AWS CSA Associate

AWS CSA Associate

1. Building a scalable, fault-tolerant and cost-efficient architecture

   • EC2, Load Balancer, and Storage
     • Payment plans
       • On-Demand instances
         • Pay per hour
         • Dev/Test Env
       • Reserved instances
         • Production-ready , long live apps
         • 1y or 3y agreement, up to 60% discount
       • Spot Instances
         • Bid on the price
         • Apps that termination of an instance won’t cause an issue
         • When price goes above the bid price / not enough capacity, instance will receive a termination notice and will be terminated in 2 mins
     • EC2
       • Instance store data is lost when an instance is restarted / terminated
       • Instance Type
         • Shared Tenancy
           • Multiple instances run on the same hardware (default option)
         • Dedicated Instance
           • A dedicated hardware that runs only a single customer instance
         • Dedicated Host
           • Physical server with full EC2 capacity dedicated to the user
           • Mostly used for Licensing reasons
     • AMI
     • VPC
       • Security Group
         • Stateful filtering
           • Only need to allow inbound, return traffic is allowed
         • EC2 level
         • Only set Allow rules, default is denied
       • NACL
         • Stateless filtering
           • Need to allow in both directions
         • Subnet level
         • Set both Allow & Deny rules
       • Inter-region peering
         • Traffic is encrypted using modern Authenticated Encryption with Associated Data
         • Can use Route 53 private DNS to resolve private IP
         • Cannot reference SGs across an Inter-Region VPC Peering
         • Does not support IPv6
         • Cannot be used with EC2-ClassicLink
           • Allows EC2-Classic instances to communicate with VPC instances using private IP
           • Cannot be linked to more than one VPC at the same time
         • Cannot use NLB, EFS, PrivateLink
       • Soft limits
         • 5 VPCs / acc / region
         • 200 subnets / VPC
         • 5 EIPs / acc / region
         • 1 IGW / VPC

2. Designing secure VPN (applications using AWS Resources), how to use the IA Policies

3. Implementation (for example: how would you implement a two-tier architecture)/ Deployment (how would you migrate resources to AWS )

4. Troubleshooting (example: how would you restore a faulty VM)