PCAM flashcards

37 cards. Read the term and the definition here. The deck at the top of this page is optional.

Well-Architected Framework pillars

Six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Each pillar has design principles and best-practice questions scored by risk.

AWS CAF perspectives

Six perspectives: Business, People, Governance (business domain) and Platform, Security, Operations (technical domain). Used to structure cloud transformation planning and stakeholder responsibilities.

Service control policy (SCP)

An Organizations policy that sets the maximum permissions for member accounts. It filters permissions but never grants them; an explicit deny in an SCP overrides any allow.

Landing zone

A pre-configured, multi-account baseline with identity, logging, networking, and guardrails. AWS Control Tower automates its creation using Organizations, IAM Identity Center, and CloudTrail.

The 7 Rs

Migration strategies: Retire, Retain, Rehost, Relocate, Replatform, Repurchase, and Refactor/Re-architect. Choice depends on business value, effort, and application characteristics.

Subnet AZ mapping

A subnet belongs to exactly one Availability Zone and cannot span AZs. A VPC spans a Region and contains subnets in multiple AZs for fault isolation.

Reserved IPs per subnet

AWS reserves five addresses in every subnet: network address, VPC router, DNS, future use, and broadcast. A /24 therefore provides 251 usable addresses.

Security group vs NACL

Security groups are stateful, allow-only, and attached to ENIs. Network ACLs are stateless, support allow and deny, are evaluated in numbered order, and apply at subnet level.

NAT Gateway behavior

Provides outbound IPv4 internet access for private subnets, sits in a public subnet with an Elastic IP, and blocks unsolicited inbound traffic. It is AZ-scoped, so deploy one per AZ for resilience.

Gateway vs interface endpoint

Gateway endpoints (S3, DynamoDB) add a route-table entry at no hourly charge. Interface endpoints use PrivateLink ENIs and incur hourly and data processing charges.

Transit Gateway

A regional network hub connecting VPCs, VPNs, and Direct Connect gateways. It supports transitive routing, unlike VPC peering, and can peer across Regions.

IAM policy evaluation logic

Explicit deny overrides everything. Otherwise an allow must come from an SCP, identity or resource policy, and permissions boundary. Missing an allow means implicit deny.

Permissions boundary

A managed policy that sets the maximum permissions an identity-based policy can grant. It does not grant permissions and is commonly used for delegated administration.

Cross-account role assumption

The role's trust policy must allow the external principal, and the caller's identity policy must allow sts:AssumeRole. The caller then receives temporary STS credentials.

KMS key rotation

Customer managed symmetric keys support automatic annual rotation. Asymmetric keys and imported key material cannot rotate automatically and require manual rotation.

S3 encryption options

SSE-S3 uses AWS managed keys by default. SSE-KMS adds CloudTrail audit and per-key access control. SSE-C means the customer supplies and manages the key material.

Compliance evidence sources

AWS Artifact supplies compliance reports and agreements. AWS Config evaluates resource compliance, CloudTrail records API activity, and Security Hub aggregates findings across accounts.

S3 durability and availability

S3 Standard is designed for 99.999999999% durability and a 99.9% availability SLA. Durability reflects expected annual object loss; availability reflects successful request time.

S3 storage class selection

Intelligent-Tiering suits unknown or changing access. Standard-IA suits infrequent but rapid access. Glacier Instant Retrieval keeps millisecond access; Deep Archive is for long-term retention.

EBS vs instance store

EBS volumes are network-attached, AZ-scoped, and persist independently of instance lifecycle. Instance store is physically attached, ephemeral, and lost on stop or termination.

DynamoDB partition limits

Each partition supports up to 3,000 read capacity units and 1,000 write capacity units. A hot partition caps throughput regardless of the table's total provisioned capacity.

RDS Multi-AZ vs replicas

Multi-AZ keeps a synchronous standby for failover and does not serve reads. Read replicas use asynchronous replication, can serve read traffic, and can be promoted.

Application Migration Service

AWS MGN performs lift-and-shift rehosting by continuously replicating source servers at block level into AWS and launching them as EC2 instances with minimal cutover downtime.

DMS and SCT

Database Migration Service moves data with minimal downtime. Schema Conversion Tool converts schemas and code for heterogeneous engines, such as Oracle to Aurora PostgreSQL.

Strangler fig pattern

Incrementally replace legacy functionality with new services behind a facade, routing traffic gradually. Old and new coexist, reducing migration risk and enabling rollback.

Containers vs serverless fit

Lambda suits short-lived, event-driven, spiky workloads. Containers on ECS, EKS, or Fargate suit long-running or stateful processes needing runtime control and predictable concurrency.

RTO and RPO

Recovery Time Objective is the maximum acceptable downtime after a failure. Recovery Point Objective is the maximum acceptable data loss measured in time.

DR strategy ordering

From lowest cost and slowest recovery to highest cost and fastest: Backup and Restore, Pilot Light, Warm Standby, Multi-Site Active/Active. Each step improves RTO and RPO.

Pilot Light vs Warm Standby

Pilot Light replicates core data and keeps minimal services running, scaling up at failover. Warm Standby runs a scaled-down but fully functional copy of the workload.

Static stability principle

Failover relies on pre-provisioned capacity and does not depend on control-plane actions during an event. This avoids delays and dependency failures at the worst moment.

Savings Plans scope

Compute Savings Plans apply to EC2, Fargate, and Lambda across families, sizes, Regions, and OS. EC2 Instance Savings Plans are tied to a family and Region for deeper discounts.

gp3 volume baseline

gp3 provides a baseline of 3,000 IOPS and 125 MiB/s throughput, with IOPS and throughput configurable independently of volume size up to published maximums.

S3 Intelligent-Tiering mechanics

Automatically moves objects between access tiers based on observed usage. It charges a per-object monitoring fee but no retrieval fees, suiting unpredictable access patterns.

CloudTrail vs Config vs CloudWatch

CloudTrail records API activity for audit. AWS Config records resource configuration and changes for compliance. CloudWatch holds metrics, logs, and alarms for operations.

Session Manager benefit

Provides shell access to instances through Systems Manager without opening inbound ports, running bastion hosts, or managing SSH keys. Sessions are logged for audit.

CloudFormation StackSets

Deploys a single template as stacks across multiple accounts and Regions from one operation, commonly used to roll out governance and baseline resources organization-wide.

Cost allocation tags

Tags activated as cost allocation tags appear in billing reports, enabling cost breakdown by team, project, or environment. Tag policies in Organizations enforce consistent keys.