Amazon SAP-C02: Storage & Data Management — Study Guide
Part of the AWS Solutions Architect Professional SAP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Object storage, lifecycle, and tiering (Amazon S3 and related services)
Amazon S3 is the foundation for durable, highly available object storage and should be treated as the canonical, long‑term store for unstructured data. Design decisions center on storage class selection, lifecycle rules, consistency semantics, and data governance. Choose S3 Standard for frequently accessed objects, Intelligent‑Tiering when access patterns are unknown, Standard‑IA or One Zone‑IA for infrequent access, and Glacier/Deep Archive for long retention with higher restore latency. Implement lifecycle policies based on tags or prefixes to transition objects automatically and to expire old versions; enable versioning before lifecycle or replication so objects are not accidentally purged. Use Cross‑Region Replication (CRR) for geographic durability and regulatory placement, or Same‑Region Replication (SRR) for compliance and separation of responsibilities. Protect critical archives with S3 Object Lock in governance or compliance mode and enable MFA Delete where appropriate. Common traps include over‑aggressive lifecycle transitions that incur restore charges and minutes-to-hours delays, not accounting for Glacier retrieval costs or times, and relying on public endpoints rather than VPC Gateway/Interface endpoints (which can expose data to the public internet or incur NAT egress costs). Balance cost versus retrieval latency and durability: tier aggressively for cold data but provision acceleration (CloudFront, S3 Transfer Acceleration, multipart uploads) for hot ingress and low latency access where needed.
Shared file systems and high‑performance storage (EFS, FSx)
Choose shared file systems when applications require POSIX semantics, low latency, or SMB semantics. Amazon EFS provides elastic NFS with multi‑AZ durability and POSIX consistency suitable for web content, home directories, and many HPC workloads that tolerate network file semantics. EFS has two performance modes (Bursting vs Provisioned throughput) and lifecycle transitions to EFS Infrequent Access. Amazon FSx offers purpose‑built file systems: Windows File Server for SMB/Active Directory integration, and FSx for Lustre for sub‑millisecond latency and high throughput for tightly coupled HPC and media workloads; FSx Lustre can transparently link to S3 for a durable data repository. Choose FSx for Windows when you need NTFS semantics, AD ACLs, DFS namespaces, or Windows-only tooling; choose FSx Lustre for render farms and ML training that require high IOPS and throughput. Common operational mistakes include assuming EFS will automatically handle metadata‑heavy workloads (you may need provisioned throughput), opening NFS/SMB ports broadly in security groups, and neglecting mount options and client timeouts. Evaluate trade‑offs: FSx is higher cost but higher performance and richer protocol features; EFS is simpler scale and multi‑AZ durable. Match workload I/O patterns, concurrency, and throughput needs to the chosen system and size throughput separately where needed.
Hybrid and offline transfer patterns (Storage Gateway, DataSync, Snow family)
Hybrid architectures commonly require low‑latency local caching, seamless cloud backups, or bulk data migration. AWS Storage Gateway provides three patterns: File Gateway exposes S3 as NFS/SMB for on‑prem apps to write to S3; Volume Gateway exposes block volumes for DR; Tape Gateway replaces physical tapes. AWS DataSync automates online, incremental, and parallel data movement between on‑prem and AWS (S3, EFS, FSx) with built‑in filtering, scheduling, and bandwidth controls; it respects POSIX metadata where configured. For offline and very large transfers, the Snow family provides edge and transport devices that include compute: Snowcone for small remote sites, Snowball Edge for tens-to-hundreds of TB with Lambda/EC2 on the device, and Snowmobile for exabyte imports. Use DataSync for ongoing, automated transfers and Storage Gateway File Gateway when legacy apps must see NFS/SMB mounts locally while storing data in S3. Common pitfalls include using the wrong gateway mode (cached vs stored), not planning network throughput leading to long migrations, neglecting IAM roles and endpoint policies for secure transfer, and underestimating Snow device ingestion/egress times. Choose DataSync for frequent incremental syncs, Storage Gateway for local protocol compatibility, and Snow devices for bulk or remote transfers where network bandwidth is insufficient.
Backups, replication, access control, and operational governance
Backups and replication choices should be driven by RTO/RPO targets, regulatory controls, and cost. Use AWS Backup to centralize backup policies across EBS, RDS, DynamoDB, EFS, and FSx, and configure lifecycle transitions from warm vault to cold storage for cost savings. For databases, prefer native mechanisms (RDS snapshots, read replicas, or DMS for heterogeneous migrations) coupled with cross‑region snapshot copy and KMS key replication or separate key policies. For S3, enable versioning, CRR/SRR, and consider replication time control (RTC) when near‑real‑time replication SLA is required. Secure access patterns rely on least‑privilege IAM, bucket policies, S3 Block Public Access, VPC Gateway/Interface endpoints with endpoint policies, and KMS with fine‑grained grants for cross‑account access and snapshot copying. Monitor with CloudTrail, S3 Access Logs, CloudWatch metrics, AWS Config rules, and use GuardDuty and Access Analyzer for threat detection and IAM misconfigurations. Typical traps include not replicating or granting access to KMS CMKs across accounts, leaving snapshots unencrypted or publicly accessible, and failing to enforce tags or resource placement with SCPs and Tag Policies, which complicates cost allocation and recovery. Decide based on resilience needs: multi‑region active‑active for lowest RTO, pilot‑light/warm standby for cost-efficient DR, and full failover when RTO must be minimal.
Practical Problem: Use-Case Scenario
Scenario: Atlas Media runs a multi-account AWS Organization with production in us‑east‑1 and a secondary region eu‑west‑1. They have a 150 TB on‑prem archive of video assets and artists across North America and Europe require high‑performance shared storage and secure, low‑latency access to current projects.
Challenge: Migrate the archive to AWS, provide high‑throughput rendering storage for artists, minimize ongoing storage costs for cold assets, and ensure secure cross‑region access with robust backups.
Recommended Approach:
- Provision an S3 bucket in us‑east‑1 as the canonical archive, enable versioning, server‑side encryption with AWS KMS (SSE‑KMS), and configure Cross‑Region Replication to eu‑west‑1 with replication of delete markers turned on.
- Use AWS Snowball Edge devices to import the initial 150 TB to S3 (storage‑optimized Snowball Edge), then run AWS DataSync for incremental synchronization for any delta changes and to validate integrity.
- For active working sets, deploy Amazon FSx for Lustre in each region and link the file system to the S3 bucket (Data Repository Integration) so artists get high throughput and low latency while writes synchronize back to S3; consider using short‑lived FSx instances for project bursts.
- Enforce secure access with VPC Interface Endpoints for S3 and FSx, restrict bucket access with IAM roles and bucket policies tied to Organization principals, front public distribution with CloudFront and signed URLs for remote reviewers, and enable AWS Backup for FSx plus cross‑region S3 replication and lifecycle rules to transition cold assets to Glacier Deep Archive.
Rationale: This approach separates durable, low‑cost archival storage (S3 + Glacier) from performant project storage (FSx Lustre linked to S3), uses Snowball and DataSync to optimize initial bulk ingest and deltas, and enforces strong security and cross‑region resilience while balancing cost, performance, and recovery objectives.
← Compute · All domains · Databases →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →