Cheat Sheet¶
Everything condensed onto one page — one section per domain, the numbers worth memorizing, and the traps that catch people. Skim in under 10 minutes. Deep dives live in Learn; this is the last-minute layer.
Exam format
65 questions · 130 min · 720/1000 to pass · domains 30 / 26 / 24 / 20. Multiple choice + multiple response. Some questions are unscored pilots. Flag-and-return; there's no penalty for guessing.
Domain 1 — Security (30%)¶
| Concept | Key point |
|---|---|
| Policy evaluation | Explicit Deny > Explicit Allow > implicit (default) Deny |
| Same-account identity + resource policy | Union (either allows) |
| Identity + permissions boundary / SCP | Intersection (all must allow); boundaries/SCPs never grant |
| Cross-account access | Need both target resource/role policy and caller's identity policy |
| Root user | Can't be limited by IAM policy — only an SCP (in an Org) restricts root |
| Workload credentials | IAM role (EC2 → instance profile, Lambda → execution role, ECS → task role); never store keys |
| Third-party role assumption | Trust policy + sts:ExternalId (confused-deputy) |
| STS session | 15 min–12 h, default 1 h |
| KMS access | Key policy is the root of access; IAM only works if the key policy delegates |
| KMS envelope encryption | KMS key encrypts data keys (direct encrypt ≤ 4 KB) |
| KMS rotation | Customer key: opt-in, default 365 days; AWS-managed: yearly auto |
| KMS deletion | 7–30 day wait (default 30); prefer disable |
| Secrets Manager vs Parameter Store | Auto-rotation → Secrets Manager; Parameter Store standard = free, no rotation |
| ACM | Free public certs, auto-renew; CloudFront cert → us-east-1; doesn't install on EC2 |
| Encrypt existing unencrypted EBS/RDS | Snapshot → copy with encryption → restore (no in-place) |
| SG vs NACL | SG = stateful, allow-only, instance; NACL = stateless, allow+deny, subnet |
| NACL return traffic | Allow ephemeral ports 1024–65535 outbound (stateless) |
| Deny a specific IP | NACL (SGs can't deny) |
| Threat detection vs vuln scan vs PII | GuardDuty vs Inspector vs Macie |
| Aggregate findings / DDoS / L7 filtering | Security Hub / Shield / WAF |
Domain 2 — Resilient Architectures (26%)¶
| Concept | Key point |
|---|---|
| Resilient web tier | ALB → ASG across ≥ 2 AZs |
| ASG health check | Default EC2; behind an ELB set to ELB |
| Load balancers | ALB = L7/HTTP + Lambda targets; NLB = L4/static IP/millions rps; GLB = appliances |
| Cross-zone LB | ALB on+free; NLB off by default |
| Scaling policy default | Target tracking; scheduled for known patterns |
| RDS Multi-AZ | HA: synchronous standby, auto-failover, standby not readable |
| RDS Read Replica | Read scaling: async (can lag), manual promote, cross-Region OK |
| Aurora | 6 copies / 3 AZs; up to 15 replicas; Global DB = RPO ~1s / RTO ~1min |
| DynamoDB | Multi-AZ by default; Global Tables = multi-Region active-active; PITR 35 days |
| RDS backups | Automated retention 0–35 days; snapshots persist, copy cross-Region for DR |
| SQS | 1 consumer/msg; visibility default 30 s (max 12 h); retention 4 d (max 14 d); size 1 MiB; DLQ for poison msgs |
| SNS | Pub/sub fan-out to many; SNS → SQS for durable fan-out |
| EventBridge | Event bus, content filtering, AWS/SaaS sources, scheduling |
| Kinesis | Ordered, replayable stream, multiple consumers |
| DR strategies | Backup&Restore (hrs) < Pilot Light (10s min) < Warm Standby (min) < Active/Active (near-zero) |
| RTO / RPO | RTO = time to recover; RPO = data you can lose. Smaller = costlier |
Domain 3 — High-Performing Architectures (24%)¶
| Concept | Key point |
|---|---|
| Lambda | Max 15 min, 128 MB–10 GB, /tmp up to 10 GB; longer job ⇒ Fargate/EC2/Batch |
| Serverless containers vs functions | Fargate vs Lambda |
| ECS vs EKS | AWS-native vs Kubernetes (both run on Fargate or EC2) |
| EC2 family → bottleneck | T/M general, C compute, R/X memory, I/D storage, P/G GPU |
| Storage shapes | S3 object · EBS block (1 instance/1 AZ) · EFS/FSx file (many mount) |
| Shared files, many instances | EFS (Linux/NFS) or FSx for Windows (SMB) — not EBS |
| EBS default | gp3 (base 3,000 IOPS/125 MiB/s); io2 for high-IOPS DBs; st1 sequential; HDD ≠ boot |
| Instance store | Ephemeral — lost on stop/terminate |
| S3 durability | 11 nines; ~3,500 write / 5,500 read req/s per prefix |
| S3 class by pattern | Unknown → Intelligent-Tiering; infrequent → Standard-IA; archive → Glacier/Deep Archive |
| S3 min durations | IA 30 d, Glacier 90 d, Deep Archive 180 d |
| DAX / ElastiCache / CloudFront | DynamoDB cache / relational-app cache / edge content cache |
| Redis vs Memcached | Redis = HA + persistence + rich types; Memcached = simple ephemeral |
| DB pick | Joins/transactions → RDS/Aurora; key-value at scale → DynamoDB |
| VPC peering | Non-transitive; many VPCs → Transit Gateway |
| VPC endpoints | Gateway (free) = S3/DynamoDB; Interface (PrivateLink) = others |
| Route 53 | Latency (fastest) ≠ Geolocation (by location); Failover = active-passive; Alias at zone apex |
| CloudFront vs Global Accelerator | Caches content vs routes TCP/UDP (static anycast IPs, no cache) |
| Direct Connect vs VPN | DX = consistent/private (not encrypted); VPN = quick/encrypted/internet-variable |
Domain 4 — Cost-Optimized Architectures (20%)¶
| Concept | Key point |
|---|---|
| EC2 purchasing | Steady → RI / Savings Plan; interruptible → Spot (~90% off, 2-min notice); short → On-Demand |
| RI vs Savings Plans | Compute SP most flexible (any family/Region + Fargate/Lambda); Standard RI = biggest but rigid |
| Spot | Only fault-tolerant/stateless (batch, CI, rendering) |
| Dedicated Hosts | Licensing/compliance — not a cost play |
| S3 cost | Lifecycle for predictable-by-age; Intelligent-Tiering for unknown; gp3 < gp2 |
| Right-sizing | AWS Compute Optimizer |
| Cost Explorer | Analyze/visualize/forecast trends |
| AWS Budgets | Alert on actual/forecasted threshold breach |
| Cost & Usage Report (CUR) | Most granular line-item data → S3 → Athena/QuickSight |
| Trusted Advisor | Recommendations across 5 pillars (full set needs Business/Enterprise Support) |
| Cost allocation tags | Attribute cost to team/project (chargeback) |
| Consolidated billing (Organizations) | One bill + aggregated volume + shared RI/SP discounts |
The 10 traps that catch everyone¶
- Explicit Deny beats every Allow — even
AdministratorAccess. - Permissions boundaries & SCPs never grant — they only cap; you still need an Allow.
- A conditional Allow ≠ a Deny — to block HTTP on S3, explicitly Deny
aws:SecureTransport=false. - KMS access starts at the key policy — an IAM
kms:*grant is inert unless the key policy delegates. - SG = stateful/allow-only; NACL = stateless/allow+deny — and NACL return traffic needs ephemeral ports.
- Multi-AZ = availability (auto-failover, no reads); Read Replica = read scaling (async, manual promote).
- Lambda caps at 15 minutes — longer ⇒ Fargate/EC2/Batch.
- DAX caches DynamoDB, ElastiCache caches relational, CloudFront caches edge content — don't swap.
- Latency-based routing ≠ Geolocation routing — fastest vs by-location.
- Cost Explorer analyzes; Budgets alerts — "alert when spend exceeds/forecast" is always Budgets.
How to use this on exam day
Read it once the morning of the exam, then again in the final 10 minutes before you go in. If any row here surprises you, that's your cue to revisit the Learn or Revise page for that topic. Track weak spots in the Gap Tracker.