AWS Solutions Architect study plan

Map every AWS identity type (IAM user, group, role, federated identity, resource-based policy) and write the evaluation logic for a single request in your own words

Build three IAM policies from scratch: a least-privilege S3 bucket policy, a role trust policy for cross-account access, and a permissions boundary that caps a developer role

Differentiate service control policies from identity policies by sketching an Organizations tree with an OU-level deny that overrides an account admin

Compare KMS key policies, grants, and IAM policy interaction, then decide which one governs a given decrypt call

Enable and interpret CloudTrail, GuardDuty, and Config findings on one account to explain the detective-control layer

Design a multi-account landing zone with separate OU tiers for security, logging, and workloads, and place SCP guardrails at each tier

Build a VPC with public and private subnets, a NAT gateway path, security groups chained by reference, and NACLs, then explain why each control sits where it does

Select encryption mechanisms for data at rest across S3, EBS, RDS, and DynamoDB, and justify SSE-KMS versus SSE-S3 for one regulated workload

Choose between ACM-managed certificates, a self-signed CA, and Secrets Manager rotation for a three-tier app, stating the tradeoff for each

Diagram a defense-in-depth stack for a public web app that includes WAF, Shield, private subnets, and a bastion-less access path

Compare the four disaster recovery strategies (backup and restore, pilot light, warm standby, multi-site active-active) by computing RTO and RPO for each on the same workload

Configure cross-Region S3 replication and an RDS read replica failover, then record measured failover behaviour

Design a multi-AZ architecture for a stateless web tier and a stateful database tier, and state exactly which component fails over and how

Select between Route 53 failover, weighted, and latency routing for three named scenarios and defend each choice

Build a backup plan in AWS Backup with retention and cross-account vaulting, then verify a restore end to end

Decouple a monolithic flow using SQS, SNS, and EventBridge, and pick the right one for fan-out, buffering, and event routing respectively

Size an Auto Scaling group with target tracking and step scaling policies, and explain how a health check type changes replacement behaviour

Configure an Application Load Balancer across two AZs with health checks and sticky sessions, then justify ALB versus NLB versus GWLB for three workloads

Choose a caching layer (ElastiCache, CloudFront, DAX) for read-heavy, global, and low-latency-database cases

Identify single points of failure in a supplied three-tier design and remove each one

Match EBS volume types (gp3, io2, st1, sc1) to four IOPS and throughput profiles and state the cost consequence of each mismatch

Select the right compute family and purchase model for a batch job, a steady-state API, and a spiky web front end

Design a database layer choosing between Aurora, RDS, DynamoDB, and Redshift for four access patterns, justifying partition key and index choices

Plan a global content delivery path using CloudFront, Global Accelerator, and Route 53 latency routing, and explain when each adds value

Tune a read-heavy workload using read replicas, ElastiCache, and query-level improvements, ranking them by effort versus gain

Instrument a workload with CloudWatch metrics, logs, and alarms, then define one composite alarm that reflects a real user-facing symptom

Right-size an instance fleet using Compute Optimizer or CloudWatch data and quantify the monthly saving

Compare Savings Plans, Reserved Instances, Spot, and On-Demand for three usage patterns and compute the blended cost

Build a cost allocation scheme with tags, cost categories, and budgets, then set an anomaly alert

Choose between serverless and always-on for a low-traffic service by calculating break-even request volume

Apply the S3 lifecycle toolkit (transition, expiration, Intelligent-Tiering) to a dataset and state the storage-class crossover points

Evaluate data transfer costs across AZ, Region, and internet egress, and redesign one architecture to eliminate a surprise egress bill

Select between NAT gateway, VPC endpoint, and PrivateLink for private access to S3 and a third-party SaaS, with the cost delta for each

Compare serverless pricing shapes for Lambda, Fargate, and Step Functions on a given invocation profile

Decide when to delete, consolidate, or reserve, and produce a decommission checklist for idle resources

Re-derive the four domain weighting tradeoffs and allocate your remaining review time to the weakest measured domain

Rewrite every missed question from earlier quizzes as a rule you can state in one sentence

Answer scenario questions under time pressure, focusing on requirement keywords such as 'most cost-effective', 'highest availability', and 'least operational overhead'

Resolve the ten concepts you flagged as uncertain by building the smallest possible working example or reading the primary documentation for each