Domain 1 -- Design Secure Architectures (30% of exam)

This is the heaviest domain. Key task statements include designing secure access to AWS resources, designing secure workloads and applications, and determining appropriate data security controls. AWSstatic Specific topics include:

• IAM (users, roles, policies, permission boundaries)
• AWS Key Management Service (KMS) and encryption at rest/in transit
• VPC security (security groups, NACLs, private/public subnets)
• AWS Shield and AWS WAF
• AWS Organizations and Service Control Policies (SCPs)
• Secrets Manager and Systems Manager Parameter Store
• S3 bucket policies and access control lists
• CloudTrail, Config, and GuardDuty for auditing and threat detection

Domain 2 -- Design Resilient Architectures (26% of exam)

This domain focuses on high availability, fault tolerance, disaster recovery, and multi-region strategies. Auto Scaling and Elastic Load Balancing come up frequently. Aabiance Topics include:

• Multi-AZ and Multi-Region deployments
• EC2 Auto Scaling groups and lifecycle hooks
• Elastic Load Balancing (ALB, NLB, GLB)
• Route 53 routing policies (failover, latency, weighted, geolocation)
• RDS Multi-AZ and Aurora Global Databases
• S3 Cross-Region Replication
• AWS Backup and disaster recovery strategies (RPO/RTO)