CertiRetrieve, filter, approve
- Knowledge base read the current documents
- Guardrails block the prompt or the completion
- AgentCore Identity the agent's permission
- Task token wait for a person
Study guide · Flashcards & memory notes
Solutions Architect Professional Flashcards & Memory Notes
50 recall cards for the distinctions SAP-C03 adds: which control belongs on the model, which boundary belongs on the tenant, and which recovery tool matches the failure.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Cloud-native
Pipelines, workflows, mesh, images, and tenants.
1.1What retrieves current documents for a Bedrock answer without training a model?
A Bedrock knowledge base. Fine-tuning changes the model. Guardrails filter input and output. They do not retrieve the document.
1.2Which Step Functions workflow type keeps a week-long approval?
A standard workflow. Express workflows are the short, high-volume path. They are not the durable audit of a long wait.
1.3What pauses a workflow until a person approves?
A task token callback. The execution waits. A Lambda loop that polls a table is the pattern you replace.
1.4When do you choose VPC Lattice instead of ECS Service Connect?
Services cross VPCs or accounts, or mix Lambda, ECS, EKS, and EC2, and need IAM auth. Service Connect is discovery and connectivity inside ECS.
1.5What should a pipeline do when an image scan reports a critical finding and policy forbids the release?
Fail the deploy stage. Turning the scan off ships the finding. It does not close it.
1.6What signs a container image so the deploy stage can verify it?
AWS Signer. An unsigned image from a laptop is the supply-chain gap.
1.7Which tenant model dedicates the data store to one tenant?
A silo. A pool shares the store and separates tenants with a key. A bridge shares compute and separates the data.
1.8Which stream lets your own consumers replay records?
Amazon Kinesis Data Streams. Amazon Data Firehose delivers and buffers. It is not that replay log.
1.9What buffers a stream into S3, Redshift, or OpenSearch?
Amazon Data Firehose. It does not keep a consumer group you operate.
1.10What lets another company analyze data without receiving the raw table?
AWS Clean Rooms. Copying the bucket hands over the raw data.
Deck 2 · Security
Guardrails, agent identity, keys, and the account ceiling.
2.1What filters a model prompt and its completion?
Amazon Bedrock Guardrails. A bucket policy does not read the completion. A knowledge base retrieves. It does not filter.
2.2How should an agent receive permission to call a tool?
Amazon Bedrock AgentCore Identity. A long-term access key in the prompt is the exposure.
2.3Which KMS algorithm is the post-quantum signature?
ML-DSA. ML-KEM encapsulates a key. It does not sign the artifact.
2.4Which KMS algorithm establishes a shared secret?
ML-KEM. ML-DSA signs. Encapsulation and a signature are different jobs.
2.5What does a service control policy do?
It sets the maximum permissions for member accounts. It does not grant access, and it does not constrain the management account the way it constrains members.
2.6What has to allow a cross-account read?
The resource policy and the caller's identity policy. An allow on only one side is a deny.
2.7How does a deployment pipeline get credentials in a target account?
It assumes a role in that account. A long-term key in the pipeline variables is the pattern to remove.
2.8A scan finds a severe dependency issue and the policy says the build must not release. What happens next?
The pipeline fails the stage. Logging the finding and deploying anyway does not meet that constraint.
2.9Where does a human approval sit in an agent design?
A Step Functions task token waits until a person approves. Confidence from the model is not the approval.
2.10Does an SCP limit the management account the way it limits a member?
No. The ceiling is for member accounts. The management account is not constrained the same way.
Deck 3 · Cost
Commitments, storage class, and the path that creates a charge.
3.1Which Savings Plan can apply to EC2, Fargate, and Lambda?
A Compute Savings Plan. An EC2 Instance Savings Plan is one instance family in one Region.
3.2When is Spot the wrong place for the workload?
It is the only copy of a stateful primary. Spot can be interrupted. Use it for work that can stop and be retried.
3.3What purchase has no commitment and no interruption?
On-Demand. A flat production fleet left entirely on On-Demand is the expensive steady state.
3.4Which S3 class fits objects whose access pattern you do not know?
S3 Intelligent-Tiering. Glacier classes are archives. Their retrieval time is part of the decision.
3.5Why can a Glacier class miss a 15-minute read requirement?
Retrieval can take much longer than 15 minutes. The storage class has to match how soon the object must be readable.
3.6How do private instances reach S3 without NAT data-processing fees?
A gateway VPC endpoint. An interface endpoint is a different elastic network interface and has an hourly charge.
3.7What charge appears when two chatty tiers sit in different Availability Zones?
Cross-AZ data transfer. Putting them in one AZ removes that charge and also removes the story for an AZ failure.
3.8What lifecycle action cleans up abandoned multipart uploads?
A lifecycle rule that aborts incomplete multipart uploads. The same rule does not change the class of an object the application reads on every request.
3.9What is an EC2 Instance Savings Plan tied to?
One instance family in one Region. A Compute Savings Plan can move across families and across EC2, Fargate, and Lambda.
3.10What does a Reserved Instance commit you to?
A specific instance shape. It is not spare capacity that AWS can reclaim. That capacity is Spot.
Deck 4 · Resilience
Experiments, shifts, recovery patterns, and migration.
4.1What assesses an application against a recovery objective before the outage?
AWS Resilience Hub. AWS Fault Injection Service runs the experiment. It does not write the assessment.
4.2What injects a controlled failure?
AWS Fault Injection Service. A dashboard shows the last incident. It does not stop the instance on purpose.
4.3What moves load off one failing Availability Zone for the stack?
An Application Recovery Controller zonal shift. Multi-AZ database failover keeps one database endpoint. It is not a shift of the whole stack.
4.4What is RPO?
How much data loss, in time, you can accept. RTO is how long you can take to restore service.
4.5Which recovery pattern has the lowest standing cost and the longest restore?
Backup and restore. Active/active costs the most and recovers the fastest.
4.6What is warm standby?
A scaled-down full copy that you scale out before shifting traffic. Pilot light keeps critical data live and starts the fleet later.
4.7What is pilot light?
Critical data stays live, and the rest of the fleet starts at failover time. Warm standby is already a small full copy.
4.8What continuously replicates a server for a lift-and-shift cutover?
AWS Application Migration Service. AWS Database Migration Service moves the database. AWS DataSync moves files.
4.9What moves a large file set that should not cross the network?
AWS Snowball. A 2 GB database that must stay in sync is a Database Migration Service job, not a truck.
4.10Why is Multi-AZ not a Regional disaster plan?
The standby is in the same Region. A Regional failure needs a cross-Region copy and a recovery pattern.
Deck 5 · Operations
Pipelines, probes, container metrics, and runbooks.
5.1How should a pipeline deploy into many accounts?
From a deployment account, by assuming a role in each target. A static key per account in the variable store is the credential to remove.
5.2What probes an endpoint on a schedule before a customer does?
Amazon CloudWatch Synthetics. CloudWatch RUM records what real browsers saw. A canary is not a real user.
5.3What records the experience in the customer's browser?
Amazon CloudWatch RUM. A synthetic canary is a script you run. It is not that browser session.
5.4Where do you look for ECS and EKS container metrics?
CloudWatch Container Insights. An EC2 CPU graph does not explain model latency or a task that cannot place.
5.5What runs the documented recovery steps?
An AWS Systems Manager Automation runbook. A wiki page is not the automation the design named.
5.6What puts a configuration back if someone edits it later?
A State Manager association. One Run Command does not notice a later change.
5.7What is a shell that does not need port 22?
Session Manager. Opening SSH to the world is the finding you close, not the access path.
5.8What do VPC Flow Logs tell you about a packet?
Whether it was accepted or rejected, and the port. They do not explain a slow model response.
5.9Where do model latency and invocation errors belong?
Application metrics you publish. They are not an EC2 status check and they are not a flow log.
5.10A container monitor and a synthetic canary both exist. Which one tells you the login page failed on a timer?
The synthetic canary. Container Insights tells you about the task. It does not browse the login page.
Memory notes
Groupings that make the highest-yield SAP-C03 distinctions easier to recall.
Mesh versus tenant
VPC Lattice crosses accounts and compute types. ECS Service Connect stays inside ECS. A silo keeps one tenant's data alone. A pool shares the store.
Sign versus encapsulate
ML-DSA signs. ML-KEM encapsulates a shared secret. AWS Signer signs the image. The pipeline verifies it and fails a critical scan.
Steady, spare, flexible
A Compute Savings Plan covers the flat fleet. Spot is spare capacity that can stop. On-Demand has no commitment. A gateway endpoint takes S3 off a NAT gateway.
Assess, inject, shift
Resilience Hub assesses the objective. Fault Injection Service runs the experiment. Application Recovery Controller shifts the zone. Multi-AZ is not a Regional plan.
Probe versus person
Synthetics runs the canary on a timer. RUM records the browser. Container Insights is the task. Flow Logs are accept or reject. A runbook is the response you already wrote.
Continue the Solutions Architect Professional study path
Test what you have learned with a timed practice exam.
Overview
Exam format, five announced domains, the SAP-C02 dates, and a study plan.
Core Notes
Reference notes for cloud-native design, security, cost, resilience, and operations.
Flashcards & Memory Notes
50 recall cards in five decks, plus memory notes for mesh, tenancy, recovery, and spend.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
CSV JSON Converter
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.