DEV Community: charliezhang

AWS SysOps Administrator Associate – Study Guide and FAQ

charliezhang — Fri, 01 Mar 2024 01:11:25 +0000

**1. Exam Introduction:
**The AWS Certified SysOps Administrator – Associate (SOA) certification consists of scenario-based questions that are either multiple-choice or multiple-response. The former has only one correct answer whilst the latter can have two or more correct responses out of five or more options. Take extra care when reading the question to determine which of the two question types you are being presented with as this can be a common tripping point for candidates.

Exam code SOA-C02
Release date July 2021 – present
Prerequisites None
Number of questions 65
Score range 100-1000

Passing score 720/1000
Time Limit 2 hours 10 minutes (130 minutes) 2
Price $150
Format Scenario-based - Multiple choice/Multiple response

As of March 28, 2023, the AWS Certified SysOps Administrator - Associate exam will not include exam labs until further notice. This removal of exam labs is temporary while we evaluate the exam labs and make improvements to provide an optimal candidate experience. With this change, the exam will consist of 65 multiple-choice questions and multiple-response questions, with an exam time of 130 minutes. All exam prep resources that are available on this exam page remain valid for this changed exam format.

1.2. Exam domains
The SOA exam can be broken down into a total of 6 domains. Each domain has a corresponding weight and topic coverage.

Domain 1: Monitoring, Logging, and Remediation (20%)
1.1 Implement metrics, alarms, and filters by using AWS monitoring and logging services
1.2 Remediate issues based on monitoring and availability metrics

Domain 2: Reliability and Business Continuity (16%)
2.1 Implement scalability and elasticity
2.2 Implement high availability and resilient environments
2.3 Implement backup and restore strategies

Domain 3: Deployment, Provisioning, and Automation (18%)
3.1 Provision and maintain cloud resources
3.2 Automate manual or repeatable processes

Domain 4: Security and Compliance (16%)
4.1 Implement and manage security and compliance policies
4.2 Implement data and infrastructure protection strategies

Domain 5: Networking and Content Delivery (18%)
5.1 Implement networking features and connectivity
5.2 Configure domains, DNS services, and content delivery
5.3 Troubleshoot network connectivity issues

Domain 6: Cost and Performance Optimization (12%)
6.1 Implement cost optimization strategies
6.2 Implement performance optimization strategies

Study Materials

A Cloud Guru - AWS Certified SysOps Administrator - Associate

YouTube - AWS Certified SysOps Administrator - Associate 2020 (old syllabus but still very good)

Whizlab - CSOA Practice Tests

AWS Official Practice Exam: SysOps Administrator - Associate

AWS – Official Exam Study Guide

AWS Whitepapers & FAQs

Exam Preparation

To prepare for the exam a combination of the following material types should be sufficient.

Suggested study plan: Skill-Builder courses + Official Exam Study Guide + Youtube Video

3.1. Sample Common Exam Scenarios
Table 3 – Examples per domain of the common exam scenarios that could appear in the exam [1]

**Scenario Solution

***Domain 1: Monitoring, Logging, and Remediation*

You need to investigate if the traffic is reaching the EC2 instance Use VPC flow logs
Metric to use to alarm when all instances behind an ALB becomes unhealthy ApplicationELB HealthyHostCount <= 0
Monitor restricted CIDR changes on a security group and remove them automatically Use AWS Config to evaluate the security group and AWS Systems Manager Automation document to remove the unwanted CIDR range
You need to track the deletion and rotation of CMKs. Use AWS CloudTrail to log AWS KMS API calls

*Domain 2: Reliability and Business Continuity
*- You need to log the client’s IP address, latencies, request paths, and server responses that go through your Application Load Balancer Enable access logging in ALB and store the logs on an S3 bucket

You need to ensure that the backups of an Amazon Redshift cluster are always available Configure the Amazon Redshift cluster to automatically copy snapshots of a cluster to another region
Slow load time when uploading objects to S3 Utilize S3 Transfer Acceleration
You need a highly available File Server that supports SMB and manages file permissions using Windows Access Control List (ACL). What should you use? Multi-AZ Amazon FSx for Windows File Server

Domain 3: Deployment, Provisioning, and Automation

You need a CloudFormation template that can be re-used for multiple environments. If the template has been updated, all the stacks that are referencing need to automatically use the updated configuration. What solution should you use? CloudFormation Nested Stacks
You need to automate the process of updating the CloudFormation templates to map to the latest AMI IDs, which AWS service should you use in conjunction with CloudFormation? Systems Manager Parameter Store
You need to provide each department in your company with a new AWS account with governance guardrails and a defined baseline in place. Which service can you use to achieve this? AWS Control Tower
You have a TLS certificate that should be renewed automatically. How can you accomplish this? Request a public certificate via AWS Certificate Manager (ACM)
Domain 4: Security and Compliance
You want to prevent/mitigate malicious attacks such as SQL injection and DDoS attacks from unknown origins. How could you achieve this? Implement AWS WAF and AWS Shield
You need to write a bucket policy that allows only AWS accounts in the organization to access an S3 bucket. What could you include in the policy to achieve this? Set the principal to (*) and create a condition for PrincipalOrgId
Your RDS credentials should not be hardcoded in your Lambda functions. Where could you store your credentials instead? Secrets Manager
You need to create a solution that allows multiple EC2 instances in a private subnet to use AWS KMS. The traffic must not pass through the public Internet Configure a VPC endpoint

Domain 5: Networking and Content Delivery

You need to allow the EC2 instances in your VPC that support IPv6 to connect to the Internet but block any incoming connection Set up an egress-only Internet gateway
How could you increase the cache hit ratio for a CloudFront web distribution? Add a Cache-Control max-age and increase the TTL by specifying the longest value possible for max-age
You need to ensure that users are consistently directed to the AWS region nearest to them Set up a Route 53 GeoProximity routing policy
You have to establish a dedicated connection between an on-premise network and an Amazon VPC Set up a Direct Connect connection between the on-premise network and the VPC

- Domain 6: Cost and Performance Optimization

How would you analyze the data hosted in Amazon S3 using standard SQL? By using Amazon Athena
How could you enforce tagging all instances launched in a VPC? Use the AWS Service Catalog TagOption library
Improve the site speed of a static S3 web hosting with customers around the globe Create a CloudFront web distribution and set Amazon S3 as the origin
You don’t want to share your Reserved Instance discounts between AWS accounts in your Organization. What should you do? Disable RI discount sharing via the management account and provision instances using individual AWS accounts

AWS Developer Associate DVA study guide DVA-C02

charliezhang — Fri, 31 Mar 2023 18:02:40 +0000

1. Exam Introduction
**1.1 Exam Details**
The AWS Certified Developer – Associate (DVA) certification is made up of scenario-based questions that are either multiple-choice or multiple-response. The former has only one correct answer whilst the latter can have two or more correct responses out of five or more options. Take extra care when reading the question to determine which of the two question types you are being presented with as this can be a common tripping point for candidates.

Exam code DVA-C02
Number of questions 65
Score range 100-1000
Passing score 720/1000
Time Limit 2 hours 10 minutes (130 minutes)[]
Format Scenario-based - Multiple choice/Multiple response

**1.2 Exam domains
**The DVA exam can be broken down into 4 different domains. Each domain has a corresponding weight and topic coverage. This breakdown can be seen in Figure 1:

Figure 1 - Breakdown of the 4 different domains for the DVA exam
Domain 1: Development with AWS Services (32%)
1.1 Develop code for applications hosted on AWS
1.2 Develop code for AWS Lambda
1.3 Use data stores in application development.
1.4 Deploy serverless applications

Domain 2: Security (26%)
2.1 Implement authentication and/or authorization for applications and AWS services.
2.2 Implement encryption by using AWS services.
2.3 Manage sensitive data in application code.

Domain 3: Deployment (24%)
3.1 Prepare application artifacts to be deployed to AWS.
3.2 Test applications in development environments.
3.3 Automate deployment testing
3.4 Deploy code by using AWS CI/CD services.

Domain 4: Troubleshooting and Optimization
(18%)
4.1 Assist in a root cause analysis.
4.2 Instrument code for observability.
4.3 Optimize applications by using AWS services and features.

**1.3.Exam scoring
**A minimum scaled score of 720 is needed to pass the DVA exam with the range of scores being 100-1000. Immediately upon completing the exam a pass or fail notification will be show on the testing application.
A complete score report is sent to the email address that was registered within 5 business days. The score report contains a breakdown of your performance over the 4 domains by way of either meeting competency or not.

**2.Study Materials
**2.1.Resources

Collation of study material

**Description **Priority Type Cost
Cloud Academy - AWS Developer – Associate (DVA-C02) Certification Preparation Highly Recommended Video Course Free for Community Builder
A Cloud Guru - AWS Certified Developer - Associate Recommended Video Course Free with A Cloud Guru subscription
Udemy Course - AWS DVA by Stephane Maarek Recommended Video Course Paid
Tutorials Dojo Jon Bonso - AWS Certified DVA - Practice Exams Recommended Practice Exam Paid
Whizlab - CDVA Practice Tests Optional Practice Exam Paid
Exam Readiness: AWS Certified Developer – Associate (Digital) Recommended Practice Exam Paid
AWS SkillBuilder AWS Certified Developer - Associate Official Practice Question Set (DVA-C02 - English) Recommended Practice Exam Free
AWS – Official Exam Study Guide Recommended Supplementary Free
Tutorial Dojo - Cheat Sheets Optional Supplementary Free
Neil Davis - Cheat Sheets Optional Supplementary Free
AWS Whitepapers, FAQ, Documentation Optional Supplementary Free

*3.Exam Scenarios
*
Scenario Solution

Domain 1: Development with AWS Services
Provides a time-ordered sequence of item level changes in any DynamoDB table DynamoDB Streams.
Using AWS Lambda to process records in a Kinesis Data streams that has 100 active shards. The Lambda function takes around 10 seconds to process the data, and the stream is receiving 50 new items per second. What can you say about the number of concurrent Lambda functions? There will be at most 100 Lambda functions (as 100 shards).
Uploaded large files to S3 (over 4GB), how do you minimize upload time? Multipart upload API.
Unresponsive MySQL RDS database. How do you collect all SQL statements that took longer to execute for troubleshooting? Enable slow query log in RDS.
Slow log in times for users in your web app hosted behind a CloudFront distribution. Use Lambda@Edge to execute the authentication process closer to the user.
How do you reuse the same Lambda function for multiple stages of your API but pass in different variables depending on the stage? Use stage variables.
Record events in an SWF Workflow execution. Use markers.
Consistency that DynamoDB global secondary indexes support. Eventual consistency only.
AWS Service for defining IaC specific to serverless services. AWS SAM.
Can APIs that are created with API Gateway support http? No, all APIs created by Amazon API Gateway expose HTTPS endpoints only.
Enable cross-device syncing of user profile data in a mobile game? Cognito Sync
How could you increase the capacity of an Amazon Kinesis Data Stream? Split every shard in the stream
High number of read operations in an RDS database which affects the website's performance, quickly resolve the issue with minimal cost and code change Create an RDS Read Replica instance and configure the application to use this for read queries
Improve an application’s performance by reducing a DynamoDB database’s response times down to microseconds Use Amazon DynamoDB Accelerator (DAX)
**- Domain 2: Security
Serverless app is composed of several Lambdas reading from RDS. These functions must share the same connection string that should be encrypted to improve data security. Create a Secure String Parameter using the AWS Systems Manager Parameter store.
Request header to use to enforce S3 server-side encryption. x-amz-server-side-encryption.
Safest way to grant an application hosted in EC2 permission to upload data to S3 Use an IAM Role to grant the application the necessary permissions.
Using API Gateway Lambda Authorizer to provide authentication for every API request. What method should be used to implement authentication like SAML or OAuth. Token-Based Authorization.
Describe the process of envelope encryption for encryption keys. Encrypt plaintext data with a data key, then encrypt the data key with a top-level plaintext master key.
In the AppSpec file in CodeDeploy, which deployment lifecycle event allows you to run a task before the traffic is shifted to the deployed app? BeforeAllowTraffic.
When managing a company’s IAM resources, what are some best practices in managing security? Grant only the permissions required by the resource to perform a task, and delete root user access keys.
2 services that can be used to safely import a SSL/TLS certificate. AWS Certificate Manager and IAM certificate store.
Most appropriate service to store RDS database credentials, where they will be encrypted and rotated on a regular basis? AWS Secrets Manager (allows automatic rotation).
How can you improve the performance of an RDS database whose performance slows down whenever there is a surge in requests that use the same SQL read queries? Create Read Replicas
Implement database caching using ElastiCache
The average time that it takes for producers to send a new message to a Standard SQS queue is 40 seconds. Which polling setting is the most efficient way for the application to query the new messages from the queue? Long Polling
**- Domain 3: Deployment
Internal Web App on EC2 instances need to access an S3 Bucket. Create a VPC endpoint for S3.
Deployment to Lambda function using CodeDeploy, need to shift 10% of traffic to new version in the first increment and the other 90% 5 minutes later. Canary Deployment.
You want to deploy a serverless app using CloudFormation, the AWS SAM syntax should be used to declare resources. Include the Transform section in CloudFormation specifying the version of SAM to use.
Amount of RCUs for a DynamoDB table, each data has an average size of 3.5KB and will send 150 eventually consistent reads per second. 75. (each read does up to 4KB per RCU, so 1 per data = 150 RCU. Divide by 2 as the reads are eventually consistent)
Application that will be hosted in an ECS cluster, tasks must be placed based on the least available amount of CPU or memory. Use the binpack placement strategy.
A developer is instructed to set up a new serverless architecture. The new architecture should allow the developer to locally build, test, and debug serverless applications. Use AWS Serverless Application Model (AWS SAM).
A developer will do iterative tests on an app hosted on Elastic Beanstalk and therefore needs to deploy code changes and view them as quickly as possible. Use All at Once Deployment.
Deploy a update to an app hosted on EC2 instances, the update needs to be on a new set of instances. Immutable deployment.
CloudFormation helper script to install packages, create files and start services. cfn-init
**- Domain 4:Troubleshooting and Optimization
How can you capture information about the IP traffic going to and from network interfaces in your VPC? -- Create VPC flow log.
A service to trace and analyse user requests as they go through an Amazon API Gateway API and eventually through to the underlying services in an application. -- AWS X-Ray
What is the lifetime of all data in a DynamoDB Stream? -- 24 hours
How can you ensure that all of the API calls to your AWS resources are logged and stored? Use CloudTrail
True or False: By default, you can see the CPU utilization of EC2 instances but not the memory utilization? True – CloudWatch does not track memory utilization by default.
(Install a CloudWatch agent in your EC2 instances to track memory utilization.)
You need to manually increase the current number of instances to 20 to prepare for a temporary influx of requests, which Auto Scaling group option will you set to 20? Desired capacity
Which of the following services should you implement to mitigate SQL injection attempts and cross-site scripting attacks? AWS WAF

**3.2.Compared Services
**The following is the service list which may appear in the exam from time to time. It is crucial to understand the key features of these services and their differences.

S3 vs EBS vs EFS
S3 Standard vs S3 Standard-IA vs S3 One Zone-IA vs S3 Intelligent Tiering vs Glacier
S3 Pre-Signed URLS vs CloudFront Signed URLS vs Origin Access Identity
S3 Transfer Acceleration vs Direct Connect vs VPN vs Snowball Edge vs Snowmobile
AWS CloudTrail vs CloudWatch
Security Group vs NACL
EBS-SSD vs HDD
Elastic Beanstalk vs CloudFormation vs OpsWorks vs CodeDeploy
Global Secondary Index vs Local Secondary Index
CloudWatch Agent vs SSM Agent vs Custom Daemon Scripts
Amazon SWF vs AWS Step Functions vs Amazon SQS
Application vs Network vs Classic vs Gateway Load Balancers
AWS DataSync vs Storage Gateway
RDS vs DynamoDB
RDS vs Aurora
EC2 Container Services ECS vs Lambda
SNI Custom SSL vs Dedicated IP Custom SSL
EC2 Instance Health Check vs ELB Health Check vs Auto Scaling and Custom Health Check
Multi-AZ deployments vs Multi-Region deployments vs Read Replicas

**4 Extra time for the exam
If English is your second language, you can request for ESL+30 mins before booking the exam from certmetrics > Request Exam Accomodations and wait for the approval. Once it is approved, this will apply to all AWS existing exams.

*Note: this needs to be done before your exam registration.
*
Good Luck for your coming DVA exam!