Passed AWS Certified Solutions Architect Professional (CSAP) – 07/03/2020

Hello Cloud Gurus!

I am happy to share with you that I passed the CSAP exam last week with a score of 902/1000.

This was my ninth AWS exam on the road to understand AWS thoroughly.

ACG

First, I want to thank Scott and the other gurus for delivering great stuff – which is no surprise for me as the learning experience was consistently good throughout the past two years. What particularly surprised me with this course, was the quality of the exam simulator. My last exam simulator run was more than a year ago and that feature enhanced significantly!

As a comparison: I scored 80% on the AWS practice exam and felt pretty confident. The exam simulator questions felt more difficult than the AWS practice exam and I scored significantly worse (somewhere between 65 – 70%)… which was great because they filled my knowledge gaps and reminded me that I have to work on my time management skills to get through this exam!

Time Management

I was surprised that I had 15 min left on the clock. AWS threw in some short questions this time. I have to admit that I had 30 min ESL time bonus. I do not know how native speakers accomplish this exam with 30 min less – that is just madness!

Topics

The following stood out to me:

• Networking was covered heavily. The ACG Advanced Networking course or at least its main chapters such as DX and Hybrid Networking are highly recommended. There are scenarios in which you must know the different throughput limits of the AWS networking services in order to pick the right solution. e.g.: You have to know how much traffic is able to flow through an AWS managed VPN connection.

• New stuff was not covered much. e.g.: DX gateway and transit gateway are merely covered and traffic mirroring was not covered at all. Focus on the things that exist for quite some time! They are usually covered by more questions than new stuff.

• Multi Account management was covered heavily. How to set up AWS Organizations with Cloud Formation and Service Catalog? How to enforce certain internal policies via IAM, SCPs etc.? How to enforce stuff with least disruption for accounting / development / etc. You must know how different tools can be used to control access to resources and which implications arise by using them. e.g.: Do you want to build IAM policies around EC2 tags (tag based security), do you want to isolate resources on the networking level (i.e. using different VPCs) or do you want to use SCPs instead of IAM policies? There are sometime multiple valid answers which impose different restrictions on different OUs in the company and you must decide which one is best regarding cost/disruptiveness/security/governance aspects for a particular OU. This is significantly difficult: You have to know who (i.e. which OU) is affected by your design decision and on which dimension (i.e. to which degree is the OU affected with regards to cost/operational restrictions/development speed)?

• No question on the well architected framework itself as far as I remember. This is a pity since the ACG course Mastering the AWS Well-Architected Framework is very informative and well presented by Mark Nunnikhoven IMO.

• There were several topics which covered data migration. You have to choose the correct tools to migrate a workload and the correct target architecture in the cloud. Unfortunately VMware stuff was covered in my exam, too.

• EFS was not covered much and often a distractor.

• Some of the "new" data analytics services were covered – particularly Glue!

Learning Material

• ACG: AWS Certified Solutions Architect – Professional 2020

• ACG: Mastering the AWS Well-Architected Framework

• Part of the following as a refresher: ACG: AWS Certified Advanced Networking – Specialty 2020 — AWS Direct Connect and Hybrid DNS chapter, What are the different ways you can connect things to a Virtual Private Gateway? HA solutions around multiple DX connections, cross connects, LAGs, VIFs and backup VPNs.

• Part of the following as a refresher: ACG: AWS Certified Solutions Architect Associate 2020 — EC2 and RDS chapters, FSx for Lustre and RoboCopy in particular!

• ACG: Exam Simulator for CSAP

• Whizlabs: CSAP Practice Tests

Was it hard?

This was definitely the hardest exam of those I have taken.

It was not much harder than the Data Analytics Beta exam I took in December 2019 though.

What makes this exam very difficult IMO, is the large amount of topics which are covered and the time pressure they put on you.

My long term strategy

In order to handle both difficulties and pass CSAP confidently, I used the following strategy:

1. I planned to do certifications along my bachelor’s studies. I budgeted around 2-3 years for the whole path.

2. I used AWS services almost daily at work. Since I worked for a startup in its early days, we had to built up the whole cloud infrastructure from zero. That covered all the different operational areas from CI/CD, networking, monitoring, centralized logging, web application development, deployment strategies and finally IoT device development. There was no pressure for me to get AWS certifications at all, but there was a constant time pressure to build things and move forward quickly in the cloud.

3. I aligned my certifications to the subjects I faced at work. When configuring all the Active Directory stuff, writing IAM policies, establishing a multi account structure etc., I prepared for the security specialty. After configuring the networking stuff, I took the Advanced Networking certification etc. I think you get the point: When you practice at work beforehand and build things that actually work, you get pretty confident for the respective exams.

4. I took CSAP almost at the very end. The associate certs, DevOps professional and {security, advanced networking, data analytics} specialties altogether cover so much of the CSAP that I had no doubt that I can pass it on the first try.

I hope this write-up encourages some students to take a similar path and become fully AWS certified during undergraduate studies.

Especially in the startup scene, where there is huge demand to move quickly, people are likely to grant you responsibility and freedom to build new things from the ground up across different areas such as networking infrastructure, IAM, development, cost control, system administration etc.

Future

I will go for the remaining three AWS certs which are {alexa, database, machine learning} specialty.

The Alexa specialty admittedly is just for fun. The database topic might gain some relevance for us once we are starting to build more granular microservices and decide to refactor their existing storage solutions. The machine learning cert is the most attractive from the missing ones for me. We have a growing number of data scientists and speaking their language thoroughly could pay off in the long term.

I will keep posting in the near future when I had time to take the next one and wish you good look for your CSAP in the meantime!

— Martin