <p>Key Pairs 42</p> <p>EC2 Auto Scaling 43</p> <p>Launch Configurations 43</p> <p>Launch Templates 43</p> <p>Auto Scaling Groups 45</p> <p>Auto Scaling Options 46</p> <p>AWS Systems Manager 49</p> <p>Actions 50</p> <p>Insights 52</p> <p>AWS Systems Manager Inventory 53</p> <p>Running Containers 54</p> <p>Amazon Elastic Container Service 54</p> <p>Amazon Elastic Kubernetes Service 55</p> <p>Other Container- Oriented Services 55</p> <p>AWS CLI Example 56</p> <p>Summary 57</p> <p>Exam Essentials 58</p> <p>Review Questions 60</p> <p><b>Chapter 3 AWS Storage 67</b></p> <p>Introduction 68</p> <p>S3 Service Architecture 69</p> <p>Prefixes and Delimiters 69</p> <p>Working with Large Objects 69</p> <p>Encryption 71</p> <p>Logging 71</p> <p>S3 Durability and Availability 72</p> <p>Durability 72</p> <p>Availability 73</p> <p>Eventually Consistent Data 73</p> <p>S3 Object Life Cycle 74</p> <p>Versioning 74</p> <p>Life Cycle Management 74</p> <p>Accessing S3 Objects 75</p> <p>Access Control 75</p> <p>Presigned URLs 77</p> <p>Static Website Hosting 77</p> <p>Amazon S3 Glacier 79</p> <p>Storage Pricing 80</p> <p>Other Storage- Related Services 81</p> <p>Amazon Elastic File System 81</p> <p>Amazon FSx 81</p> <p>AWS Storage Gateway 81</p> <p>AWS Snow Family 82</p> <p>AWS DataSync 82</p> <p>AWS CLI Example 83</p> <p>Summary 84</p> <p>Exam Essentials 85</p> <p>Review Questions 86</p> <p><b>Chapter 4 Amazon Virtual Private Cloud (VPC) 91</b></p> <p>Introduction 92</p> <p>VPC CIDR Blocks 92</p> <p>Secondary CIDR Blocks 93</p> <p>IPv6 CIDR Blocks 93</p> <p>Subnets 95</p> <p>Subnet CIDR Blocks 96</p> <p>Availability Zones 97</p> <p>IPv6 CIDR Blocks 99</p> <p>Elastic Network Interfaces 99</p> <p>Primary and Secondary Private IP Addresses 100</p> <p>Attaching Elastic Network Interfaces 100</p> <p>Enhanced Networking 101</p> <p>Internet Gateways 102</p> <p>Route Tables 102</p> <p>Routes 103</p> <p>The Default Route 104</p> <p>Security Groups 106</p> <p>Inbound Rules 106</p> <p>Outbound Rules 107</p> <p>Sources and Destinations 108</p> <p>Stateful Firewall 108</p> <p>Default Security Group 109</p> <p>Network Access Control Lists 110</p> <p>Inbound Rules 110</p> <p>Outbound Rules 113</p> <p>Using Network Access Control Lists and Security Groups Together 114</p> <p>AWS Network Firewall 115</p> <p>Public IP Addresses 115</p> <p>Elastic IP Addresses 116</p> <p>AWS Global Accelerator 118</p> <p>Network Address Translation 119</p> <p>Network Address Translation Devices 120</p> <p>Configuring Route Tables to Use NAT Devices 121</p> <p>NAT Gateway 121</p> <p>NAT Instance 122</p> <p>AWS PrivateLink 123</p> <p>VPC Peering 123</p> <p>Hybrid Cloud Networking 124</p> <p>AWS Site-to-Site VPN 125</p> <p>AWS Transit Gateway 125</p> <p>AWS Direct Connect 133</p> <p>High-Performance Computing 134</p> <p>Elastic Fabric Adapter 135</p> <p>AWS ParallelCluster 136</p> <p>Summary 136</p> <p>Exam Essentials 137</p> <p>Review Questions 138</p> <p><b>Chapter 5 Database Services 143</b></p> <p>Introduction 144</p> <p>Relational Databases 144</p> <p>Columns and Attributes 144</p> <p>Using Multiple Tables 145</p> <p>Structured Query Language 146</p> <p>Online Transaction Processing vs. Online Analytic Processing 147</p> <p>Amazon Relational Database Service 148</p> <p>Database Engines 148</p> <p>Licensing Considerations 149</p> <p>Database Option Groups 150</p> <p>Database Instance Classes 150</p> <p>Storage 151</p> <p>Read Replicas 154</p> <p>High Availability (Multi- AZ) 155</p> <p>Single- Master 156</p> <p>Multi- Master 157</p> <p>Backup and Recovery 157</p> <p>Automated Snapshots 157</p> <p>Maintenance Items 158</p> <p>Amazon RDS Proxy 158</p> <p>Amazon Redshift 159</p> <p>Compute Nodes 159</p> <p>Data Distribution Styles 159</p> <p>Redshift Spectrum 160</p> <p>AWS Database Migration Service 160</p> <p>Nonrelational (NoSQL) Databases 161</p> <p>Storing Data 161</p> <p>Querying Data 161</p> <p>Types of Nonrelational Databases 162</p> <p>DynamoDB 162</p> <p>Partition and Hash Keys 163</p> <p>Attributes and Items 164</p> <p>Throughput Capacity 165</p> <p>Reading Data 167</p> <p>Global Tables 168</p> <p>Backups 168</p> <p>Summary 168</p> <p>Exam Essentials 169</p> <p>Review Questions 170</p> <p><b>Chapter 6 Authentication and Authorization— AWS Identity and Access Management 175</b></p> <p>Introduction 176</p> <p>IAM Identities 176</p> <p>IAM Policies 177</p> <p>User and Root Accounts 178</p> <p>Access Keys 180</p> <p>Groups 181</p> <p>Roles 182</p> <p>Authentication Tools 183</p> <p>Amazon Cognito 183</p> <p>AWS Managed Microsoft AD 183</p> <p>AWS Single Sign-On 184</p> <p>AWS Key Management Service 184</p> <p>AWS Secrets Manager 184</p> <p>AWS CloudHSM 185</p> <p>AWS Resource Access Manager (AWS RAM) 185</p> <p>AWS CLI Example 185</p> <p>Summary 187</p> <p>Exam Essentials 187</p> <p>Review Questions 189</p> <p><b>Chapter 7 CloudTrail, CloudWatch, and AWS Config 193</b></p> <p>Introduction 194</p> <p>CloudTrail 195</p> <p>Management Events 195</p> <p>Data Events 196</p> <p>Event History 196</p> <p>Trails 196</p> <p>Log File Integrity Validation 198</p> <p>CloudWatch 199</p> <p>CloudWatch Metrics 200</p> <p>Graphing Metrics 201</p> <p>Metric Math 203</p> <p>CloudWatch Logs 205</p> <p>CloudWatch Alarms 208</p> <p>Amazon EventBridge 211</p> <p>AWS Config 212</p> <p>The Configuration Recorder 213</p> <p>Configuration Items 213</p> <p>Configuration History 213</p> <p>Configuration Snapshots 213</p> <p>Monitoring Changes 214</p> <p>Summary 216</p> <p>Exam Essentials 216</p> <p>Review Questions 218</p> <p><b>Chapter 8 The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront 223</b></p> <p>Introduction 224</p> <p>The Domain Name System 224</p> <p>Namespaces 225</p> <p>Name Servers 225</p> <p>Domains and Domain Names 226</p> <p>Domain Registration 226</p> <p>Domain Layers 226</p> <p>Fully Qualified Domain Names 227</p> <p>Zones and Zone Files 227</p> <p>Record Types 227</p> <p>Alias Records 228</p> <p>Amazon Route 53 228</p> <p>Domain Registration 229</p> <p>DNS Management 229</p> <p>Availability Monitoring 231</p> <p>Routing Policies 232</p> <p>Traffic Flow 234</p> <p>Route 53 Resolver 234</p> <p>Amazon CloudFront 235</p> <p>AWS CLI Example 237</p> <p>Summary 238</p> <p>Exam Essentials 238</p> <p>Review Questions 239</p> <p><b>Chapter 9 Data Ingestion, Transformation, and Analytics 243</b></p> <p>Introduction 244</p> <p>AWS Lake Formation 244</p> <p>Ingestion 245</p> <p>Transformation 245</p> <p>Analytics 245</p> <p>AWS Transfer Family 246</p> <p>Kinesis 246</p> <p>Kinesis Video Streams 246</p> <p>Kinesis Data Streams 247</p> <p>Kinesis Data Firehose 248</p> <p>Kinesis Data Firehose vs. Kinesis Data Streams 248</p> <p>Summary 249</p> <p>Exam Essentials 249</p> <p>Review Questions 250</p> <p><b>Part II Architecting for Requirements 255</b></p> <p><b>Chapter 10 Resilient Architectures 257</b></p> <p>Introduction 258</p> <p>Calculating Availability 258</p> <p>Availability Differences in Traditional vs. Cloud-Native Applications 259</p> <p>Know Your Limits 262</p> <p>Increasing Availability 262</p> <p>EC2 Auto Scaling 263</p> <p>Launch Configurations 263</p> <p>Launch Templates 263</p> <p>Auto Scaling Groups 265</p> <p>Auto Scaling Options 266</p> <p>Data Backup and Recovery 270</p> <p>S 3 270</p> <p>Elastic File System 271</p> <p>Elastic Block Storage 271</p> <p>Database Resiliency 271</p> <p>Creating a Resilient Network 272</p> <p>VPC Design Considerations 272</p> <p>External Connectivity 273</p> <p>Simple Queue Service 273</p> <p>Queues 274</p> <p>Queue Types 275</p> <p>Polling 276</p> <p>Dead- Letter Queues 276</p> <p>Designing for Availability 276</p> <p>Designing for 99 Percent Availability 277</p> <p>Designing for 99.9 Percent Availability 278</p> <p>Designing for 99.99 Percent Availability 279</p> <p>Summary 280</p> <p>Exam Essentials 281</p> <p>Review Questions 282</p> <p><b>Chapter 11 High-Performing Architectures 289</b></p> <p>Introduction 290</p> <p>Optimizing Performance for the Core AWS Services 290</p> <p>Compute 291</p> <p>Storage 295</p> <p>Database 298</p> <p>Network Optimization and Load Balancing 299</p> <p>Infrastructure Automation 302</p> <p>CloudFormation 302</p> <p>Third- Party Automation Solutions 309</p> <p>Reviewing and Optimizing Infrastructure Configurations 310</p> <p>AWS Well-Architected Tool 311</p> <p>Load Testing 311</p> <p>Visualization 312</p> <p>Optimizing Data Operations 313</p> <p>Caching 313</p> <p>Partitioning/Sharding 315</p> <p>Compression 315</p> <p>Summary 316</p> <p>Exam Essentials 316</p> <p>Review Questions 318</p> <p><b>Chapter 12 Secure Architectures 323</b></p> <p>Introduction 324</p> <p>Identity and Access Management 324</p> <p>Protecting AWS Credentials 325</p> <p>Fine- Grained Authorization 325</p> <p>Permissions Boundaries 327</p> <p>Roles 328</p> <p>Enforcing Service-Level Protection 334</p> <p>Detective Controls 335</p> <p>CloudTrail 335</p> <p>CloudWatch Logs 335</p> <p>Searching Logs with Athena 336</p> <p>Auditing Resource Configurations with AWS Config 338</p> <p>Amazon GuardDuty 339</p> <p>Amazon Inspector 342</p> <p>Amazon Detective 343</p> <p>Security Hub 344</p> <p>Amazon Fraud Detector 344</p> <p>AWS Audit Manager 344</p> <p>Protecting Network Boundaries 344</p> <p>Network Access Control Lists and Security Groups 345</p> <p>AWS Web Application Firewall 345</p> <p>AWS Shield 345</p> <p>AWS Firewall Manager 346</p> <p>Data Encryption 346</p> <p>Data at Rest 346</p> <p>Data in Transit 348</p> <p>Macie 349</p> <p>Summary 349</p> <p>Exam Essentials 350</p> <p>Review Questions 351</p> <p><b>Chapter 13 Cost-Optimized Architectures 357</b></p> <p>Introduction 358</p> <p>Planning, Tracking, and Controlling Costs 358</p> <p>AWS Budgets 359</p> <p>Monitoring Tools 360</p> <p>AWS Trusted Advisor 361</p> <p>Online Calculator Tools 362</p> <p>Cost-Optimizing Compute 363</p> <p>Maximizing Server Density 364</p> <p>EC2 Reserved Instances 364</p> <p>EC2 Spot Instances 365</p> <p>Auto Scaling 368</p> <p>Elastic Block Store Lifecycle Manager 368</p> <p>Summary 368</p> <p>Exam Essentials 369</p> <p>Review Questions 370</p> <p><b>Appendix A Answers to Review Questions 375</b></p> <p>Chapter 1: Introduction to Cloud Computing and AWS 376</p> <p>Chapter 2: Compute Services 377</p> <p>Chapter 3: AWS Storage 380</p> <p>Chapter 4: Amazon Virtual Private Cloud (VPC) 381</p> <p>Chapter 5: Database Services 383</p> <p>Chapter 6: Authentication and Authorization— AWS Identity and Access Management 386</p> <p>Chapter 7: CloudTrail, CloudWatch, and AWS Config 388</p> <p>Chapter 8: The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront 390</p> <p>Chapter 9: Data Ingestion, Transformation, and Analytics 392</p> <p>Chapter 10: Resilient Architectures 393</p> <p>Chapter 11: High-Performing Architectures 397</p> <p>Chapter 12: Secure Architectures 399</p> <p>Chapter 13: Cost-Optimized Architectures 401</p> <p><b>Appendix B Additional Services 405</b></p> <p>Deployment Tools 406</p> <p>AWS Amplify 406</p> <p>AWS Serverless Application Repository 406</p> <p>AWS Proton 407</p> <p>Developer Tools 407</p> <p>Amazon API Gateway 407</p> <p>AWS Device Farm 407</p> <p>AWS Step Functions 407</p> <p>Infrastructure Tools 408</p> <p>AWS Outposts 408</p> <p>AWS Wavelength 408</p> <p>VMware Cloud on AWS 408</p> <p>Connectivity Tools 409</p> <p>Amazon Pinpoint 409</p> <p>AWS Transfer Family 409</p> <p>AWS AppSync 409</p> <p>Database Tools 410</p> <p>Amazon DocumentDB (with MongoDB Compatibility) 410</p> <p>Amazon Keyspaces (for Apache Cassandra) 410</p> <p>Amazon Quantum Ledger Database (QLDB) 410</p> <p>Data Streaming Tools 410</p> <p>Amazon Managed Streaming for Apache Kafka (MSK) 410</p> <p>Amazon MQ 411</p> <p>AWS Data Exchange 411</p> <p>Amazon Timestream 411</p> <p>AWS Data Pipeline 411</p> <p>Amazon AppFlow 411</p> <p>Machine Learning and Artificial Intelligence 412</p> <p>Amazon Comprehend 412</p> <p>Amazon Forecast 412</p> <p>Amazon Lex 412</p> <p>Amazon Polly 412</p> <p>Amazon Rekognition 413</p> <p>Amazon Textract 413</p> <p>Amazon Transcribe 413</p> <p>Amazon Translate 413</p> <p>Other Tools 413</p> <p>AWS Batch 413</p> <p>AWS X-Ray 414</p> <p>Amazon Kendra 414</p> <p>Amazon OpenSearch Service (Amazon Elasticsearch Service) 414</p> <p>Amazon Managed Grafana 414</p> <p>Amazon Managed Service for Prometheus 415</p> <p>Index 417</p>

<p><b>ABOUT THE AUTHOR</b> <p><b>BEN PIPER</b> is an IT consultant who has created more than 30 educational courses covering Amazon Web Services, networking, and automation. Learn more about Ben from his website at www.benpiper.com. <p><b>DAVID CLINTON</b> is a system administrator, teacher, and writer. He has created training material for subjects including Linux systems, cloud computing (AWS in particular), and container technologies like Docker. David has written books on AWS, Linux administration, and server virtualization. Many of his video training courses can be found on Pluralsight.com.

<p><b>Your Comprehensive Guide to the SAA-C03 Exam</b> <p>The AWS Certified Solutions Architect Associate (SAA-C03) Exam certification is intended for individuals who perform in a solutions architect role. This exam validates your ability to effectively demonstrate knowledge of how to architect and deploy secure and robust applications on AWS technologies. This fully revised <i>AWS Certified Solutions Architect Study Guide, Fourth Edition</i> contains robust and effective study tools that will help you succeed on the SAA-C03 exam. Carefully organized and covering every exam essential, it provides an assessment test to help you focus your study as well as detailed summaries and review questions in each chapter. You’ll also have access to the exclusive Sybex online learning environment with hundreds of practice questions, electronic flashcards, and a glossary of terms. It’s the smart way to prepare for the exam. <p><b>Coverage of 100% of all exam objectives in this Study Guide means you’ll be ready to:</b> <ul><li>Design secure architectures</li> <li>Design resilient architectures </li> <li>Design high-performing architectures </li> <li>Design cost-optimized architectures</li></ul> <p><b>ABOUT THE AWS SOLUTIONS ARCHITECT CERTIFICATION</b> <p>The AWS Certified Solutions Architect - Associate (SAA-C03) certification is intended for individuals who perform in a solutions architect role. The exam validates a candidate’s ability to use AWS technologies to design solutions based on the AWS Well-Architected Framework. <p><b>Interactive learning environment</b> <p>Take your exam prep to the next level with Sybex’s superior interactive online study tools. To access our learning environment, simply visit <b>www.wiley.com/go/sybextestprep,</b> register your book to receive your unique PIN, and instantly gain one year of FREE access after activation to: <ul><li><b>Interactive test bank</b> with 900 practice questions to help you identify areas where further review is needed. Get more than 90% of the answers correct, and you’re ready to take the certification exam.</li> <li><b>100 electronic flashcards</b> to reinforce learning and last-minute prep before the exam</li> <li><b>Comprehensive glossary in PDF format</b> gives you instant access to the key terms so you are fully prepared</li></ul>

US