Scenarios & real-world use cases
Exam cheat sheet
A condensed review for the final days before the exam. Each line points to a fuller explanation earlier in the handbook.
Keyword → service
| If the question says… | Think |
|---|---|
| Decouple, buffer, absorb spikes | SQS |
| Strict order, no duplicates | SQS FIFO |
| Fan-out, notify many | SNS (+ SQS) |
| React to AWS/SaaS events, schedules | EventBridge |
| Orchestrate steps, retries | Step Functions |
| Real-time stream, replay, multiple consumers | Kinesis Data Streams |
| Deliver stream to S3/Redshift, near real time | Data Firehose |
| Kafka | MSK |
| Existing JMS/AMQP/MQTT | Amazon MQ |
| GraphQL | AppSync |
| SaaS data to S3 | AppFlow |
| Serverless SQL on S3 | Athena |
| ETL, catalog, CSV→Parquet | Glue |
| Data lake permissions | Lake Formation |
| Data warehouse | Redshift |
| Dashboards | QuickSight |
| Hadoop/Spark | EMR |
| Key-value, serverless, massive scale | DynamoDB |
| Microsecond DynamoDB reads | DAX |
| Cache, sessions, leaderboard | ElastiCache |
| Graph | Neptune |
| MongoDB-compatible | DocumentDB |
| Cassandra | Keyspaces |
| Time series | Timestream |
| Too many DB connections | RDS Proxy |
| Global relational, RPO seconds | Aurora Global Database |
| Variable relational load | Aurora Serverless v2 |
| Shared Linux files | EFS |
| Windows SMB + AD | FSx for Windows |
| HPC/ML file system | FSx for Lustre |
| On-prem file access backed by S3 | S3 File Gateway |
| Replace tapes | Tape Gateway |
| Online file migration | DataSync |
| SFTP into S3 | Transfer Family |
| Petabytes offline | Snow Family |
| Lift-and-shift servers | Application Migration Service |
| Database migration | DMS (+ schema conversion) |
| Cache content globally | CloudFront |
| Static IPs, UDP, fast global failover | Global Accelerator |
| Path/host routing, Lambda targets | ALB |
| Static IP, extreme TCP/UDP performance | NLB |
| Third-party appliances inline | GWLB |
| Many VPCs, transitive | Transit Gateway |
| Private S3/DynamoDB access | Gateway endpoint |
| Expose service privately to other VPCs | PrivateLink (NLB) |
| Dedicated private link to on-prem | Direct Connect |
| Encrypted tunnel over internet | Site-to-Site VPN |
| SQLi/XSS, rate limiting | WAF |
| DDoS response team, cost protection | Shield Advanced |
| Threat detection | GuardDuty |
| Vulnerability scanning | Inspector |
| PII in S3 | Macie |
| Central findings | Security Hub |
| Who did what (API) | CloudTrail |
| Config compliance/history | Config |
| Metrics, logs, alarms | CloudWatch |
| Trace latency | X-Ray |
| Workforce SSO across accounts | IAM Identity Center |
| App user sign-up/sign-in | Cognito |
| Restrict all accounts | SCPs |
| Multi-account landing zone | Control Tower |
| Share resources across accounts | RAM |
| Rotate DB credentials | Secrets Manager |
| Customer-controlled keys | KMS customer managed keys |
| Single-tenant HSM | CloudHSM |
| Free auto-renewing certificates | ACM |
| Central backups, immutable | AWS Backup + Vault Lock |
| WORM objects | S3 Object Lock |
| Spending alerts | Budgets |
| Analyse costs | Cost Explorer |
| Right-sizing | Compute Optimizer |
Numbers worth remembering
| Fact | Value |
|---|---|
| Exam | 65 questions (50 scored), 130 min, pass 720/1000 |
| Reserved IPs per subnet | 5 |
| VPC CIDR size | /16 to /28 |
| S3 object max / single PUT | 5 TB / 5 GB |
| S3 durability | 11 nines |
| S3 request rate per prefix | 3,500 writes, 5,500 reads per second |
| IA minimum duration / object size | 30 days / 128 KB |
| Glacier IR & Flexible min duration | 90 days |
| Deep Archive min duration / retrieval | 180 days / 12–48 h |
| Glacier Flexible retrieval | 1–5 min, 3–5 h, 5–12 h |
| Lambda max duration / memory | 15 min / 10,240 MB |
| SQS retention / visibility max / long poll | up to 14 days / 12 h / 20 s |
| Spot interruption notice | 2 minutes |
| DynamoDB item max | 400 KB |
| RCU / WCU | 4 KB strongly consistent read / 1 KB write per second |
| RDS backup retention | up to 35 days |
| Aurora storage copies | 6 across 3 AZs; up to 15 replicas |
| Spread placement group | 7 running instances per AZ |
| KMS key deletion wait | 7–30 days |
| CloudTrail event history | 90 days |
| ACM cert for CloudFront | us-east-1 |
Classic comparisons
| A vs B | Rule of thumb |
|---|---|
| Security group vs NACL | Stateful allow-only per ENI vs stateless allow/deny per subnet |
| Multi-AZ vs read replica | Availability (failover) vs read scaling |
| SQS vs SNS | Pull queue vs push pub/sub |
| Kinesis Streams vs Firehose | Real-time custom consumers vs managed delivery |
| CloudFront vs Global Accelerator | Caching HTTP vs static IPs for any TCP/UDP |
| ALB vs NLB | Layer 7 routing vs layer 4 performance/static IP |
| Peering vs Transit Gateway | Few VPCs, non-transitive vs many VPCs, transitive hub |
| Gateway vs interface endpoint | S3/DynamoDB free route vs ENI for most services |
| VPN vs Direct Connect | Quick, encrypted, internet vs private, consistent, weeks to set up |
| EBS vs EFS vs S3 | Block single-AZ disk vs shared file vs object |
| Secrets Manager vs Parameter Store | Rotation vs cheap config |
| KMS vs CloudHSM | Managed multi-tenant vs dedicated HSM |
| Cognito vs Identity Center | App users vs workforce |
| SCP vs permissions boundary | Account-wide ceiling vs per-identity ceiling |
| CloudTrail vs Config vs CloudWatch | Who did what vs what it looks like vs how it performs |
| Savings Plans vs RIs vs Spot | Flexible commitment vs specific commitment vs interruptible discount |
Written by Bipin Singh
Work with meSenior Full-Stack Engineer · AI & AWS. I design and run production systems on AWS — serverless, data and AI.