Domain Deep Review

Cloud concepts form the foundation of every cloud certification exam. Understanding these principles deeply enables you to reason through any question, even on unfamiliar services.

Cloud Computing Models include IaaS (EC2, Azure VMs), PaaS (Elastic Beanstalk, App Service), and SaaS (Salesforce, Office 365). Understand the shared responsibility model for each: IaaS gives customers most control and responsibility, PaaS shifts infrastructure management to the provider, and SaaS handles nearly everything. Certification exams test your ability to identify the right model for a given scenario.

Deployment Models range from public cloud (shared infrastructure) to private cloud (dedicated infrastructure) to hybrid (combination). Multi-cloud uses multiple providers. Understand the trade-offs: public cloud offers scale and cost efficiency, private cloud provides control and customization, hybrid offers flexibility but adds complexity.

Design Principles from the Well-Architected Framework guide every architectural decision. Stop guessing capacity: use auto scaling. Test systems at production scale: use automation. Consider evolutionary architectures: design for change. These principles appear throughout certification exams.

Cost Optimization principles include: understand spending patterns (Cost Explorer), select appropriate pricing models (Reserved, Spot, On-Demand), scale with demand (Auto Scaling), and use managed services to reduce operational overhead. Exams frequently test cost optimization scenarios requiring you to identify the most cost-effective solution that meets requirements.

Architecture Patterns commonly tested include: multi-tier architectures (presentation, application, data), microservices versus monolithic, event-driven architectures, and serverless patterns. Understand when to apply each pattern based on requirements for scalability, maintainability, cost, and team expertise.

Global Infrastructure knowledge is tested through scenarios involving latency, availability, and compliance. Know the difference between Regions (geographic areas), Availability Zones (isolated data centers within regions), and Edge Locations (CDN and DNS caching). Understand how to design for high availability across AZs and disaster recovery across Regions.

Security is the most heavily tested domain across all cloud certifications. Exams test your ability to design secure architectures and implement security best practices.

Identity and Access Management is foundational. Understand IAM users, groups, roles, and policies. Know the difference between identity-based policies and resource-based policies. Master IAM roles for service access: EC2 instance roles, Lambda execution roles, and cross-account access. Understand policy evaluation logic: explicit deny overrides allow, and all policies must permit the action.

Data Protection covers encryption at rest and in transit. Know the difference between server-side encryption (SSE-S3, SSE-KMS, SSE-C) and client-side encryption. Understand TLS/SSL for data in transit. Know how KMS manages encryption keys: customer-managed, AWS-managed, and AWS-owned keys. Exams test when to use each encryption type and how key management works.

Network Security includes security groups (stateful, instance-level), network ACLs (stateless, subnet-level), VPC Flow Logs (traffic monitoring), and WAF (application layer protection). Understand the differences: security groups allow only specified traffic, NACLs deny by default and allow specified traffic. Know when to use each for defense in depth.

Compliance frameworks tested include SOC, PCI DSS, HIPAA, GDPR, and FedRAMP. Understand the shared responsibility model for compliance: AWS manages infrastructure compliance, customers manage data and application compliance. Know which AWS services help demonstrate compliance: CloudTrail for audit logging, Config for resource compliance, and Artifact for compliance reports.

Threat Detection and Response services include GuardDuty (threat detection), Inspector (vulnerability assessment), Macie (data privacy), and Security Hub (aggregated findings). Understand how these services integrate: GuardDuty findings flow to Security Hub, which triggers remediation through EventBridge and Lambda. Exams test your ability to design automated security response workflows.

Technology and deployment best practices cover the hands-on implementation knowledge tested across all certification levels.

Compute Services knowledge goes beyond basic service identification. Understand EC2 instance families and when to use each: compute-optimized for CPU-intensive, memory-optimized for in-memory databases, storage-optimized for sequential read/write. Know Auto Scaling group configurations: launch templates, scaling policies, and lifecycle hooks. Understand container services: ECS, EKS, Fargate, and when to use each.

Storage Services require understanding use cases and performance characteristics. S3 storage classes (Standard, IA, Glacier, Deep Archive) optimize cost for different access patterns. EBS volume types (gp3, io2, st1, sc1) optimize for IOPS, throughput, or cost. EFS provides shared file storage for multiple instances. Know when to use each and how to optimize costs.

Database Services testing includes RDS (relational), DynamoDB (NoSQL), ElastiCache (caching), Redshift (data warehousing), and Neptune (graph). Understand when to use each: relational for ACID transactions with complex queries, DynamoDB for key-value with predictable performance, ElastiCache for session storage and database caching. Know RDS features: Multi-AZ for availability, Read Replicas for scaling reads, automated backups for recovery.

CI/CD Pipelines are tested through deployment scenarios. Understand CodePipeline stages: source, build, deploy. Know CodeBuild for building and testing, CodeDeploy for deployment automation, and CodeCommit for source control. Understand deployment strategies: blue-green deployments for zero-downtime, canary deployments for gradual rollout, and rolling deployments for incremental updates.

Infrastructure as Code testing includes CloudFormation and CDK. Understand templates, stacks, change sets, and drift detection. Know CloudFormation intrinsic functions, conditions, and outputs. Understand CDK for programmatic infrastructure definition using familiar programming languages.

Monitoring and Observability covers CloudWatch (metrics, alarms, dashboards), X-Ray (distributed tracing), and CloudTrail (API auditing). Design monitoring strategies that provide actionable insights: set alarms on business metrics, not just infrastructure metrics. Understand CloudWatch Logs Insights for log analysis and CloudWatch Synthetics for endpoint monitoring.