Domain 3: Continuous Improvement on Album69

Backup General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. AWS Backup is the centralized backup service. Know backup plans, vaults, cross-region/cross-account backup, and supported services.

1. Overview

AWS Backup is a fully managed, centralized backup service that automates and consolidates backup tasks across AWS services and accounts. It replaces service-specific backup configurations with a single policy-driven approach.

2. Supported Services

Category	Services
Compute	EC2 instances (EBS volumes)
Storage	EFS, FSx (all types), S3
Databases	RDS, Aurora, DynamoDB, DocumentDB, Neptune
Hybrid	VMware workloads (on-premises via AWS Backup Gateway)
Other	Storage Gateway volumes

3. Core Concepts

Backup Plan

Policy that defines: backup frequency, retention period, lifecycle rules, vault destination
Assign resources by tag, resource ID, or resource type

BackupPlan:
 Rules:
 - RuleName: DailyBackup
 TargetBackupVault: MyVault
 ScheduleExpression: "cron(0 2 * * ? *)" # 2 AM daily
 StartWindowMinutes: 60
 CompletionWindowMinutes: 120
 Lifecycle:
 DeleteAfterDays: 35
 - RuleName: MonthlyBackup
 TargetBackupVault: MyVault
 ScheduleExpression: "cron(0 2 1 * ? *)" # 1st of month
 Lifecycle:
 MoveToColdStorageAfterDays: 90
 DeleteAfterDays: 365

Backup Vault

Encrypted container for backup recovery points
Vault Lock: WORM protection — backups cannot be deleted before retention period
- Governance mode: admins with special permissions can override
- Compliance mode: no one can delete — even root
Default vault uses AWS-managed KMS key; create custom vaults with customer-managed keys

Recovery Points

Individual backup of a resource
Stored in the backup vault
Restore from recovery point to original or new resource

4. Cross-Region Backup

Copy backups to another region for DR
Configure in backup plan as a copy action
Destination vault must exist in the target region

CopyActions:
 - DestinationBackupVaultArn: arn:aws:backup:eu-west-1:123456789012:backup-vault:DR-Vault
 Lifecycle:
 DeleteAfterDays: 90

5. Cross-Account Backup

Copy backups to another AWS account for additional protection
Requires: backup vault in destination account with resource policy allowing source account
Use Organizations integration for simplified cross-account backup policies
Protects against accidental deletion or ransomware in the source account

6. AWS Backup for Organizations

Deploy backup policies (Backup Plans) across all accounts in an OU or organization
Centrally manage and monitor backup compliance
Backup compliance reports: identify resources not covered by backup plans
Delegated admin: manage from a dedicated backup account

7. Exam Scenarios

Scenario 1: A company needs to ensure all RDS databases, DynamoDB tables, and EFS file systems are backed up daily with 35-day retention, and monthly backups retained for 1 year. What is the solution?

Cloudtrail General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1, 3. CloudTrail is the API audit log for AWS. Know trail types, event types, CloudTrail Lake, and Insights.

1. Overview

AWS CloudTrail records API calls made to AWS services — who did what, when, from where. It is the primary tool for security auditing, compliance, and operational troubleshooting.

What CloudTrail captures:

AWS Management Console actions
AWS CLI and SDK calls
AWS service-to-service calls
CloudFormation stack operations
IAM changes, S3 bucket policy changes, security group modifications

2. Event Types

Type	Description	Default
Management events	Control plane operations (create, delete, modify resources)	Enabled (free)
Data events	Data plane operations (S3 GetObject, Lambda Invoke, DynamoDB GetItem)	Disabled (additional cost)
Insights events	Unusual API activity detection	Disabled (additional cost)

Management Events

Read events: Describe*, List*, Get* (low security value, high volume)
Write events: Create*, Delete*, Modify*, Put* (high security value)
Can filter to write-only to reduce cost

Data Events

High-volume, resource-level operations:

Cloudwatch General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3, 4. CloudWatch is the observability foundation. Know metrics, alarms, Logs Insights, dashboards, Container Insights, and cross-account observability.

1. Overview

Amazon CloudWatch is the unified observability service for AWS. It collects metrics, logs, and traces, and enables alarms, dashboards, and automated actions.

2. Metrics

Namespaces and Dimensions

Namespace: logical grouping (e.g., AWS/EC2, AWS/RDS, custom)
Dimension: key-value pair that identifies a metric (e.g., InstanceId=i-1234)
Resolution: standard (1-minute) or high-resolution (1-second) for custom metrics

Key Metrics by Service

Service	Key Metrics
EC2	CPUUtilization, NetworkIn/Out, StatusCheckFailed — no memory/disk by default
RDS/Aurora	CPUUtilization, FreeStorageSpace, DatabaseConnections, ReadLatency
ALB	RequestCount, TargetResponseTime, HTTPCode_Target_5XX, HealthyHostCount
Lambda	Invocations, Errors, Duration, Throttles, ConcurrentExecutions
SQS	ApproximateNumberOfMessagesVisible, NumberOfMessagesSent, ApproximateAgeOfOldestMessage
DynamoDB	ConsumedReadCapacityUnits, ConsumedWriteCapacityUnits, ThrottledRequests

EC2 memory and disk metrics require the CloudWatch Agent — not available by default.

Computeoptimizer General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Compute Optimizer uses ML to recommend optimal resource configurations. Know supported resources, recommendation types, and how it differs from Cost Explorer rightsizing.

1. Overview

AWS Compute Optimizer analyzes historical utilization metrics using machine learning and recommends optimal AWS resource configurations to reduce cost and improve performance.

Compute Optimizer vs Cost Explorer Rightsizing:

Feature	Compute Optimizer	Cost Explorer Rightsizing
ML-based	Yes	No (threshold-based)
Supported resources	EC2, ASG, Lambda, ECS Fargate, EBS, RDS	EC2 only
Performance risk	Shows risk of under-provisioning	Not shown
Enhanced metrics	Yes (CloudWatch Agent memory)	Yes (CloudWatch Agent)
Cost	Free (standard), paid (enhanced)	Free

2. Supported Resources

Resource	What It Optimizes
EC2 instances	Instance type, size
EC2 Auto Scaling Groups	Instance type, size
EBS volumes	Volume type, size, IOPS
Lambda functions	Memory size
ECS services on Fargate	CPU and memory
RDS DB instances	Instance class (preview)

3. Recommendation Types

Each recommendation includes:

Costexplorer General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Cost Explorer is the primary tool for analyzing and forecasting AWS costs. Know filtering, grouping, rightsizing recommendations, and Savings Plans analysis.

1. Overview

AWS Cost Explorer provides interactive visualizations and analysis of AWS costs and usage. It helps identify cost drivers, forecast future spend, and find optimization opportunities.

2. Key Features

Cost and Usage Analysis

Visualize costs by: service, account, region, tag, instance type, purchase option
Filter by: time range (up to 13 months historical), service, linked account, tag
Group by multiple dimensions simultaneously
Daily, monthly, or hourly granularity (hourly requires additional cost)

Forecasting

ML-based cost forecast for up to 12 months
Based on historical usage patterns
Confidence intervals included
Use for: budget planning, capacity planning

Rightsizing Recommendations

Identifies over-provisioned EC2 instances
Recommends instance type changes based on CloudWatch utilization metrics
Shows estimated monthly savings
Requires Cost Explorer rightsizing recommendations enabled (free)
Considers: CPU, memory (requires CloudWatch Agent), network utilization

Savings Plans Recommendations

Recommends Compute, EC2 Instance, or SageMaker Savings Plans
Based on historical On-Demand usage
Shows: recommended commitment, estimated savings, coverage
Lookback period: 7, 30, or 60 days

3. Cost Allocation Tags

Tag resources to track costs by project, team, environment, cost center
AWS-generated tags: aws:createdBy (who created the resource)
User-defined tags: custom key-value pairs
Activate tags in Cost Explorer for cost allocation
Tags appear in Cost Explorer after 24 hours

4. Budgets Integration

Create budgets based on Cost Explorer data
Alert when actual or forecasted costs exceed thresholds
Budget types: cost, usage, Savings Plans coverage, reservation coverage
Actions: notify via SNS, apply IAM policy, apply SCP (to restrict spending)

5. Exam Scenarios

Scenario 1: A company wants to identify which AWS accounts and services are driving the most cost increase over the last 3 months. What is the solution?

Elastic Disaster Recovery General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3. AWS Elastic Disaster Recovery (AWS DRS) continuously replicates supported source servers to a low-cost staging area in AWS and supports recovery launches into EC2. It is a disaster-recovery service, distinct from AWS Transform MGN, which is primarily used to migrate servers to AWS.

1. When to Use DRS

Use DRS when the recovery objective requires a tested server-level recovery environment in AWS for on-premises or supported cloud source servers. It can support recovery from source-site outages, ransomware events, and other disruptions when the replication and recovery plan are configured appropriately.

Resilience Patterns General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. DR strategies and resilience patterns are core SAP-C02 topics. Know the 4 DR strategies, RTO/RPO trade-offs, and multi-region patterns cold.

1. RTO and RPO

Metric	Definition	Lower =
RTO (Recovery Time Objective)	Max acceptable downtime after a disaster	Faster recovery, higher cost
RPO (Recovery Point Objective)	Max acceptable data loss (time since last backup)	Less data loss, higher cost

2. DR Strategies (AWS)

1. Backup and Restore

Active Region DR Region
Primary workload ──── backup ──→ S3 / AWS Backup (snapshots)
 ↓ (disaster occurs)
 Restore from backup (hours)

RTO: hours
RPO: hours (depends on backup frequency)
Cost: lowest — pay only for storage
Use case: non-critical workloads, cost-sensitive

2. Pilot Light

Active Region DR Region
Full workload ──── replicate ──→ Core services only (DB replica, minimal infra)
 ↓ (disaster occurs)
 Scale up remaining services (minutes to hours)

RTO: minutes to hours (need to scale up)
RPO: minutes (near real-time replication)
Cost: low — only core services running in DR
Use case: critical data, moderate recovery time acceptable

3. Warm Standby

Active Region DR Region
Full workload ──── replicate ──→ Scaled-down but functional workload
 ↓ (disaster occurs)
 Scale up to full capacity (minutes)

RTO: minutes
RPO: seconds to minutes
Cost: moderate — DR environment always running at reduced capacity
Use case: business-critical workloads

4. Multi-Site Active-Active

Active Region (us-east-1) Active Region (eu-west-1)
Full workload ←── Route 53 ──→ Full workload
 (latency routing)
Both application stacks can serve traffic; the data write model needs its own consistency/conflict design

RTO: can be low with healthy capacity and tested traffic controls; not guaranteed to be zero
RPO: depends on the replication and consistency model; asynchronous replication can lose acknowledged writes
Cost: highest — full infrastructure in multiple regions
Use case: mission-critical, zero-downtime requirement

3. DR Strategy Comparison

Strategy	RTO	RPO	Cost	Complexity
Backup & Restore	Usually longest; measured restore time	Depends on backup frequency and consistency	Lowest ongoing infrastructure cost	Lower steady-state, higher recovery effort
Pilot Light	Depends on provisioning, scaling, and validation	Depends on replication/backup design	Low-to-moderate	Medium
Warm Standby	Faster when continuously tested and ready	Depends on replication mode and lag	Moderate-to-high	Medium-high
Multi-Site Active-Active	Can reduce traffic-recovery time; not automatically zero	Depends on consistency and replication model	Highest	High

These are relative patterns, not fixed service guarantees. Measure failover, recovery, and data-loss windows against the workload’s actual RTO/RPO.

Servicequotas General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). Service Quotas is the centralized way to view and request quota increases. Know how to monitor quotas proactively and integrate with CloudWatch.

1. Overview

AWS Service Quotas provides a central location to view and manage AWS service quotas (formerly called limits) across all services and regions. It enables proactive quota management before hitting limits.

2. Key Concepts

Concept	Description
Quota	Maximum value for a resource or operation (e.g., 5 VPCs per region)
Default quota	AWS-defined starting value
Applied quota	Current quota for your account (may be higher than default after increase)
Adjustable quota	Can be increased via request
Non-adjustable quota	Hard limit — cannot be increased

3. Quota Increase Requests

Submit increase requests directly from Service Quotas console
Requests go to AWS Support automatically
Track request status in Service Quotas console
Some quotas are auto-approved; others require manual review

# Request quota increase via CLI
aws service-quotas request-service-quota-increase \
 --service-code ec2 \
 --quota-code L-1216C47A \
 --desired-value 100

4. CloudWatch Integration

Monitor quota utilization proactively:

Systemsmanager General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. Systems Manager is the operational backbone for EC2 and hybrid environments. Know Parameter Store, Session Manager, Run Command, Patch Manager, and Automation.

1. Overview

AWS Systems Manager (SSM) provides operational management capabilities for EC2 instances, on-premises servers, and other AWS resources. It replaces SSH/RDP access and manual operational tasks with secure, auditable automation.

Key capabilities:

Secure remote access without SSH/RDP (Session Manager)
Run scripts across fleets of instances (Run Command)
Automated patching (Patch Manager)
Configuration and secrets storage (Parameter Store)
Automated operational runbooks (Automation)
Inventory and compliance (Inventory, State Manager)

2. SSM Agent

Required on EC2 instances and on-premises servers
Pre-installed on most AWS-provided AMIs (Amazon Linux 2, Windows Server 2016+)
Requires IAM instance profile with AmazonSSMManagedInstanceCore policy
Communicates with SSM service over HTTPS (port 443) — no inbound ports needed

3. Session Manager

Secure, browser-based or CLI shell access to instances without SSH/RDP:

Trustedadvisor General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 1 and 3. Trusted Advisor provides checks across six categories. These are not the six Well-Architected pillars. Check availability depends on the current AWS Support plan and is changing; verify the current plan and check reference before relying on a specific check.

1. Overview

AWS Trusted Advisor inspects your AWS environment and provides recommendations based on AWS best practices. Check refresh behavior and availability depend on the plan and check; do not assume every result is real-time.

Wellarchitected Tool General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domain 3 (25%). The Well-Architected Framework and Tool are the structured approach to architecture improvement. Know the 6 pillars, key design principles, and how the tool works.

1. The Six Pillars

Pillar	Focus
Operational Excellence	Run and monitor systems, improve processes
Security	Protect data, systems, and assets
Reliability	Recover from failures, meet demand
Performance Efficiency	Use resources efficiently
Cost Optimization	Avoid unnecessary costs
Sustainability	Minimize environmental impact

2. Key Design Principles per Pillar

Operational Excellence

Perform operations as code (IaC, runbooks)
Make frequent, small, reversible changes
Anticipate failure — test failure scenarios
Learn from operational events

Security

Implement a strong identity foundation (least privilege, IAM)
Enable traceability (CloudTrail, CloudWatch)
Apply security at all layers
Automate security best practices
Protect data in transit and at rest

Reliability

Automatically recover from failure
Test recovery procedures
Scale horizontally to increase availability
Stop guessing capacity — use Auto Scaling
Manage change through automation

Performance Efficiency

Democratize advanced technologies (use managed services)
Go global in minutes (multi-region)
Use serverless architectures
Experiment more often
Consider mechanical sympathy (match resource to workload)

Cost Optimization

Implement cloud financial management
Adopt a consumption model (pay for what you use)
Measure overall efficiency
Stop spending money on undifferentiated heavy lifting
Analyze and attribute expenditure

Sustainability

Understand your impact
Establish sustainability goals
Maximize utilization
Use managed services
Reduce downstream impact

3. AWS Well-Architected Tool

A free service in the AWS console for conducting architecture reviews:

Xray General

Fri, 09 Oct 2026 00:00:00 +0000

Exam relevance: Domains 2, 3. X-Ray is the distributed tracing service. Know service maps, sampling, annotations, and integration with Lambda, ECS, and API Gateway.

1. Overview

AWS X-Ray provides distributed tracing for applications. It tracks requests as they travel through microservices, Lambda functions, databases, and external APIs — helping identify latency bottlenecks and errors.

Problems it solves:

Latency is high but you don’t know which service is slow
Errors occur but you can’t trace them across services
No visibility into downstream dependency performance

2. Core Concepts

Concept	Description
Trace	End-to-end record of a request across all services
Segment	Data from a single service (one segment per service)
Subsegment	Granular data within a segment (DB call, HTTP call, custom)
Service map	Visual graph of services and their connections
Annotation	Key-value pair indexed for filtering (searchable)
Metadata	Key-value pair not indexed (for debugging, not filtering)
Sampling	Percentage of requests traced (reduces cost and overhead)

3. Service Map

Visual representation of your application’s architecture
Shows: services, connections, latency, error rates, throttle rates
Color-coded: green (healthy), yellow (slow), red (errors)
Drill down into any node to see traces

4. Sampling

By default: first request per second + 5% of additional requests
Custom sampling rules: define rate by service, URL, method, host
Higher sampling = more visibility, higher cost
Use reservoir (fixed number per second) + rate (percentage above reservoir)

{
 "version": 2,
 "rules": [{
 "description": "High-value transactions",
 "host": "*",
 "http_method": "POST",
 "url_path": "/api/payment*",
 "fixed_target": 10,
 "rate": 0.5
 }]
}

5. Integration with AWS Services

Service	Integration
Lambda	Built-in — enable Active Tracing in function config
API Gateway	Enable X-Ray tracing on stage
ECS	Add X-Ray daemon as sidecar container
EC2	Install X-Ray daemon, instrument SDK
Elastic Beanstalk	Enable via configuration option
App Mesh	Native integration
SNS / SQS	Trace propagation via message attributes

Lambda Active Tracing

# SAM template
Properties:
 Tracing: Active  # Enables X-Ray for Lambda

Lambda automatically creates a segment. Add subsegments for downstream calls using the X-Ray SDK.