Exam Tips & Strategies

This section provides battle-tested exam strategies, common question patterns, and preparation tips to help you succeed on the FCJ (First Cloud Journey) Midterm Exam.

FCJ Midterm Exam Overview

Exam Focus:

The FCJ midterm assesses your understanding of AWS Well-Architected Framework principles across four key pillars:

1. Secure Architectures: IAM, encryption, security services, compliance
2. Resilient Architectures: High availability, disaster recovery, Auto Scaling
3. High-Performing Architectures: Compute, storage, caching, network optimization
4. Cost-Optimized Architectures: Cost management, resource optimization, monitoring

Critical Exam Patterns & Common Traps

Recognizing Common Exam Traps

1. DNS and Domain Configuration Traps

TRAP: Using CNAME records on zone apex (example.com)

• ❌ Wrong: CNAME records on apex domain violate DNS standards
• ✅ Correct: Use Route 53 ALIAS records to map apex domains to:
  • Application Load Balancer (ALB)
  • CloudFront distributions
  • S3 static website endpoints
  • Global Accelerator

Key Point: ALIAS records are AWS-specific and work on apex domains, unlike CNAMEs.

2. “Least Operational Overhead” Questions

TRAP: Choosing solutions that require manual management

• ❌ Wrong: Self-managed solutions on EC2
• ✅ Correct: Fully managed AWS services (Lambda, RDS, Fargate, etc.)

Pattern Recognition: Questions with “least operational overhead”, “minimize maintenance”, or “reduce management complexity” always favor managed services.

Examples:

• Database: Choose RDS over self-managed database on EC2
• Compute: Choose Lambda over EC2 for event-driven workloads
• DNS Resolution: Choose Route 53 Resolver over custom DNS servers

3. Layer 7 Logging Confusion

TRAP: Using VPC Flow Logs to analyze HTTP status codes

• ❌ Wrong: VPC Flow Logs only capture Layer 3/4 (IP, port, protocol)
• ✅ Correct: Use ALB access logs or CloudFront logs for HTTP/HTTPS analysis

What VPC Flow Logs CAN’T do:

• Capture HTTP status codes (200, 404, 500)
• Analyze application-layer traffic
• Track API calls or user sessions

What to use instead:

• ALB access logs: HTTP request/response details
• CloudFront logs: Edge location requests
• WAF logs: Layer 7 security events

4. Data Immutability Requirements

TRAP: Using versioning or lifecycle policies for compliance

• ❌ Wrong: S3 versioning (can still delete versions)
• ❌ Wrong: Backup retention policies (can be modified)
• ✅ Correct: S3 Object Lock with retention mode

Key Distinction: “Cannot be deleted” = Object Lock ONLY

• Compliance mode: Nobody (including root) can delete before retention expires
• Governance mode: Special permissions required to override

Pattern: Questions mentioning “regulatory compliance”, “cannot be deleted”, “immutable” → S3 Object Lock

5. Lambda VPC Integration Trap

TRAP: Assuming Lambda can access private RDS by default

• ❌ Wrong: Lambda runs outside VPC by default
• ✅ Correct: Lambda must be attached to VPC subnet with proper Security Group

Lambda VPC Requirements:

1. Attach Lambda to private subnets
2. Configure Security Group allowing RDS access
3. Ensure subnet has NAT Gateway (if Lambda needs internet)
4. Consider RDS Proxy for connection pooling

Alternative: Use RDS Proxy (no VPC attachment needed, handles connections efficiently)

6. Static Global IP Requirements

TRAP: Using ALB/NLB for static global IPs

• ❌ Wrong: ALB/NLB IPs can change
• ✅ Correct: Use AWS Global Accelerator

When to use Global Accelerator:

• Need static anycast IP addresses (2 IPs)
• Global traffic distribution
• Automatic failover between regions
• DDoS protection at network edge
• Lower latency via AWS backbone

Cost Consideration: Higher than CloudFront, but provides static IPs

Exam Question Decision Framework

Cost Questions: The Cost Hierarchy

When questions ask for “MOST cost-effective”:

1. Serverless first: Lambda, Fargate, DynamoDB On-Demand
2. Managed services: RDS over EC2 database
3. Right-sizing: Compute Optimizer recommendations
4. Storage tiering: S3 Intelligent-Tiering, Glacier
5. Reserved capacity: Reserved Instances, Savings Plans
6. Free options: S3 Gateway Endpoint (vs NAT Gateway)

Example Pattern:

• Question: “Most cost-effective way for EC2 to access S3”
• Answer: S3 Gateway Endpoint (FREE) vs NAT Gateway ($0.045/hour)

High Availability Questions: The HA Checklist

✅ Multi-AZ deployment (minimum requirement) ✅ Load balancer distributing across AZs ✅ Auto Scaling for capacity management ✅ Automated backups with tested restore ✅ Health checks (ELB level, not just EC2) ✅ Database replication (Multi-AZ RDS or Aurora)

Red Flags (NOT highly available):

• Single AZ deployment
• Single instance (no Auto Scaling)
• No health monitoring
• Manual failover processes

Security Questions: Least Privilege Approach

Decision Tree:

1. Can this be done with IAM role? → Use role (EC2 instance roles, Lambda execution roles)
2. Need temporary credentials? → Use STS AssumeRole
3. Need to store secrets? → Use Secrets Manager (auto-rotation) or SSM Parameter Store
4. Need MFA? → IAM policy condition: aws:MultiFactorAuthPresent
5. Need to deny? → Use SCP (Organizations) or explicit Deny in IAM policy

NEVER in correct answers:

• Hardcoded access keys in code
• Long-term credentials for applications
• Overly permissive policies (e.g., * permissions)

Advanced Operational Patterns

Hybrid DNS with Route 53 Resolver

Use Case: Integrating AWS VPC with on-premises DNS infrastructure

Architecture Components:

1. Route 53 Resolver Outbound Endpoint

   • Allows EC2 instances in VPC to query on-premises DNS
   • Deployed in multiple AZs for high availability
   • Requires minimum 2 IP addresses per AZ

2. Forwarding Rules

   • Define which domains to forward to on-premises
   • Example: corp.internal → on-premises DNS servers
   • Can be shared across multiple VPCs using RAM (Resource Access Manager)

3. Reverse DNS (PTR) Lookups

   • Requires separate forwarding rule for in-addr.arpa domain
   • Essential for IP-to-hostname resolution

Common FCJ Midterm Pattern:

• Question: “EC2 instances need to resolve internal corporate hostnames”
• ❌ Wrong: Install BIND/dnsmasq on EC2 (high operational overhead)
• ❌ Wrong: Create Private Hosted Zone (doesn’t help with on-premises)
• ✅ Correct: Route 53 Resolver with outbound endpoint + forwarding rules

Why This is Best:

• Fully managed (no DNS server maintenance)
• Automatic failover and scaling
• Integrates seamlessly with existing DNS infrastructure
• Low operational overhead

Practical Tip: Most questions don’t require Private Hosted Zone unless you’re managing internal DNS records within AWS.

Multi-Account Deployment with Organizations

Use Case: Deploying infrastructure across multiple AWS accounts (dev, staging, prod)

Architecture Components:

1. AWS Organizations

   • Central management account (billing and governance)
   • Organizational Units (OUs) for logical grouping
   • Service Control Policies (SCPs) for permission boundaries

2. CloudFormation StackSets

   • Deploy identical infrastructure across accounts
   • Managed from central account
   • Automatic rollout and updates

3. Service Control Policies (SCPs)

   • Applied at OU level (not root)
   • Prevent actions even if IAM allows them
   • Common use: Enforce required tags

Critical Configuration: Preserve Successfully Provisioned Resources

CloudFormation StackSets don’t use OnFailure parameter. Instead, use the “Preserve successfully provisioned resources” option (also called DisableRollback in CLI):

Console: Select “Preserve successfully provisioned resources” when creating/updating StackSet

CLI: Use --disable-rollback flag

Why This Matters:

• Keeps successfully created resources across accounts
• Allows debugging failed deployments
• Enables partial deployment success
• Can retry failed stacks without redeploying successful ones
• Avoids destroying resources that work in some accounts

SCP Best Practice - Tag Enforcement:

{
  "Effect": "Deny",
  "Action": "ec2:RunInstances",
  "Resource": "arn:aws:ec2:*:*:instance/*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestTag/Environment": ["dev", "staging", "prod"]
    }
  }
}

FCJ Midterm Pattern:

• Question: “Deploy security baseline across 50 AWS accounts with minimal effort”
• ❌ Wrong: Manually deploy to each account
• ❌ Wrong: Write custom scripts
• ✅ Correct: CloudFormation StackSets from Organizations management account

CloudWatch Operational Excellence

Use Case: Comprehensive monitoring and automated remediation

Logs Insights for Troubleshooting

Common Queries:

# Find all 404 errors
fields @timestamp, @message
| filter @message like /404/
| sort @timestamp desc
| limit 100

# Find errors by status code
fields @timestamp, status, request
| filter status >= 400
| stats count() by status

When to Use:

• Ad-hoc log analysis
• Troubleshooting specific issues
• Building custom dashboards
• Creating metric filters

Metric Filters → Custom Metrics → Alarms

Pattern: Convert log patterns to actionable metrics

Example Flow:

1. Metric Filter: Parse logs for “ERROR” keyword
2. Custom Metric: Create ApplicationErrors metric
3. CloudWatch Alarm: Alert when errors > threshold
4. SNS Topic: Notify team
5. Optional: Trigger Lambda for auto-remediation

Exam Scenario:

• Question: “Alert when application logs contain 5+ errors in 5 minutes”
• ❌ Wrong: Write custom script to poll logs
• ❌ Wrong: Use third-party monitoring tool
• ✅ Correct: Metric filter → CloudWatch Alarm → SNS

RAM Monitoring (Critical!)

Trap: EC2 doesn’t provide RAM metrics by default

Solution: Install CloudWatch Agent on EC2 instances

What Agent Provides:

• Memory utilization
• Disk space usage
• Disk I/O metrics
• Network metrics (beyond basic)
• Custom application metrics

FCJ Midterm Pattern:

• Question: “Monitor memory usage of EC2 instances”
• ❌ Wrong: Use default CloudWatch metrics (doesn’t include RAM!)
• ✅ Correct: Install CloudWatch Agent

Automated Remediation

Scenario: CPU usage > 90% for extended period

Remediation Options:

1. SSM RunCommand: Execute scripts on instance
2. SSM Automation: Pre-built workflows (restart, resize)
3. Lambda: Custom remediation logic

Complete Flow:

CloudWatch Alarm (CPU > 90%)
   ↓
EventBridge Rule
   ↓
SSM Automation Document
   ↓
Action: AWS-RestartEC2Instance

Exam Tip: SSM Automation is preferred over Lambda for standard operations (restart, patch, backup).

Private Subnet Service Access Patterns

Core Principle: Resources in private subnets need VPC endpoints to access AWS services without internet

VPC Endpoint Types

Interface Endpoints (PrivateLink):

• Creates ENI with private IP in your subnet
• Requires Security Group configuration
• Costs: $0.01/hour per AZ + data processing

Services:

• CloudWatch (logs and metrics)
• SNS
• SQS
• Secrets Manager
• Systems Manager (SSM)
• KMS

Gateway Endpoints:

• Route table entry (no ENI)
• FREE (no additional charges!)
• Only for:
  • S3
  • DynamoDB

FCJ Midterm Pattern:

• Question: “Most cost-effective way for Lambda in private subnet to access S3”
• ❌ Wrong: NAT Gateway ($0.045/hour + data transfer)
• ✅ Correct: S3 Gateway Endpoint (FREE!)

Canary Testing in Private Subnet

Requirements Checklist:

✅ Interface Endpoint: CloudWatch (logs) ✅ Gateway Endpoint: S3 (store test results) ✅ Security Groups: Allow HTTPS outbound ✅ IAM Role: s3:PutObject permission ✅ S3 Bucket Policy: Allow VPC endpoint access

Common Mistake: Forgetting S3 bucket permissions for VPC endpoint

Correct S3 Policy:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::canary-results/*",
  "Condition": {
    "StringEquals": {
      "aws:SourceVpce": "vpce-1234567"
    }
  }
}

EventBridge for S3 → SQS FIFO

Why Not Direct S3 Event Notification?

• S3 native notifications to SQS Standard only
• FIFO ordering not guaranteed
• No deduplication support

Correct Pattern:

S3 Event
   ↓
EventBridge Rule
   ↓
SQS FIFO Queue (with ordering + deduplication)

Benefits:

• Guaranteed message ordering
• Automatic deduplication
• Content-based filtering
• Multiple targets support

Auto Scaling Best Practices

Health Check Strategy

EC2 Status Check (default):

• Only checks if instance is running
• Doesn’t verify application health
• Can route traffic to unhealthy apps

ELB Health Check (recommended):

• Checks application endpoint (e.g., /health)
• Verifies app is responding correctly
• Auto-replaces truly unhealthy instances

FCJ Midterm Pattern:

• Question: “Prevent Auto Scaling from routing traffic to instances where app failed to start”
• ❌ Wrong: Use EC2 status check only
• ✅ Correct: Configure ELB health check in Auto Scaling Group

Warm Pools for Faster Scaling

Problem: Cold starts can take 2-5 minutes (boot → configure → app start)

Solution: Warm Pool

• Pre-initialized EC2 instances in “stopped” state
• When scaling needed: Start instance (typically 30-60 seconds vs 3-5 minutes)
• Much faster than launching new instances

Cost Optimization:

• Stopped instances: Only pay for EBS storage (no compute charges)
• No data transfer charges while stopped
• Balance between readiness and cost

Use Cases:

• Predictable traffic spikes (e.g., business hours)
• Applications with long initialization times
• Gaming servers with daily patterns
• E-commerce sites with flash sales

FCJ Midterm Pattern:

• Question: “Reduce Auto Scaling response time from 3 minutes to under 1 minute”
• ✅ Answer: Configure Warm Pool with stopped, pre-initialized instances

Placement Groups for HPC

When Needed: High-performance computing workloads requiring:

• Low latency (« 1ms)
• High throughput (10-100 Gbps)
• Tightly coupled applications

Placement Group Types:

1. Cluster: Single AZ, low latency (HPC, big data)
2. Partition: Multi-AZ, isolated groups (Hadoop, Kafka)
3. Spread: Individual hardware, maximum isolation

Exam Scenario:

• Question: “HPC application needs lowest latency between instances”
• ✅ Answer: Cluster placement group (all instances in same rack/network)

RDS Operational Excellence

Performance Insights

Purpose: Identify database bottlenecks and slow queries

Key Metrics:

• Database load (DBLoad)
• Top SQL statements by load
• Wait events (I/O, CPU, locks)
• Session activity

When to Use:

• Database performance degradation
• Identifying slow queries for optimization
• Capacity planning

Exam Tip: Performance Insights is the recommended tool for RDS query analysis (not CloudWatch alone).

RDS Proxy Benefits

Problems RDS Proxy Solves:

1. Connection Pooling: Reduces DB connection overhead
2. Failover Resilience: Maintains application connections during failover (up to 66% faster recovery)
3. Lambda Integration: Handles Lambda burst connections efficiently
4. Simplified Architecture: Lambda doesn’t need VPC configuration (though RDS Proxy still needs to be in VPC)

FCJ Midterm Pattern:

• Question: “Thousands of Lambda functions connecting to RDS causing connection exhaustion”
• ❌ Wrong: Increase RDS instance size (expensive, doesn’t solve root cause)
• ❌ Wrong: Implement connection pooling in each Lambda (complex)
• ✅ Correct: Deploy RDS Proxy (handles pooling automatically)

Fast Snapshot Restore (FSR)

Use Case: Need to restore EBS volumes quickly without warm-up period

Normal Behavior:

• Snapshots are lazy-loaded
• First access to each block is slower
• Can pre-warm by reading entire volume

FSR Benefits:

• Instant full performance
• No warm-up required
• Critical for time-sensitive restores

Cost: $0.75/snapshot-hour per AZ (can be expensive!)

Exam Scenario:

• Question: “Clone RDS database and achieve full performance immediately”
• ✅ Answer: Use Fast Snapshot Restore (FSR) when restoring from snapshot

Aurora Backtrack vs Point-in-Time Restore

Aurora Backtrack:

• Rewind database to earlier time (like video rewind)
• Doesn’t create new cluster
• Fast: Completes in minutes
• Use case: Quick rollback from accidental changes
• Limitation: Only Aurora MySQL, max 72 hours back

Point-in-Time Restore (PITR):

• Creates new database cluster
• Slower: 10-30 minutes
• Works with all RDS engines
• Use case: Recover from major data loss
• Retention: 1-35 days

FCJ Midterm Pattern:

• Question: “Quickly rollback Aurora after bad migration script”
• ✅ Answer: Use Aurora Backtrack (faster than PITR)

Secrets Manager Rotation with RDS

Integration: Automatically rotates RDS credentials

How It Works:

1. Secrets Manager triggers Lambda rotation function
2. Lambda creates new credentials in RDS
3. Tests new credentials
4. Updates secret with new credentials
5. Marks old credentials for deletion

Benefits:

• No application downtime
• Automatic credential lifecycle
• Compliance with security policies

Exam Scenario:

• Question: “Automatically rotate RDS master password every 30 days”
• ✅ Answer: Enable Secrets Manager automatic rotation

Enterprise Security and Compliance

Security Hub for Multi-Account Governance

Purpose: Centralized security posture management across AWS accounts

Key Features:

• Aggregates findings from GuardDuty, Inspector, Macie
• Automated compliance checks (CIS AWS Foundations, PCI-DSS)
• Security score and trend analysis
• Auto-enable for new accounts in Organizations

FCJ Midterm Pattern:

• Question: “Monitor security compliance across 100 AWS accounts in organization”
• ❌ Wrong: Manually enable GuardDuty in each account
• ❌ Wrong: Build custom compliance dashboard
• ✅ Correct: Enable Security Hub with auto-enable members

Why This Matters:

• Centralized visibility (single pane of glass)
• Automatic onboarding of new accounts
• Standardized compliance reporting
• Integrates with multiple security services

IAM Role Best Practices (EC2)

Golden Rule: NEVER use access keys on EC2

Correct Approach:

1. Create IAM role with required permissions
2. Attach role to EC2 instance
3. Application automatically gets temporary credentials
4. Credentials rotate automatically every 6 hours

Benefits:

• No hardcoded credentials
• Automatic rotation
• Easy to audit (CloudTrail logs)
• Follows least privilege

FCJ Midterm Pattern:

• Question: “EC2 application needs S3 access. Most secure approach?”
• ❌ Wrong: Store access keys in environment variables
• ❌ Wrong: Hardcode access keys in application code
• ✅ Correct: Attach IAM role to EC2 instance

FCJ Reference: IAM Roles for EC2 Workshop (000048)

S3 Object Lock for Compliance

Use Case: Meet regulatory requirements for data retention

Lock Modes:

Compliance Mode:

• ✅ Nobody can delete (including root account)
• ✅ Retention cannot be shortened
• ✅ Object Lock cannot be removed
• ✅ Use for: Financial records, healthcare data, legal documents

Governance Mode:

• ⚠️ Requires special permission to override
• ⚠️ Can be removed with s3:BypassGovernanceRetention
• ⚠️ Use for: Testing, development, less strict requirements

Exam Red Flags:

• “Cannot be deleted for X years” → Compliance mode
• “Immutable” → Object Lock
• “Regulatory requirement” → Object Lock

Wrong Answers to Eliminate:

• S3 versioning (can still delete)
• S3 lifecycle policies (can be changed)
• Bucket policies (can be modified)
• Glacier vault lock (for vaults, not objects)

AWS Config with Automated Remediation

Purpose: Track configuration changes and automatically fix non-compliant resources

Flow:

AWS Config detects non-compliance
   ↓
EventBridge rule triggered
   ↓
SSM Automation Document executes
   ↓
Resource remediated automatically

Example Remediation:

• Rule: EBS volumes must be encrypted
• Detection: Unencrypted volume created
• Action: Stop instance, create encrypted snapshot, replace volume
• Result: Compliance restored automatically

FCJ Midterm Pattern:

• Question: “Automatically encrypt unencrypted EBS volumes”
• ❌ Wrong: Write Lambda to poll and fix manually
• ❌ Wrong: Use CloudWatch Events with custom script
• ✅ Correct: AWS Config rule + SSM Automation remediation

GuardDuty for Threat Detection

What It Monitors:

• VPC Flow Logs (network behavior)
• CloudTrail logs (API activity)
• DNS logs (malicious domains)
• S3 data events (suspicious access)

Threat Examples:

• Cryptocurrency mining
• Unauthorized API calls
• Port scanning
• Data exfiltration attempts
• Compromised instances

Integration:

• Sends findings to Security Hub
• Can trigger Lambda for auto-response
• SNS notifications for critical threats

FCJ Midterm Pattern:

• Question: “Detect unusual network behavior and compromised instances”
• ✅ Answer: Enable GuardDuty (ML-powered threat detection)

Not GuardDuty: GuardDuty doesn’t prevent threats (use WAF, Shield) or scan code (use CodeGuru).

Cost Optimization Strategies

Compute Optimizer

Purpose: Identify over-provisioned and under-provisioned resources

Analyzes:

• EC2 instances (CPU, memory, network utilization)
• EBS volumes (IOPS, throughput)
• Lambda functions (memory configuration)
• Auto Scaling groups
• ECS on Fargate

Recommendations Based On:

• Historical CloudWatch metrics (minimum 14 days)
• Machine learning models
• AWS best practices

FCJ Midterm Pattern:

• Question: “Identify over-provisioned EC2 instances across accounts”
• ❌ Wrong: Manually analyze CloudWatch metrics
• ❌ Wrong: Use Cost Explorer (shows costs, not optimization)
• ✅ Correct: Use AWS Compute Optimizer

Key Insight: Compute Optimizer is for RIGHT-SIZING, Cost Explorer is for SPENDING ANALYSIS.

Target Tracking Scaling Policy

Why Better Than Step Scaling:

• Easier to configure (just set target metric)
• AWS handles scaling adjustments automatically
• Responds to gradual and sudden changes
• Self-optimizing

Example Metrics:

• CPU Utilization: 70% target
• Request Count: 1000 requests/target
• ALB Request Count Per Target: 100 requests
• Custom Metrics: Application-specific (queue depth, active connections)

FCJ Midterm Pattern:

• Question: “Scale based on application memory usage (custom metric)”
• ❌ Wrong: Use CPU-based scaling (doesn’t match requirement)
• ✅ Correct: Target tracking with custom CloudWatch metric for RAM

Best Practice: Use business metrics (requests, queue depth) over infrastructure metrics (CPU) when possible.

Global Accelerator for Latency

When to Choose Global Accelerator:

✅ Need static global IP addresses (2 anycast IPs) ✅ Want automatic failover across regions ✅ TCP/UDP workloads (gaming, IoT, VoIP) ✅ Want traffic to stay on AWS backbone

vs CloudFront:

• CloudFront: HTTP/HTTPS only, caching CDN
• Global Accelerator: Any TCP/UDP, no caching, network layer

Cost: Higher than CloudFront (~$0.025/hour per accelerator + data transfer)

FCJ Midterm Pattern:

• Question: “Global application needs static IP and lowest latency”
• ❌ Wrong: ALB with Route 53 (ALB IPs can change)
• ❌ Wrong: NLB alone (not global, no automatic multi-region)
• ✅ Correct: AWS Global Accelerator

Exam Day Thinking Framework

Step 1: Identify Question Type

Keywords to Spot:

• Cost: “cost-effective”, “lowest cost”, “minimize expenses”
• Operations: “least operational overhead”, “minimize maintenance”, “automated”
• Performance: “lowest latency”, “highest throughput”, “fastest”
• Availability: “highly available”, “fault tolerant”, “99.99% uptime”
• Security: “most secure”, “comply with”, “encrypt”, “least privilege”

Action: Categorize question and apply appropriate decision framework

Step 2: Understand the Requirement

Critical Reading:

1. What is the current state?
2. What is the desired outcome?
3. What are the constraints? (cost, time, security, compliance)
4. What are the scale requirements? (users, requests, data volume)

Red Flags:

• “EXCEPT” or “NOT” questions (look for wrong answer!)
• Multiple constraints (must satisfy ALL)
• Edge cases (failure scenarios, security breaches)

Step 3: Apply the Decision Tree

For “Least Operational Overhead”

1. Is there a managed service? → Use it
2. Is there a serverless option? → Prefer it
3. Does it require manual intervention? → Eliminate
4. Does it auto-scale and self-heal? → Strong candidate

Examples:

• Database: RDS > Self-managed on EC2
• DNS: Route 53 Resolver > BIND on EC2
• Load Balancing: ALB/NLB > HAProxy on EC2

For “Most Cost-Effective”

1. Can you use serverless? (Lambda, Fargate, DynamoDB On-Demand)
2. Can you use free services? (S3 Gateway Endpoint, CloudFront free tier)
3. Can you right-size? (Compute Optimizer recommendations)
4. Can you use cheaper storage? (S3 Glacier, EBS gp3)
5. Can you reserve capacity? (Reserved Instances, Savings Plans)

Cost Hierarchy (cheapest to most expensive):

1. Free services (S3 Gateway Endpoint, CloudFront SSL cert)
2. Serverless with low usage (Lambda free tier)
3. Managed services (RDS, ECS)
4. Optimized EC2 (Reserved Instances, Spot)
5. On-Demand EC2 (most expensive compute)

For “Highest Performance”

1. Where is the bottleneck? (compute, storage, network, database)
2. Can you cache? (ElastiCache, CloudFront, DAX)
3. Can you optimize network? (Global Accelerator, placement groups)
4. Can you use purpose-built services? (Aurora, ElastiCache Redis)
5. Can you scale horizontally? (Read replicas, Auto Scaling)

Performance Patterns:

• Low latency globally: CloudFront or Global Accelerator
• Low latency regionally: ElastiCache, placement groups
• Database performance: Read replicas, Aurora, caching
• Application performance: Lambda provisioned concurrency, warm pools

For “Most Secure”

1. Is data encrypted? (at rest and in transit)
2. Are credentials managed? (IAM roles, Secrets Manager)
3. Is access controlled? (least privilege, MFA)
4. Is network isolated? (private subnets, Security Groups)
5. Is activity monitored? (CloudTrail, GuardDuty, VPC Flow Logs)

Security Hierarchy (least to most secure):

1. Public resources, hardcoded credentials ❌
2. Public resources, IAM users
3. Private resources, IAM roles
4. Private resources, IAM roles, encryption
5. Private resources, IAM roles, encryption, monitoring ✅

Step 4: Eliminate Wrong Answers

Common Wrong Answer Patterns:

1. Overly Complex: Multi-step solutions when simple one exists
2. Manual Processes: Requires human intervention for routine tasks
3. Deprecated Services: EC2-Classic, RDS old engines
4. Ignores Constraints: Doesn’t meet cost/performance requirements
5. Single Point of Failure: Single AZ, single instance, no backup

Elimination Strategy:

1. Read all 4 answers first
2. Eliminate 2 obviously wrong answers
3. Compare remaining 2 against question requirements
4. Choose answer that best fits ALL constraints

Step 5: Verify Your Answer

Checklist:

• ✅ Meets ALL stated requirements?
• ✅ Addresses the primary constraint (cost/ops/performance/security)?
• ✅ Follows AWS best practices?
• ✅ Scalable and highly available?
• ✅ Makes architectural sense?

Common Mistakes to Avoid:

• Choosing first “good enough” answer without reading all options
• Missing “EXCEPT” or “NOT” in question
• Confusing similar services (CloudWatch vs CloudTrail, Security Groups vs NACLs)
• Ignoring cost implications when question mentions cost
• Overcomplicating when simple solution exists

Study Strategy

Week-by-Week Study Plan (8 Weeks)

Week 1: AWS Service Fundamentals (Foundation)

• AWS Service Fundamentals - Complete this entire section first!
  • EC2: Instance types, pricing models, storage options, Security Groups
  • S3: Storage classes, versioning, replication, lifecycle policies, encryption
  • IAM: Users, groups, roles, policies, best practices
  • RDS: Engines, Multi-AZ vs Read Replicas, backups, encryption
  • VPC: Components, CIDR, Security Groups vs NACLs, endpoints
  • Lambda: Limits, pricing, cold/warm starts, concurrency
  • CloudWatch: Metrics, logs, alarms, agent
  • CloudFront: Edge locations, origins, caching, security
• Practice: Launch EC2 instances, create S3 buckets, write IAM policies, set up VPC

Weeks 2-3: Secure Architectures

• Deep dive IAM (policies, roles, MFA, cross-account access)
• KMS (envelope encryption, key rotation, $1/key/month)
• Security Groups vs NACLs (stateful vs stateless)
• AWS security services (GuardDuty $4/million events, WAF, Shield Standard FREE vs Advanced $3K)
• Secrets Manager ($0.40/secret/month)
• Practice: Create IAM policies with conditions, set up MFA, configure Security Groups, enable KMS encryption

Weeks 3-4: Resilient Architectures

• Multi-AZ deployments (RDS synchronous replication, 60-120s failover)
• Read Replicas (asynchronous, up to 15 for Aurora)
• Disaster recovery strategies (Backup/Restore, Pilot Light, Warm Standby, Multi-Site)
• Auto Scaling (target tracking, step scaling, scheduled)
• Route 53 routing policies (7 types: Simple, Weighted, Latency, Failover, etc.)
• AWS Backup strategies
• Practice: Set up Multi-AZ RDS, configure Auto Scaling with ALB, test failover scenarios

Weeks 5-6: High-Performing Architectures

• Compute: EC2 instance types (T3 burstable, M6i general, C6i compute, R6i memory, I4i storage)
• Lambda (15 min timeout, 10 GB memory, cold start 100ms-2s, warm ~10ms)
• Fargate (35s-2min cold start, no hard timeout limit)
• Storage: S3 performance (3500 PUT/5500 GET per prefix), EBS types (gp3, io2), EFS
• Caching: ElastiCache Redis (persistence, Multi-AZ) vs Memcached (simple, multi-threaded)
• CloudFront (450+ edge locations, 24hr default TTL)
• Network: Global Accelerator, VPC optimization
• CloudWatch monitoring (5 min standard, 1 min detailed, 1 sec high-res metrics)
• Practice: Deploy Lambda functions, configure ElastiCache, optimize S3 performance, set up CloudFront

Weeks 7-8: Cost-Optimized Architectures & Review

• Cost Explorer, AWS Budgets, Cost Allocation Tags
• S3 storage classes (Standard $0.023/GB → Glacier Deep Archive $0.00099/GB)
• S3 lifecycle policies (transition to cheaper classes)
• Reserved Instances (75% off), Savings Plans (72% off), Spot Instances (90% off)
• VPC cost optimization (NAT Gateway $0.045/hr, use S3 Gateway Endpoint FREE)
• Lambda pricing ($0.20/1M requests + $0.0000166667/GB-sec, 1M + 400K GB-sec FREE)
• Full practice exams
• Review weak areas
• Practice: Set up S3 lifecycle policies, analyze costs with Cost Explorer, right-size instances

Daily Study Routine

Weekdays (2-3 hours):

• 1 hour: AWS documentation and FCJ workshop reading
• 1 hour: Hands-on practice in AWS Free Tier
• 30 minutes: Review practice scenarios
• 30 minutes: Review flashcards

Weekends (4-5 hours):

• 2 hours: Build complete projects (e.g., 3-tier web app)
• 2 hours: Practice midterm scenarios
• 1 hour: Review weak areas

Key Concepts to Memorize

FCJ Workshop References

Practice with official FCJ workshops covering core AWS services:

• IAM Fundamentals - Users, Groups, Roles, Switch Roles
• VPC Networking - VPC, Security Groups, NACLs, Site-to-Site VPN
• EC2 Instances - Windows Server 2022, Amazon Linux 2023, Security Groups
• RDS Databases - Multi-AZ, Read Replicas, Backups
• IAM Roles for EC2 - EC2 instance roles, avoiding hardcoded credentials

Service Limits and Quotas

Pricing Quick Reference

Common Midterm Scenarios

Scenario 1: Minimize Costs for Variable Workloads

• Answer: Use Lambda (serverless), Auto Scaling, Spot Instances, S3 Intelligent-Tiering
• FCJ Reference: EC2 Workshop for instance types

Scenario 2: Achieve Near-Zero RPO and RTO

• Answer: Multi-region active-active with DynamoDB Global Tables, Aurora Global Database
• FCJ Reference: RDS Workshop for Multi-AZ concepts

Scenario 3: Secure Access to S3 from Private Subnet

• Answer: Use S3 Gateway Endpoint (FREE) instead of NAT Gateway
• FCJ Reference: VPC Workshop for VPC endpoints

Scenario 4: Require MFA for Sensitive Operations

• Answer: IAM policy with aws:MultiFactorAuthPresent condition
• FCJ Reference: IAM Workshop for IAM policies

Scenario 5: Long-Term Data Retention (7+ Years) at Lowest Cost

• Answer: S3 Glacier Deep Archive ($0.00099/GB-month)

Scenario 6: High-Performance Caching with Persistence

• Answer: ElastiCache Redis (supports persistence, replication, Multi-AZ)

Scenario 7: Lowest Latency for Global Users

• Answer: CloudFront (CDN), Route 53 latency-based routing, Global Accelerator

Scenario 8: Block Specific IP Addresses

• Answer: Use NACLs (support DENY rules), not Security Groups
• FCJ Reference: VPC Workshop for Security Groups vs NACLs

Hands-On Practice Recommendations

Essential Hands-On Labs

1. IAM Deep Dive - FCJ IAM Workshop

   • Create users, groups, roles
   • Write custom IAM policies
   • Set up MFA
   • Test policy evaluation logic

2. VPC Networking - FCJ VPC Workshop

   • Create VPC with public/private subnets across 2 AZs
   • Configure NAT Gateways (one per AZ)
   • Set up S3 Gateway Endpoint
   • Configure Security Groups and NACLs

3. Multi-AZ RDS Deployment - FCJ RDS Workshop

   • Launch RDS with Multi-AZ
   • Test automatic failover
   • Configure backups and snapshots

4. EC2 Instances - FCJ EC2 Workshop

   • Launch Windows Server 2022 and Amazon Linux 2023
   • Configure Security Groups
   • Understand instance types and pricing

5. IAM Roles for EC2 - FCJ IAM Roles Workshop

   • Create and attach IAM roles to EC2
   • Avoid hardcoded credentials
   • Test role-based access to S3 and other services

6. Auto Scaling with ALB

   • Create Launch Template
   • Configure Auto Scaling Group
   • Set up target tracking policy
   • Create Application Load Balancer
   • Stress test and observe scaling

7. Serverless Architecture

   • Deploy Lambda function triggered by S3
   • Create API Gateway + Lambda
   • Configure CloudWatch Logs
   • Test Lambda limits (timeout, memory)

8. S3 Storage Optimization

   • Create S3 bucket
   • Configure lifecycle policies
   • Enable versioning
   • Set up Cross-Region Replication
   • Test retrieval times for Glacier

9. CloudWatch Monitoring

   • Create custom metrics
   • Set up alarms
   • Create dashboards
   • Configure SNS notifications

AWS Free Tier Resources

Always Free:

• Lambda: 1M requests/month
• DynamoDB: 25 GB storage
• CloudFront: 1 TB data transfer out
• CloudWatch: 10 custom metrics

12 Months Free (from account creation):

• EC2: 750 hours/month t2.micro or t3.micro
• RDS: 750 hours/month db.t2.micro or db.t3.micro
• S3: 5 GB Standard storage
• EBS: 30 GB

Tip: Use Free Tier to practice without costs!

FCJ Midterm Preparation Resources

FCJ Workshop Series (Required Practice)

These official FCJ workshops provide hands-on experience with core AWS services:

1. IAM Fundamentals - Users, Groups, Roles, Switch Roles, least privilege
2. VPC Networking - VPC, Security Groups, NACLs, Site-to-Site VPN, Multi-AZ NAT
3. EC2 Instances - Windows Server 2022, Amazon Linux 2023, Security Groups, cost governance
4. RDS Databases - Multi-AZ (60-120s failover), Read Replicas, backups (1-35 days)
5. IAM Roles for EC2 - EC2 instance roles, avoiding hardcoded access keys

Practice Strategy

First Practice Round (Week 4):

• Complete all FCJ workshops
• Establish baseline knowledge
• Identify weak areas
• Focus study on gaps

Second Practice Round (Week 6):

• Revisit challenging workshops
• Measure improvement
• Refine weak areas
• Practice architecture design

Final Practice Round (Week 8):

• Review all workshops
• Build complete architectures
• Aim for strong understanding of all services
• Review every knowledge gap

Study Tips

Time Management:

• Break study into focused 1-2 hour sessions
• Complete one workshop at a time
• Practice hands-on immediately after learning theory
• Leave time for review and reinforcement

Midterm Preparation Tips

Day Before Midterm

• ✅ Review flashcards (no new material)
• ✅ Get good sleep (8 hours)
• ✅ Review FCJ workshop key concepts
• ✅ Quick review of Service Fundamentals section
• ✅ Review common exam traps from this guide
• ✅ Practice decision frameworks (one dry run)

During Midterm: Question Analysis Approach

Essential Questions to Ask Yourself

When reading each exam question, systematically ask:

1. Does this solution provide High Availability (HA)?

• Is it deployed across multiple AZs?
• Does it have automatic failover?
• Is there a single point of failure?

2. Is this solution automated with minimal operational overhead?

• Does it require manual intervention?
• Is it a fully managed service?
• Does it self-heal and auto-scale?

3. Does this follow AWS least privilege security?

• Are IAM roles used instead of access keys?
• Is data encrypted at rest and in transit?
• Are permissions scoped to minimum necessary?

4. Are logs and metrics at the correct layer?

• CloudWatch: Infrastructure metrics (CPU, network)
• ALB/CloudFront logs: HTTP/HTTPS traffic analysis
• VPC Flow Logs: Network layer (IP, port, protocol only)
• CloudTrail: API call auditing

5. Does the answer match the question’s priority?

• “Cost-effective” → Choose cheapest option that meets requirements
• “Least operational overhead” → Choose most automated/managed option
• “Highest performance” → Choose fastest/most optimized option
• “Most secure” → Choose solution with most security layers

Reading Strategy

Step-by-Step Approach:

1. Read the scenario - Understand current state and constraints
2. Identify the requirement - What needs to be achieved?
3. Spot the priority keyword - Cost? Performance? Operations? Security?
4. Read ALL four answers - Don’t select first good option
5. Eliminate obviously wrong answers - Usually 2 are clearly incorrect
6. Compare remaining options - Which better satisfies ALL requirements?
7. Verify your choice - Does it answer the actual question asked?

Critical Reading Tips:

• Watch for “EXCEPT” or “NOT” (you’re looking for wrong answer!)
• Note scale requirements (10 users vs 10 million users)
• Identify constraints (must stay in single region, must be real-time)
• Recognize trap keywords (see Common Exam Traps section)

Common Exam Traps to Recognize

Trap 1: CNAME on Apex Domain

Question Pattern: “Configure DNS for example.com to point to ALB”

• ❌ TRAP: Create CNAME record on apex
• ✅ CORRECT: Use Route 53 ALIAS record

Remember: DNS standard prohibits CNAME on zone apex; AWS ALIAS records solve this.

Trap 2: “Least Operational Overhead”

Question Pattern: “Deploy solution with least operational overhead”

• ❌ TRAP: Self-managed solution on EC2 (requires patching, scaling, monitoring)
• ✅ CORRECT: Fully managed AWS service (RDS, Lambda, Fargate, Route 53 Resolver)

Rule: “Least operational overhead” = “most managed service”

Trap 3: Lambda → RDS Connection

Question Pattern: “Lambda needs to access RDS database in private subnet”

• ❌ TRAP: Assume Lambda can connect by default
• ✅ CORRECT: Lambda must be attached to VPC subnet with Security Group access

Alternatives:

• Use RDS Proxy (recommended for connection pooling)
• Attach Lambda to VPC (if direct access needed)

Trap 4: HTTP Logging with VPC Flow Logs

Question Pattern: “Analyze HTTP 404 errors from web application”

• ❌ TRAP: Use VPC Flow Logs (only Layer 3/4, no HTTP status codes!)
• ✅ CORRECT: Use ALB access logs or CloudFront logs

Remember:

• VPC Flow Logs = IP, port, protocol (network layer)
• ALB/CloudFront logs = HTTP status, URLs, user agents (application layer)

Trap 5: “Cannot Be Deleted” Requirements

Question Pattern: “Ensure data cannot be deleted for 7 years due to compliance”

• ❌ TRAP: S3 versioning (versions can still be deleted)
• ❌ TRAP: Lifecycle policies (can be modified)
• ❌ TRAP: Bucket policies (can be changed)
• ✅ CORRECT: S3 Object Lock in Compliance mode

Rule: “Cannot be deleted” or “immutable” = Object Lock ONLY

Trap 6: Choosing Complex Over Simple

Question Pattern: Any question with straightforward requirement

• ❌ TRAP: Multi-step solution with custom scripts and Lambda
• ✅ CORRECT: Single AWS managed service

AWS Philosophy: Use managed services; avoid custom solutions when native option exists.

Trap 7: Forgetting Cost Constraint

Question Pattern: “Cost-effective solution for…”

• ❌ TRAP: Choosing most powerful option without considering price
• ✅ CORRECT: Cheapest option that meets performance requirements

Examples:

• S3 Gateway Endpoint (FREE) vs NAT Gateway ($0.045/hour)
• Lambda ($0.20/1M requests) vs EC2 for occasional workloads
• Reserved Instances (75% off) vs On-Demand

Trap 8: Missing Multi-AZ for HA

Question Pattern: “Highly available solution…”

• ❌ TRAP: Single-AZ deployment
• ✅ CORRECT: Multi-AZ with automatic failover

High Availability Checklist:

• Resources in multiple AZs
• Load balancer distributing traffic
• Auto Scaling (or Multi-AZ RDS)
• Automated health checks
• No single point of failure

Effective Study Techniques for FCJ Midterm

Active Learning Through Practice

Theory → Practice → Review Cycle:

1. Learn concept from FCJ workshops or documentation
2. Build it yourself in AWS Free Tier
3. Break it intentionally to understand failure modes
4. Review what you learned and document key insights

Example: Multi-AZ RDS

• Learn: Read about Multi-AZ architecture
• Practice: Deploy Multi-AZ RDS in AWS console
• Test: Simulate failover, observe behavior
• Review: Document failover time, DNS changes, connection impact

Hands-On Validation

Don’t Just Read - Verify Everything:

• ✅ ALB listener configuration → Create ALB, test HTTP → HTTPS redirect
• ✅ Security Group stickiness → Enable stickiness, test session persistence
• ✅ Route 53 ALIAS records → Create record, test resolution
• ✅ VPC endpoints → Create Gateway Endpoint, test S3 access
• ✅ IAM policy evaluation → Write policies, test with IAM Policy Simulator

Why This Matters: Exam questions often test practical understanding, not just theory.

Pattern Recognition Training

Build Your Mental Model:

Create a pattern library in your notes:

Pattern: "Least operational overhead" + "DNS resolution"
Answer: Route 53 Resolver (not BIND on EC2)

Pattern: "Cost-effective" + "EC2 → S3 access"
Answer: S3 Gateway Endpoint (not NAT Gateway)

Pattern: "Cannot be deleted" + "compliance"
Answer: S3 Object Lock Compliance mode

Pattern: "HTTP analysis" + "status codes"
Answer: ALB access logs (not VPC Flow Logs)

Study Method:

1. Encounter a question pattern
2. Document the pattern and correct answer
3. Understand WHY the answer is correct
4. Review patterns weekly

Comparative Analysis

Learn by Comparing Similar Services:

Create comparison tables to understand differences:

Other Comparisons to Master:

• Security Groups vs NACLs
• CloudFront vs Global Accelerator
• ELB health check vs EC2 status check
• Backtrack vs PITR (Aurora)
• Interface Endpoint vs Gateway Endpoint
• Warm Pool vs Launch Configuration

Scenario-Based Thinking

Train Your Decision-Making:

For each service you study, create scenarios:

Example: Auto Scaling

• Scenario 1: Predictable daily traffic spike (9am-5pm)

  • Solution: Scheduled scaling policy

• Scenario 2: Unpredictable traffic, want to maintain 70% CPU

  • Solution: Target tracking scaling

• Scenario 3: Application takes 3 minutes to initialize

  • Solution: Warm pools with pre-initialized instances

• Scenario 4: Traffic spike causing failed health checks

  • Solution: Increase health check grace period

Training Method:

1. Study a service
2. Create 3-5 scenarios covering different use cases
3. Determine best solution for each
4. Validate with hands-on practice

Mistake Journal

Learn From Errors:

Keep a study journal documenting:

1. Concepts you got wrong in practice questions
2. Why you got it wrong (misunderstood requirement, forgot detail)
3. Correct answer and explanation
4. How to recognize this pattern in future

Example Entry:

❌ MISTAKE: Chose VPC Flow Logs to analyze 404 errors
🎯 CORRECT: ALB access logs

WHY WRONG: Forgot VPC Flow Logs are Layer 3/4 only
LESSON: HTTP analysis requires Layer 7 logs (ALB/CloudFront)
TRIGGER: "HTTP status code" → ALB/CloudFront logs

Review your journal before the exam to avoid repeating mistakes.

Spaced Repetition

Optimize Long-Term Retention:

Review Schedule:

• Day 1: Learn new concept (e.g., RDS Multi-AZ)
• Day 2: Review concept briefly (5 minutes)
• Day 4: Practice hands-on or answer practice questions
• Week 2: Review again, add to flashcards
• Week 4: Final review before exam

Why This Works: Spaced repetition moves information from short-term to long-term memory.

Tools:

• Physical flashcards
• Anki (spaced repetition app)
• Notion database with review dates
• Personal notes with review checkboxes

Teaching to Learn

Best Way to Master Content:

• Explain concepts to study partner
• Write blog posts about what you learned
• Create architecture diagrams and present them
• Help others in AWS Study Group Facebook community

Why This Works: Teaching forces you to understand deeply, not just memorize.

Practice Explaining:

• “How does Multi-AZ RDS failover work?”
• “What’s the difference between Security Groups and NACLs?”
• “When should you use CloudFront vs Global Accelerator?”

If you can explain it clearly to someone else, you truly understand it.

Intensive 7-Day Study Plan for FCJ Midterm

Study Plan Overview

Total Duration: 7 days Daily Study Time: 3-4 hours per evening (with 1.5x playback speed for video review) Focus: FCJ Midterm Exam preparation across 4 pillars

Key Resources:

• FCJ Workshops: Review completed workshops at cloudjourney.awsstudygroup.com
• AWS Documentation: Service-specific documentation for deep dives

Study Schedule:

Days 1-2: FCJ Pillars 1 & 2 - Secure & Resilient Architectures

IAM (Identity and Access Management)

Core Concepts to Master:

• Permissions Management: Users, groups, roles, policies
• Multi-Factor Authentication (MFA): Adding extra security layer
• Least Privilege Principle: Grant only minimum necessary permissions

Policy Evaluation Logic:

{
  "Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": {
    "IpAddress": {
      "aws:SourceIp": "203.0.113.0/24"
    }
  }
}

Critical Rule: “Deny” always wins in policy evaluation! 🚨

FCJ Midterm Tips:

• Understand policy JSON structure (Effect, Action, Resource, Condition)
• Questions may show policy file and ask about action outcomes
• Explicit Deny overrides any Allow statements
• Always apply least privilege principle
• Know difference between user, group, role
• Review: Workshop 000002 - Introduction to IAM

Practice: Read policy examples from workshops and predict their behavior

VPC (Virtual Private Cloud)

Network Components:

• Subnets: Public (internet-facing) vs Private (internal only)
• Route Tables: Direct traffic flow
• Security Groups: Stateful firewall at instance level
• NACLs: Stateless firewall at subnet level
• NAT Gateway: Allow private subnet instances to reach internet
• VPC Peering: Connect two VPCs
• VPN/Direct Connect: Hybrid cloud connectivity

Security Groups vs NACLs:

FCJ Midterm Pattern: Questions will ask when to use each networking component based on use cases.

Amazon S3

Encryption Options:

• SSE-S3: AWS-managed keys (simplest)
• SSE-KMS: Customer master keys (more control)
• Client-Side: Your own encryption algorithm before upload

FCJ Midterm Pattern: “Company wants to use their proprietary encryption algorithm” → Client-Side Encryption

Storage Classes & Lifecycle Waterfall:

S3 Standard (frequent access, highest cost)
    ↓ 30 days
S3 Standard-IA (Infrequent Access)
    ↓ 90 days
S3 Glacier Flexible Retrieval (archive, minutes-hours retrieval)
    ↓ 180 days
S3 Glacier Deep Archive (long-term archive, 12-hour retrieval)

Lifecycle Rules: Automatically transition objects between storage classes to optimize costs

Key FCJ Midterm Topics:

• Bucket policies and versioning
• Encryption types and when to use each
• Storage class selection based on access patterns
• Lifecycle transitions for cost optimization
• When to use S3 Standard vs S3-IA vs Glacier

High Availability (HA) & Fault Tolerance

Multi-AZ vs Multi-Region:

• Multi-AZ: Deploy across multiple Availability Zones for high availability
• Multi-Region: Deploy across multiple AWS regions for disaster recovery (DR)

Load Balancing:

• ALB (Application Load Balancer): HTTP/HTTPS (Layer 7)
• NLB (Network Load Balancer): TCP/UDP (Layer 4)
• CLB (Classic Load Balancer): Legacy (both Layer 4 & 7)

Auto Scaling:

• Scale based on CPU utilization, request count, custom metrics
• Scheduled scaling for predictable patterns
• Target tracking policies for automation

FCJ Midterm Decision Tree:

Need High Availability?
└─ Yes → Multi-AZ + ELB + Auto Scaling
    └─ Need Disaster Recovery?
        └─ Yes → Multi-Region replication

Days 3-4: High-Performing Architectures

Compute Services

EC2 Instance Types:

Storage Options:

• EBS (Elastic Block Store): Block storage attached to EC2 instances
• EFS (Elastic File System): Shared file storage across multiple instances

FCJ Midterm Tip: Match instance type to workload requirements! Complete FCJ Workshop 000004 - EC2 for hands-on practice.

Database Services

Amazon RDS:

• Supports: MySQL, PostgreSQL, Oracle, SQL Server, MariaDB
• Multi-AZ: Synchronous replication to standby for fast failover
• Read Replicas: Asynchronous replication for read scaling
• Automated Backups: Point-in-time recovery

RDS Multi-AZ vs Read Replicas:

FCJ Workshop Connection: Review Workshop 000005 (RDS) which covers Multi-AZ and Read Replica configurations.

Amazon Aurora

Performance Advantages:

• 5x faster than MySQL, 3x faster than PostgreSQL
• Cloud-native architecture with distributed storage
• Automatic storage scaling up to 128 TB
• Up to 15 read replicas (vs 5 for RDS)
• Lower replication lag than RDS

Aurora vs RDS Decision Matrix:

Aurora Unique Features:

• Aurora Serverless: Auto-scaling for unpredictable workloads
• Aurora Backtrack: Rewind database to specific point in time (up to 72 hours) without creating new instance
• Aurora Global Database: Multi-region with <1 second replication

Amazon DynamoDB

NoSQL Database Characteristics:

• Serverless: No server management required
• Automatic scaling: Handle any level of traffic
• Low latency: Single-digit millisecond response times
• High throughput: Millions of requests per second

Key Concepts:

• Partition Key: Primary key for data distribution
• Sort Key: Optional secondary key for ordering
• Global Secondary Index (GSI): Query on non-key attributes
• DynamoDB Accelerator (DAX): In-memory caching for microsecond latency

FCJ Midterm Decision:

• “Low latency” + “High throughput” = DynamoDB
• “Gaming leaderboards” = DynamoDB
• “IoT sensor data” = DynamoDB
• Need SQL? = RDS or Aurora

Performance Pattern: Choose partition key carefully to avoid hotspots!

Amazon ElastiCache

In-Memory Caching Engines:

Redis (Complex Use Cases):

• Supports complex data structures (lists, sets, sorted sets)
• Data persistence available
• Replication and automatic failover
• Pub/sub messaging

Memcached (Simple Caching):

• Simple key-value storage
• Multi-threaded performance
• No persistence
• Lower cost

When to Use:

• Reduce database load (cache frequent queries)
• Session storage for web applications
• Real-time analytics
• Leaderboards and counting

FCJ Midterm Pattern: “Reduce database latency” → ElastiCache

Content Delivery & Networking

Amazon CloudFront (CDN):

• Global content distribution via edge locations
• Caching static content (images, CSS, JS)
• Signed URLs/cookies for private content
• Integrates with S3, ALB, custom origins

Route 53:

• DNS service with health checks
• Routing policies:
  • Latency-based: Route to lowest latency endpoint
  • Failover: Primary/secondary for DR
  • Geolocation: Route based on user location
  • Weighted: Distribute traffic by percentage

FCJ Midterm Pattern: “Distribute content globally” + “Reduce latency” → CloudFront + S3

Day 5: Cost-Optimized Architectures

EC2 Purchasing Options

Cost Comparison:

Spot Instances:

• Can be interrupted with 2-minute notice
• Best for: Batch processing, CI/CD, data analysis, containerized workloads
• Interruption rate: Historically <5%

Reserved Instances:

• 1 or 3-year commitment
• Payment options: All upfront, partial upfront, no upfront
• Best for: Production databases, always-on applications

Compute Savings Plans:

• Commit to specific usage level ($/hour) for 1-3 years
• Flexibility to change instance types, regions, services
• Best for: Growing businesses with evolving needs

S3 Cost Optimization

Storage Class Selection:

• Standard: Frequently accessed data
• Intelligent-Tiering: Unknown or changing access patterns (auto-moves between tiers)
• Standard-IA: Infrequent access (>30 days)
• Glacier Flexible: Archive with retrieval in minutes-hours
• Glacier Deep Archive: Long-term archive (12-hour retrieval), lowest cost

Cost Optimization Pattern:

Lifecycle Policy Example:
- 0-30 days: S3 Standard
- 30-90 days: Transition to Standard-IA
- 90+ days: Transition to Glacier
- 365+ days: Transition to Glacier Deep Archive

Monitoring & Automation

AWS Cost Management Tools:

• AWS Budgets: Set cost/usage budgets with alerts
• Cost Explorer: Visualize and analyze spending patterns
• Cost Allocation Tags: Track costs by project/department

Monitoring Services:

• CloudWatch: Metrics, alarms, logs for AWS resources
• CloudTrail: API call logging for security and compliance audit
• CloudFormation: Infrastructure as Code (IaC) for automated deployment
• AWS OpsWorks: Application configuration management

FCJ Midterm Pattern:

• “Track spending” → Cost Explorer + AWS Budgets
• “Monitor performance” → CloudWatch
• “Audit actions” → CloudTrail
• “Automate deployment” → CloudFormation

Day 6: Practice Questions Day

Recommended Approach:

• Review FCJ workshop materials and create questions from each section
• Use AWS documentation to understand service comparisons
• Study with peers in AWS Study Group and quiz each other
• Focus on decision-making patterns, not memorization

After Completing Practice Questions:

1. ✅ Review every incorrect answer carefully
2. 📝 Note why you got it wrong
3. 📚 Research the correct answer in AWS documentation
4. 🔍 Identify patterns in your mistakes
5. 💤 GET PROPER SLEEP - Your brain needs time to consolidate learning!

Day 7: Review Weak Areas

Focus Activities:

1. Review Mistake Journal: Read all incorrect practice question notes
2. Re-study Weak Topics: Focus on pillars where you’re less confident
3. Review FCJ Workshops: Revisit hands-on labs for weak areas
4. Deep Dive on Concepts: Understand WHY solutions work, not just what they are

Common FCJ Midterm Mistake Patterns to Review:

• Confused “least operational overhead” with “highest performance”
• Selected expensive solution when cheaper option existed
• Forgot to check for Multi-AZ requirement
• Used wrong logging service for the layer (VPC Flow vs ALB logs)
• Missed hidden cost constraint in question

General FCJ Midterm Exam-Taking Tips

Read Questions Carefully

Identify Key Requirements:

• Primary Goal: Performance? Cost? Security? Operations?
• Constraints: Timeframe, budget, compliance requirements
• Keywords: “least”, “most”, “EXCEPT”, “NOT”, “cost-effective”, “highly available”

Example Analysis:

“Design a cost-effective solution with high availability for a web application”

Breakdown:

• Priority 1: Cost-effective (eliminate expensive options)
• Priority 2: High availability (requires Multi-AZ)
• Application: Web (suggests ALB + Auto Scaling)

Eliminate Wrong Answers

Systematic Elimination:

1. ❌ Remove answers that violate main requirement
2. ❌ Remove unnecessarily complex solutions
3. ❌ Remove non-managed services when “least operational overhead”
4. ✅ Choose simplest remaining option

Example:

• ❌ Custom EC2-based solution (operational overhead)
• ❌ Single-AZ deployment (not highly available)
• ❌ Most expensive option (not cost-effective)
• ✅ Multi-AZ RDS + ALB (managed + HA + cost-effective)

FCJ Midterm Keyword Patterns

Pattern Recognition:

Time Management

FCJ Midterm Structure:

• Check with your instructor for exam format and duration
• Average: ~2 minutes per question (adjust based on actual exam)
• Some questions need 30 seconds, others need 4 minutes

Strategy:

1. ✅ Answer easy questions quickly (build confidence)
2. 🚩 Flag difficult questions, move on
3. ⏱️ Don’t spend >4 minutes on any single question
4. 🔄 Return to flagged questions after completing all others
5. 🕒 Reserve time for final review

Trust Your Preparation

FCJ Midterm Day Mindset:

• ✅ First instinct is usually correct
• ❌ Changing answers often leads to mistakes
• ✅ Trust your hands-on experience
• ✅ You’ve studied thoroughly - believe in your preparation!

Study Wisdom: Choose your first instinct answer - changing often leads to mistakes! Trust your hands-on FCJ workshop experience.

Study Plan Summary

Day-by-Day Checklist:

• Days 1-2: Complete Secure & Resilient Architectures study + FCJ Workshops 000002, 000003
• Days 3-4: Complete High-Performing Architectures study + FCJ Workshops 000004, 000005
• Day 5: Complete Cost-Optimized Architectures study
• Day 6: Create and answer practice questions, review mistakes, sleep well
• Day 7: Review weak areas, revisit difficult FCJ workshops

Before FCJ Midterm Day:

• Review mistake journal
• Review key decision frameworks from this guide
• Get 8 hours of sleep
• Eat proper breakfast
• Arrive early (or prepare quiet space)
• Stay calm and confident - you’re prepared!

AWS Documentation Resources

Essential Documentation

Well-Architected Framework:

• AWS Well-Architected Framework
• Read all 6 pillars, focus on 4 midterm pillars

Service-Specific Documentation:

• IAM User Guide
• VPC User Guide
• EC2 Documentation
• S3 Documentation
• RDS Documentation
• Lambda Documentation

AWS Whitepapers (Midterm Relevant):

1. Security Best Practices: IAM, encryption, network security
2. Architecting for the Cloud: Cloud design patterns
3. Backup and Recovery: DR strategies
4. Cost Optimization: Cost management best practices

AWS FAQs (High Yield)

• S3 FAQ: Storage classes, lifecycle, pricing
• RDS FAQ: Multi-AZ, read replicas, backups
• VPC FAQ: Subnets, NAT, endpoints
• Lambda FAQ: Limits, pricing, use cases
• CloudFront FAQ: Caching, origins, pricing

Tip: AWS FAQs are excellent for midterm preparation!

Final Midterm Checklist

Core Service Fundamentals (MUST MASTER FIRST!)

• EC2: Instance types (T3, M6i, C6i, R6i, I4i), pricing models, Security Groups, EBS vs Instance Store (Target: 5/5)
  • FCJ Reference: EC2 Workshop
• S3: 7 storage classes with pricing ($0.023 → $0.00099), versioning, replication, lifecycle, encryption (Target: 5/5)
• IAM: Users/groups/roles/policies, JSON structure, least privilege, cross-account access (Target: 5/5)
  • FCJ Reference: IAM Workshop
• RDS: 6 engines, Multi-AZ (sync, 60-120s) vs Read Replicas (async, up to 15), backups (Target: 5/5)
  • FCJ Reference: RDS Workshop
• VPC: CIDR blocks, Security Groups vs NACLs, NAT Gateway vs Gateway Endpoint, Flow Logs (Target: 5/5)
  • FCJ Reference: VPC Workshop
• Lambda: 15 min timeout, 10 GB memory, cold start (100ms-2s), pricing ($0.20/1M + GB-sec) (Target: 5/5)
• CloudWatch: Metrics (5min/1min/1sec), logs, alarms, agent, pricing (first 10 FREE) (Target: 5/5)
• CloudFront: 450+ edges, origins, caching (24hr TTL), OAC, signed URLs, pricing (Target: 5/5)

Well-Architected Framework Knowledge

• IAM policies and roles - conditions, trust policies (Target: 5/5)
  • FCJ Reference: IAM Roles Workshop
• VPC networking and security - multi-AZ architecture (Target: 5/5)
  • FCJ Reference: VPC Workshop
• Multi-AZ vs Multi-Region - RPO/RTO implications (Target: 5/5)
• S3 storage classes and pricing - lifecycle transitions (Target: 5/5)
• RDS deployment options - Multi-AZ, Read Replicas, Aurora (Target: 5/5)
  • FCJ Reference: RDS Workshop
• Lambda limits and pricing - concurrent executions, layers (Target: 5/5)
• Auto Scaling policies - target tracking, step, scheduled (Target: 4/5)
• Route 53 routing policies - 7 types (Target: 4/5)
• Disaster recovery strategies - 4 types with RTO/RPO (Target: 5/5)
• Cost optimization techniques - Reserved, Savings Plans, Spot (Target: 4/5)

FCJ Workshops Completed:

• IAM Fundamentals (000002)
• VPC Networking (000003)
• EC2 Instances (000004)
• RDS Databases (000005)
• IAM Roles for EC2 (000048)

Hands-On Completed:

• Created VPC with public/private subnets
• Deployed Multi-AZ RDS
• Configured Auto Scaling + ALB
• Built serverless app (Lambda + API Gateway)
• Set up S3 lifecycle policies
• Created IAM policies and roles
• Configured CloudWatch alarms

Final Exam Readiness Checklist

Knowledge Verification

Self-Assessment: Rate yourself 1-5 on each area (Target: 4+ on all)

Core Services (Must be 5/5):

• EC2: Instance types, pricing, Security Groups, storage options (5/5)
• S3: Storage classes, lifecycle, encryption, performance (5/5)
• IAM: Policies, roles, least privilege, evaluation logic (5/5)
• RDS: Multi-AZ vs Read Replicas, backups, failover times (5/5)
• VPC: CIDR, subnets, Security Groups vs NACLs, endpoints (5/5)
• Lambda: Limits (15min, 10GB), pricing, cold/warm starts (5/5)

Exam Patterns (Must be 4+/5):

• Recognize “least operational overhead” → managed services (4/5)
• Identify cost optimization patterns (Free tier, right-sizing) (4/5)
• Spot high availability requirements (Multi-AZ, load balancing) (4/5)
• Understand logging layers (VPC Flow vs ALB vs CloudTrail) (4/5)
• Know when to use ALIAS vs CNAME records (4/5)
• Distinguish between compliance solutions (Object Lock) (4/5)

Practical Application (Must be 4+/5):

• Can design 3-tier architecture with HA and security (4/5)
• Can explain Multi-AZ RDS failover process (4/5)
• Can configure Auto Scaling with proper health checks (4/5)
• Can set up VPC with public/private subnets and endpoints (4/5)
• Can write IAM policies with conditions (4/5)

Pre-Exam Confidence Builders

The Night Before:

• ✅ Review this exam tips section one final time
• ✅ Scan through common traps (CNAME on apex, VPC Flow Logs for HTTP, etc.)
• ✅ Review decision frameworks (Cost hierarchy, HA checklist)
• ✅ Get 8 hours of sleep (more important than late-night cramming!)
• ✅ Prepare water and snacks for exam day
• ❌ Don’t learn new concepts (consolidate existing knowledge)

Exam Day Morning:

• ✅ Eat a good breakfast (brain fuel!)
• ✅ Arrive early (reduce stress)
• ✅ Quick mental review of key patterns
• ✅ Positive mindset: “I’ve prepared well, I know this material”
• ❌ Don’t cram or review complex topics

During the Exam:

• ✅ Read every question twice (catch “EXCEPT” and “NOT”)
• ✅ Identify the priority keyword (cost, operations, performance, security)
• ✅ Eliminate obviously wrong answers first
• ✅ Apply decision frameworks systematically
• ✅ Trust your preparation
• ⏱️ Pace yourself (don’t spend 10 minutes on one question)
• 🤔 Mark difficult questions for review, move on

Mental Framework for Success

Remember These Principles:

1. AWS favors managed services - Choose RDS over EC2 database, Lambda over EC2 for events
2. Free options often win - S3 Gateway Endpoint (FREE) > NAT Gateway ($)
3. Multi-AZ is essential for HA - Single AZ = single point of failure
4. IAM roles > access keys - Always prefer roles for EC2, Lambda
5. Layer matters for logs - VPC Flow (Layer 3/4), ALB (Layer 7)
6. Immutability = Object Lock - Only solution for “cannot be deleted”
7. ALIAS for apex domains - CNAME doesn’t work on zone apex

When In Doubt:

• ❓ Cost question? → Choose cheapest managed service
• ❓ Operations question? → Choose most automated option
• ❓ Performance question? → Choose caching or purpose-built DB
• ❓ Security question? → Choose most encrypted/isolated option
• ❓ Between two good answers? → Re-read requirements, check for hidden constraints

You’ve Got This! 💪

You’ve prepared by:

• ✅ Studying AWS Well-Architected Framework
• ✅ Completing FCJ workshops hands-on
• ✅ Understanding common exam patterns and traps
• ✅ Learning decision frameworks for systematic analysis
• ✅ Practicing with real AWS services
• ✅ Building mental models of AWS architectures

Trust your preparation. You’re ready!

Good Luck on Your FCJ Midterm! 🎯

From the AWS Study Group Community with love ❤️

“The cloud is not a place, it’s a journey. Your First Cloud Journey starts here!”

Additional Support

Need Help?

• 💬 AWS Study Group Facebook - 41,000+ members
• 🎓 FCJ Workshops - Free hands-on labs
• 📚 AWS Documentation - Official reference
• 🤝 FCJ Mentors - Available during monthly meetups

After the Exam:

• Share your experience to help others
• Continue learning with advanced FCJ workshops
• Build your portfolio with real projects
• Join AWS Community Builder Program
• Consider AWS certifications (Cloud Practitioner, Solutions Architect)

Remember: This is just the beginning of your cloud journey. The skills you’ve learned will serve you throughout your career in cloud computing. Keep building, keep learning, keep sharing! 🌟