AWS CloudOps Engineer (SOA-C03) flashcards
AWS CloudOps Engineer (SOA-C03) · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- RTO vs RPO
- RTO is the maximum tolerable time to restore service after disruption. RPO is the maximum tolerable amount of data loss measured in time before the incident.
- CloudWatch detailed monitoring
- Publishes EC2 metrics at 1-minute granularity instead of the default 5-minute basic monitoring. It is enabled per instance and incurs additional charges.
- Composite alarm
- A CloudWatch alarm whose state is determined by a rule combining the states of other alarms using AND/OR logic. It reduces alert noise from correlated symptoms.
- Permission boundary
- An IAM managed policy that sets the maximum permissions an identity-based policy can grant to a user or role. It never grants permissions on its own.
- Service control policy
- An AWS Organizations policy that limits the maximum permissions available to accounts in an organization. It does not grant permissions and does not affect the management account.
- S3 Block Public Access
- A set of four settings that block public ACLs and policies on buckets and accounts. Account-level settings override bucket-level settings.
- Gateway VPC endpoint
- A route-table target that privately connects a VPC to S3 or DynamoDB without internet or NAT. It has no hourly charge and is not an ENI.
- Transit Gateway
- A regional hub that connects VPCs, VPNs, and Direct Connect attachments with transitive routing, replacing complex mesh peering topologies.
- Security group statefulness
- Security groups are stateful and allow-only; return traffic for an allowed connection is automatically permitted. Network ACLs are stateless and require explicit rules both directions.
- Route 53 failover routing
- A routing policy that sends traffic to a primary record while healthy and to a secondary record when a health check reports the primary unhealthy.
- CloudFormation change set
- A preview of the resource changes a stack update will make before execution. It shows additions, modifications, and replacements without applying them.
- CloudFormation drift detection
- Compares a stack's actual resource configuration against its expected template configuration and reports resources that differ, indicating out-of-band changes.
- DeletionPolicy Retain
- A CloudFormation attribute that keeps a resource and its data when the stack is deleted, instead of deleting it. Commonly used for stateful resources.
- CodeDeploy blue/green
- A deployment type that shifts traffic from the original environment to a replacement environment after validation, enabling quick rollback.
- SSM Session Manager
- Provides interactive shell access to managed instances without opening inbound ports, bastion hosts, or managing SSH keys. Sessions can be logged to S3 or CloudWatch.
- Secrets Manager rotation
- Automatically rotates stored credentials on a schedule by invoking a Lambda rotation function, updating the secret and the target database or service.
- GuardDuty
- A managed threat-detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious or anomalous activity.
- AWS Artifact
- A self-service portal providing on-demand access to AWS compliance reports such as SOC and ISO, plus agreements including the Business Associate Addendum.
- EBS snapshot incrementality
- The first EBS snapshot is full; subsequent snapshots store only blocks changed since the previous snapshot, reducing storage cost and time.
- Multi-AZ RDS
- A deployment with a synchronous standby replica in another Availability Zone. Failover to the standby is automatic and does not require application changes.
- Warm standby DR
- A disaster recovery strategy running a scaled-down but fully functional copy of the workload in another region, able to scale up quickly after failover.
- S3 Cross-Region Replication
- Asynchronously copies objects to a bucket in another region. Versioning must be enabled on both source and destination buckets.
- CloudWatch Logs subscription filter
- A filter on a log group that streams matching log events in real time to Kinesis Data Streams, Firehose, or Lambda for processing.
- EventBridge scheduled rule
- A rule using a rate or cron expression to invoke a target such as a Lambda function on a schedule, commonly used for automated remediation.
- AWS Config remediation
- An action, often an SSM Automation document, that corrects a noncompliant resource detected by an AWS Config rule. It can run automatically or manually.
- Compute Savings Plans
- A commitment to a consistent hourly spend for one or three years in exchange for discounted pricing, flexible across instance family, region, and compute service.
- Spot Instance interruption
- AWS reclaims Spot capacity with a two-minute interruption notice when capacity is needed or the Spot price exceeds the bid. Suitable for fault-tolerant workloads.
- gp3 EBS volume
- A general-purpose SSD volume with a baseline of 3,000 IOPS and 125 MB/s throughput. IOPS and throughput can be provisioned independently of capacity.
- S3 Intelligent-Tiering
- A storage class that automatically moves objects between frequent and infrequent access tiers based on observed access patterns, charging a small monitoring fee.
- Auto Scaling target tracking
- A scaling policy that adjusts capacity to keep a chosen metric, such as average CPU utilization, at a specified target value.
- NAT Gateway availability
- A NAT Gateway is scoped to a single Availability Zone. Deploying one per AZ in each private subnet's route table prevents cross-AZ dependency and outages.
- ALB versus NLB
- ALB routes at Layer 7 using host, path, and headers. NLB routes at Layer 4, supports static IPs, and handles extreme throughput and low latency.