Three AWS Solutions Architect Associate Questions From My Shorts, Answered Properly - Migrating Web, Batch and Legacy Apps; Cutting EC2 Cost for a 2-Week Shutdown Without Losing Memory; Internet for Private Subnets (with the Prerequisites the 30-Second Answers Skip)

TL;DR

• Question 1, migrate web, batch and legacy apps with scalability and security: legacy and web tiers on EC2 in an Auto Scaling group across multiple Availability Zones, network ACLs plus security groups for defence in layers, and AWS Batch for the batch jobs, because it provisions and releases the compute per job.
• Question 2, cut EC2 cost during a 2-week shutdown when the data is in instance memory: hibernate the instances. Hibernation writes RAM to the encrypted EBS root volume, you stop paying for instance hours, and the RAM comes back on start. The conditions the Short skipped: an EBS root volume that is encrypted, not an instance store, and less than 150 GiB of RAM on Linux.
• Question 3, private-subnet instances need to download patches: a NAT gateway in a public subnet with an Elastic IP, plus a 0.0.0.0/0 route to it in the private subnets' route table. The public subnet itself needs its route to the internet gateway or nothing works.
• The exam pattern behind all three: the question names a constraint (legacy, in-memory data, private subnet) and the right answer is the managed service that respects the constraint at the lowest cost, not the most powerful service.
• Numbers to carry into the exam: SAA-C03 is 65 questions in 130 minutes for 150 USD; hibernation needs RAM under 150 GiB; a NAT gateway is billed per hour and per GB processed, so one per Availability Zone is the resilient layout and also the expensive one.
• Not your exact case? If you are deciding whether to sit the exam at all, read should you do a cloud certification; if you want to build Question 3 instead of answering it, the NAT gateway deep dive does it step by step.

Table of Content

1. Why three Shorts became one post
2. Question 1 - migrating web, batch and legacy applications
3. Question 2 - a 2-week shutdown with data in memory
4. Question 3 - internet access from a private subnet
5. What went wrong in the Shorts
6. Conclusion

1. Why three Shorts became one post

In June 2024 I posted three practice questions for the AWS Certified Solutions Architect Associate as Shorts of 38 s, 35 s and 29 s. They are among the most watched things on the channel, past 41,000 views together, and the comments under them are the reason for this post: a Short has room for the answer and not for the reasoning, and the exam is a reasoning test. Below are the three questions exactly as I read them in the recordings, the answer from each Short, and then the part the format could not hold: why the answer wins, what it requires, and where the AWS documentation says so.

The pattern I see in these three, and in the sample questions AWS publishes, is that the service is rarely the hard part; the constraint you read past is. The exam itself, per the AWS certification page, is 65 questions in 130 minutes for 150 USD, and every question looks like these: a scenario, a constraint, and four services that could all technically work.

2. Question 1 - migrating web, batch and legacy applications

1Question 1 (from the Short, 38 s)
2  "A company wants to migrate their on-premise application to AWS. They have a web application,
3   batch processing and a legacy application. They want highly scalable, secured, and a batch
4   processing. So what are the options you're going to choose when you want to migrate to AWS?"
5Answer given
6  "deploy my legacy application onto the EC2 instances along with the Auto Scaling group in the
7   multi-AZ region; secondly use the ACL and security group for implementing and improving the
8   security; third, for batch processing go with the cost-effective way of AWS Batch"

Why I answered that way. The constraint is the legacy application: it cannot be rewritten for containers or Lambda on a migration timeline, so it goes to EC2 as it is. "Highly scalable" with EC2 means an Auto Scaling group, and "multi-AZ" is what turns scaling into availability: the group replaces an instance that fails its health check and keeps capacity spread across zones (Auto Scaling benefits). "Secured" at the network layer is two controls, not one: security groups are stateful and attached to instances, network ACLs are stateless and attached to subnets, and the exam likes answers that use both (VPC infrastructure security). For batch, AWS Batch provisions the compute in response to submitted jobs and releases it afterwards, which is what "cost-effective" means in exam language: you do not pay for an idle batch fleet.

3. Question 2 - a 2-week shutdown with data in memory

1Question 2 (from the Short, 35 s)
2  "A company is planning a shutdown for 2 weeks, and during the two-week shutdown they want to
3   reduce the cost of running the EC2 instances. But those EC2 instances store the data in the
4   instance memory, so there is no separate EBS volume attached. They want the same data to be
5   available when they resume operation. What would be your strategy?"
6Answer given
7  "just go with the enable hibernate option for your EC2 instances"

Why I answered that way. Stopping an instance saves the hourly charge but loses RAM, which is the one thing the question says must survive; I would not stop them. terminating loses everything; leaving it running for 2 weeks is the cost you were asked to remove. Hibernation is the fourth option: per the EC2 hibernation page, it "saves the contents from the instance memory (RAM) to your Amazon EBS root volume", and "you're not charged for instance usage for a hibernated instance when it is in the stopped state"; you pay only for the EBS storage, including the space holding the RAM image. On start, the RAM is reloaded and the processes continue.

What the Short had no time for. Hibernation has prerequisites, and the exam can turn any of them into the trick:

My reading of the question's phrase "no separate EBS volume" is that the instance has only its root volume, which is still EBS for any instance that can hibernate. If the question had said "instance store root volume" or "200 GiB of memory", hibernate would be the wrong answer and the right one would be to persist the data somewhere first.

4. Question 3 - internet access from a private subnet

1Question 3 (from the Short, 29 s)
2  "A company is deploying a three-tier application in a multi-AZ region and all the EC2 instances
3   are running in the private subnet, but those EC2 instances need internet access to download
4   certain patches and updates. How would you make the internet enabled to the EC2 instances
5   running in the private subnet?"
6Answer given
7  "there are two answers to it: the first one is create a NAT gateway in the public subnet;
8   second one is to create a route table in the private subnet and create a route to the NAT
9   gateway which is present in the public subnet"

Why I answered that way. A private subnet has no route to the internet gateway, which is what makes it private; it is the layout I build in every VPC video on this channel. The instances still need outbound access for apt-get or yum update, without becoming reachable from outside. A public NAT gateway does exactly that: it sits in a public subnet with an Elastic IP, and the NAT gateway documentation describes it as the way "instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances".

The full chain the Short compresses into two sentences:

1. A public subnet whose route table sends 0.0.0.0/0 to the internet gateway.
2. A NAT gateway created in that public subnet with an Elastic IP allocated to it ("you must associate an Elastic IP address with the NAT gateway at creation").
3. A route table for the private subnets with 0.0.0.0/0 pointing at the NAT gateway.
4. One NAT gateway per Availability Zone if the three tiers are truly multi-AZ, because a NAT gateway lives in one zone and a zone failure takes its subnets' internet access with it.

The exam traps here are the internet gateway (the instances would need public IPs, so no longer private), a NAT instance (the legacy answer; works, but you manage it, and the exam prefers the managed gateway), and a VPC endpoint (right for S3 and DynamoDB traffic, wrong for "download patches" from arbitrary repositories). I built this exact setup, with the ping test from the private instance, in the NAT gateway deep dive and in VPC Part 5.

5. What went wrong in the Shorts

1. Question 2's answer is right only because of a prerequisite the Short never states. "Enable hibernate" assumes the instances were launched with hibernation enabled on an encrypted EBS root volume with less than 150 GiB of RAM. If they were not, the honest answer during a real shutdown is to snapshot and persist the data first, because hibernation cannot be switched on afterwards. The exam version of this question usually includes the word "encrypted" or a RAM figure for exactly this reason.

2. Question 3 names two things and the working setup needs four. The Short says NAT gateway plus route. A NAT gateway in a public subnet whose own route table has no internet gateway route does nothing, and a NAT gateway without an Elastic IP cannot be created. Section 4 lists the four pieces; the recording linked there shows the route table.

3. Question 1's "ACL and security group" was said in one breath. They are different layers with different behaviour: security groups are stateful and per instance, network ACLs are stateless and per subnet with explicit allow and deny rules. The exam asks about the difference more often than it asks you to pick both, and a Short cannot carry that distinction.

4. The Shorts give answers; the exam gives four options. None of the three recordings shows the distractors, and eliminating distractors is most of the skill. The tables in sections 2 to 4 add the alternatives and why they lose, which is how I would study each question.

6. Conclusion

To summarise:

1. Legacy and web tiers go to EC2 in a multi-AZ Auto Scaling group, batch goes to AWS Batch, and security uses both security groups and network ACLs.
2. Hibernation keeps RAM across a shutdown and stops the hourly charge, if the root volume is encrypted EBS and the RAM is under 150 GiB.
3. Private-subnet internet access is a NAT gateway with an Elastic IP in a public subnet that routes to an internet gateway, plus a private route to the NAT gateway, per zone.
4. The exam rewards the managed service that respects the stated constraint at the lowest cost.

AWS step by step series -

1. Part-1 : AWS IAM user - create a user, group, policy, access keys and MFA
2. Part-2 : AWS Organizations - multi-account setup, OUs and SCPs
3. Part-3 : AWS assume IAM role - trust policy, switch role in console and CLI
4. Part-4 : How to launch an EC2 instance - key pair, security group, SSH
5. Part-5 : AWS VPC - public and private subnets, Internet Gateway, NAT Gateway, route tables
6. Part-8 : EC2 launch template - versions, default version, source template, SSM parameter AMI
7. Part-10 : EC2 Auto Scaling - launch template, Auto Scaling group, target tracking, ALB
8. Part-11 : AWS WAF - web ACL, managed rules, rate limiting, geo blocking
9. Part-12 : AWS VPC Peering - connect two VPCs, routes, security groups, DNS
10. Part-13 : AWS Transit Gateway - hub-and-spoke for many VPCs and on-premises
11. Part-14 : AWS NAT Gateway deep dive - public vs private, limits, cost, troubleshooting
12. Part-15 : Amazon Route 53 - hosted zones, records, alias, routing policies, health checks
13. Part-16 : AWS security groups - inbound and outbound rules, stateful, referencing, quotas
14. Part-16 : AWS Certificate Manager - free TLS certificates for ALB, CloudFront and API Gateway
15. Part-17 : AWS Lambda - function URLs, environment variables and layers
16. Part-18 : Network Load Balancer - setup, and ALB vs NLB
17. Part-19 : VPC endpoints - gateway and interface endpoints (PrivateLink) instead of NAT
18. Part-20 : AWS PrivateLink - publish your own service with an endpoint service and NLB
19. Part-20 : Amazon EBS volumes - types, attach, mount, resize, snapshots, encryption
20. Part-21 : VPC Flow Logs - CloudWatch Logs, S3, record format, Logs Insights, Athena
21. Part-21 : EC2 Spot Instances - pricing, interruptions, mixed instances groups
22. Part-23 : AWS Global Accelerator - static anycast IPs in front of ALBs in two regions, traffic dials, weights
23. Part-24 : AWS Control Tower - landing zone, controls, Account Factory, Identity Center
24. Part-25 : AWS Cloud WAN - global network, core network policy, dev/prod/shared segments, tag-based attachments across three regions

Networking fundamentals -

1. What is a VPC and a subnet? AWS networking in five minutes
2. What is CIDR? Calculate IP ranges for VPCs and subnets
3. VPC Subnet Planner - the free tool I use to size the VPC and subnet CIDRs in every part of this series (AWS, Azure, GCP rules built in)
4. What is NAT? Static NAT, dynamic NAT and PAT explained

More AWS guides -

1. What is AWS CloudFormation? Templates, stacks, change sets, drift, StackSets
2. Learn AWS S3 - the complete course
3. AWS API Gateway - REST API with Lambda, authorizers, Terraform
4. AWS Advanced Networking Specialty (ANS-C01) - course companion
5. AWS ECS and Fargate - how to deploy a Docker container
6. AWS S3 - how to host a static website
7. Terraform create EC2 instance on AWS
8. Terraform AWS IAM - users, roles and policies
9. Terraform and AWS multi-account setup
10. Terraform - setting up an ALB and SSL