Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 75 questions in 180 minutes: 65 scored and 10 unscored trial questions you can’t spot. Scaled score 100 to 1,000; you need 750.
- About 2.4 minutes per question, and the scenarios are long. No penalty for guessing; unanswered counts as wrong. Flag and move on.
- Multiple choice (one of four) and multiple response (two or more of five or more; all must be right).
- Scoring is compensatory: you only need to pass overall, not every domain.
- Domain weights: organizational complexity 26%, new solutions 29%, continuous improvement 25%, migration and modernization 20%.
How to read a SAP question
Read the last sentence and the answers first. Answers often differ by one or two words, and that tells you what the scenario tests. Then scan for constraints.
| The question says | Pick |
|---|---|
| Least operational overhead | Managed, serverless, native integration |
| Most cost-effective | Tiering, Savings Plans for baseline, Spot for fault tolerance, endpoints against NAT cost |
| Minimal changes to the application | Rehost or replatform, not refactor |
| Across the organization, including new accounts | Organizations features, delegated admin, auto-enable, SCPs, StackSets auto-deploy |
| Most secure | Roles, private endpoints, customer managed KMS keys, least privilege |
| Minimal downtime | Continuous replication (DMS CDC, MGN, DRS), blue/green |
| Without internet access | VPC endpoints, PrivateLink |
| Quickly with limited bandwidth | Snow Family offline transfer |
Eliminate answers that need custom code where a managed feature exists, that don’t meet one stated requirement, or that name features that don’t exist.
Networking cheat sheet
| Need | Answer |
|---|---|
| Few VPCs, cheapest | Peering (non-transitive) |
| Many VPCs, transitive | Transit Gateway (+ RAM) |
| One-way service exposure, overlapping CIDRs | PrivateLink |
| Layer 7 service-to-service across accounts | VPC Lattice |
| Global policy-driven network | Cloud WAN |
| Encrypted on-premises link now | Site-to-Site VPN (2 tunnels, about 1.25 Gbps each) |
| Private consistent link | Direct Connect (not encrypted) |
| DX to many Regions | Direct Connect gateway |
| DX to a TGW | Transit VIF |
| DX to a VPC | Private VIF |
| DX to public AWS services | Public VIF |
| DX resilience | Two connections at two locations; VPN as cheap backup |
| Hybrid DNS | Resolver inbound + outbound endpoints + rules |
| Packet-level capture | Traffic Mirroring |
| Why can’t A reach B | Reachability Analyzer |
DR ladder
| Strategy | RTO / RPO | Key services |
|---|---|---|
| Backup and restore | Hours | AWS Backup cross-Region copy, IaC |
| Pilot light | Tens of minutes | Replicated DB, off app tier, Elastic Disaster Recovery |
| Warm standby | Minutes | Scaled-down full stack |
| Active-active | Near zero | Aurora Global, DynamoDB global tables, Route 53 / Global Accelerator |
Route 53 policies
Simple, weighted (migrations, canary), latency, failover (active-passive), geolocation (compliance; needs default), geoproximity (bias), IP-based, multivalue. ARC routing controls for dependable failover; Global Accelerator for static IPs and no DNS caching.
Governance one-liners
- SCP: caps permissions, never grants, not on the management account. RCP: caps resource access org-wide. Permission boundary: caps one role or user.
- Control Tower: landing zone, Log Archive and Audit accounts, Account Factory, preventive (SCP), detective (Config) and proactive (hook) controls.
- RAM: share subnets, TGW, Resolver rules. StackSets service-managed with auto-deploy for baselines.
- Delegated administrator + auto-enable: GuardDuty, Security Hub, Inspector, Macie, Config, Firewall Manager.
- Organization trail to a log archive account with Object Lock.
- Identity Center for workforce; Cognito for customers.
Migration cheat sheet
| Need | Tool |
|---|---|
| Discover servers and dependencies | Application Discovery Service, Migration Hub |
| TCO and business case | Migration Evaluator |
| Servers, continuous replication | Application Migration Service |
| Single VM image | VM Import/Export |
| VMware as is | VMware Cloud on AWS / Amazon EVS |
| Online files to S3/EFS/FSx | DataSync |
| Offline bulk | Snowball Edge |
| SFTP/FTPS/AS2 front end | Transfer Family |
| Hybrid file/volume/tape access | Storage Gateway |
| Same-engine database | Native tools or DMS |
| Different engine | SCT or DMS Schema Conversion + DMS |
| RDS MySQL/PostgreSQL into Aurora | Aurora read replica then promote |
| SQL Server app on PostgreSQL | Babelfish for Aurora |
| Incremental monolith breakup | Refactor Spaces (strangler fig) |
The 7 Rs: retire, retain, rehost, relocate, repurchase, replatform, refactor.
Numbers worth knowing
| Thing | Number |
|---|---|
| Lambda max run time / memory | 15 minutes / 10 GB |
| API Gateway integration timeout | 29 seconds |
| Default Lambda concurrency | 1,000 per Region (soft) |
| SQS message size / retention | 1 MiB / up to 14 days |
| SNS message size | 256 KB |
| DynamoDB item size | 400 KB |
| S3 object max / single PUT | 5 TB / 5 GB |
| S3 requests per prefix | 3,500 writes, 5,500 reads per second |
| Kinesis shard write | 1 MB/s or 1,000 records/s |
| KMS direct Encrypt size | 4 KB |
| EBS io2 Block Express | up to 256,000 IOPS |
| Snowball Edge storage optimized | about 210 TB usable |
| Direct Connect ports | 1, 10, 100 Gbps dedicated; hosted 50 Mbps to 25 Gbps |
| Spot interruption notice | 2 minutes |
| S3 IA / Glacier IR / Flexible / Deep Archive minimum | 30 / 90 / 90 / 180 days |
Pairs people mix up
| A | B | The difference |
|---|---|---|
| Peering | Transit Gateway | Non-transitive pair / hub with transitive routing |
| Gateway endpoint | Interface endpoint | S3 and DynamoDB, free, route table / ENI, any service, on-premises reachable |
| ALB | NLB | Layer 7 / layer 4, static IPs, PrivateLink |
| CloudFront | Global Accelerator | Cache HTTP content / anycast to dynamic TCP/UDP endpoints |
| Aurora Global | RDS cross-Region replica | Fast managed failover / manual promotion |
| Secrets Manager | Parameter Store | Rotation, replication / cheap config |
| SSE-S3 | SSE-KMS | No key control / key policy, audit, per-request cost |
| DataSync | Storage Gateway | Migration transfer / ongoing hybrid access |
| MGN | DMS | Servers / databases |
| Standard RI | Convertible RI | Higher discount / exchangeable |
| Compute SP | EC2 Instance SP | Flexible across families, Regions / one family in a Region |
| FSx Windows | EFS | SMB and AD / NFS for Linux |
| SQS | SNS / EventBridge | Queue and buffer / fan-out and content routing |
| Step Functions Standard | Express | Long, exactly-once / short, high-rate |
Defaults that are usually right
- Multi-account from the start with Control Tower and Identity Center.
- Roles and temporary credentials, never access keys.
- Private subnets with VPC endpoints; one NAT gateway per AZ.
- Customer managed KMS key when anything crosses accounts.
- Config rules with automatic remediation; EventBridge to Systems Manager Automation.
- Fargate over EC2, Aurora over self-managed databases, Lambda for event-driven work.
- Cache and queue before scaling the database.
- Measure first (X-Ray, Performance Insights, Compute Optimizer), then change.