The exam rarely asks what a service does. It asks which of four workable answers fits a constraint. This is a list of the distinctions that decide those questions, organised by the choice you are actually making.
How to read a question
Read the last sentence first. It carries the qualifier: MOST cost-effectively, LEAST operational overhead, MOST secure, with the LEAST downtime. That word decides between answers that are all technically correct.
Then find the constraint. It is usually one clause buried mid-scenario: a number (RTO, RPO, bandwidth, retention), a prohibition (cannot modify the application, no source code, vendor will not support changes), or an organizational fact (300 accounts, a central team, an auditor).
Two habits that pay:
- Eliminate answers that require changing something the scenario said cannot change.
- When two answers both work, pick the more managed one unless the qualifier is cost, in which case do the arithmetic.
Connectivity
| Need | Answer |
|---|---|
| Many VPCs plus on-premises, transitive routing | Transit Gateway |
| Two VPCs, simple, low cost, no transitivity needed | VPC peering |
| Expose one service, or overlapping CIDRs | PrivateLink with an NLB endpoint service |
| Share subnets so teams deploy into a network you own | VPC sharing via RAM |
| Consistent bandwidth and latency to on-premises | Direct Connect |
| Cheap or fast-to-provision hybrid link, or DX backup | Site-to-Site VPN |
| On-premises resolves AWS private zones | Route 53 Resolver inbound endpoint |
| AWS resolves on-premises domains | Route 53 Resolver outbound endpoint plus forwarding rules |
Direct Connect resiliency, in the exam’s own language:
- Development and test: one connection at one location.
- High resiliency: two connections at two locations, single device each. Roughly 99.9 percent.
- Maximum resiliency: two connections at each of two locations, separate devices. Required for 99.99 percent.
- VPN backup is a supplement, never the answer for a production availability target on its own.
Transit Gateway is not transitive for free. Route table association controls which table an attachment uses for lookups. Propagation controls which routes get advertised into a table. Segmentation questions are answered by using more than one route table.
Failover mechanism
| Signal | Answer |
|---|---|
| HTTP or HTTPS, caching, header manipulation at the edge | CloudFront with an origin group |
| TCP or UDP, static IPs required, clients ignore DNS TTL | Global Accelerator |
| DNS-level routing by latency, geography, or weight | Route 53 routing policies |
| Sub-minute failover with no DNS dependency | Global Accelerator |
If a question mentions clients caching DNS or hardcoding IPs, Route 53 is the wrong answer.
Disaster recovery
| Strategy | RPO | RTO | What is running |
|---|---|---|---|
| Backup and restore | Hours | Hours (up to 24) | Nothing |
| Pilot light | Minutes | Tens of minutes | Data replicating, compute off |
| Warm standby | Seconds | Minutes | Scaled-down full stack running |
| Multi-site active-active | Near zero | Near zero | Full stack in both, serving traffic |
Map the numbers in the question to the row, then check cost. If the question says cost matters, the answer is the cheapest strategy that still meets the numbers, never the most resilient one.
Data replication choices:
- Aurora global database: sub-second lag, one writer, promotion needed. Warm standby and pilot light.
- DynamoDB global tables: active-active, all replicas writable, no promotion. Multi-site.
- RDS cross-Region read replica: async, promotion needed, higher lag.
- S3 Cross-Region Replication: new objects only. Use S3 Batch Replication for objects that already exist.
- AWS Backup cross-Region copy: backup and restore tier.
- Elastic Disaster Recovery: on-premises or cross-Region servers, seconds of RPO, low idle cost.
Governance controls
| Control | Scope | Grants access? |
|---|---|---|
| SCP | Accounts in an OU or the org, including the root user | No, only limits |
| Resource control policy | Resources in accounts, on the resource side | No, only limits |
| IAM policy | A principal in one account | Yes |
| Permissions boundary | Maximum for one principal, set by an admin | No, only limits |
| Resource policy | Who may touch this resource | Yes, including cross-account |
| Session policy | One STS session | No, only limits |
Rules the exam leans on:
- SCPs do not grant anything. Effective permission is the intersection of SCP, IAM policy, and any boundary.
- An SCP is the only thing that constrains an account administrator or the account root user. If a question says “even administrators must not be able to”, the answer is an SCP.
- Region restriction SCPs need a NotAction carve-out for global services such as IAM, Organizations, Route 53, CloudFront, and Support.
- Cross-account access needs both sides: a resource policy or trust policy on one, an IAM policy on the other.
Detection and security services
| Service | What it actually answers |
|---|---|
| GuardDuty | Threat activity from CloudTrail, DNS, VPC Flow Logs, EKS and S3 telemetry |
| Inspector | Known CVEs in EC2 packages, ECR images, and Lambda functions |
| Macie | Sensitive data discovery and classification in S3 |
| Detective | Investigating the scope of a finding across time and entities |
| IAM Access Analyzer | Policies granting external access, and unused permissions |
| Config | Resource configuration compliance and remediation |
| Security Hub | Aggregation and standards scoring across accounts and Regions |
| CloudTrail | Who called which API and when |
| Audit Manager | Evidence collection mapped to a compliance framework |
If the question is about a policy, it is Access Analyzer. If it is about behaviour, it is GuardDuty. If it is about packages, it is Inspector. If it is about data content, it is Macie.
Secrets and keys
- Secrets Manager: native rotation, higher cost per secret. Choose it whenever rotation is a requirement.
- Parameter Store SecureString: cheap, no built-in rotation. Choose it when the question says configuration values or mentions cost with no rotation requirement.
- KMS AWS managed key: no policy control, no cross-account use.
- KMS customer managed key: key policy, grants, cross-account, rotation, multi-Region option.
- KMS custom key store on CloudHSM: you control the hardware and the key material origin, and the AWS service integrations still work.
- CloudHSM alone: FIPS 140-2 Level 3, single-tenant, and you rewrite applications to use it. Only when the question explicitly rules out AWS having any access path or requires a specific HSM API.
Migration tooling
The 7Rs, with a one-line trigger each:
| Strategy | Trigger |
|---|---|
| Rehost | Lift and shift, tight deadline, no changes |
| Replatform | Small optimisation on the way, usually database to RDS |
| Repurchase | Move to SaaS, often no source code or vendor end of life |
| Refactor | Business needs features the current architecture cannot deliver |
| Retire | Nobody uses it |
| Retain | Not ready, or a dependency blocks it |
| Relocate | VMware Cloud on AWS, move hypervisor-level with no conversion |
| Job | Tool |
|---|---|
| Inventory and dependency mapping | Application Discovery Service, tracked in Migration Hub |
| Server migration | Application Migration Service |
| Ongoing DR for servers | Elastic Disaster Recovery |
| Database, same engine | DMS |
| Database, different engine | SCT for schema, then DMS with change data capture |
| Bulk one-time data over the wire | DataSync |
| Bulk one-time data too large for the wire | Snow Family |
| Ongoing scheduled file sync | DataSync |
| On-premises apps needing cloud storage as a local share | Storage Gateway |
| Partners uploading over SFTP or FTPS | Transfer Family |
| Faster uploads to S3 over long distances | S3 Transfer Acceleration |
Bandwidth arithmetic, which appears at least once: at 1 Gbps fully utilised you move about 10 TB per day. Multiply by the utilisation the question allows, divide the data volume, compare to the deadline. If it does not fit, the answer is Snow.
Storage
| Need | Answer |
|---|---|
| Unknown or changing access patterns | S3 Intelligent-Tiering |
| Known cold after N days, millisecond retrieval still required | Lifecycle to Standard-IA, then Glacier Instant Retrieval |
| Archive, minutes to hours acceptable | Glacier Flexible Retrieval |
| Deep archive, 12 hours acceptable, lowest cost | Glacier Deep Archive |
| Immutable retention for compliance | S3 Object Lock compliance mode, or AWS Backup Vault Lock compliance mode |
| Windows shares, NTFS ACLs, DFS, AD | FSx for Windows File Server |
| Linux NFS shared across instances | EFS |
| HPC parallel throughput, S3-linked | FSx for Lustre |
| NetApp features, snapshots, multi-protocol | FSx for NetApp ONTAP |
| Above 16,000 IOPS on one volume | io2 Block Express |
| General purpose with independently provisioned IOPS up to 16,000 | gp3 |
Vault Lock and Object Lock both have governance mode, which a sufficiently privileged principal can override, and compliance mode, which nobody can. If the question says “including administrators” or names an auditor, it is compliance mode.
Databases
| Signal | Answer |
|---|---|
| Relational, multi-Region writes | Not Aurora. Reconsider the requirement or use DynamoDB global tables |
| Relational, fast failover and read scaling | Aurora with reader endpoint and failover tiers |
| Key-value at any scale, single-digit millisecond | DynamoDB |
| DynamoDB read hot spots | DAX |
| DynamoDB write hot spots | Fix the partition key, add write sharding |
| Time series | Timestream |
| Graph and relationships | Neptune |
| Ledger with cryptographic verification | QLDB |
| Wide-column Cassandra workload | Keyspaces |
| MongoDB workload | DocumentDB |
| SQL Server licence cost is the problem | Aurora PostgreSQL with Babelfish |
| Analytics warehouse, repeated BI queries | Redshift |
| Ad hoc SQL over S3, infrequent | Athena over partitioned Parquet |
Connection storms from Lambda or a large fleet mean RDS Proxy. A repeated identical read query means ElastiCache.
Compute and purchasing
- Compute Savings Plans: flexible across family, size, Region, and covers Fargate and Lambda. Default answer when the question mentions changing workloads.
- EC2 Instance Savings Plans: deeper discount, locked to family and Region, no serverless.
- Standard RIs: least flexible, highest discount for genuinely static workloads.
- Convertible RIs: exchangeable, no serverless coverage.
- Spot: interruption-tolerant, checkpointed, stateless. With Batch or with capacity-optimized allocation in an ASG.
- Dedicated Hosts: BYOL with socket or core licensing, or a compliance requirement for physical isolation.
- Dedicated Instances: isolation at the instance level, no licence visibility into sockets and cores.
Application integration
| Need | Answer |
|---|---|
| Buffer work, one consumer group, retries and DLQ | SQS |
| Fan out one message to many subscribers | SNS |
| Route events by content to many targets, cross-account | EventBridge |
| Strict ordering and exactly-once processing | SQS FIFO |
| Multi-step workflow with state, retries, and human approval | Step Functions |
| Existing Kafka clients | MSK |
| Existing RabbitMQ or ActiveMQ clients | Amazon MQ |
| Replay of a stream by multiple independent consumers | Kinesis Data Streams |
Cost levers, in rough order of impact
- Turn off non-production outside business hours.
- Rightsize using Compute Optimizer.
- Cover the steady baseline with Savings Plans.
- Gateway VPC endpoints for S3 and DynamoDB, which are free and remove NAT gateway processing charges.
- S3 lifecycle or Intelligent-Tiering.
- Reduce cross-AZ chatter between services.
- Spot for anything interruption-tolerant.
Gateway endpoints, for S3 and DynamoDB only, have no hourly or data charge. Interface endpoints have both, but still usually beat NAT gateway processing at volume.
Phrases that give the answer away
| Phrase in the question | Where to look |
|---|---|
| Least operational overhead | The most managed service on the list |
| Even administrators must not | SCP, or compliance mode lock |
| Cannot modify the application | EFS, RDS Proxy, ALB, a sidecar, an ASG of one |
| No source code available | Rehost or repurchase, never refactor |
| Overlapping CIDR blocks | PrivateLink |
| Hundreds of accounts | Organizations, Control Tower, delegated administrator, StackSets, Firewall Manager |
| Existing objects or existing data | Batch operations or a backfill job, because live replication is forward-only |
| Clients cache DNS | Global Accelerator |
| Sub-second replication, writes in every Region | DynamoDB global tables |
| Unpredictable access patterns | Intelligent-Tiering, or on-demand capacity |
| Must prove the key never left our control | KMS custom key store on CloudHSM |
| Within the next 30 days, large volume | Do the bandwidth arithmetic, expect Snow |