Day 5 - Week 2 Synthesis: How the EC2 Layers Mesh Inside a Single System

Every EC2 layer we covered in Week 2 — Nitro, instance families, AMIs, Security Groups, Key Pairs, User Data, EBS, Instance Store, ALB, NLB, ASG — is a poor fit for rote memorization. The exam always frames things as scenarios, and those scenarios ask questions like "The SG is wide open, so why doesn't it work?", "Why doesn't the new instance show up in the ALB?", or "Why did our cross-AZ traffic bill explode?" You can't answer these by looking at each layer in isolation; you have to see how the layers mesh and operate together.

Today we tie every Week 2 concept into one production-grade architecture, then work through the traps and exam scenarios you hit most often on top of it. At the end, 12 scenario-based synthesis questions to gauge your real exam readiness.

How All of Week 2 Meshes Inside a Single System

Assume we're building a classic 3-tier web service on EC2. The shape is user → CloudFront → ALB → ASG(EC2) → RDS Multi-AZ + ElastiCache. Let's locate each Week 2 concept within this structure.

                          [Route 53 (DNS, alias to ALB)]
                                       │
                                       ▼
                          [CloudFront (edge cache + WAF)]
                                       │
                                       ▼
                          [ALB in 3 AZs (cross-zone ON, ACM cert)]
            HTTPS:443  ┌──────┴──────┐
                       ▼             ▼
            (path /api/*)   (path /*)
                       │             │
                       ▼             ▼
            [api-tg]         [web-tg]
            (target=instance, /healthz)
                       │             │
            ┌──────────┴─────────────┴──────────┐
            ▼                                   ▼
     [ASG: Mixed Instance Policy]
     Min 3, Max 30, Desired 6
     ┌─ AZ-a ─┐  ┌─ AZ-b ─┐  ┌─ AZ-c ─┐
     │ EC2 #1 │  │ EC2 #3 │  │ EC2 #5 │
     │ EC2 #2 │  │ EC2 #4 │  │ EC2 #6 │
     │ gp3 root│  │ gp3 root│  │ gp3 root│
     │ io2 data│  │ io2 data│  │ io2 data│
     └────────┘  └────────┘  └────────┘
                       │
     IAM Instance Profile (S3 read, Secrets Manager read)
     User Data: fetch DB pass from Secrets Manager
     IMDSv2 required, hop-limit 1
                       │
                       ▼
     [Security Group: web-sg]
        Inbound:  443 from ALB SG
                  22  from Bastion SG
        Outbound: 3306 to db-sg, 6379 to cache-sg, 443 to 0.0.0.0/0
                       │
                       ▼
            ┌─ AZ-a ──┐   ┌─ AZ-b ──┐
     [RDS Multi-AZ Primary/Standby (synchronous), db-sg]
     [ElastiCache Redis Cluster (Multi-AZ, cache-sg)]

Let's trace how each Week 2 concept works inside this architecture.

Starting point - a user requests https://app.example.com

1. Route 53 receives the DNS query and answers with the ALB's alias record
2. The ALB presents the app.example.com certificate via SNI (issued by ACM, auto-renewed)
3. The ALB listener rule decides web-tg or api-tg by path-pattern
4. The ALB forwards to one of the healthy targets. With cross-zone ON, it spreads evenly across AZs
5. The ALB SG's outbound matches web-sg's inbound 443
6. nginx on the EC2 instance reverse-proxies 8080 → the application

When Auto Scaling launches one more instance

1. ALB RequestCountPerTarget hits 1500 in CloudWatch → the ASG's Target Tracking bumps desired +1
2. The ASG starts a new EC2 from the launch template. With Mixed Instance Policy it picks capacity-optimized across c5.large or c5a.large
3. The Nitro hypervisor assigns a host, attaches the EBS gp3 root volume + io2 data volume
4. cloud-init grabs an IMDSv2 token and fetches metadata, injecting the IAM instance profile's credentials
5. User Data fetches the DB password with aws secretsmanager get-secret-value and writes it to /etc/app/secrets.env with chmod 600
6. The EC2_INSTANCE_LAUNCHING lifecycle hook holds the instance in Pending:Wait
7. The application starts, and after cache pre-warm completes it calls complete-lifecycle-action
8. The ASG flips the instance to InService and auto-registers it in the ALB target group
9. Health check /healthz returns 200 five times in a row → healthy. Only now does it start receiving traffic

When an instance dies or is scaled in

1. The EC2's own status check fails, or the ALB hits the unhealthy threshold
2. Since the ASG has HealthCheckType=ELB, it decides to terminate that instance
3. The EC2_INSTANCE_TERMINATING lifecycle hook holds it in Terminating:Wait
4. It notifies via SNS/SQS, a Lambda syncs the logs to S3, and the application does a graceful shutdown
5. In-flight requests drain over the ALB's 300-second deregistration delay
6. After complete-lifecycle-action, the instance terminates; the EBS volume is deleted alongside it if DeleteOnTermination=true

Every concept that appears in this sequence is in Week 2's exam scope. The exam asks its questions by breaking one step somewhere in this sequence and framing it as a scenario.

The Traps You Hit Most Often

Trap 1: The SG is wide open but the connection still fails

Usually one of: ① a missing ephemeral-port outbound rule on the NACL, ② a missing inbound rule on the Endpoint SG (PrivateLink), ③ conntrack limit exceeded (per instance type), or ④ a missing IGW/NAT route in the Route Table. Don't stare at the SG alone — follow the entire packet path.

Trap 2: The new instance returns 5xx from the ALB

The moment the health check passes is not the moment the application is fully ready. Point the health check path at /healthz and have the application respond 200 only when its ready flag is true, or use an ASG lifecycle hook to buy warmup time.

Trap 3: Cross-AZ costs explode

Happens when NLB cross-zone is on and target counts differ per AZ, or when two AWS accounts have mismatched ZoneName mappings and PrivateLink ends up flowing cross-AZ. Align on ZoneId.

Trap 4: Response is slow after restoring an EBS snapshot

This is lazy loading. Turn on Fast Snapshot Restore, or read every block once with dd.

Trap 5: Hardcoding a password into User Data gets flagged in a security audit

Anyone can read it from IMDS. Switch to Secrets Manager + instance profile.

Trap 6: High Spot reclamation rate keeps taking production down

Change the lowest-price strategy to capacity-optimized or price-capacity-optimized. Register several instance types in the Override list.

Trap 7: Trying to boot from an HDD volume

st1 and sc1 can't boot. Only SSD (gp2/gp3/io1/io2) is bootable.

Trap 8: Two EC2s accessing the same EBS volume at once

Not possible with plain gp3. You need io1/io2 + Nitro + same AZ + Multi-Attach + a cluster file system. Usually EFS is the better answer.

Trap 9: Storing important data on instance store, then stopping

Permanent data loss. If you need durable storage use EBS; if you need sharing use EFS/S3.

Trap 10: SSRF attack while running IMDSv1

Enforce IMDSv2 (HttpTokens=required, HttpPutResponseHopLimit=1). The root cause of the Capital One breach.

Trap 11: The ALB target group is target-type=ip but the security group doesn't match

IP-type target SG referencing behaves differently from instance-type targets. You have to allow the ENI's SG on inbound precisely.

Trap 12: Manually changing the ASG's desired capacity, but the scaling policy reverts it

If Target Tracking is on, it re-adjusts desired against the metric every time. If you need a manual adjustment, pause the policy or use suspend-processes.

Week 2 Easy-to-Confuse Comparisons

Week 2 Acronym Glossary

DVA-Specific Exam Points (What Differs from SAA)

DVA covers the same EC2 scope as SAA, but the exam's vantage point is different. Even for the same ASG, DVA drills down to the code, SDK, and option-name level: ① how you handle the IMDSv2 token in boto3, ② how CodeDeploy's Blue/Green manipulates the ALB target group, ③ how you mount EFS from Lambda, ④ at what point the instance profile permissions are attached when you call Secrets Manager inside User Data.

Wrapping Up

Week 2 took in the whole EC2 layer. We started from EC2's own virtualization, instance families, and AMIs, then moved up through the network controls on top (SG, Key Pair, User Data), the disk layer (EBS, Instance Store, EFS/FSx), and finally the traffic-distribution layer (ALB/NLB, ASG) — following how one production architecture is woven together. Since the exam bundles all of this into a single scenario, you need to be able to picture "the full path an instance travels before it receives traffic" in your head, rather than memorizing each layer separately.

From Week 3 on, the DVA-specific layers — IAM, Lambda, DynamoDB, API Gateway, CodePipeline — stack on top of this EC2 layer. Only when the EC2 layer is firmly in place do the developer-vantage layers above it settle cleanly.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

An e-commerce company's ALB + ASG production system spikes to 20x its normal RPS during the first 5 minutes of a sale that starts at 7 PM daily. It uses a Target Tracking (CPU 60%) scaling policy, but users are getting 5xx. What is the most appropriate improvement?

• APermanently raise the ASG's min size to the spike peak so there are always enough instances — survives the spike but idle-instance cost for 23 hours is enormous
• BUse Predictive Scaling + Scheduled Scaling to raise desired ahead of time at 6:55, and Step Scaling for aggressive scale-out during the spike
• CLower the Target Tracking CPU target to 30% to trigger scale-out earlier — this doubles the instance count even at normal load (wasteful) and the boot delay remains
• DReplace the ALB with an NLB to distribute connections faster at L4 — boot delay is the cause, so swapping the LB won't clear the 5xx and only loses HTTP routing

Question 2

A company runs ML training on an EC2 instance every midnight and uploads the results to S3. It wants to minimize cost, and the job only needs to finish within 24 hours. What is the most appropriate purchase option?

• AOn-Demand, starting and stopping at each midnight to bill only by the hour — flexible but has no discount versus Spot, so it misses the cost-minimization goal
• BA 1-year Reserved Instance commitment to lower the hourly rate — but it's used only a few hours a day while committing to 24/7, so most of the time is wasted
• CSpot Instance + periodically saving a checkpoint to S3
• DA Dedicated Host to secure a whole physical server for stable execution — a BYOL-license-only option, the most expensive, exactly opposite to the cost goal

Question 3

A developer trying to pull IAM credentials from an EC2 instance's IMDS finds that curl http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole returns a 401. What is the most likely cause?

• ANo IAM Role is attached to the instance — but that returns a 404 at that path, not a 401, so it doesn't match the symptom
• BIMDSv2 is required but curl uses only an IMDSv1 GET (you must obtain a token via PUT first)
• C169.254.169.254/32 is blocked in web-sg's outbound rules — a link-local IP isn't controlled by SGs, so this can't be the cause
• DThe subnet NACL blocks 169.254.0.0/16 link-local traffic with a deny rule — link-local isn't subject to NACLs, so this can't be the cause

Question 4

A company runs two EC2 instances that must read and write in the same directory. Concurrent access is required, and the two EC2s are in different AZs. What is the most appropriate solution?

• AAttach an io2 EBS volume to both EC2s at once via Multi-Attach and set up a cluster file system — Multi-Attach only supports the same AZ, so it's impossible in this different-AZ scenario
• BMount an EFS file system on both EC2s over NFS
• CUse an S3 bucket as shared storage and have the two EC2s sync files periodically — being an object store, it lacks POSIX filesystem semantics and concurrent read/write locking
• DGive each EC2 an instance store and replicate data bidirectionally — host-bound ephemeral storage, so neither shared nor durable

Question 5

A company runs microservices behind an ALB. api.example.com/orders/* must go to the orders service and api.example.com/users/* to the users service. The two services each run on their own ASG. What is the most accurate configuration?

• ACreate a dedicated ALB per service and attach each ALB to a separate subdomain — it works, but two ALBs for path branching under the same host wastes cost and operational effort
• BCreate two target groups on one listener of a single ALB, and use listener rules for path-pattern matching: /orders/* → orders-tg, /users/* → users-tg
• CMove to an NLB and branch services by destination port on a TCP listener — NLB is L4 and can't see the URL path, so path routing is impossible
• DUse a Route 53 routing policy to branch /orders/* and /users/* to each service's IP — DNS only sees the host name, not the path, so it's impossible

Question 6

An EC2 instance calls aws s3 cp s3://bucket/app.tar.gz /opt/ inside user-data but gets an Unable to locate credentials error. What is the most likely cause?

• AThe specified S3 bucket doesn't exist or the object key is wrong — that yields NoSuchBucket/NoSuchKey, not Unable to locate credentials
• BNo IAM Instance Profile is attached to the instance, or that Role lacks s3:GetObject permission
• CThe CLI's default region differs from the bucket's region, so endpoint resolution fails — a region mismatch produces an endpoint error, not a credentials error
• DThe IMDSv2 token's TTL expired and cut off credential lookups — botocore 1.13+ re-issues the token automatically, so this isn't the cause of this error

Question 7

A company wants to encrypt a production EC2's EBS volume (unencrypted gp2). To minimize downtime, what should it do?

• AEncrypt the running volume in-place with no downtime via modify-volume --encrypted — modify-volume only changes size/type/IOPS and has no encryption-toggle option
• BCreate a snapshot → make an encrypted copy with copy-snapshot --encrypted → create a new volume from the encrypted snapshot → swap detach/attach during a short downtime
• COpen a case with AWS Support to convert the volume's encryption on the backend — Support doesn't encrypt your volume on your behalf
• DCreate a new encrypted instance, move all data with rsync, then cut over — possible, but on large volumes the sync time and consistency risk are high, so it's not the standard procedure

Question 8

A company finds that a new instance starts receiving traffic the moment it registers with the ALB target group and returns 5xx before the application warms up. What is the most appropriate response?

• ARaise the ASG's HealthCheckGracePeriod to 300 seconds to defer the unhealthy verdict right after registration — the grace period only prevents premature termination, not the traffic reception itself
• BRegister an EC2_INSTANCE_LAUNCHING lifecycle hook on the ASG and call complete-lifecycle-action from inside the instance once warmup is complete
• CChange the ALB health check path to / for a lighter endpoint check — if / returns 200 even before warmup, it's a false positive and registers too early
• DIncrease the target group's deregistration delay to preserve in-flight requests longer — that's a termination-time setting, unrelated to a new instance's warm-up problem

Question 9

A company distributes game-server traffic with an NLB. Users are spread evenly across 5 AZs, but the instance count per AZ differs (AZ-a 10, AZ-b 5, AZ-c 2). A report comes in that traffic is uneven. What is the most appropriate action?

• AEnable NLB cross-zone load balancing (note: it incurs cross-AZ data transfer cost)
• BReplace the NLB with an ALB to use L7 routing and weighted distribution — ALB is HTTP-only, so it's unsuitable for L4 game traffic (UDP/TCP)
• CFix every AZ's instance count to 10 — a partial fix, but the ASG doesn't always guarantee even placement per AZ, so the imbalance can recur
• DDistribute traffic with Route 53 weighted routing by giving each AZ a weight — DNS cache/TTL means it doesn't take effect immediately and it isn't per-connection distribution

Question 10

An ML team needs to load a 2GB ML model in a Lambda function. It exceeds the Lambda layer limit (250MB). What is the most appropriate solution?

• AAbandon Lambda and serve inference from an EC2/ASG with the model preloaded — possible, but it throws away all the benefits of serverless auto-scaling and billing
• BMount an EFS access point on Lambda and store the model file on EFS
• CKeep the model in S3 and download the 2GB to /tmp on every cold start — a multi-GB transfer per cold start makes latency explode and strains the /tmp limit (10GB)
• D8-bit quantize the model down under 250MB and package it in the Layer — it fits the limit, but at an accuracy cost and it's a model change unrelated to the requirement

Question 11

An instance sporadically returns Connection refused. CPU and memory have headroom and the SG is wide open. CloudWatch shows the conntrack_allowance_exceeded metric. What is the most appropriate response?

• AConntrack limit exceeded. Move to a larger instance type (enhanced networking like c5n), or make the application's connection pool more efficient and use keep-alive
• BAsk AWS Support for a quota increase to raise the conntrack table limit — the conntrack limit is a hard limit fixed per instance type and can't be raised
• CIncrease the ASG max size to add more instances — total throughput rises but each individual instance's conntrack saturation remains
• DAdd more explicit allow rules to the Security Group to secure connection throughput — the number of rules is unrelated to conntrack capacity, so it has no effect

Question 12

A company runs EC2 production behind an ALB + ASG. It wants to set up Blue/Green deployment with CodeDeploy — which ALB feature does it use?

• AWeighted forward on the listener rule distributes traffic across the two target groups (Blue/Green), and CodeDeploy shifts the weight over time from 0/100 → 100/0
• BCreate two ALBs, one each for Blue/Green, and switch with a Route 53 weighted record — DNS TTL caching makes instant/gradual switchover and fast rollback difficult
• CReplace with an NLB and use source IP affinity to steer existing sessions to Blue and new ones to Green — affinity isn't a deployment tool and offers no weighted switchover or automatic rollback
• DPin users to Blue/Green with ALB sticky sessions (cookies) — that's session pinning, not a mechanism for shifting traffic between versions

📊 Week 2 Self-Assessment

📌 Week 2 Full Summary

1. EC2 virtualization evolved into the Nitro System (dedicated hardware cards), and Firecracker microVMs are the foundation of Lambda and Fargate. Choosing the instance family (M/C/R/I/D/P/G/T) and Graviton (g suffix) chips is the starting point of cost optimization.
2. A Security Group is an ENI-level stateful firewall (conntrack-based). A NACL is subnet-level and stateless. Enforcing IMDSv2 (HttpTokens=required) is the standard SSRF defense.
3. User Data runs once as the final step of cloud-init, with a 16KB limit. Never hardcode passwords — use Secrets Manager + instance profile.
4. EBS is AZ-bound distributed block storage. gp3 is the default, io2/Block Express for critical DBs. Snapshots are S3 incremental + Snapshot Archive (75% savings). KMS envelope encryption.
5. Instance Store is host-attached NVMe with microsecond latency, but it's lost on stop/terminate. No durable storage.
6. For shared files, use EFS (NFS multi-AZ), not EBS Multi-Attach. HPC uses FSx for Lustre, Windows uses FSx for Windows, enterprise uses FSx for NetApp ONTAP.
7. Choosing between ALB (L7 HTTP routing) and NLB (L4 TCP/UDP with static EIP) is based on the workload protocol. ALB cross-zone is default ON and free; NLB is default OFF and costs money when enabled.
8. An ASG is a reconciliation loop, with lifecycle hooks controlling warmup and graceful shutdown. Target Tracking is the default scaling policy. Mixed Instance Policy + capacity-optimized Spot is the production standard.
9. Blue/Green deployment is implemented natively through the ALB's weighted forward integrated with CodeDeploy.
10. Exam scenarios ask about connections between layers. Building the habit of narrowing "the SG is open but it doesn't work" down to one of NACL/Endpoint SG/conntrack/Route Table, and "5xx" down to one of health-check timing/warmup/IAM permission, is what determines your score.