Multiple-choice
Question with one correct answer among options.
Getting Started: Exam Essentials
Free knowledge base
AWS Certified DevOps Engineer – Professional — key terms, tricks & tips
Everything from the course in one searchable place: 314 entries. Use it to review before a practice test or look up a word you forgot.
314 results · showing first 300, refine your search
Multiple-response
Question requiring selection of multiple correct answers.
Getting Started: Exam Essentials
Exam Guide
Official AWS document detailing exam objectives and format.
Getting Started: Exam Essentials
Domain weighting
Percentage of exam questions from a specific topic area.
Getting Started: Exam Essentials
Passing score
Minimum score required to pass the certification exam.
Getting Started: Exam Essentials
Distractor
An incorrect answer option in a multiple-choice question.
Getting Started: Exam Essentials
Unscored questions
Questions included for data, not affecting final score.
Getting Started: Exam Essentials
Understanding the DOP-C02 Exam Format
Think of 'DOP-C02' as 'DO-Pace-Carefully-02' – reminding you to manage your time and read questions thoroughly.
Getting Started: Exam Essentials
Understanding the DOP-C02 Exam Format
The DOP-C02 exam is 180 minutes long and contains 65 questions. A passing score is 750. Remember the exact number of questions and the time limit.
Getting Started: Exam Essentials
Understanding the DOP-C02 Exam Format
Not reading the question carefully enough to distinguish between multiple-choice and multiple-response questions.
Getting Started: Exam Essentials
Understanding the DOP-C02 Exam Format
Spending too much time on a single difficult question, leaving insufficient time for easier questions later.
Getting Started: Exam Essentials
Understanding the DOP-C02 Exam Format
Not utilizing the 'mark for review' feature and getting stuck on challenging questions.
Getting Started: Exam Essentials
Exam Blueprint
Document outlining exam domains, tasks, and weightings.
Getting Started: Exam Essentials
Active Learning
Engaging with material through hands-on, teaching, or explaining.
Getting Started: Exam Essentials
Spaced Repetition
Reviewing material at increasing intervals to improve retention.
Getting Started: Exam Essentials
Forgetting Curve
The rate at which memory of learned information declines over time.
Getting Started: Exam Essentials
Passive Learning
Absorbing information without active engagement, e.g., reading.
Getting Started: Exam Essentials
Hands-on Practice
Directly implementing concepts in a real or simulated environment.
Getting Started: Exam Essentials
Time Management
Strategically allocating study and exam time for optimal results.
Getting Started: Exam Essentials
Effective Study Strategies for Professional Exams
To remember the key study steps: 'BLUEPRINT' (Blueprint, Labs, Understand, Practice, Review, Integrate, Plan, Test).
Getting Started: Exam Essentials
Effective Study Strategies for Professional Exams
The DOP-C02 exam frequently tests your ability to apply knowledge in complex, multi-service scenarios. Memorizing facts is not enough; you must understand how services integrate and behave under various conditions. Look for keywords like 'optimize cost', 'improve reliability', 'automate deployment', or 'reduce downtime' in questions.
Getting Started: Exam Essentials
Effective Study Strategies for Professional Exams
Only reading study guides without hands-on practice, leading to theoretical but not practical understanding.
Getting Started: Exam Essentials
Effective Study Strategies for Professional Exams
Cramming all material right before the exam instead of using spaced repetition, resulting in poor long-term retention.
Getting Started: Exam Essentials
Effective Study Strategies for Professional Exams
Ignoring the exam blueprint and spending too much time on low-weightage topics, misallocating study effort.
Getting Started: Exam Essentials
Continuous Integration (CI)
Frequent code merges, automated builds, and tests.
SDLC Automation Mastery
Continuous Delivery (CD)
Automated release process, software always deployable.
SDLC Automation Mastery
Continuous Deployment
Automated production deployment without human approval.
SDLC Automation Mastery
Idempotency
Operation yields same result regardless of execution count.
SDLC Automation Mastery
Pipeline as Code
Defining CI/CD workflow in version-controlled code.
SDLC Automation Mastery
CodeCommit
Managed Git repository service on AWS.
SDLC Automation Mastery
CodeBuild
Compiles code, runs tests, produces artifacts.
SDLC Automation Mastery
CodePipeline
Orchestrates release pipelines for fast updates.
SDLC Automation Mastery
Designing & Implementing CI/CD Pipelines with AWS
To remember the AWS Code services, think: 'Commit' your code, 'Build' it, 'Deploy' it, and 'Pipeline' it all together!
SDLC Automation Mastery
Designing & Implementing CI/CD Pipelines with AWS
The exam often tests your understanding of which AWS service fits which stage of a CI/CD pipeline. Memorize the core functions of CodeCommit (source), CodeBuild (build/test), CodeDeploy (deploy), and CodePipeline (orchestration). Look for keywords like 'version control', 'compile code', 'deploy application', and 'automate release process'.
SDLC Automation Mastery
Designing & Implementing CI/CD Pipelines with AWS
Overlooking manual approval gates for critical production deployments, leading to unintended releases.
SDLC Automation Mastery
Designing & Implementing CI/CD Pipelines with AWS
Neglecting comprehensive automated testing, allowing bugs to reach production environments.
SDLC Automation Mastery
Designing & Implementing CI/CD Pipelines with AWS
Failing to implement rollback strategies, making recovery from failed deployments difficult and slow.
SDLC Automation Mastery
Shift Left
Performing activities like testing and security earlier in the SDLC.
SDLC Automation Mastery
SAST
Static Application Security Testing; analyzes code without execution.
SDLC Automation Mastery
DAST
Dynamic Application Security Testing; tests running applications for vulnerabilities.
SDLC Automation Mastery
SCA
Software Composition Analysis; identifies vulnerabilities in open-source components.
SDLC Automation Mastery
DevSecOps
Integrating security practices into every stage of the DevOps lifecycle.
SDLC Automation Mastery
Unit Test
Tests individual components or functions of code in isolation.
SDLC Automation Mastery
Integration Test
Verifies interactions between different modules or services.
SDLC Automation Mastery
Continuous Compliance
Automated, ongoing enforcement and monitoring of regulatory and policy requirements.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
TEST SECURE: T-est E-very S-tage, T-hrough S-hifting E-arly C-ode U-nder R-igorous E-xamination.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
The exam frequently tests your understanding of 'shifting left' for both quality and security. Know the specific types of tests (unit, integration, functional, performance) and security scans (SAST, DAST, SCA) and where they fit into a typical CI/CD pipeline. Keywords like 'early detection,' 'automated feedback,' and 'preventing issues' are good indicators.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
Only performing security scans at the end of the development cycle, leading to costly rework.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
Relying solely on manual testing, which slows down the pipeline and introduces human error.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
Not integrating security tools directly into the CI/CD pipeline, making them an optional afterthought.
SDLC Automation Mastery
Automating Testing & Integrating Security in CI/CD
Ignoring the different types of automated tests; a single test type is insufficient for comprehensive coverage.
SDLC Automation Mastery
Dependency
An external component or library required by an application.
SDLC Automation Mastery
Build Artifact
The deployable output of a build process, such as a JAR or Docker image.
SDLC Automation Mastery
Immutability
The characteristic of an artifact that, once created, cannot be changed.
SDLC Automation Mastery
Versioning
Assigning unique identifiers to different iterations of dependencies or artifacts.
SDLC Automation Mastery
AWS CodeArtifact
A fully managed artifact repository service for package managers.
SDLC Automation Mastery
Amazon ECR
A fully managed Docker container registry for storing and managing container images.
SDLC Automation Mastery
Amazon S3
Object storage service often used for storing various types of build artifacts.
SDLC Automation Mastery
Dependency Hell
A situation where incompatible dependency versions cause build or runtime failures.
SDLC Automation Mastery
Managing Application Dependencies & Artifacts
S3, ECR, CodeArtifact: 'SECure Artifacts' – S3 for files, ECR for containers, CodeArtifact for packages. Keep your artifacts SECure!
SDLC Automation Mastery
Managing Application Dependencies & Artifacts
The exam frequently tests your knowledge of which AWS services are appropriate for different artifact types. Remember: S3 for general files, CodeArtifact for package manager artifacts (Maven, npm, pip), and ECR for Docker images.
SDLC Automation Mastery
Managing Application Dependencies & Artifacts
Not versioning artifacts: Deploying unversioned artifacts makes rollbacks difficult and introduces uncertainty about what's actually deployed.
SDLC Automation Mastery
Managing Application Dependencies & Artifacts
Using different dependency versions across environments: This leads to 'works on my machine' issues and inconsistent application behavior.
SDLC Automation Mastery
Managing Application Dependencies & Artifacts
Storing artifacts in ephemeral locations: Artifacts must be stored in durable, centralized repositories, not on build server local disks.
SDLC Automation Mastery
Blue/Green Deployment
Running two identical environments, switching traffic instantly.
SDLC Automation Mastery
Canary Deployment
Gradually rolling out a new version to a small user subset.
SDLC Automation Mastery
Rollback
Reverting to a previous, stable version of an application.
SDLC Automation Mastery
Traffic Shifting
Directing a percentage of user requests to a specific version.
SDLC Automation Mastery
Load Balancer
Distributes incoming network traffic across multiple targets.
SDLC Automation Mastery
AWS CodeDeploy
Service that automates software deployments to various compute services.
SDLC Automation Mastery
Amazon Route 53
Scalable cloud Domain Name System (DNS) web service.
SDLC Automation Mastery
Advanced Deployment Strategies
Think of 'Blue/Green' like changing a light switch: instant on/off. 'Canary' is like sending a scout ahead: a small group goes first to check for danger.
SDLC Automation Mastery
Advanced Deployment Strategies
The exam often tests your understanding of which AWS services facilitate each deployment strategy. Memorize that AWS CodeDeploy supports both blue/green and canary for EC2, Lambda, and ECS. Also, know that Route 53 and ELB are critical for traffic shifting in both scenarios.
SDLC Automation Mastery
Advanced Deployment Strategies
Confusing the purpose of blue/green (fast rollback) with canary (gradual risk mitigation).
SDLC Automation Mastery
Advanced Deployment Strategies
Not planning for the cost implications of running duplicate environments for blue/green.
SDLC Automation Mastery
Advanced Deployment Strategies
Failing to implement robust monitoring and alarms during canary deployments to detect issues early.
SDLC Automation Mastery
Infrastructure as Code (IaC)
Managing infrastructure using code, not manual processes.
Configuration & Infrastructure as Code
Declarative IaC
Describes the desired end state of infrastructure.
Configuration & Infrastructure as Code
Imperative IaC
Defines the specific steps to provision infrastructure.
Configuration & Infrastructure as Code
AWS CloudFormation
AWS service for declarative infrastructure provisioning via templates.
Configuration & Infrastructure as Code
AWS CDK
Framework to define cloud infrastructure using programming languages.
Configuration & Infrastructure as Code
Stack
A collection of AWS resources managed as a single unit by CloudFormation.
Configuration & Infrastructure as Code
Configuration Drift
When actual infrastructure deviates from its defined state.
Configuration & Infrastructure as Code
Automating Infrastructure Provisioning with IaC
CODE for Consistency, Orchestration, Documentation, and Efficiency – the four pillars of IaC!
Configuration & Infrastructure as Code
Automating Infrastructure Provisioning with IaC
The exam frequently tests your understanding of CloudFormation's capabilities and limitations, especially its declarative nature and how it manages stacks. Be prepared to identify scenarios where CloudFormation is the most appropriate IaC tool.
Configuration & Infrastructure as Code
Automating Infrastructure Provisioning with IaC
Treating IaC templates as throwaway scripts rather than version-controlled, tested code.
Configuration & Infrastructure as Code
Automating Infrastructure Provisioning with IaC
Making manual changes to infrastructure provisioned by IaC, leading to configuration drift.
Configuration & Infrastructure as Code
Automating Infrastructure Provisioning with IaC
Not validating IaC templates before deployment, causing failed deployments and delays.
Configuration & Infrastructure as Code
Desired State
The intended configuration of infrastructure as defined by IaC.
Configuration & Infrastructure as Code
Actual State
The current, real-time configuration of deployed infrastructure.
Configuration & Infrastructure as Code
Immutable Infrastructure
Replacing components instead of modifying them in place.
Configuration & Infrastructure as Code
Drift Detection
Process of identifying differences between desired and actual states.
Configuration & Infrastructure as Code
Remediation
Bringing drifted infrastructure back into alignment with IaC.
Configuration & Infrastructure as Code
IaC Modules
Reusable, self-contained units of infrastructure code.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
DRIFT: Detect, Remediate, Implement policies, Focus on IaC, Test regularly.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
The exam often tests your understanding of how AWS services like AWS Config and CloudFormation's drift detection feature help identify and manage configuration drift. Remember that CloudFormation drift detection identifies changes to resources managed by the stack, but doesn't automatically remediate them.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
Ignoring small, 'temporary' manual changes, as they often become permanent and cause drift.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
Not integrating drift detection into your CI/CD pipeline, leading to late discovery of issues.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
Having inconsistent IaC repositories or not versioning your IaC, making it hard to track changes.
Configuration & Infrastructure as Code
Managing Configuration Drift & IaC Best Practices
Over-automating remediation without proper testing, which can lead to unintended outages.
Configuration & Infrastructure as Code
Secrets Manager
AWS service for managing, rotating, and retrieving secrets.
Configuration & Infrastructure as Code
Parameter Store
AWS service for secure, hierarchical config and secret storage.
Configuration & Infrastructure as Code
Least Privilege
Granting only necessary permissions for a task.
Configuration & Infrastructure as Code
Secret Rotation
Regularly changing secrets to enhance security.
Configuration & Infrastructure as Code
KMS
AWS Key Management Service, for encryption keys.
Configuration & Infrastructure as Code
Hardcoding
Embedding secrets directly into code or config.
Configuration & Infrastructure as Code
CloudTrail
AWS service for logging API calls and events.
Configuration & Infrastructure as Code
Securely Managing Secrets and Credentials
Secrets Manager ROTATES, Parameter Store STORES. Remember 'R' for Rotation in Secrets Manager, and 'S' for Storage in Parameter Store.
Configuration & Infrastructure as Code
Securely Managing Secrets and Credentials
The exam frequently tests your knowledge of AWS Secrets Manager versus AWS Systems Manager Parameter Store. Remember that Secrets Manager focuses on lifecycle management and automatic rotation, especially for database credentials, while Parameter Store is broader for configuration data and secrets.
Configuration & Infrastructure as Code
Securely Managing Secrets and Credentials
Storing secrets directly in environment variables in production environments.
Configuration & Infrastructure as Code
Securely Managing Secrets and Credentials
Granting overly permissive IAM roles to applications or CI/CD pipelines that access secrets.
Configuration & Infrastructure as Code
Securely Managing Secrets and Credentials
Neglecting to implement regular secret rotation, increasing the risk of compromise.
Configuration & Infrastructure as Code
Nested Stack
CloudFormation stack created by another stack.
Configuration & Infrastructure as Code
IaC Module
Reusable, self-contained IaC configuration.
Configuration & Infrastructure as Code
Parameterization
Using variables to customize IaC templates.
Configuration & Infrastructure as Code
CloudFormation StackSets
Deploy stacks across multiple accounts/regions.
Configuration & Infrastructure as Code
Terraform Workspace
Separate state for different environments.
Configuration & Infrastructure as Code
Advanced IaC Patterns: Stacks, Modules, & Drift
MODULAR D.R.I.F.T.: **M**odules, **O**rganization, **D**eployments, **U**nderstanding, **L**ogging, **A**utomation, **R**euse, **D**rift **R**emediation, **I**ntegration, **F**lexibility, **T**esting.
Configuration & Infrastructure as Code
Advanced IaC Patterns: Stacks, Modules, & Drift
The exam often asks about managing multi-account/multi-region deployments and detecting/remediating drift. Memorize that CloudFormation StackSets are for multi-account/region deployments and CloudFormation's built-in drift detection feature. For Terraform, remember modules and workspaces for modularity and environment separation, and 'terraform plan' for drift detection.
Configuration & Infrastructure as Code
Advanced IaC Patterns: Stacks, Modules, & Drift
Ignoring drift: Allowing manual changes to persist without updating IaC leads to unmanageable infrastructure.
Configuration & Infrastructure as Code
Advanced IaC Patterns: Stacks, Modules, & Drift
Monolithic IaC: Trying to manage all infrastructure in a single, giant template, making it hard to maintain and scale.
Configuration & Infrastructure as Code
Advanced IaC Patterns: Stacks, Modules, & Drift
Lack of version control: Not treating IaC like application code, leading to lost changes and inconsistent deployments.
Configuration & Infrastructure as Code
High Availability (HA)
System designed to operate continuously, minimizing downtime.
Building Resilient Cloud Solutions
Fault Tolerance (FT)
System designed to continue operating without interruption during failures.
Building Resilient Cloud Solutions
Availability Zone (AZ)
One or more discrete data centers with redundant power, networking, and connectivity.
Building Resilient Cloud Solutions
Multi-AZ Deployment
Distributing resources across multiple Availability Zones for resilience.
Building Resilient Cloud Solutions
Multi-Region Deployment
Distributing resources across geographically separate AWS Regions.
Building Resilient Cloud Solutions
Recovery Time Objective (RTO)
Maximum acceptable downtime after an incident.
Building Resilient Cloud Solutions
Recovery Point Objective (RPO)
Maximum acceptable data loss after an incident.
Building Resilient Cloud Solutions
Graceful Degradation
System maintains essential functionality during partial failures or high load.
Building Resilient Cloud Solutions
Designing HA & Fault-Tolerant Architectures
HA-FT: 'HA'ppy to recover, 'FT'otally uninterrupted. HA minimizes downtime, FT prevents it.
Building Resilient Cloud Solutions
Designing HA & Fault-Tolerant Architectures
The exam frequently tests your understanding of the differences between HA and FT, and which AWS services contribute to each. Pay close attention to scenario questions that describe specific RTO/RPO requirements, as these will guide your choice of HA/DR strategy.
Building Resilient Cloud Solutions
Designing HA & Fault-Tolerant Architectures
Confusing High Availability with Fault Tolerance; they are related but distinct concepts.
Building Resilient Cloud Solutions
Designing HA & Fault-Tolerant Architectures
Assuming Multi-AZ deployment automatically provides full fault tolerance for all services.
Building Resilient Cloud Solutions
Designing HA & Fault-Tolerant Architectures
Overlooking application-level resilience patterns (e.g., retries, circuit breakers) in addition to infrastructure-level solutions.
Building Resilient Cloud Solutions
RTO
Recovery Time Objective; max acceptable downtime.
Building Resilient Cloud Solutions
RPO
Recovery Point Objective; max acceptable data loss.
Building Resilient Cloud Solutions
Backup and Restore
DR strategy: restore from backups; highest RTO/RPO.
Building Resilient Cloud Solutions
Pilot Light
DR strategy: minimal core running; scale up on disaster.
Building Resilient Cloud Solutions
Warm Standby
DR strategy: scaled-down replica running; faster recovery.
Building Resilient Cloud Solutions
Multi-Site Active/Active
DR strategy: full app in multiple regions; near-zero RTO/RPO.
Building Resilient Cloud Solutions
AWS Backup
Managed service for centralized backup across AWS services.
Building Resilient Cloud Solutions
Implementing Disaster Recovery Strategies on AWS
Remember 'B-P-W-M' for the strategies in increasing order of complexity/cost: Backup, Pilot light, Warm standby, Multi-site.
Building Resilient Cloud Solutions
Implementing Disaster Recovery Strategies on AWS
The exam frequently tests your ability to match a business requirement (e.g., 'needs minimal downtime and data loss, but is cost-sensitive') to the most appropriate DR strategy and associated AWS services. Pay close attention to RTO/RPO implications for each strategy.
Building Resilient Cloud Solutions
Implementing Disaster Recovery Strategies on AWS
Confusing RTO and RPO: RTO is about time to recover, RPO is about data loss.
Building Resilient Cloud Solutions
Implementing Disaster Recovery Strategies on AWS
Over-engineering DR for non-critical applications: Multi-Site Active/Active is expensive and unnecessary for all workloads.
Building Resilient Cloud Solutions
Implementing Disaster Recovery Strategies on AWS
Forgetting to test DR plans: A DR plan is useless if it hasn't been regularly tested and validated.
Building Resilient Cloud Solutions
Auto Scaling Group (ASG)
Automatically adjusts EC2 instance count based on demand and health.
Building Resilient Cloud Solutions
Elastic Load Balancer (ELB)
Distributes incoming traffic across multiple targets for high availability.
Building Resilient Cloud Solutions
Application Load Balancer (ALB)
ELB type for HTTP/HTTPS traffic, offering advanced routing features.
Building Resilient Cloud Solutions
Network Load Balancer (NLB)
ELB type for high-performance TCP/UDP/TLS traffic at the network layer.
Building Resilient Cloud Solutions
Target Group
Used by ELBs to route requests to registered targets and perform health checks.
Building Resilient Cloud Solutions
Scaling Policy
Rules defining when and how an ASG should scale instances in or out.
Building Resilient Cloud Solutions
Route 53
AWS's highly available and scalable cloud Domain Name System (DNS) web service.
Building Resilient Cloud Solutions
Auto-Scaling, Load Balancing & Traffic Management
Think of 'ALB' as 'Application Layer Bouncer' (for web traffic) and 'NLB' as 'Network Layer Bouncer' (for raw speed).
Building Resilient Cloud Solutions
Auto-Scaling, Load Balancing & Traffic Management
For the DOP-C02 exam, understand the differences between ALB, NLB, and GLB, and when to use each. Pay close attention to how ASGs integrate with ELBs and how scaling policies are configured. Keywords to spot include 'high availability,' 'fault tolerance,' 'elasticity,' and 'traffic distribution.'
Building Resilient Cloud Solutions
Auto-Scaling, Load Balancing & Traffic Management
Not configuring proper health checks for instances within ASGs or ELBs, leading to traffic being sent to unhealthy instances.
Building Resilient Cloud Solutions
Auto-Scaling, Load Balancing & Traffic Management
Setting ASG scaling policies that are too aggressive (scaling too fast) or too conservative (scaling too slow), leading to either over-provisioning or performance issues.
Building Resilient Cloud Solutions
Auto-Scaling, Load Balancing & Traffic Management
Using an ALB when an NLB is more appropriate for high-performance, non-HTTP/S traffic, or vice-versa, causing unnecessary complexity or performance bottlenecks.
Building Resilient Cloud Solutions
Durability
Probability data remains intact over time.
Building Resilient Cloud Solutions
Consistency
Guarantee all reads return the latest write.
Building Resilient Cloud Solutions
Strong Consistency
Reads always return the most recent data.
Building Resilient Cloud Solutions
Eventual Consistency
Reads might return stale data, but eventually converge.
Building Resilient Cloud Solutions
Multi-AZ
Resources deployed across multiple Availability Zones.
Building Resilient Cloud Solutions
S3 Versioning
Keeps multiple versions of an object in S3.
Building Resilient Cloud Solutions
Point-in-Time Recovery
Restore database to any second within a retention window.
Building Resilient Cloud Solutions
ACID Properties
Atomicity, Consistency, Isolation, Durability for transactions.
Building Resilient Cloud Solutions
Ensuring Data Durability and Consistency
Durable Data Doesn't Disappear (Durability). Consistent Clicks Confirm Current Content (Consistency).
Building Resilient Cloud Solutions
Ensuring Data Durability and Consistency
The exam often tests your understanding of S3's 11 nines durability and the difference between DynamoDB's strongly consistent and eventually consistent reads. Pay close attention to scenario questions that imply a need for immediate data accuracy versus those that can tolerate slight delays.
Building Resilient Cloud Solutions
Ensuring Data Durability and Consistency
Confusing durability with consistency: They are related but distinct concepts. Durability is about data not being lost; consistency is about what data is seen when read.
Building Resilient Cloud Solutions
Ensuring Data Durability and Consistency
Assuming all AWS services provide strong consistency by default: Many services, especially distributed ones, default to eventual consistency for performance reasons.
Building Resilient Cloud Solutions
Ensuring Data Durability and Consistency
Over-provisioning for strong consistency when not needed: Strong consistency often comes with performance or cost trade-offs. Only use it where truly required by the application.
Building Resilient Cloud Solutions
Centralized Logging
Aggregating logs from all sources into a single location.
Monitoring, Logging & Observability
CloudWatch Logs
AWS service for ingesting, storing, and monitoring logs.
Monitoring, Logging & Observability
Kinesis Data Firehose
Streams data to destinations like S3, OpenSearch, Redshift.
Monitoring, Logging & Observability
Amazon OpenSearch Service
Managed service for searching, analyzing, and visualizing logs.
Monitoring, Logging & Observability
CloudWatch Agent
Collects logs and metrics from EC2 instances and on-premises.
Monitoring, Logging & Observability
Log Group
A container for log streams in CloudWatch Logs.
Monitoring, Logging & Observability
Log Stream
A sequence of log events from a single source in CloudWatch.
Monitoring, Logging & Observability
Retention Policy
Defines how long logs are stored in CloudWatch Logs.
Monitoring, Logging & Observability
Implementing Centralized Logging Solutions
To remember the main services: 'C'entralized 'L'ogging 'O'ften 'S'tarts with 'C'loudWatch, then 'K'inesis 'F'irehose for 'O'penSearch and 'S'3. (CLOCKS)
Monitoring, Logging & Observability
Implementing Centralized Logging Solutions
The exam often asks about the most cost-effective or scalable solution for log storage and analysis. Remember that S3 is best for long-term, cold storage, while OpenSearch Service is for real-time analysis and visualization. CloudWatch Logs is the central ingestion point for most AWS services.
Monitoring, Logging & Observability
Implementing Centralized Logging Solutions
Not configuring proper log retention policies, leading to excessive costs or data loss.
Monitoring, Logging & Observability
Implementing Centralized Logging Solutions
Sending all logs directly to OpenSearch Service without considering S3 for long-term, cheaper archival.
Monitoring, Logging & Observability
Implementing Centralized Logging Solutions
Forgetting to install and configure the CloudWatch Agent on EC2 instances for application logs.
Monitoring, Logging & Observability
CloudWatch Metrics
Time-ordered data points representing a variable being monitored.
Monitoring, Logging & Observability
Namespace
A container for CloudWatch metrics, preventing naming collisions.
Monitoring, Logging & Observability
Dimensions
Name/value pairs that uniquely identify a metric.
Monitoring, Logging & Observability
CloudWatch Alarms
Watches a metric and performs actions when a threshold is breached.
Monitoring, Logging & Observability
Alarm States
OK, ALARM, INSUFFICIENT_DATA indicating metric status.
Monitoring, Logging & Observability
CloudWatch Dashboards
Customizable home pages for monitoring resources in a single view.
Monitoring, Logging & Observability
Custom Metrics
Metrics published by your applications or on-premises servers.
Monitoring, Logging & Observability
Four Golden Signals
Latency, traffic, errors, and saturation for comprehensive monitoring.
Monitoring, Logging & Observability
Configuring Monitoring, Alarms & Dashboards
To remember the CloudWatch alarm states: 'O.A.I.' - Oh, An Issue!
Monitoring, Logging & Observability
Configuring Monitoring, Alarms & Dashboards
The exam frequently asks about the components of a CloudWatch alarm (metric, statistic, period, threshold, evaluation periods, actions) and the purpose of namespaces and dimensions for metrics. Memorize the three alarm states: OK, ALARM, INSUFFICIENT_DATA.
Monitoring, Logging & Observability
Configuring Monitoring, Alarms & Dashboards
Setting alarm thresholds too low, leading to 'noisy' alarms and alert fatigue.
Monitoring, Logging & Observability
Configuring Monitoring, Alarms & Dashboards
Not using dimensions effectively, making it hard to pinpoint the source of a problem.
Monitoring, Logging & Observability
Configuring Monitoring, Alarms & Dashboards
Creating too many dashboards that are redundant or not focused on specific operational needs.
Monitoring, Logging & Observability
Log
A timestamped record of a discrete event in a system.
Monitoring, Logging & Observability
Metric
A numerical measurement collected over time, representing system performance.
Monitoring, Logging & Observability
Trace
The end-to-end path of a request through a distributed system.
Monitoring, Logging & Observability
CloudWatch Logs Insights
A powerful query language for interactive analysis of CloudWatch log data.
Monitoring, Logging & Observability
Anomaly Detection
Automatically identifying data points that deviate significantly from expected patterns.
Monitoring, Logging & Observability
Baseline
A normal or expected level of performance or behavior for a system.
Monitoring, Logging & Observability
Correlation
Identifying relationships or dependencies between different data points or metrics.
Monitoring, Logging & Observability
Analyzing Logs, Metrics & Performance Data
LMT: Logs are like a diary, Metrics are like a speedometer, Traces are like following a package delivery.
Monitoring, Logging & Observability
Analyzing Logs, Metrics & Performance Data
The exam often tests your ability to choose the correct AWS service for a given logging or monitoring analysis task. Memorize that CloudWatch Logs Insights is for interactive log querying, OpenSearch Service for large-scale centralized log management, and CloudWatch for metrics and dashboards.
Monitoring, Logging & Observability
Analyzing Logs, Metrics & Performance Data
Confusing logs with metrics: Logs are discrete events, metrics are aggregated numerical values.
Monitoring, Logging & Observability
Analyzing Logs, Metrics & Performance Data
Not establishing baselines: Without knowing what's normal, it's hard to spot what's abnormal.
Monitoring, Logging & Observability
Analyzing Logs, Metrics & Performance Data
Over-collecting data without a purpose: Collect what's necessary for insights, not just everything.
Monitoring, Logging & Observability
Distributed Tracing
Monitoring technique for tracking requests across multiple services.
Monitoring, Logging & Observability
Span
An individual operation within a trace, with start/end times and attributes.
Monitoring, Logging & Observability
Context Propagation
Mechanism to pass trace/span IDs between services.
Monitoring, Logging & Observability
AWS X-Ray
AWS service for analyzing and debugging distributed applications.
Monitoring, Logging & Observability
OpenTelemetry
Open-source framework for collecting telemetry data (traces, metrics, logs).
Monitoring, Logging & Observability
Service Map
Visual representation of services and their connections in X-Ray.
Monitoring, Logging & Observability
Implementing Tracing and Distributed Observability
X-Ray eXamines eXecution eXactly. It's like an X-ray vision for your distributed application's internal workings!
Monitoring, Logging & Observability
Implementing Tracing and Distributed Observability
The exam often tests your understanding of how AWS X-Ray integrates with other services (Lambda, API Gateway, EC2, ECS) and its role in troubleshooting microservices. Be prepared to differentiate between X-Ray, CloudWatch Logs, and CloudWatch Metrics, understanding when to use each for observability.
Monitoring, Logging & Observability
Implementing Tracing and Distributed Observability
Not instrumenting all relevant services: Partial tracing provides an incomplete picture and can mislead debugging efforts.
Monitoring, Logging & Observability
Implementing Tracing and Distributed Observability
Ignoring context propagation: Without proper context propagation, spans cannot be linked into a coherent trace.
Monitoring, Logging & Observability
Implementing Tracing and Distributed Observability
Overlooking the cost of tracing: High-volume tracing can generate significant data, leading to increased storage and processing costs if not managed.
Monitoring, Logging & Observability
CloudWatch
Monitoring and observability service for AWS resources and applications.
Incident & Event Response
EventBridge
Serverless event bus that connects application data from various sources.
Incident & Event Response
Systems Manager Automation
Defines and executes operational tasks across AWS resources.
Incident & Event Response
Lambda
Serverless compute service to run code without provisioning servers.
Incident & Event Response
SNS
Managed messaging service for application-to-application and application-to-person communication.
Incident & Event Response
GuardDuty
Intelligent threat detection service that monitors for malicious activity.
Incident & Event Response
Security Hub
Comprehensive view of your security state across AWS services.
Incident & Event Response
Step Functions
Serverless workflow service for orchestrating complex distributed applications.
Incident & Event Response
Automating Incident Response with AWS Services
D.A.R.T.S.: Detect, Alert, Remediate, Track, Secure. Use this to remember the core phases of automated incident response.
Incident & Event Response
Automating Incident Response with AWS Services
The exam frequently tests your ability to combine multiple AWS services to achieve automated incident response. Look for scenarios involving detection (CloudWatch, GuardDuty), triggering (EventBridge, SNS), and remediation (Systems Manager, Lambda, Step Functions). Memorize the core function of each service in this context.
Incident & Event Response
Automating Incident Response with AWS Services
Over-automating without proper testing, leading to unintended consequences or 'runaway' automation.
Incident & Event Response
Automating Incident Response with AWS Services
Failing to include notification mechanisms, leaving teams unaware of automated actions.
Incident & Event Response
Automating Incident Response with AWS Services
Not logging or auditing automated actions, making it difficult to perform root cause analysis or track changes.
Incident & Event Response
Event Pattern
JSON structure used by EventBridge rules to match specific event characteristics.
Incident & Event Response
Target
AWS service or resource invoked by an EventBridge rule when an event matches.
Incident & Event Response
AWS Lambda
Serverless compute service for running code in response to events.
Incident & Event Response
AWS Config
Assesses, audits, and evaluates the configurations of your AWS resources.
Incident & Event Response
AWS Step Functions
Serverless workflow service for orchestrating complex, multi-step processes.
Incident & Event Response
Implementing Event-Driven Actions & Remediation
Remember 'E.V.E.N.T.S.': **E**ventBridge **V**alidates **E**vents, **N**avigates to **T**argets, **S**olving problems.
Incident & Event Response
Implementing Event-Driven Actions & Remediation
The exam frequently tests your understanding of EventBridge as the central orchestrator for event-driven actions. Be prepared to identify appropriate event sources (e.g., CloudWatch Alarms, CloudTrail) and remediation targets (e.g., Lambda, SSM Automation, SNS) for various scenarios. Remember that EventBridge rules are the key to linking events to actions.
Incident & Event Response
Implementing Event-Driven Actions & Remediation
Forgetting to grant EventBridge permission to invoke the target service (e.g., Lambda, SSM).
Incident & Event Response
Implementing Event-Driven Actions & Remediation
Creating overly broad EventBridge event patterns that trigger remediation for unintended events.
Incident & Event Response
Implementing Event-Driven Actions & Remediation
Not thoroughly testing automated remediation workflows, leading to unintended side effects or infinite loops.
Incident & Event Response
Root Cause Analysis (RCA)
Systematic process to find fundamental reasons for problems.
Incident & Event Response
Post-Mortem
Structured, blameless review after an incident to learn and improve.
Incident & Event Response
Blameless Culture
Focuses on system and process failures, not individual blame.
Incident & Event Response
5 Whys
RCA technique asking 'why' repeatedly to find root cause.
Incident & Event Response
Fishbone Diagram
Visual tool to categorize potential causes of a problem.
Incident & Event Response
Actionable Items
Specific, measurable tasks to prevent incident recurrence.
Incident & Event Response
Incident Timeline
Chronological record of events during an incident.
Incident & Event Response
Performing Root Cause Analysis & Post-Mortems
Remember 'RCA' as 'Really Clear Actions' – because the goal is to get clear, actionable steps from your analysis!
Incident & Event Response
Performing Root Cause Analysis & Post-Mortems
The exam emphasizes blameless post-mortems and identifying actionable improvements. Look for questions about preventing recurrence, not just fixing. Keywords: 'blameless retrospective,' 'root cause,' 'lessons learned,' 'continuous improvement.'
Incident & Event Response
Performing Root Cause Analysis & Post-Mortems
Assigning blame during a post-mortem, which stifles honest communication and learning.
Incident & Event Response
Performing Root Cause Analysis & Post-Mortems
Failing to implement or follow up on actionable items, rendering the RCA effort useless.
Incident & Event Response
Performing Root Cause Analysis & Post-Mortems
Focusing only on immediate symptoms rather than digging for the underlying systemic root cause.
Incident & Event Response
Incident Response Plan (IRP)
Comprehensive strategy for handling security incidents.
Incident & Event Response
Security Playbook
Step-by-step guide for responding to specific incident types.
Incident & Event Response
Containment
Limiting the scope and impact of a security incident.
Incident & Event Response
Eradication
Removing the root cause of a security incident.
Incident & Event Response
Recovery
Restoring systems to normal operation after an incident.
Incident & Event Response
AWS CloudTrail
Logs API calls and events for auditing and forensics.
Incident & Event Response
Amazon GuardDuty
Threat detection service monitoring for malicious activity.
Incident & Event Response
AWS Security Hub
Centralized view of security alerts and compliance status.
Incident & Event Response
Managing Security Incidents & Playbooks
P-D-A-C-E-R-P: 'Please Don't Ask, Cause Everyone Runs Panicked!' (Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-Incident)
Incident & Event Response
Managing Security Incidents & Playbooks
The exam often tests your understanding of the incident response lifecycle phases and the purpose of security playbooks. Remember the order of the lifecycle: Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Activity. Know that playbooks standardize responses to specific threats.
Incident & Event Response
Managing Security Incidents & Playbooks
Not having a well-defined incident response plan or playbooks before an incident occurs.
Incident & Event Response
Managing Security Incidents & Playbooks
Failing to regularly test and update incident response procedures and playbooks.
Incident & Event Response
Managing Security Incidents & Playbooks
Not properly documenting incidents or performing post-incident analysis to learn from events.
Incident & Event Response
NACL
Network Access Control List; stateless firewall at subnet level.
Security & Compliance in DevOps
Security Group
Stateful firewall at instance/ENI level, controls inbound/outbound traffic.
Security & Compliance in DevOps
AWS KMS
Key Management Service; manages cryptographic keys for data encryption.
Security & Compliance in DevOps
Shift Left Security
Integrating security practices early in the software development lifecycle.
Security & Compliance in DevOps
AWS WAF
Web Application Firewall; protects web applications from common exploits.
Security & Compliance in DevOps
CMK
Customer-Managed Key; encryption key managed by the customer in KMS.
Security & Compliance in DevOps
TLS
Transport Layer Security; protocol for encrypting communication over a network.
Security & Compliance in DevOps
Implementing Robust Security Controls on AWS
NACLs are 'Nasty' and 'Network-wide' (subnet level, stateless). Security Groups are 'Safe' and 'Specific' (instance level, stateful).
Security & Compliance in DevOps
Implementing Robust Security Controls on AWS
The exam frequently tests your understanding of where to apply specific security controls (e.g., NACLs vs. Security Groups, KMS for encryption, WAF for web apps). Pay attention to the 'layer' of security being discussed in a question.
Security & Compliance in DevOps
Implementing Robust Security Controls on AWS
Confusing NACLs (stateless, subnet) with Security Groups (stateful, instance).
Security & Compliance in DevOps
Implementing Robust Security Controls on AWS
Neglecting encryption for data at rest or in transit for sensitive information.
Security & Compliance in DevOps
Implementing Robust Security Controls on AWS
Failing to integrate automated security checks into the CI/CD pipeline, leading to late discovery of vulnerabilities.
Security & Compliance in DevOps
IAM User
An identity for a person or application with long-term credentials.
Security & Compliance in DevOps
IAM Group
A collection of IAM users that share the same permissions.
Security & Compliance in DevOps
IAM Role
An identity that can be assumed by trusted entities for temporary permissions.
Security & Compliance in DevOps
IAM Policy
A JSON document defining permissions for AWS actions and resources.
Security & Compliance in DevOps
MFA
Multi-Factor Authentication, adds an extra layer of security.
Security & Compliance in DevOps
Federation
Allows external identities to access AWS resources without IAM users.
Security & Compliance in DevOps
Service Control Policy (SCP)
Organizational policy to set maximum permissions across accounts.
Security & Compliance in DevOps
Managing Access, Permissions & Identity
Users are People, Groups are Teams, Roles are Hats, Policies are Rules. Remember: People work in Teams, wear different Hats, and follow Rules.
Security & Compliance in DevOps
Managing Access, Permissions & Identity
Memorize the core differences between IAM Users, Groups, and Roles. The exam often presents scenarios where choosing the correct IAM entity is critical for security and manageability. Pay attention to whether long-term credentials are appropriate or if temporary, assumable permissions are better.
Security & Compliance in DevOps
Managing Access, Permissions & Identity
Using the AWS root user for daily operational tasks instead of dedicated IAM users.
Security & Compliance in DevOps
Managing Access, Permissions & Identity
Granting overly broad permissions (e.g., `s3:*` or `ec2:*`) instead of specific actions.
Security & Compliance in DevOps
Managing Access, Permissions & Identity
Hardcoding AWS credentials directly into application code instead of using IAM roles.
Security & Compliance in DevOps
Compliance
Adherence to rules, laws, or standards.
Security & Compliance in DevOps
GDPR
EU data protection and privacy law.
Security & Compliance in DevOps
HIPAA
US law for protecting health information.
Security & Compliance in DevOps
PCI DSS
Security standard for credit card data.
Security & Compliance in DevOps
Shared Responsibility Model
AWS secures the cloud, customer secures in the cloud.
Security & Compliance in DevOps
AWS Artifact
On-demand access to AWS compliance reports.
Security & Compliance in DevOps
Ensuring Compliance with Regulations & Standards
For compliance, think 'C-A-R-E': Compliance, Artifact, Responsibility, Enforcement. CARE for your cloud compliance!
Security & Compliance in DevOps