Ultimate SAA-C03 Revision Cheatsheet

AWS Solutions Architect Associate (SAA-C03) - Ultimate Revision Cheatsheet

Exam Domains:

Domain 1: Design Secure Architectures (30%)
Domain 2: Design Resilient Architectures (26%)
Domain 3: Design High-Performing Architectures (24%)
Domain 4: Design Cost-Optimized Architectures (20%)

🔐 DOMAIN 1: DESIGN SECURE ARCHITECTURES (30%)

1.1 Identity and Access Management (IAM)

IAM Core Concepts

Component	Description	Exam Focus
Users	Individual identities with credentials	Long-term credentials, access keys
Groups	Collection of users (cannot be nested)	Simplify permission management
Roles	Temporary credentials for services/users	Cross-account, EC2 instance profiles
Policies	JSON documents defining permissions	Identity vs Resource-based policies

IAM Policy Types

Policy Type	Attached To	Use Case
Identity-based	Users, Groups, Roles	Grant permissions to principals
Resource-based	Resources (S3, SQS, etc.)	Cross-account access, no trust relationship needed
Permission Boundary	Users, Roles	Maximum permissions limit (guardrails)
SCPs	AWS Organizations OUs/Accounts	Organization-wide restrictions
Session Policies	AssumeRole sessions	Further restrict role permissions

IAM Best Practices

✅ Enable MFA for all users (especially root)

✅ Use roles instead of long-term access keys

✅ Follow least privilege principle

✅ Use groups to assign permissions

✅ Never share credentials

✅ Rotate access keys regularly

✅ Use IAM Access Analyzer to find external access

Critical IAM Limits

Limit	Value
Users per account	5,000
Groups per account	300
Roles per account	1,000
Managed policies per account	1,500
Policies attached to user/role	10
Policy size (managed)	6,144 characters
Access keys per user	2

1.2 AWS Organizations & Multi-Account

Service Control Policies (SCPs) Hierarchy

📦 Management Account (SCPs don't affect root user here)

↓ SCP Applied

📁 Production OU → SCP: Deny region changes

📄 Account A → Effective: SCP ∩ IAM
📄 Account B → Effective: SCP ∩ IAM

📁 Development OU → SCP: Allow more services

📄 Account C → Effective: SCP ∩ IAM

Key Points:

SCPs don't grant permissions, only restrict
Effective permissions = SCP ∩ IAM policies
SCPs affect all users in the account (including root)
SCPs do NOT affect the management account

AWS Control Tower

Feature	Description
Landing Zone	Pre-configured multi-account environment
Guardrails	Preventive (SCPs) and Detective (Config rules)
Account Factory	Automated account provisioning
Dashboard	Compliance visibility across accounts

1.3 Encryption & Key Management

AWS KMS (Key Management Service)

Key Type	Description	Control
AWS Managed Keys	Created by AWS services (e.g., aws/s3)	No control, auto-rotation
Customer Managed Keys (CMK)	You create and manage	Full control, policies, rotation
AWS Owned Keys	Used by AWS internally	No visibility or control

Envelope Encryption

🔐 AWS KMS

Contains: Customer Master Key (CMK) (Never leaves KMS unencrypted)

↓ Encrypts

🔑 Data Encryption Key (DEK) (Encrypted DEK stored with data)

↓ Encrypts

📄 Your Data (Encrypted)

AWS CloudHSM

Feature	KMS	CloudHSM
Tenancy	Multi-tenant	Single-tenant (dedicated)
Compliance	FIPS 140-2 Level 2	FIPS 140-2 Level 3
Key Control	AWS manages HSM	You manage HSM
Integration	100+ AWS services	Custom apps, Oracle TDE
Cost	Per key + API calls	$1.60/hour per HSM

Use CloudHSM when: FIPS 140-2 Level 3, Oracle TDE, custom key management, regulatory requirements

S3 Encryption Options

Method	Key Management	Use Case
SSE-S3	AWS manages keys	Default, simplest
SSE-KMS	KMS keys	Audit trail, key control
SSE-C	Customer provides keys	Bring your own keys
Client-side	Client encrypts	Full control, encrypt before upload

1.4 Network Security

Security Groups vs NACLs

Feature	Security Group	Network ACL
Level	Instance (ENI)	Subnet
State	Stateful	Stateless
Rules	Allow only	Allow AND Deny
Evaluation	All rules evaluated	First match wins
Default	Deny all inbound	Allow all in/out
Use Case	App-tier isolation	Block specific IPs

VPC Security Architecture

🌐 VPC

Public Subnet (10.0.1.0/24)

🖥️ Bastion Host → NACL: Allow SSH from Corp, SG: Allow SSH from Corp IP
🌉 NAT Gateway → For private subnet internet access

Private Subnet (10.0.2.0/24)

🖥️ App Server → SG: Allow from ALB SG only
🗄️ DB Server → SG: Allow from App SG only, NACL: Deny all from Internet

AWS WAF, Shield & Firewall Manager

Service	Protection	Key Feature
AWS WAF	Layer 7 (HTTP/S)	SQL injection, XSS, rate limiting
AWS Shield Standard	DDoS (Layer 3/4)	Free, automatic
AWS Shield Advanced	DDoS + support	$3K/month, DDoS Response Team
AWS Firewall Manager	Centralized	Multi-account policy management

WAF Integration Points: CloudFront, ALB, API Gateway, AppSync

1.5 Data Protection Services

Amazon Macie

Purpose: Discover and protect sensitive data in S3
Detection: PII, credentials, financial data using ML
Use Cases: GDPR compliance, find exposed secrets

Amazon GuardDuty

Purpose: Threat detection (malicious activity)
Analyzes: VPC Flow Logs, CloudTrail, DNS logs
Detects: Crypto mining, compromised instances, unusual API calls

Amazon Inspector

Purpose: Vulnerability scanning
Scans: EC2 instances, ECR images, Lambda functions
Detects: CVEs, network exposure, CIS benchmarks

AWS Secrets Manager

Purpose: Store and auto-rotate secrets
Features: Automatic rotation for RDS, Redshift, DocumentDB
Cost: $0.40/secret/month

SSM Parameter Store

Purpose: Store configuration and secrets (cheaper)
Features: Free tier, versioning, encryption with KMS
Limitation: No automatic rotation

1.6 Logging & Auditing

AWS CloudTrail

Feature	Description
Purpose	API audit trail ("who did what, when")
Events	Management events (control plane), Data events (data plane)
Retention	90 days in console, S3 for long-term
Multi-region	Single trail can cover all regions
Use Cases	Security analysis, compliance, forensics

AWS Config

Feature	Description
Purpose	Resource configuration tracking and compliance
Rules	Managed or custom (Lambda) compliance rules
Remediation	Automatic remediation with SSM Automation
Use Cases	Drift detection, compliance, inventory

Amazon CloudWatch

Component	Purpose
Metrics	Performance monitoring (CPU, network, custom)
Logs	Log aggregation and analysis
Alarms	Alerting based on thresholds
Events/EventBridge	Event routing and automation
Dashboards	Visualization

🔄 DOMAIN 2: DESIGN RESILIENT ARCHITECTURES (26%)

2.1 Compute Resilience

EC2 Placement Groups

Type	Use Case	Key Characteristic
Cluster	HPC, low latency	Same rack, single AZ
Spread	Critical instances	Different racks, 7 per AZ
Partition	Big data (Hadoop, Kafka)	Partition-aware, 7 partitions/AZ

Auto Scaling Group

⚙️ Auto Scaling Group Configuration

Setting	Value
Target Tracking	CPU = 40%
Min Capacity	2
Desired Capacity	4
Max Capacity	10

Distribution across AZs:

AZ-a: 2 EC2 instances
AZ-b: 2 EC2 instances
AZ-c: 0 EC2 instances (scales as needed)

Scaling Policies:

⭐ Target Tracking - Most common, recommended
📊 Step Scaling - Based on CloudWatch alarms
📉 Simple Scaling - Legacy approach
🗓️ Scheduled Scaling - For predictable patterns

Launch Template Components

Component	Purpose
AMI	Base image
Instance Type	Size and family (or multiple for mixed)
Key Pair	SSH access
Security Groups	Firewall rules
EBS Volumes	Storage configuration
User Data	Bootstrapping script
IAM Role	Instance profile

2.2 Database Resilience

RDS High Availability

Feature	Multi-AZ	Read Replicas
Purpose	HA and DR	Read scaling
Replication	Synchronous	Asynchronous
Failover	Automatic (60-120s)	Manual promotion
Accessibility	Standby NOT accessible	Replicas serve reads
Region	Same region only	Same or cross-region
Cost	2x instance cost	Per replica

Aurora Architecture

🌟 Aurora Cluster

Endpoints:

✏️ Writer Endpoint → Points to Primary Instance
📖 Reader Endpoint → Load balances across replicas

Instances across AZs:

AZ-a	AZ-b	AZ-c
Primary	Replica	Replica

Shared Storage Layer:

📀 6 copies across 3 AZs
📈 Auto-scales: 10 GB → 128 TiB

Aurora Key Numbers:

15 read replicas (vs 5 for RDS)
<30 seconds failover
5x faster than MySQL, 3x faster than PostgreSQL
6 copies across 3 AZs
Auto-scaling storage (10GB to 128TiB)

Aurora Global Database

Feature	Value
Cross-region replication	<1 second lag
Secondary regions	Up to 5
RTO	<1 minute
Read replicas per region	16

2.3 Storage Resilience

S3 Durability & Availability

Storage Class	Durability	Availability	AZs
S3 Standard	11 9s	99.99%	≥3
S3 Standard-IA	11 9s	99.9%	≥3
S3 One Zone-IA	11 9s	99.5%	1
S3 Glacier Instant	11 9s	99.9%	≥3
S3 Glacier Flexible	11 9s	99.99%	≥3
S3 Glacier Deep Archive	11 9s	99.99%	≥3

S3 Replication

Type	Use Case
CRR (Cross-Region)	DR, compliance, lower latency
SRR (Same-Region)	Log aggregation, prod/test sync

Requirements:

Versioning enabled on BOTH buckets
IAM role for replication
Objects encrypted with SSE-S3 or SSE-KMS (with key policy)

EBS Resilience

Feature	Description
Replication	Within single AZ
Snapshots	Point-in-time backup to S3
Multi-Attach	io1/io2 only, up to 16 instances
Encryption	At rest with KMS

2.4 Backup Strategies

AWS Backup

Purpose: Centralized, policy-based backup across services
Supported: EBS, RDS, DynamoDB, EFS, FSx, Storage Gateway, S3
Features: Cross-region, cross-account, compliance reports

Disaster Recovery Strategies

Strategy	RTO	RPO	Cost
Backup & Restore	Hours	Hours	$
Pilot Light	10s of minutes	Minutes	$$
Warm Standby	Minutes	Seconds	$$$
Multi-Site/Hot	Real-time	Near-zero	$$$$

DR Strategy Progression (Cost & Speed →)

1️⃣ Backup & Restore - Data backed up only, slowest recovery

2️⃣ Pilot Light - Core services running (minimal)

3️⃣ Warm Standby - Scaled-down version running

4️⃣ Multi-Site Active/Active - Fully running in DR

2.5 Decoupling & Messaging

Amazon SQS

Feature	Standard	FIFO
Order	Best-effort	Strict FIFO
Delivery	At-least-once	Exactly-once
Throughput	Unlimited	3,000 msg/s (batching)
Deduplication	No	Built-in
Queue Name	Any	Must end in .fifo

Key Limits:

Message size: 256 KB
Retention: 1 min to 14 days (default 4 days)
Visibility timeout: 0s to 12 hours (default 30s)
Long polling: 1-20 seconds

Amazon SNS

Pattern: Pub/Sub (fan-out)
Subscribers: SQS, Lambda, HTTP, Email, SMS
Features: Message filtering, FIFO topics

Amazon EventBridge

Purpose: Serverless event bus
Sources: AWS services, SaaS apps, custom apps
Targets: Lambda, Step Functions, SQS, SNS, ECS, etc.
Features: Schema registry, content-based filtering, scheduling

Comparison

When to use...	Choose...
Queue, async processing	SQS
Pub/Sub, multiple subscribers	SNS
Event-driven, SaaS integration, scheduling	EventBridge
Fan-out to multiple SQS queues	SNS → SQS

⚡ DOMAIN 3: DESIGN HIGH-PERFORMING ARCHITECTURES (24%)

3.1 Compute Performance

EC2 Instance Types

Family	Optimized For	Use Case
M	General purpose	Web servers, small DBs
C	Compute	CPU-intensive, batch
R	Memory	In-memory DBs, caching
X	Memory (extreme)	SAP HANA, large in-memory
P, G	GPU	ML training, graphics
I, D	Storage	Data warehousing, HDFS
T	Burstable	Dev/test, variable workloads

Lambda Performance

Setting	Impact
Memory	128 MB - 10 GB (CPU scales with memory)
Timeout	Up to 15 minutes
Provisioned Concurrency	Eliminates cold starts
Reserved Concurrency	Guarantees capacity
Container Images	Up to 10 GB

3.2 Storage Performance

EBS Volume Types Cheat Sheet

Type	Max IOPS	Max Throughput	Use Case
gp3	16,000	1,000 MB/s	General purpose (default)
gp2	16,000	250 MB/s	Legacy general purpose
io2 Block Express	256,000	4,000 MB/s	Mission-critical DBs
io1/io2	64,000	1,000 MB/s	High-performance DBs
st1	500	500 MB/s	Big data, sequential
sc1	250	250 MB/s	Cold data, lowest cost

Quick Rule:

Need IOPS → SSD (gp3, io2)
Need throughput → HDD (st1) or gp3

Instance Store vs EBS

Feature	Instance Store	EBS
Persistence	Ephemeral	Persistent
Performance	Highest IOPS	High IOPS
Data survives	No (stop/terminate)	Yes
Snapshots	No	Yes
Cost	Included	Additional

S3 Performance

Optimization	Description
S3 Transfer Acceleration	Uses CloudFront edge locations
Multipart Upload	Recommended >100 MB, required >5 GB
S3 Select	Query subset of object
Byte-Range Fetches	Parallel downloads

S3 Limits:

3,500 PUT/POST/DELETE per prefix/second
5,500 GET/HEAD per prefix/second
Use random prefixes to distribute load

EFS Performance Modes

Mode	Latency	Throughput
General Purpose	Lower	Good for most
Max I/O	Higher	Parallel workloads
Elastic	Auto-scales	Best for variable

3.3 Database Performance

DynamoDB Performance

Feature	Description
Read Capacity Unit (RCU)	1 strongly consistent read/sec (4 KB)
Write Capacity Unit (WCU)	1 write/sec (1 KB)
DAX	In-memory cache (microseconds)
Global Tables	Multi-region, active-active

Scaling Modes:

On-Demand: Pay per request, auto-scales
Provisioned: Set RCU/WCU, with auto-scaling

ElastiCache

Feature	Redis	Memcached
Persistence	Yes	No
Replication	Yes (Multi-AZ)	No
Data Structures	Complex	Key-value only
Failover	Automatic	None
Use Case	Sessions, leaderboards	Simple caching

3.4 Networking Performance

Load Balancer Selection

Type	Layer	Use Case
ALB	7	HTTP/S, path routing, microservices
NLB	4	TCP/UDP, static IP, extreme performance
GWLB	3	Third-party appliances (IDS/IPS)

CloudFront

Feature	Description
Edge Locations	400+ worldwide
Origins	S3, ALB, EC2, HTTP servers
Cache Behaviors	Path-based routing
Lambda@Edge	Customize at edge
CloudFront Functions	Lightweight edge compute

Global Accelerator vs CloudFront

Feature	Global Accelerator	CloudFront
Protocol	TCP, UDP	HTTP, HTTPS
IPs	2 static anycast IPs	Dynamic
Caching	No	Yes
Use Case	Gaming, IoT, VoIP	Web content, streaming

3.5 Data Analytics Performance

Kinesis Family

Service	Use Case
Data Streams	Real-time (<1s), custom consumers
Data Firehose	Near real-time (60s+), auto-delivery to S3/Redshift
Data Analytics	SQL on streaming data
Video Streams	Video ingestion

Analytics Services Comparison

Service	Use Case	Data Location
Redshift	Data warehouse, complex queries	Data loaded into cluster
Athena	Serverless, ad-hoc S3 queries	Query S3 directly
EMR	Big data (Spark, Hadoop)	S3, HDFS
QuickSight	BI dashboards	Various sources
Glue	Serverless ETL	S3, databases

💰 DOMAIN 4: DESIGN COST-OPTIMIZED ARCHITECTURES (20%)

4.1 EC2 Pricing Models

Comparison

Model	Discount	Commitment	Use Case
On-Demand	0%	None	Short-term, unpredictable
Reserved (1yr)	~36%	Instance type	Steady-state
Reserved (3yr)	~60%	Instance type	Long-running
Savings Plans	Up to 72%	$/hour	Flexible compute
Spot	Up to 90%	None	Fault-tolerant, batch
Dedicated Host	Varies	Physical server	Licensing, compliance

Spot Fleet Strategies

Strategy	Description
diversified	Spread across pools (resilience)
lowestPrice	Cheapest pools first
capacityOptimized	Most available capacity
capacityOptimizedPrioritized	Capacity + priority

Interruption Handling:

⚠️ 2-minute warning before termination
📡 Use Spot interruption notice from metadata
💾 Checkpointing for long-running jobs

Reserved Instance Types

Type	Flexibility	Discount
Standard RI	Fixed (instance type, region)	Highest
Convertible RI	Can change family, OS, tenancy	Lower
Scheduled RI	Specific time windows	Moderate

4.2 Storage Cost Optimization

S3 Storage Classes (Cost Order: Expensive → Cheap)

Class	Cost	Access Pattern
💰💰💰 S3 Standard	Highest	Frequent access
💰💰 S3 Standard-IA	Medium	Infrequent, immediate
💰💰 S3 One Zone-IA	Medium-Low	Infrequent, recreatable
💰 S3 Glacier Instant	Low	Rare, immediate
💰 S3 Glacier Flexible	Lower	1-5 min to 12 hrs
✨ S3 Glacier Deep Archive	Lowest	12-48 hours

S3 Lifecycle Rules Example

Sample Lifecycle Policy:

Day 0-29: S3 Standard
Day 30: → Transition to Standard-IA
Day 90: → Transition to Glacier
Day 180: → Transition to Deep Archive
Day 365: → Expire/Delete

S3 Intelligent-Tiering

Purpose: Automatic cost optimization for unknown access patterns
Tiers: Frequent, Infrequent (30 days), Archive (90 days), Deep Archive (180 days)
Cost: Small monthly monitoring fee per object
Best for: Unpredictable access patterns

EBS Cost Optimization

Strategy	Description
gp3 over gp2	Lower cost for same performance
Snapshots	Delete unneeded, use incremental
Delete on termination	Enable for temporary volumes
Right-size volumes	Monitor and resize

4.3 Database Cost Optimization

RDS Cost Strategies

Strategy	Description
Reserved Instances	Up to 70% savings for 1-3 year
Right-sizing	Use Performance Insights
Aurora Serverless	Variable workloads
Stop unused	Dev/test instances
Storage optimization	Use gp3, delete old snapshots

DynamoDB Cost Strategies

Strategy	Description
On-Demand	Unpredictable workloads
Provisioned + Auto Scaling	Steady with bursts
Reserved Capacity	Very predictable
TTL	Auto-delete expired items

4.4 Data Transfer Costs

Free Data Transfer

Into AWS: Always free
Same AZ: Free (using private IP)
VPC Peering (same AZ): Free

Charged Data Transfer

Different AZ: $0.01/GB each way
Different Region: $0.02/GB (varies by region)
To Internet: $0.09/GB first 10TB (tiered)

Cost Optimization Tips

✅ Use VPC endpoints (avoid NAT Gateway charges for S3/DynamoDB)

✅ Use S3 Transfer Acceleration wisely (data transfer + acceleration fee)

✅ Compress data before transfer

✅ Keep resources in same AZ when possible

✅ Use CloudFront for frequently accessed content

4.5 Cost Management Tools

Tool	Purpose
AWS Cost Explorer	Visualize spending, forecasts
AWS Budgets	Set alerts for spending/usage
Cost Allocation Tags	Track costs by project/team
AWS Trusted Advisor	Cost optimization recommendations
Compute Optimizer	Right-sizing recommendations
Savings Plans	Flexible compute discounts

🔧 KEY AWS SERVICES REFERENCE

Compute Services

Service	Type	Use Case
EC2	IaaS	Full control VMs
Lambda	Serverless	Event-driven, <15 min
ECS	Containers	Docker on AWS
EKS	Kubernetes	Kubernetes on AWS
Fargate	Serverless containers	No EC2 management
Elastic Beanstalk	PaaS	Deploy apps easily
Lightsail	Simple VPS	Simple workloads
Batch	Batch computing	Scheduled jobs
Outposts	Hybrid	AWS on-prem

Storage Services

Service	Type	Use Case
S3	Object	Unlimited scalable storage
EBS	Block	EC2 persistent volumes
EFS	File (NFS)	Shared Linux file system
FSx Windows	File (SMB)	Windows file shares
FSx Lustre	File (HPC)	High-performance computing
Storage Gateway	Hybrid	On-prem to cloud
Snow Family	Edge/Transfer	Offline data transfer

Database Services

Service	Type	Use Case
RDS	Relational	MySQL, PostgreSQL, etc.
Aurora	Relational	High-performance RDS
DynamoDB	NoSQL (Key-Value)	Serverless, milliseconds
ElastiCache	In-Memory	Redis/Memcached caching
DocumentDB	Document	MongoDB-compatible
Neptune	Graph	Social networks, fraud
Timestream	Time-series	IoT, monitoring
QLDB	Ledger	Immutable, verifiable
Keyspaces	Cassandra	Cassandra-compatible

Networking Services

Service	Use Case
VPC	Isolated virtual network
Subnets	Segment VPC
Route Tables	Control routing
Internet Gateway	Public internet access
NAT Gateway	Outbound internet for private subnets
VPN	Encrypted connection to on-prem
Direct Connect	Dedicated private connection
Transit Gateway	Hub for connecting VPCs
PrivateLink	Private service access
Route 53	DNS and routing policies
CloudFront	CDN
Global Accelerator	TCP/UDP acceleration

Application Integration

Service	Pattern	Use Case
SQS	Queue	Decoupling, async
SNS	Pub/Sub	Notifications, fan-out
EventBridge	Event Bus	Event-driven architecture
Step Functions	Workflow	Orchestration
AppSync	GraphQL	GraphQL APIs
API Gateway	REST/WebSocket	API management

Security Services

Service	Purpose
IAM	Identity and access
Cognito	User authentication
KMS	Encryption key management
CloudHSM	Hardware security modules
Secrets Manager	Secret storage with rotation
Certificate Manager	SSL/TLS certificates
WAF	Web application firewall
Shield	DDoS protection
GuardDuty	Threat detection
Inspector	Vulnerability scanning
Macie	S3 sensitive data
Security Hub	Security posture

Migration Services

Service	Use Case
DMS	Database migration
SMS	Server migration
DataSync	Data transfer to AWS
Transfer Family	SFTP, FTPS, FTP
Snowball	Offline data transfer
Application Discovery	Discover on-prem apps
Migration Hub	Track migrations

📊 CRITICAL NUMBERS TO MEMORIZE

S3 Limits

Limit	Value
Max object size	5 TB
Single PUT	5 GB
Multipart required	>5 GB
Standard-IA transition	30 days
Glacier transition	90 days
Deep Archive transition	180 days

Lambda Limits

Limit	Value
Timeout	15 minutes
Memory	128 MB - 10 GB
Package (zip)	50 MB
Package (unzipped)	250 MB
Container image	10 GB
Concurrent executions	1,000 (default)
Payload (sync)	6 MB

SQS Limits

Limit	Value
Message size	256 KB
Retention	1 min - 14 days
Visibility timeout	0s - 12 hours
FIFO throughput	3,000 msg/s (batching)

Kinesis Limits

Limit	Value
Record size	1 MB
Shard write	1 MB/s or 1,000 records/s
Shard read	2 MB/s
Retention	24 hours - 365 days
Firehose buffer	60 seconds minimum

EBS Limits

Limit	Value
Max volume	64 TiB
gp3 IOPS	16,000
io2 Block Express IOPS	256,000
Multi-Attach	16 instances

RDS/Aurora

Limit	Value
RDS read replicas	5
Aurora read replicas	15
Aurora failover	<30 seconds
Backup retention	35 days
Aurora storage	128 TiB
Aurora Global DB regions	5

DynamoDB

Limit	Value
Item size	400 KB
GSIs	20
LSIs	5 (at creation only)
BatchGetItem	100 items
BatchWriteItem	25 items

VPC

Limit	Value
VPCs per region	5 (soft)
Subnets per VPC	200
CIDR blocks per VPC	5
Elastic IPs	5 (soft)
Security group rules	60/60
NAT Gateway bandwidth	45 Gbps

🎯 EXAM DAY QUICK RULES

"If you see... choose..."

Trigger Word	Answer
"Stateful firewall"	Security Group
"Block specific IP"	NACL
"Static IP for load balancer"	NLB
"Path-based routing"	ALB
"Third-party firewall inline"	GWLB
"Shared Linux file system"	EFS
"Windows file shares"	FSx for Windows
"HPC file system"	FSx for Lustre
"Millisecond latency NoSQL"	DynamoDB
"Complex SQL queries"	RDS/Aurora
"Up to 15 read replicas"	Aurora
"Serverless, event-driven"	Lambda
"Kubernetes"	EKS
"Docker, AWS-native"	ECS
"Serverless containers"	Fargate
"Queue, decouple"	SQS
"Fan-out, multiple subscribers"	SNS
"Event-driven, SaaS"	EventBridge
"Real-time streaming"	Kinesis Data Streams
"Near real-time to S3"	Kinesis Data Firehose
"Serverless SQL on S3"	Athena
"Data warehouse"	Redshift
"Big data, Spark, Hadoop"	EMR
"Auto-rotate secrets"	Secrets Manager
"Free secrets/config storage"	Parameter Store
"Threat detection"	GuardDuty
"Vulnerability scanning"	Inspector
"S3 sensitive data"	Macie
"FIPS 140-2 Level 3"	CloudHSM
"Who did what"	CloudTrail
"Config compliance"	AWS Config
"Metrics and alarms"	CloudWatch
"Centralized logging"	CloudWatch Logs
"Cross-region low latency DB"	Aurora Global Database
"Active-active multi-region"	DynamoDB Global Tables
"Offline data transfer"	Snowball
"Hybrid on-prem storage"	Storage Gateway
"Private S3/DynamoDB access (free)"	Gateway Endpoint
"Private AWS service access"	Interface Endpoint
"Dedicated private connection"	Direct Connect
"Quick encrypted VPN"	Site-to-Site VPN
"CDN, caching"	CloudFront
"Static IP, non-HTTP"	Global Accelerator
"Low-latency failover routing"	Route 53 Failover
"Geographic content"	Route 53 Geolocation
"Traffic split A/B test"	Route 53 Weighted

✅ FINAL EXAM CHECKLIST

Pre-Exam Review:

All the best on your exam! 🚀

Last updated: February 2026