Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions in 130 minutes: 50 scored and 15 unscored trial questions you can’t spot. Multiple choice and multiple response (two or more correct out of five or more options).
- Scaled score from 100 to 1,000. You need 720. The scoring is compensatory, so you don’t need to pass each domain, only the whole exam.
- No penalty for guessing. Unanswered counts as wrong, so answer every question and flag the unsure ones for a second pass.
- About 2 minutes per question. Don’t spend 6 on one.
- Domain weights: secure architectures 30%, resilient architectures 26%, high-performing architectures 24%, cost-optimized architectures 20%.
How to read a question
- Read the last sentence first, then find the deciding phrase: least operational overhead, most cost-effective, highly available, lowest latency, without changing the application, most secure.
- Cross out answers that break a stated requirement (wrong Region, adds downtime, needs code changes).
- Of what’s left, pick the most managed option that meets every requirement, and for cost questions the cheapest.
| The question says | Lean toward |
|---|---|
| Least operational overhead | Managed or serverless: Lambda, Fargate, Aurora, DynamoDB, S3 |
| Most secure | Roles, private connectivity (endpoints), encryption, least privilege |
| Without changing the application | Infrastructure-level fix: load balancer, Multi-AZ, EFS, RDS Proxy, Storage Gateway |
| Decouple | SQS, SNS, EventBridge |
| Unpredictable or spiky | Serverless, on-demand capacity, Auto Scaling |
| Steady, predictable | Savings Plans, Reserved, provisioned capacity |
| Interruptible, fault-tolerant | Spot |
| Global users | CloudFront, Global Accelerator, Route 53 latency routing |
| Compliance, can’t be deleted | Object Lock compliance mode, Vault Lock |
Elimination tricks
- Answers that need SSH into servers, hand-written scripts or manual steps are rarely right.
- Answers with access keys on instances, public S3 buckets or open security groups to 0.0.0.0/0 are wrong.
- “Choose TWO” answers each fix a different part of the same requirement.
- Retired or renamed things (QLDB, Elastic Transcoder, Classic Load Balancer, EC2-Classic) are traps in new questions.
Numbers worth knowing
| Thing | Number |
|---|---|
| S3 object size | 5 TB maximum. Single PUT up to 5 GB, multipart above that (recommended above 100 MB) |
| S3 request rate | 3,500 writes and 5,500 reads per second, per prefix |
| S3 durability | 11 nines |
| S3 minimum durations | IA classes 30 days, Glacier Instant and Flexible 90 days, Deep Archive 180 days. IA classes bill at least 128 KB |
| Lambda | 15 min timeout, 10,240 MB memory, 6 MB synchronous payload, default 1,000 concurrent executions per Region |
| API Gateway | 29 second integration timeout, 10,000 requests per second default account throttle |
| SQS | Message up to 1 MiB. Retention default 4 days, up to 14. Visibility timeout default 30 s, max 12 h. Long polling up to 20 s. FIFO 300 msg/s (3,000 batched) |
| Kinesis Data Streams | Shard 1 MB/s in, 2 MB/s out. Retention 24 h default, up to 365 days |
| DynamoDB | Item max 400 KB. 1 RCU = 4 KB strongly consistent read/s. 1 WCU = 1 KB write/s. PITR 35 days |
| gp3 baseline | 3,000 IOPS and 125 MB/s. Up to 16,000 IOPS and 1,000 MB/s |
| io2 Block Express | Up to 256,000 IOPS |
| EBS | One AZ. Volumes up to 64 TiB. HDD can’t be boot |
| Aurora | 6 copies across 3 AZs, up to 15 replicas, storage up to 128 TiB |
| RDS backups | 0 to 35 days retention. Read replicas up to 15 (MySQL, MariaDB, PostgreSQL) |
| Spot interruption notice | 2 minutes |
| Subnet | 5 reserved IPs. VPC CIDR /16 to /28 |
| Site-to-Site VPN | 2 tunnels, about 1.25 Gbps each |
| NLB / ALB deregistration delay | 300 seconds default |
| Placement group, spread | 7 instances per AZ |
| KMS | Direct encrypt up to 4 KB. Key deletion wait 7 to 30 days. Customer managed key rotation yearly by default |
| CloudTrail event history | 90 days |
| Transfer rule of thumb | 1 Gbps is about 10 TB a day |
Pairs people mix up
| A | B | The difference |
|---|---|---|
| Security group | Network ACL | Stateful, allow-only, instance level / stateless, allow and deny, subnet level |
| RDS Multi-AZ | Read replica | Availability with automatic failover / read scaling, asynchronous |
| Aurora replica | Aurora Global Database | In-Region reads and failover / cross-Region DR and local reads |
| SQS | SNS | Pull queue, one consumer per message / push, many subscribers |
| SQS | Kinesis Data Streams | Simple buffer, no replay / ordered, replayable, many consumers |
| Kinesis Data Streams | Amazon Data Firehose | Custom consumers, replay / managed delivery to S3, Redshift and others |
| SNS | EventBridge | Simple fan-out / rule-based routing from AWS and SaaS events |
| CloudFront | Global Accelerator | Caches HTTP content at the edge / static anycast IPs, any TCP or UDP, fast failover |
| Gateway endpoint | Interface endpoint | S3 and DynamoDB, free, route table / most services, ENI, paid |
| VPC peering | Transit Gateway | One-to-one, non-transitive / hub for many, transitive |
| VPN | Direct Connect | Quick, encrypted, internet / dedicated, consistent, weeks to set up, not encrypted |
| Secrets Manager | Parameter Store | Built-in rotation / config and simple secrets, cheaper |
| KMS | CloudHSM | Shared managed keys / dedicated single-tenant HSM you control |
| GuardDuty | Inspector | Threat detection from logs / vulnerability scanning of workloads |
| Macie | GuardDuty | Sensitive data in S3 / malicious activity |
| CloudTrail | Config | Who called which API / what the configuration was and is it compliant |
| EFS | FSx for Windows | Linux NFS / Windows SMB with Active Directory |
| EFS | EBS | Shared, multi-AZ file system / one disk in one AZ |
| Cognito user pool | Cognito identity pool | Sign-in for app users / temporary AWS credentials |
| IAM Identity Center | Cognito | Workforce access to AWS accounts / customers of your app |
| SCP | Permissions boundary | Caps an account or OU / caps one user or role |
| Compute Savings Plans | EC2 Instance Savings Plans | Any family, Region, Fargate and Lambda / one family in one Region, deeper discount |
| Standard RI | Convertible RI | Bigger discount, fixed / flexible, exchangeable |
| Object Lock governance | Object Lock compliance | Can be overridden with permission / nobody can delete before retention ends |
| Intelligent-Tiering | Lifecycle rules | Unknown access pattern, no retrieval fee / known pattern, you set the schedule |
| ALB | NLB | Layer 7, path routing / layer 4, static IP, extreme throughput |
| Standard Step Functions | Express Step Functions | Long, exactly-once / short, high volume, at-least-once |
| DataSync | Storage Gateway | Move data to AWS / ongoing hybrid access with a local cache |
| Athena | Redshift | Serverless SQL on S3 / data warehouse for heavy repeated analytics |
DR in one line each
- Backup and restore: cheapest. Recovery takes hours.
- Pilot light: data replicated, servers off. Recovery takes tens of minutes.
- Warm standby: scaled-down copy running. Recovery takes minutes.
- Active/active: full copy serving traffic. Near-zero RTO and RPO, highest cost.
- Elastic Disaster Recovery: continuous server replication to cheap staging, minutes of RTO.
Cost cheat sheet
| Situation | Choose |
|---|---|
| Steady baseline, might change family or service | Compute Savings Plans |
| Steady, one family | EC2 Instance Savings Plans or Standard RIs |
| Interruptible work | Spot, with diversification |
| Dev and test | Smaller, scheduled off, Spot, single AZ |
| Unknown S3 access | Intelligent-Tiering |
| Cold archive, rare reads | Glacier Flexible or Deep Archive |
| Heavy S3/DynamoDB traffic through NAT | Gateway endpoint |
| Spiky DynamoDB | On-demand. Steady: provisioned plus auto scaling |
| Variable relational load | Aurora Serverless v2 |
| Reduce internet egress | CloudFront |
| Alerts and actions on spend | Budgets. Analysis: Cost Explorer. Detail: CUR |
Defaults that are usually right
- Roles, never access keys, for anything running in AWS.
- Multi-AZ for every stateful tier, and one NAT gateway per AZ in production.
- An Auto Scaling group behind a load balancer, with ELB health checks and target tracking.
- SQS between tiers that run at different speeds.
- Encryption with KMS at rest and TLS in transit. Block Public Access on S3.
- CloudFront in front of S3 for users around the world, with origin access control.
- Gateway endpoints for S3 and DynamoDB from private subnets.
- The managed service over running it yourself on EC2, unless the question demands control of the OS or a specific licence.
- The cheapest design that still meets the stated RTO, RPO and availability.