4.3. Reflection Checkpoint

Phase 4 covers the deployment and automation domain. Without a clear mental model of how CloudFormation, CDK, and Systems Manager interact, exam questions in this domain tend to blur together — the wrong service, the wrong tool, the wrong answer. For instance, confusing what AWS Config detects versus what SCPs prevent is a trap that appears in multiple question formats. Consider which concepts you could explain to a colleague before relying on them under exam conditions.

Verify these before continuing:

1. What is the difference between an EBS-backed and instance store-backed AMI? Which can be stopped?
2. EC2 Image Builder vs. manually creating AMIs: what are the two main benefits of Image Builder?
3. What is ECR image tag immutability, and why does it matter for production deployments?
4. A CloudFormation stack creates an RDS database. You want to ensure the database is not deleted when the stack is deleted. What property do you set, and on which resource?
5. Explain the relationship between AWS CDK and CloudFormation. What does cdk synth produce?
6. Terraform stores state in S3 and uses DynamoDB for locking. What does DynamoDB locking prevent?
7. What is the difference between CloudFormation StackSets with self-managed vs. service-managed permissions? Which automatically deploys to new accounts?
8. Blue/green vs. canary deployment: what is the key difference in how traffic is shifted?
9. What three prerequisites must exist for an EC2 instance to appear in Systems Manager?
10. AWS Config detects a non-compliant security group. Can Config prevent the security group from being created in the first place? What service can prevent it?

💾 CHECKPOINT — Session 3 Complete Files saved: complete-guide.md (Phases 1–4), keywords.json, relationships.json Resume Point: Begin Phase 5 (Security and Compliance) in the next session.