- Basic understanding of IP networking, DNS, HTTP, and operating systems
- Some familiarity with cloud concepts such as regions, virtual machines, storage, and managed services
Cloud Computing · Professionals
AWS Solutions Architect
Architecture-focused AWS learning spanning identity, compute, networking, storage, reliability, security, and cost.
Course roadmap
Know where you are going before you begin
A useful course should make the starting point, destination, and learning method clear—not make you guess from a list of links.
Learning material
Inside this course
Move through the material in order unless a prerequisite or practice link gives you a better reason to branch.
1. TutorialIAM Architecture Essentials
22 min Design identity boundaries, roles, policies, and access patterns.
2. InterviewAWS Architecture Interview Questions
25 min Scenario-based questions with reasoning frameworks.
3. MCQResilient Design MCQs
18 min Test availability, scaling, storage, and disaster-recovery decisions.
Learning connections
Continue with purpose
These are curated relationships from the SubjectVision learning graph. Each recommendation should answer why it is useful next rather than merely adding another link.
Interview preparation
Course interview practice
Use these as short speaking drills after the course. State assumptions first, give the smallest defensible architecture, then explain failure behavior, security boundaries, and the trade-off you accepted.
01 · SeniorA CI workload in one AWS account must deploy into another account. How would you design the access path?Answer out loud before opening the expected response.
Practice
Answer out loud before opening the expected response.
Expected answer
Use a narrowly scoped cross-account role in the target account, a trust policy that allows only the approved source principal, and short-lived role credentials rather than copied long-lived access keys.
Why this answer works
The key distinction is between who may assume the role and what the assumed role may do. Trust policy and permissions policy solve different parts of the problem. A strong answer also mentions session duration, auditability, least privilege, and how the source workload proves its identity.
02 · SeniorWhy is “deploy the application in three Availability Zones” not, by itself, a complete high-availability design?Answer out loud before opening the expected response.
Practice
Answer out loud before opening the expected response.
Expected answer
Because compute placement is only one failure domain. The data tier, network egress, dependencies, health checks, capacity, retry behavior, and deployment process can still create single points of failure.
Why this answer works
Interviewers are looking for end-to-end failure reasoning. Multi-AZ compute helps only if state, traffic flow, dependencies, and operational controls also tolerate the loss or degradation of a zone. Explain what the user experiences during failure, not merely which boxes exist on the diagram.
03 · IntermediateA business says it can lose at most five minutes of data and must restore service within thirty minutes. What do those requirements change in your design?Answer out loud before opening the expected response.
Practice
Answer out loud before opening the expected response.
Expected answer
They define an RPO of five minutes and an RTO of thirty minutes, which should drive backup or replication frequency, recovery automation, data-copy strategy, failover procedures, and how often recovery is tested.
Why this answer works
The useful move is to translate business language into measurable recovery objectives before choosing services. A design that cannot demonstrate recovery inside those limits is not compliant merely because it uses a managed database or spans multiple zones.
04 · SeniorA document application stores large files plus searchable ownership and project metadata. Why might you separate the binary objects from the metadata store?Answer out loud before opening the expected response.
Practice
Answer out loud before opening the expected response.
Expected answer
The two parts have different access patterns and scaling needs: object storage is well suited to durable large-file storage and delivery, while searchable transactional metadata often needs indexed queries, updates, and application-level integrity.
Why this answer works
A strong architecture answer decomposes the problem by behavior rather than putting every related datum into one technology. It should also acknowledge the new consistency boundary: object creation and metadata updates may need compensation or reconciliation because they are not one atomic transaction.
05 · ArchitectHow should you answer an interview question that asks whether a bursty event workload should use serverless functions or container workers?Answer out loud before opening the expected response.
Practice
Answer out loud before opening the expected response.
Expected answer
Start from workload shape and constraints—event rate, burst duration, processing time, concurrency, ordering, downstream limits, latency tolerance, operational ownership, and cost—then compare the two compute models against those requirements.
Why this answer works
“Serverless is cheaper” and “containers are more scalable” are both weak shortcuts. The decision depends on execution duration, steady-state versus burst traffic, startup behavior, concurrency controls, dependency pressure, unit economics, and the team’s operational model. Make the trade-off explicit instead of declaring a universal winner.
Knowledge check
Test what you can apply
Five course-specific questions covering the most important ideas in AWS Solutions Architect. Commit to an answer before reading the explanation.
Score0 / 50 answered
01
A deployment pipeline in one AWS account must deploy into several application accounts. Which credential design best reduces long-lived-secret risk while keeping permissions auditable?
Cross-account role assumption gives the pipeline short-lived credentials and lets each target account define exactly what the pipeline may do. A stored administrator key is powerful and long-lived, root credentials should not be used for workloads, and copying one IAM user pattern across accounts still leaves long-lived secrets to rotate and protect.
Review this topic →02
An application role currently has s3:* on every bucket because the team expects future features. What is the best next design step?
Least privilege starts from the actions and resources the workload actually needs and evolves when requirements change. Broad wildcard or administrator permissions increase blast radius; naming conventions alone are not an authorization control.
Review this topic →03
A checkout API can tolerate at most 15 minutes of service interruption and at most 5 minutes of lost committed data after a regional disaster. Which statement correctly interprets those requirements?
RTO is the target time to restore service, so it is 15 minutes. RPO is the acceptable data-loss window, so it is 5 minutes. Swapping them confuses recovery time with recovery point, and neither metric is an autoscaling target.
Review this topic →04
A public API currently runs as one instance in one Availability Zone. The requirement is to survive a single-instance or single-AZ failure without manual intervention. Which change most directly addresses that failure objective?
Redundancy across independent failure domains plus health-aware routing directly addresses instance and AZ failure. A larger single instance is still one failure domain, disabling health checks hides failures, and a manual runbook cannot satisfy a no-manual-intervention requirement.
Review this topic →05
A team proposes active-active deployment in three regions for an internal tool with low traffic, a four-hour RTO, a one-hour RPO, and a strict cost ceiling. What should the architect do first?
Architecture should be justified by workload requirements and explicit failure objectives. Multi-region active-active may be unnecessary for a four-hour RTO and can add operational and consistency cost. Instance price is only one dimension, and service count is not a resilience metric.
Review this topic →Complete
Review any missed answers, then continue while the concepts are fresh enough to connect.