About this AWS Solutions Architect – Associate (SAA-C03) AWS Architecture practice test

While lower-level exams check your ability to recall service definitions, SAA-C03 challenges you to act as a seasoned advisor facing ambiguous business dilemmas. The true test of an associate architect is balancing a budget constraint with strict security policies, high availability demands, and sudden spikes in traffic. Rather than relying on memorization cards, passing this exam means learning how to weigh multi-faceted trade-offs. Each scenario in this guide guides you through the process of choosing the single most resilient, cost-effective design out of several highly plausible options.

AWS Certified Solutions Architect – Associate Practice Test sample questions

These starter questions help you launch a aws architecture mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.

1. 1. A company runs a critical application on a single EC2 instance in one Availability Zone. Which change would best protect the application from a complete data center outage?

   • A) Increase the instance size
   • B) Deploy the application across multiple Availability Zones within the Region
   • C) Enable EBS encryption
   • D) Move the instance to a larger EBS volume

2. 2. A company runs Amazon RDS for PostgreSQL and needs the database to fail over automatically to a standby with minimal downtime if the primary fails. What should the solutions architect enable?

   • A) Read replicas in a different Region
   • B) Multi-AZ deployment
   • C) A larger DB instance class
   • D) Automated snapshots every hour

3. 3. An application's EC2 instances are spread across three Availability Zones. Which service should distribute incoming traffic only to healthy instances?

   • A) Amazon Route 53 alone
   • B) An Application Load Balancer with health checks
   • C) A NAT Gateway
   • D) Amazon CloudFront

4. 4. A company must keep a durable, automatically-updated copy of its S3 data in a second AWS Region for disaster recovery. What should it configure?

   • A) An S3 Lifecycle policy to Glacier
   • B) S3 Cross-Region Replication
   • C) A read replica
   • D) EBS snapshots

5. 5. A producer service occasionally sends bursts of requests far faster than a downstream consumer service can process them. Which change decouples the two services and prevents the burst from overwhelming the consumer?

   • A) Increase the consumer's instance size
   • B) Place an Amazon SQS queue between the producer and consumer
   • C) Use a NAT Gateway between the services
   • D) Combine both services into a single instance

6. 6. A company wants a disaster recovery strategy that keeps recovery time and recovery point objectives as close to zero as possible and can accept the additional cost. Which strategy fits?

   • A) Backup and restore
   • B) Pilot light
   • C) Warm standby
   • D) Multi-site active/active

7. 7. Instances behind an Application Load Balancer occasionally stop responding to requests. What should the solutions architect configure to automatically replace them?

   • A) Manual instance restarts
   • B) An Auto Scaling group with ALB health checks
   • C) A larger instance type
   • D) Amazon CloudWatch dashboards only

8. 8. A company serves a global audience from two Regions and wants traffic automatically routed to the nearest healthy Region, failing over if one Region becomes unavailable. Which Route 53 routing policy should be used?

   • A) Simple routing
   • B) Weighted routing
   • C) Latency-based routing with health checks
   • D) Geoproximity routing without health checks

9. 9. A read-heavy web application repeatedly queries Amazon RDS for the same product catalog data. Which addition would reduce database load with the least development effort?

   • A) Add more read replicas only
   • B) Place Amazon ElastiCache in front of the database to cache frequent reads
   • C) Increase the DB instance storage
   • D) Switch to S3 for all reads

10. 10. An application needs a NoSQL database that delivers single-digit-millisecond latency at any scale, without the team managing servers. Which service fits?

    • A) Amazon RDS
    • B) Amazon DynamoDB
    • C) Amazon Redshift
    • D) Amazon EMR

11. 11. A media company wants to reduce latency for users worldwide accessing both static images and dynamic API responses from an origin server. What should they deploy?

    • A) An additional Availability Zone
    • B) Amazon CloudFront in front of the origin
    • C) A larger EC2 instance
    • D) Amazon Route 53 alone

12. 12. An Auto Scaling group should add or remove EC2 instances to keep average CPU utilization near 60%. Which scaling policy achieves this automatically?

    • A) Simple scaling
    • B) Scheduled scaling
    • C) Target tracking scaling
    • D) Manual scaling

13. 13. A big data workload performs large, sequential reads and writes to an EBS volume and needs high throughput rather than high IOPS. Which volume type is most appropriate?

    • A) General Purpose SSD (gp3)
    • B) Provisioned IOPS SSD (io2)
    • C) Throughput Optimized HDD (st1)
    • D) Cold HDD (sc1) used for frequent access

14. 14. A batch-processing job can tolerate interruptions and needs to run at the lowest possible compute cost. Which EC2 purchasing option should the architect choose?

    • A) On-Demand Instances
    • B) Reserved Instances
    • C) Spot Instances
    • D) Dedicated Hosts

15. 15. To let an Auto Scaling group add and remove web servers freely, where should user session data be stored instead of on the local instance?

    • A) On each instance's local disk
    • B) In Amazon ElastiCache or DynamoDB
    • C) In the instance's EBS root volume
    • D) In the AMI used to launch the instance

16. 16. A company manages many AWS accounts and wants centralized billing along with the ability to restrict which services each account can use, regardless of IAM permissions granted within it. Which service should it use?

    • A) IAM users in a single account
    • B) AWS Organizations with service control policies
    • C) Amazon Cognito
    • D) AWS Config rules

17. 17. An application running on an EC2 instance needs to call the S3 API. What is the most secure way to grant it permission without storing long-term credentials on the instance?

    • A) Store an IAM user's access keys in the application code
    • B) Attach an IAM role to the EC2 instance profile
    • C) Hardcode the root account credentials
    • D) Email the credentials to the development team

18. 18. A company must encrypt objects in S3 at rest and retain full control over key rotation and an audit trail of key usage. Which encryption option should it choose?

    • A) SSE-S3 with Amazon-managed keys
    • B) Client-side encryption with no key management
    • C) SSE-KMS with a customer managed CMK
    • D) No encryption, relying on bucket policies

19. 19. Which statement correctly distinguishes a network ACL from a security group in a VPC?

    • A) Security groups are stateless and evaluate rules in order; NACLs are stateful
    • B) NACLs are stateless, evaluate rules in order, and can explicitly deny traffic; security groups are stateful and only allow
    • C) Both are stateful and only allow traffic
    • D) NACLs apply only to EC2 instances, not subnets

20. 20. A company wants to block common web exploits such as SQL injection and cross-site scripting from reaching its public-facing Application Load Balancer. Which service should it deploy?

    • A) AWS WAF
    • B) A network ACL
    • C) AWS Shield Standard
    • D) Security groups alone

21. 21. A team needs Amazon RDS database credentials rotated automatically on a schedule without changing application code every time. Which service manages this?

    • A) AWS Systems Manager Parameter Store
    • B) AWS Secrets Manager
    • C) AWS KMS
    • D) IAM Access Analyzer

22. 22. A company wants to make sure that objects deleted from a versioned S3 bucket cannot be permanently removed without additional authentication. What should it enable?

    • A) S3 Object Lock in governance mode only
    • B) MFA Delete on the versioned bucket
    • C) A bucket policy denying all deletes
    • D) S3 Transfer Acceleration

23. 23. A company serves its S3 content only through Amazon CloudFront and wants to make sure users cannot bypass CloudFront and access the S3 bucket directly. What should it configure?

    • A) A public bucket policy allowing all reads
    • B) Origin Access Control (OAC) with a bucket policy restricting access to CloudFront
    • C) A NAT Gateway in front of S3
    • D) An internet gateway attached to the bucket

24. 24. A company wants to automatically detect unusual API activity, such as calls from an unfamiliar geographic location, that may indicate compromised credentials. Which service should it enable?

    • A) Amazon GuardDuty
    • B) AWS Trusted Advisor
    • C) Amazon Inspector
    • D) AWS Config

25. 25. A company knows a particular EC2 workload will run continuously, 24 hours a day, for the next three years. Which purchasing option minimizes cost for this predictable usage?

    • A) On-Demand Instances
    • B) Spot Instances
    • C) Reserved Instances or a Savings Plan
    • D) Dedicated Hosts billed On-Demand

26. 26. Which AWS tool provides automated recommendations for identifying idle or underutilized EC2 instances so a company can reduce costs?

    • A) AWS Trusted Advisor
    • B) Amazon CloudFront
    • C) AWS Direct Connect
    • D) Amazon Route 53

27. 27. A media archive is accessed only a few times a year, but when it is accessed, the retrieval must happen in milliseconds, just like standard storage. Which storage class fits both the cost and access needs?

    • A) S3 Standard
    • B) S3 Glacier Instant Retrieval
    • C) S3 Glacier Deep Archive
    • D) S3 One Zone-IA with restore jobs

28. 28. A company's object access patterns change unpredictably over time and it wants objects moved between storage tiers automatically, without writing custom lifecycle logic, to optimize cost.

    • A) S3 Standard only
    • B) S3 Intelligent-Tiering
    • C) Manual lifecycle rules reviewed monthly
    • D) S3 One Zone-IA exclusively

29. 29. A VPC's private subnets send a large volume of traffic to Amazon S3 through a NAT Gateway, generating high data processing charges. How can the company reduce this cost without changing the network's security posture?

    • A) Replace the NAT Gateway with a NAT instance
    • B) Add a Gateway VPC endpoint for S3
    • C) Move S3 traffic through an internet gateway
    • D) Increase the NAT Gateway bandwidth

30. 30. A company runs workloads on a mix of EC2, AWS Fargate, and AWS Lambda and wants a flexible pricing commitment that applies across all three based on consistent hourly spend, rather than being tied to a specific instance family. Which pricing option fits?

    • A) Standard Reserved Instances
    • B) Compute Savings Plans
    • C) Spot Instances
    • D) Dedicated Hosts

Answer key & quick explanations

Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.

1. 1. A company runs a critical application on a single EC2 instance in one Availability Zone. Which change would best protect the application from a complete data center outage?

   B) Deploy the application across multiple Availability Zones within the Region

   Availability Zones are physically separate data centers within a Region. Running the application in only one AZ means a single facility outage takes the whole application down, so spreading it across multiple AZs — usually behind a load balancer — is what actually protects against that failure mode; resizing the instance or encrypting the volume doesn't address it at all.

2. 2. A company runs Amazon RDS for PostgreSQL and needs the database to fail over automatically to a standby with minimal downtime if the primary fails. What should the solutions architect enable?

   B) Multi-AZ deployment

   Multi-AZ keeps a synchronously replicated standby in a second Availability Zone and fails over to it automatically within roughly 60-120 seconds if the primary fails. Read replicas improve read throughput but aren't automatic failover targets for the primary, and neither a larger instance class nor more frequent snapshots reduces failover time.

3. 3. An application's EC2 instances are spread across three Availability Zones. Which service should distribute incoming traffic only to healthy instances?

   B) An Application Load Balancer with health checks

   An Application Load Balancer continuously runs health checks against its registered targets and only routes traffic to the ones that pass, which is exactly what's needed to avoid sending requests to unhealthy instances. Route 53 alone works at the DNS level between endpoints, not between individual instances in the same Region, and CloudFront and NAT Gateways don't perform target health checks at all.

4. 4. A company must keep a durable, automatically-updated copy of its S3 data in a second AWS Region for disaster recovery. What should it configure?

   B) S3 Cross-Region Replication

   Cross-Region Replication continuously copies new and updated objects to a bucket in another Region, giving a near real-time, durable copy for disaster recovery. A lifecycle policy to Glacier changes storage class within the same Region rather than replicating elsewhere, and read replicas and EBS snapshots apply to databases and block volumes, not S3 objects.

5. 5. A producer service occasionally sends bursts of requests far faster than a downstream consumer service can process them. Which change decouples the two services and prevents the burst from overwhelming the consumer?

   B) Place an Amazon SQS queue between the producer and consumer

   SQS sits between the two services as a buffer: the producer can write messages as fast as it wants, and the consumer reads and processes them at its own pace, with messages persisting until they're processed. Resizing the consumer only raises the ceiling rather than removing the coupling, and combining the services would make the bottleneck worse, not better.

6. 6. A company wants a disaster recovery strategy that keeps recovery time and recovery point objectives as close to zero as possible and can accept the additional cost. Which strategy fits?

   D) Multi-site active/active

   Multi-site active/active runs full capacity in more than one Region simultaneously, so if one Region fails, the others are already serving live traffic — this gets RTO and RPO closest to zero, at the highest cost of the four DR strategies. Backup and restore, pilot light, and warm standby all trade lower cost for progressively longer recovery times.

7. 7. Instances behind an Application Load Balancer occasionally stop responding to requests. What should the solutions architect configure to automatically replace them?

   B) An Auto Scaling group with ALB health checks

   An Auto Scaling group paired with ALB health checks detects instances that fail the load balancer's health check and automatically terminates and replaces them, without anyone needing to notice or intervene manually. CloudWatch dashboards only surface metrics for a human to look at; they don't take replacement action on their own.

8. 8. A company serves a global audience from two Regions and wants traffic automatically routed to the nearest healthy Region, failing over if one Region becomes unavailable. Which Route 53 routing policy should be used?

   C) Latency-based routing with health checks

   Latency-based routing sends each user to the Region that gives them the lowest latency, and attaching health checks means Route 53 automatically stops sending traffic to a Region that's failed, routing users to the next-best healthy Region instead. Simple and weighted routing don't consider latency or failover, and geoproximity without health checks won't detect an unhealthy Region.

9. 9. A read-heavy web application repeatedly queries Amazon RDS for the same product catalog data. Which addition would reduce database load with the least development effort?

   B) Place Amazon ElastiCache in front of the database to cache frequent reads

   Putting ElastiCache in front of RDS lets repeated, identical reads for the same catalog data be served from memory instead of hitting the database every time, cutting load with only a small application change. Adding more read replicas helps too, but it costs more and adds more infrastructure to manage than a cache layer; switching reads to S3 doesn't fit a relational catalog query pattern.

10. 10. An application needs a NoSQL database that delivers single-digit-millisecond latency at any scale, without the team managing servers. Which service fits?

    B) Amazon DynamoDB

    DynamoDB is a fully managed NoSQL database purpose-built for consistent single-digit-millisecond performance at any scale, with no servers for the team to provision or patch. RDS is relational and typically slower at extreme scale, Redshift is a data warehouse for analytics, and EMR is a big-data processing framework — neither is a low-latency operational database.

11. 11. A media company wants to reduce latency for users worldwide accessing both static images and dynamic API responses from an origin server. What should they deploy?

    B) Amazon CloudFront in front of the origin

    CloudFront caches content at edge locations close to users worldwide and can also accelerate dynamic content back to the origin over optimized network paths, cutting latency for a global audience. Adding an Availability Zone or a bigger instance only helps users near that one Region, and Route 53 alone routes DNS queries but doesn't cache or deliver content itself.

12. 12. An Auto Scaling group should add or remove EC2 instances to keep average CPU utilization near 60%. Which scaling policy achieves this automatically?

    C) Target tracking scaling

    A target tracking policy lets you specify a target metric — like 60% average CPU utilization — and Auto Scaling automatically adds or removes instances to keep the metric near that target, adjusting continuously as load changes. Simple scaling reacts to individual alarm breaches without that continuous adjustment, scheduled scaling only fires at set times, and manual scaling requires a person to act.

13. 13. A big data workload performs large, sequential reads and writes to an EBS volume and needs high throughput rather than high IOPS. Which volume type is most appropriate?

    C) Throughput Optimized HDD (st1)

    st1 volumes are optimized for throughput-intensive, sequential workloads like big data and log processing, and are priced per GB rather than per provisioned IOPS. gp3 and io2 are tuned for transactional, IOPS-heavy workloads with smaller random I/O, and sc1 is even lower-performance and meant for infrequently accessed data, not frequent large sequential access.

14. 14. A batch-processing job can tolerate interruptions and needs to run at the lowest possible compute cost. Which EC2 purchasing option should the architect choose?

    C) Spot Instances

    Spot Instances offer the deepest discount off On-Demand pricing — often 70-90% — in exchange for AWS being able to reclaim the capacity with short notice, which is fine for a batch job that can tolerate interruption. On-Demand and Reserved Instances cost more for this use case, and Dedicated Hosts are priced for compliance and licensing needs, not for minimizing batch-processing cost.

15. 15. To let an Auto Scaling group add and remove web servers freely, where should user session data be stored instead of on the local instance?

    B) In Amazon ElastiCache or DynamoDB

    Storing session state outside the instance, in ElastiCache or DynamoDB, means any instance in the Auto Scaling group can serve any user's request, so instances can be added or removed freely without losing anyone's session. Storing it on local disk, an EBS root volume, or baked into the AMI ties a user's session to one specific instance, which breaks under scaling or replacement.

16. 16. A company manages many AWS accounts and wants centralized billing along with the ability to restrict which services each account can use, regardless of IAM permissions granted within it. Which service should it use?

    B) AWS Organizations with service control policies

    AWS Organizations lets a company manage many accounts under one consolidated bill and attach service control policies that set the maximum permissions available in an account, overriding whatever IAM policies exist inside it. IAM users are scoped to a single account, Cognito handles end-user identity for applications, and Config tracks configuration compliance rather than restricting service access.

17. 17. An application running on an EC2 instance needs to call the S3 API. What is the most secure way to grant it permission without storing long-term credentials on the instance?

    B) Attach an IAM role to the EC2 instance profile

    An IAM role attached to the EC2 instance profile provides temporary, automatically rotated credentials to the application with nothing to store on disk or embed in code, which is the AWS-recommended pattern. Storing an IAM user's keys in code, and especially using root credentials, creates long-lived secrets that can leak and don't rotate on their own.

18. 18. A company must encrypt objects in S3 at rest and retain full control over key rotation and an audit trail of key usage. Which encryption option should it choose?

    C) SSE-KMS with a customer managed CMK

    SSE-KMS uses a customer managed CMK in AWS KMS, so the company controls key rotation and gets a CloudTrail-logged audit trail of every time the key is used to encrypt or decrypt an object. SSE-S3 uses Amazon-managed keys with no customer control over rotation or a per-use audit trail, client-side encryption without key management leaves rotation and audit as manual problems, and skipping encryption doesn't meet the requirement at all.

19. 19. Which statement correctly distinguishes a network ACL from a security group in a VPC?

    B) NACLs are stateless, evaluate rules in order, and can explicitly deny traffic; security groups are stateful and only allow

    Network ACLs operate at the subnet level, are stateless (so return traffic needs its own explicit rule), evaluate numbered rules in order, and can explicitly allow or deny. Security groups operate at the instance level, are stateful (return traffic is automatically allowed), and can only allow, never explicitly deny — the reverse of what the other options claim.

20. 20. A company wants to block common web exploits such as SQL injection and cross-site scripting from reaching its public-facing Application Load Balancer. Which service should it deploy?

    A) AWS WAF

    AWS WAF inspects HTTP/HTTPS requests reaching resources like an ALB or CloudFront and can block patterns associated with SQL injection, cross-site scripting, and other common web exploits using managed or custom rules. Network ACLs and security groups filter by IP address and port, not by the content of a web request, and Shield Standard protects against network and transport-layer DDoS, not application-layer exploits.

21. 21. A team needs Amazon RDS database credentials rotated automatically on a schedule without changing application code every time. Which service manages this?

    B) AWS Secrets Manager

    Secrets Manager natively integrates with RDS to rotate database credentials on a schedule using a Lambda rotation function, updating both the secret and the database in step, so the application just retrieves the current secret instead of storing a fixed password. Parameter Store can hold secrets but doesn't provide this built-in RDS rotation, KMS manages encryption keys rather than credentials, and IAM Access Analyzer reviews resource policies for unintended access.

22. 22. A company wants to make sure that objects deleted from a versioned S3 bucket cannot be permanently removed without additional authentication. What should it enable?

    B) MFA Delete on the versioned bucket

    MFA Delete requires a second authentication factor from the bucket owner's root credentials to permanently delete an object version or change the bucket's versioning state, adding a strong safeguard on top of normal IAM permissions. Object Lock governance mode is a separate retention feature that needs to be enabled per object, and a bucket policy denying all deletes would also block legitimate, authorized ones.

23. 23. A company serves its S3 content only through Amazon CloudFront and wants to make sure users cannot bypass CloudFront and access the S3 bucket directly. What should it configure?

    B) Origin Access Control (OAC) with a bucket policy restricting access to CloudFront

    Origin Access Control lets CloudFront authenticate its requests to S3, and pairing it with a bucket policy that only allows that CloudFront distribution means requests sent directly to the bucket's S3 URL are rejected. A public bucket policy allows exactly the direct access the company is trying to prevent, and NAT Gateways and internet gateways route traffic rather than enforcing which caller is allowed to read from S3.

24. 24. A company wants to automatically detect unusual API activity, such as calls from an unfamiliar geographic location, that may indicate compromised credentials. Which service should it enable?

    A) Amazon GuardDuty

    GuardDuty continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs using threat intelligence to flag anomalies like API calls from unusual locations or known-malicious IPs, which is exactly the compromised-credential signal described. Trusted Advisor checks cost, performance, and best-practice configuration rather than active threats, Inspector scans workloads for vulnerabilities, and Config tracks resource configuration changes over time.

25. 25. A company knows a particular EC2 workload will run continuously, 24 hours a day, for the next three years. Which purchasing option minimizes cost for this predictable usage?

    C) Reserved Instances or a Savings Plan

    Reserved Instances and Savings Plans both trade a 1- or 3-year usage commitment for a substantially lower hourly rate, which is the right trade when usage is already known to be steady and continuous. On-Demand carries no discount for that certainty, Spot Instances can be interrupted and aren't meant for guaranteed 24/7 workloads, and Dedicated Hosts billed On-Demand cost more than a commitment-based option for the same usage.

26. 26. Which AWS tool provides automated recommendations for identifying idle or underutilized EC2 instances so a company can reduce costs?

    A) AWS Trusted Advisor

    Trusted Advisor's cost optimization checks flag EC2 instances with low utilization and other cost-saving opportunities, using AWS's own best-practice thresholds, without any extra setup. CloudFront, Direct Connect, and Route 53 are networking and delivery services and don't provide instance utilization recommendations.

27. 27. A media archive is accessed only a few times a year, but when it is accessed, the retrieval must happen in milliseconds, just like standard storage. Which storage class fits both the cost and access needs?

    B) S3 Glacier Instant Retrieval

    S3 Glacier Instant Retrieval keeps the low per-GB storage price of the Glacier tier while still returning objects in milliseconds, exactly matching data that's read rarely but needs to be available immediately when it is. S3 Standard costs more for data accessed a few times a year, Glacier Deep Archive is cheaper but takes hours to restore, and One Zone-IA with restore jobs implies an archival retrieval delay this scenario doesn't allow.

28. 28. A company's object access patterns change unpredictably over time and it wants objects moved between storage tiers automatically, without writing custom lifecycle logic, to optimize cost.

    B) S3 Intelligent-Tiering

    S3 Intelligent-Tiering monitors access patterns automatically and moves objects between frequent-access and infrequent-access tiers on its own, with no lifecycle rules to write or maintain, which fits data whose access pattern isn't predictable. Manual lifecycle rules require someone to define and revisit the thresholds, S3 Standard alone doesn't optimize cost at all, and One Zone-IA exclusively removes the multi-AZ durability most workloads still need.

29. 29. A VPC's private subnets send a large volume of traffic to Amazon S3 through a NAT Gateway, generating high data processing charges. How can the company reduce this cost without changing the network's security posture?

    B) Add a Gateway VPC endpoint for S3

    A Gateway VPC endpoint routes traffic to S3 privately within the AWS network, bypassing the NAT Gateway entirely for that traffic and eliminating its per-GB data processing charge, at no extra cost for the endpoint itself. Swapping in a NAT instance or increasing NAT Gateway bandwidth still routes traffic through a NAT device that charges for processing, and sending S3 traffic through an internet gateway would expose it to the public internet instead of keeping it private.

30. 30. A company runs workloads on a mix of EC2, AWS Fargate, and AWS Lambda and wants a flexible pricing commitment that applies across all three based on consistent hourly spend, rather than being tied to a specific instance family. Which pricing option fits?

    B) Compute Savings Plans

    Compute Savings Plans apply an hourly spend commitment across EC2, Fargate, and Lambda usage regardless of instance family, size, OS, or Region, which is exactly the cross-service flexibility described. Standard Reserved Instances are tied to a specific instance family and Region, Spot Instances don't involve a spend commitment at all, and Dedicated Hosts are priced for hardware-level isolation, not general compute discounting.

Curriculum Mapping & Learning Guide

Use this breakdown to identify which skills each question tests and guide post-test review.

AWS Solutions Architect – Associate (SAA-C03) AWS Architecture units covered

1. Chapter 1: Designing Resilient Architectures: Multi-AZ designs, configuring auto-scaling groups, and evaluating decoupling options like SQS.
2. Chapter 2: Designing High-Performing Architectures: Choosing compute types, content distribution with CloudFront, and designing high-performance databases.
3. Chapter 3: Designing Secure Applications: IAM roles, VPC endpoints and network security, and setting up encryption.
4. Chapter 4: Designing Cost-Optimized Architectures: EC2 reservation options, automated storage tiering, and identifying unused resources to cut costs.