AWS Certified Solutions Architect — Professional (SAP-C02)

Transit Gateway is the default answer for connecting many VPCs and on-premises networks at scale — it is the most heavily tested networking service on SAP-C02. Know attachments (VPC, VPN, Direct Connect gateway, peering), route tables and how associating/propagating routes creates segmentation (prod cannot reach dev), inter-Region peering (non-transitive), and the centralized egress/inspection patterns. Know when VPC peering still wins (two or three VPCs, lowest cost, no bandwidth ceiling). Expect 4-6 questions where Transit Gateway is the answer or a key distractor.

Hybrid connectivity questions hinge on bandwidth, consistency, cost, and resiliency requirements. Know Direct Connect connection types (dedicated vs hosted), virtual interface types (private, public, transit), Direct Connect gateway (connect to VPCs in any Region), LAG, and the resiliency models (development, high, maximum). Know Site-to-Site VPN as the encrypted, fast-to-provision, cheaper option (1.25 Gbps per tunnel, ECMP over transit gateway to scale), VPN as backup for Direct Connect, and that a VPN over a Direct Connect public VIF gives you encryption over the dedicated link. MACsec covers encryption on 10/100 Gbps dedicated connections. Expect 3-5 questions.

Know the three ways to connect VPCs and when each wins: peering (one-to-one, non-transitive, no bandwidth cap, free within an AZ), Transit Gateway (many-to-many, transitive, hourly + per-GB cost), and PrivateLink (expose one service to thousands of consumers, works with overlapping CIDRs, unidirectional). Gateway endpoints (S3, DynamoDB) are free; interface endpoints cost per hour + per GB but work from on-premises over Direct Connect/VPN. Endpoint policies restrict what an endpoint can reach. Overlapping-CIDR scenarios are a strong PrivateLink signal. Expect 3-5 questions.

Hybrid DNS is a Professional-exam staple. Know that the Route 53 Resolver at VPC CIDR +2 answers queries inside a VPC, that an inbound resolver endpoint lets on-premises DNS resolve AWS private hosted zones, and that an outbound endpoint plus forwarding rules lets VPCs resolve on-premises domains. Forwarding rules can be shared across accounts with AWS RAM, and private hosted zones can be associated with VPCs in other accounts. Expect 1-3 questions.

Know which tool answers which troubleshooting question: VPC Flow Logs for accepted/rejected traffic records (published to CloudWatch Logs or S3), Reachability Analyzer for static configuration analysis of a path between two resources (no packets sent), Network Access Analyzer for finding unintended network access at scale, and Traffic Mirroring for full packet capture to an appliance. Expect 1-2 questions, often "which tool proves why the connection fails".

Cross-account access is the bread and butter of Domain 1. Know the role-assumption pattern (trust policy in the target account, sts:AssumeRole permission in the source account), when resource-based policies are enough (S3, KMS, SNS, SQS — the principal keeps its own identity, no role hop), the external ID pattern for third parties (confused deputy), and policy evaluation across account boundaries (both the identity policy and the resource policy must allow). Permissions boundaries and session policies cap what a role can do. Expect 3-4 questions.

IAM Identity Center (formerly AWS SSO) is the modern answer for workforce access to many accounts: one identity source (built-in, Active Directory via AWS Directory Service, or an external SAML/SCIM IdP), permission sets that materialize as roles in member accounts, and integration with Organizations. Know classic SAML 2.0 federation to a single account and AWS Directory Service options (AWS Managed Microsoft AD vs AD Connector) for scenarios anchored on existing Active Directory. Expect 2-3 questions.

At the Professional level KMS questions are about key policies and boundaries: cross-account key grants and key policies, multi-Region keys for encrypting data that replicates across Regions, customer managed vs AWS managed keys (only customer managed keys support cross-account use and custom rotation), and imported key material. ACM certificates are regional (except CloudFront, which uses us-east-1) and cannot be exported; ACM Private CA issues internal certs. CloudHSM appears when the scenario demands single-tenant FIPS 140-2 Level 3 hardware or SQL Server TDE. Expect 2-3 questions.

Central security teams need organization-wide visibility. Know the delegated administrator pattern: an organization trail in CloudTrail logging every account to one S3 bucket, Security Hub aggregating findings across accounts and Regions, GuardDuty with a delegated admin auto-enrolling new accounts, IAM Access Analyzer finding resources shared outside the organization zone of trust, and Amazon Inspector scanning EC2, ECR, and Lambda for vulnerabilities. EventBridge routes findings to notification and remediation targets. Expect 2-3 questions.

Memorize the four DR strategies in order of decreasing RTO/RPO and increasing cost: backup and restore (hours), pilot light (tens of minutes — data live, core services replicated but switched off), warm standby (minutes — scaled-down full copy always running), and multi-site active/active (near zero — full capacity in both Regions). Exam questions give you an RTO/RPO and a budget constraint and ask you to pick the cheapest strategy that meets them, or to identify the components of a given strategy (Aurora global database for pilot light data, Route 53 failover for cutover). This pattern appears across every domain. Expect 4-6 questions exam-wide.

Elastic Disaster Recovery (DRS) is the named service for lift-and-shift DR of physical, virtual, and cloud servers: continuous block-level replication into a low-cost staging area, launch into full capacity only during drills or recovery, point-in-time recovery for ransomware. It replaced CloudEndure and is the recommended DR answer for EC2-hostable workloads with short RTO/RPO and minimal steady-state cost. Distinguish from AWS Backup (snapshots, longer RTO) and from MGN (one-way migration, not DR). Expect 1-2 questions.

AWS Backup centralizes backup across services (EBS, RDS, DynamoDB, EFS, FSx, S3, VMware and more) with backup plans, cross-Region and cross-account copies, and organization-wide backup policies through Organizations. Backup Vault Lock provides WORM immutability against ransomware and rogue admins. Know service-native alternatives (EBS snapshot lifecycle via Data Lifecycle Manager, RDS automated backups and PITR, S3 versioning + replication) and when the scenario's compliance wording points to Vault Lock. Expect 2-3 questions.

The single most tested management topic on SAP-C02. Know OU design (security OU, infrastructure OU, workload OUs; group by function, not company org chart), service control policies (guardrails that set the maximum permissions — they never grant, do not affect the management account or service-linked roles, and evaluate as an intersection along the OU path), delegated administrator for security services, consolidated billing (volume discount and RI/Savings Plan sharing across the organization), and tag policies. Common SCP patterns: deny leaving the organization, deny disabling CloudTrail/GuardDuty, region restriction, deny root user actions. Expect 4-6 questions.

Control Tower is the managed landing zone: it sets up Organizations, the log archive and audit accounts, IAM Identity Center, and applies controls (formerly guardrails) — preventive (SCPs), detective (Config rules), and proactive (CloudFormation hooks). Account Factory provisions standardized accounts on demand. Pick Control Tower when the scenario says "quickly establish a governed multi-account environment with minimal custom work"; pick raw Organizations + StackSets when deep customization is required. Expect 1-2 questions.

AWS RAM shares resources (Transit Gateway attachments, subnets, Route 53 Resolver rules, License Manager configs and more) with accounts or OUs without duplicating them — sharing within an organization skips invitation handshakes. Shared-VPC subnets let a network team own the VPC while application accounts deploy into it. For events, know the central event bus pattern: EventBridge rules in member accounts target a bus in the security or operations account (resource policy required). Expect 1-2 questions.

Know the standard central logging architecture: an organization CloudTrail trail and AWS Config delivery to a log-archive account S3 bucket with restrictive bucket policies, CloudWatch Logs subscription filters streaming to Kinesis Data Streams or Amazon Data Firehose for aggregation, and cross-account CloudWatch observability for dashboards. S3 access logs, VPC Flow Logs, and ELB access logs all land in the same archive. Athena queries the archive in place. Expect 1-2 questions.

Know which tool answers which question: Cost Explorer for interactive analysis and RI/Savings Plans recommendations, AWS Budgets for threshold alerts and budget actions (can trigger an SCP or stop instances), and the Cost and Usage Report (CUR) for the most granular line-item data delivered to S3 and queried with Athena/QuickSight. Cost allocation tags must be activated in the management account before they appear in reports; cost categories group costs by business dimension. Expect 2-3 questions.

Cost questions on SAP-C02 usually reduce to picking the right purchase model. Know: Compute Savings Plans (most flexible — any instance family, Region, Fargate, Lambda) vs EC2 Instance Savings Plans (cheaper, locked to a family in a Region) vs Standard RIs (can also be sold on the marketplace) vs Convertible RIs (exchangeable). Spot for interruptible, stateless, or batch workloads (2-minute interruption notice); On-Demand for spiky unpredictable baselines. RIs and Savings Plans are shared across consolidated billing by default. Expect 3-4 questions.

Know the visibility tools by their signature outputs: Compute Optimizer gives ML-based rightsizing recommendations for EC2, ASGs, EBS, Lambda, and ECS on Fargate; Trusted Advisor flags idle resources, underutilized instances, and service limit usage (full checks need Business/Enterprise support); S3 Storage Lens gives organization-wide storage metrics and finds incomplete multipart uploads or cold data. Expect 1-2 questions.

Professional-level CloudFormation means StackSets: deploy stacks to many accounts and Regions from one template, with service-managed permissions that auto-deploy to new accounts in an OU. Know change sets (preview before update), drift detection, stack policies (protect resources during updates), custom resources (Lambda-backed for anything CloudFormation cannot do), and rollback behavior. StackSets + Organizations is the standard answer for "apply this baseline to every account". Expect 2-4 questions.

Know the deployment strategies and their rollback characteristics cold: all-at-once (downtime, fastest), rolling (reduced capacity during deploy), blue/green (two full environments, instant rollback by swapping traffic — Route 53 weighted records, ALB target groups, or CodeDeploy), and canary/linear traffic shifting (CodeDeploy for Lambda and ECS). CodePipeline orchestrates source, build (CodeBuild), and deploy (CodeDeploy) with manual approvals and cross-account actions. Expect 2-3 questions, usually "which strategy meets this rollback/availability requirement".

Systems Manager is the exam's configuration-management answer: Run Command for fleet-wide commands without SSH, State Manager for enforcing desired configuration, Patch Manager with patch baselines and maintenance windows for org-wide patching, Automation runbooks for operational workflows and remediation, Session Manager for auditable shell access with no open inbound ports, and Parameter Store for configuration data. Expect 2-3 questions spread across domains.

Service Catalog lets a platform team publish approved CloudFormation products that end users launch with constrained permissions (launch constraints use the catalog role, not the user's) — the answer for "let teams self-serve approved architectures without granting broad IAM permissions". Proton does the same for containerized/serverless application templates with environment and service templates. One question at most, often as a distractor pair.

Know Route 53 routing policies as failover machinery: failover routing with health checks for active/passive, weighted for gradual cutover and blue/green, latency-based for active/active. Health checks can monitor endpoints, other health checks (calculated), or CloudWatch alarms; they cannot monitor private resources directly (use a CloudWatch alarm health check). Route 53 Application Recovery Controller adds readiness checks and manual routing controls that work even when control planes are impaired. Alias records at the zone apex point to ELB, CloudFront, and Global Accelerator. Expect 2-4 questions.

Match the replication technology to the RPO/RTO: Aurora Global Database (storage-level replication, typically under one second RPO, promote a secondary Region in about a minute), DynamoDB global tables (active/active multi-Region writes, last-writer-wins), RDS cross-Region read replicas (asynchronous, promotable but slower), and ElastiCache Global Datastore for Redis. Know Multi-AZ vs read replica distinctions: Multi-AZ is synchronous HA within a Region, not a scaling or DR-across-Region tool. Expect 3-4 questions.

S3 Cross-Region Replication requires versioning, replicates new objects only (use Batch Replication for existing), and offers Replication Time Control (15-minute SLA) when the RPO is contractual. Multi-Region Access Points route requests to the nearest replicated bucket. Know EBS snapshot copy, EFS replication, and FSx backup copy as the block/file equivalents. S3 Object Lock plus versioning covers immutability requirements. Expect 2-3 questions.

Attack-mitigation scenarios have a standard stack: CloudFront in front (absorbs and caches), AWS WAF web ACLs on CloudFront/ALB/API Gateway (SQL injection, XSS, rate-based rules, managed rule groups), Shield Standard (free, always on, L3/L4) vs Shield Advanced (DDoS response team, cost protection, health-based detection, WAF included), and Firewall Manager to enforce WAF/Shield/security-group policies across every account in the organization. Expect 2-3 questions.

Know each detection service's one-line identity: GuardDuty (ML threat detection from CloudTrail, VPC Flow Logs, DNS logs — no agents), Inspector (vulnerability and network-exposure scanning of EC2, ECR images, Lambda), Macie (finds PII/sensitive data in S3), Detective (investigates and visualizes root cause after a finding), and Security Hub (aggregates all of them against standards like CIS and AWS Foundational Security Best Practices). Wrong-answer distractors rely on you confusing these. Expect 2-3 questions.

Secrets Manager owns automatic rotation (built-in for RDS, Redshift, DocumentDB; Lambda-based for everything else) and cross-account secret sharing via resource policies; Parameter Store SecureString is the free alternative without rotation. Never store credentials in code, user data, or AMIs — the answer is always an IAM role (instance profile, task role, execution role) or, for hybrid servers, IAM Roles Anywhere. Expect 1-2 questions.

Associate-level knowledge assumed and tested in passing: security groups are stateful, allow-only, and can reference other security groups (the preferred pattern for tiered apps); NACLs are stateless, ordered, support deny rules, and require ephemeral-port return rules. Service endpoints keep AWS API traffic off the internet — pair endpoint policies with S3 bucket policy conditions like aws:sourceVpce for defense in depth.

Know scaling policy types and when each fits: target tracking (keep a metric at a value — the default recommendation), step scaling (graduated response), scheduled (predictable cycles), and predictive (ML forecasting for recurring patterns). Health checks: EC2 status vs ELB health checks on the ASG; unhealthy instances are replaced automatically — that is the exam's definition of self-healing. Warm pools and lifecycle hooks handle slow-booting apps. Expect 2-3 questions.

Decoupling questions test the classic patterns: SQS between tiers to absorb bursts and smooth scaling (queue depth as a scaling metric), SNS-to-SQS fanout for parallel consumers, dead-letter queues for poison messages, FIFO when ordering/dedup matters, and Step Functions for orchestrating long-running multi-step workflows with retries and compensation. EventBridge routes events between services and accounts. Expect 2-3 questions.

The recurring exam move: replace self-managed components with managed multi-AZ services — ALB/NLB across at least two AZs, RDS Multi-AZ or Aurora (which replicates six ways across three AZs), EFS (regional by design), S3, and stateless app tiers with session state pushed to ElastiCache or DynamoDB. Static stability — surviving an AZ loss without needing to launch capacity — is the phrase to know. Expect 2-3 questions.

Know that Service Quotas centrally tracks and requests limit increases, Trusted Advisor has quota-usage checks, and architectures must respect hard limits (for example, one internet gateway per VPC). Quota exhaustion in a scenario (throttling, launch failures during failover) is the clue: request increases in the DR Region ahead of time — quotas are per-Region.

"Pick the right database" is a guaranteed question category. Know the one-line use case for each: DynamoDB (key-value at any scale, single-digit ms), Aurora (relational, MySQL/PostgreSQL compatible at scale), ElastiCache (microsecond in-memory), Redshift (columnar analytics/OLAP), OpenSearch (full-text search and log analytics), Neptune (graph relationships), DocumentDB (MongoDB-compatible documents), Keyspaces (Cassandra), Timestream (time series), QLDB-style immutable ledgers. The scenario names an access pattern; you name the engine. Expect 3-4 questions.

Layered caching is the standard performance answer: CloudFront for static and dynamic content at the edge (plus Lambda@Edge/CloudFront Functions), Global Accelerator for non-HTTP or static-IP needs (anycast IPs onto the AWS backbone, fast regional failover — know the CloudFront vs Global Accelerator distinction cold), ElastiCache or DAX in front of databases, and API Gateway caching for APIs. Expect 2-3 questions.

Know instance family letters and signature workloads: C (compute-bound, batch), M (general purpose), R/X (memory, in-memory DBs), I/D (local NVMe storage, high IOPS), P/G (GPU/ML), plus Graviton for price-performance. Placement groups: cluster (low latency, single AZ), spread (max seven instances per AZ, critical isolation), partition (large distributed systems like Hadoop/Kafka). Enhanced networking (ENA) and EFA for HPC/MPI. Expect 1-2 questions.

Match storage to the access pattern: EBS gp3 (baseline 3,000 IOPS, provision IOPS/throughput independently of size) vs io2 (high, durable IOPS, Multi-Attach) vs st1/sc1 (sequential throughput); instance store for ephemeral scratch at the highest IOPS; EFS for shared POSIX access (performance and throughput modes); FSx for Lustre for HPC scratch linked to S3; S3 with multipart upload, Transfer Acceleration, and request-rate parallelism by prefix. Expect 2-3 questions.

Data transfer economics decide several questions: inbound is free, cross-AZ traffic costs in both directions, cross-Region costs vary by pair, NAT gateway adds per-GB processing (move S3/DynamoDB traffic to free gateway endpoints), PrivateLink and Transit Gateway have per-GB charges, CloudFront egress is cheaper than EC2/S3 egress and origin fetches from S3 are free. Direct Connect egress is cheaper than internet egress for sustained hybrid volume. Expect 1-2 questions.

Know the S3 class ladder and the retrieval trade-offs: Standard, Intelligent-Tiering (unknown access patterns, no retrieval fees), Standard-IA and One Zone-IA (30-day minimum), Glacier Instant Retrieval (ms retrieval), Glacier Flexible Retrieval (minutes-hours), Glacier Deep Archive (12-48 hours, cheapest). Lifecycle rules transition and expire objects; Intelligent-Tiering is the safe answer when access is unpredictable. EBS: gp3 is ~20% cheaper than gp2; snapshots to archive tier for rarely restored images. Expect 1-2 questions.

The improvement pattern the exam loves: CloudWatch alarm or EventBridge rule detects the condition, then triggers an automated response — an SSM Automation runbook, a Lambda function, or an Auto Scaling action — with SNS for the humans. Know composite alarms (reduce noise), anomaly detection alarms (no fixed threshold), metric filters on logs, and EC2 auto-recovery alarms (StatusCheckFailed_System recovers the instance to new hardware with the same instance ID). Expect 2-3 questions.

AWS Config records resource configuration history and evaluates it against rules; noncompliant resources can be auto-remediated with SSM Automation runbooks. Know managed vs custom rules, conformance packs (rule bundles deployable org-wide), aggregators (multi-account/multi-Region compliance view), and the Config vs CloudTrail distinction: Config answers "what does/did the resource look like", CloudTrail answers "who called what API". Expect 2-3 questions.

Improvement scenarios describe a painful manual deployment and ask for the managed fix: move to CodePipeline with automated tests, adopt blue/green or canary to remove deployment downtime, add CloudWatch alarms as automatic rollback triggers in CodeDeploy, and manage app config separately from code with AppConfig (validators plus gradual rollout and automatic rollback). Game days and AWS Fault Injection Service exercise the recovery runbooks. Expect 1-2 questions.

Know the audit toolkit: IAM Access Analyzer (external access findings, unused roles/keys/permissions, policy generation from CloudTrail activity), IAM last-accessed information (trim unused service permissions), credential reports, and CloudTrail as the traceability backbone. The remediation pattern is to replace long-lived users/keys with roles and Identity Center, then constrain with permissions boundaries and SCPs. Expect 1-2 questions.

The exam wants event-driven security response: GuardDuty or Inspector finding, routed by EventBridge, remediated by Lambda or an SSM Automation runbook (isolate the instance's security group, snapshot for forensics, disable keys), with Security Hub tracking the finding lifecycle. Config rules with auto-remediation handle configuration drift (public S3 bucket, open security group). Expect 2-3 questions.

Patch Manager with patch baselines, patch groups, and maintenance windows is the org-scale patching answer; run it across accounts with Systems Manager and Organizations integration. For immutable infrastructure, EC2 Image Builder pipelines produce patched golden AMIs that roll out through Auto Scaling instance refresh — recognize both the in-place and the replace-the-AMI patterns. Expect 1-2 questions.

Regulatory scenarios map to a short list: Macie to find and classify PII in S3, S3 Object Lock and Backup Vault Lock for immutable retention, lifecycle rules plus Glacier for long-term archives, KMS key policies for crypto-shredding, and CloudTrail log file integrity validation for evidentiary logs. AWS Artifact supplies compliance reports.

Bottleneck questions name a symptom and expect the right lens: CloudWatch metrics and dashboards for resource saturation, X-Ray traces and the service map for which microservice adds latency, RDS Performance Insights for database load by wait state and SQL, Enhanced Monitoring for OS-level DB metrics, and CloudWatch Logs Insights for log forensics. Translate SLAs into alarmed KPIs (p99 latency, error rate). Expect 1-2 questions.

"Users far from the Region complain about latency" has three canonical fixes, in order of invasiveness: put CloudFront in front (HTTP, cacheable), add Global Accelerator (TCP/UDP, static IPs, no caching), or go multi-Region with latency-based routing and replicated data. S3 Transfer Acceleration fixes slow uploads from distant clients; Local Zones and Wavelength appear for single-digit-millisecond edge requirements. Expect 1-2 questions.

Improvement questions often reward replacing self-managed components: self-hosted MySQL to RDS/Aurora, self-managed Kafka to Amazon MSK, cron boxes to EventBridge Scheduler plus Lambda, and oversized instances to Compute Optimizer-recommended sizes or Graviton. The tell is wording about "reduce operational overhead" — pick the most managed option that satisfies the constraints.

Spot the SPOF in the described architecture: single EC2 instance (put it in an ASG behind an ALB, minimum two AZs), single-AZ RDS (enable Multi-AZ), single NAT gateway (one per AZ), stateful app servers (externalize session state), one Region (apply a DR strategy). The answer is usually the cheapest change that removes the named failure mode, not a full multi-Region rebuild. Expect 2-3 questions.

Growth scenarios test recognizing the scaling ceiling and the managed fix: add read replicas or an ElastiCache layer for read-heavy relational load, move sessions to DynamoDB/ElastiCache to unlock horizontal scaling, enable DynamoDB auto scaling or on-demand for spiky NoSQL traffic, adopt Aurora Serverless v2 for variable workloads, and use SQS buffering so bursts queue instead of dropping. Expect 1-2 questions.

Know the verification tools: AWS Fault Injection Service for controlled failure experiments (AZ outage, API throttling), AWS Resilience Hub for assessing whether an application meets its RTO/RPO policy, and regular game days plus DR drills (Elastic Disaster Recovery non-disruptive recovery drills). Usually one question.

Know which tool surfaces which waste: Trusted Advisor (idle load balancers, low-utilization instances, unassociated Elastic IPs), Compute Optimizer (over-provisioned instances/volumes/functions), Cost Explorer resource-level granularity and RI/SP utilization reports, S3 Storage Lens (incomplete multipart uploads, cold buckets), and CUR + Athena for granular investigation. Cost anomaly detection alerts on unusual spend automatically. Expect 2-3 questions.

Cost retrofits the exam rewards: move fault-tolerant batch/CI/stateless work to Spot (mixed-instances ASGs combine On-Demand baseline with Spot), schedule non-production environments off, replace idle NAT/transfer-heavy paths with endpoints, tighten scaling policies so capacity tracks demand, and adopt serverless (Lambda, Fargate, Aurora Serverless) where utilization is low. Expect 1-2 questions.

An effective tagging strategy is explicitly named in the exam guide: enforce standard tags with tag policies (Organizations) and Config rules (required-tags), activate them as cost allocation tags in the management account, then report by tag in Cost Explorer/CUR and group with cost categories. Budgets can filter by tag to alert per business unit. Expect 1 question.

Memorize the seven migration strategies and their one-line triggers: retire (decommission), retain (not ready or not worth moving), rehost (lift and shift with MGN — fastest at scale), relocate (VMware Cloud on AWS or move between accounts/Regions — no new hardware), repurchase (move to SaaS), replatform (lift, tinker, and shift — for example onto RDS or Elastic Beanstalk), and refactor (re-architect for cloud-native — highest cost, highest payoff). Wave planning groups applications by dependency and risk. Expect 2-3 questions that hinge on choosing the right R for a constraint.

Application Discovery Service inventories on-premises servers two ways: the Agentless Collector for VMware (VM-level data from vCenter, no per-server installs) and the Discovery Agent for per-server detail including running processes and network dependencies (needed for dependency mapping). Data lands in Migration Hub, which tracks migration status across MGN, DMS, and partner tools in one home Region. Expect 1-2 questions.

MGN is the primary rehost tool: an agent continuously replicates source servers at block level into a low-cost staging area, you launch test instances without disrupting the source, then cut over with minutes of downtime. It converts servers to run natively on EC2 (physical, virtual, or other clouds). Know it replaced Server Migration Service (SMS), the difference from Elastic Disaster Recovery (same engine, different purpose), and that post-launch modernization actions can replatform during cutover. Expect 2-3 questions.

DMS migrates data with the source staying online: full load, full load plus change data capture (CDC) for minimal-downtime cutover, or CDC-only for ongoing replication. Homogeneous migrations (Oracle to Oracle) need only DMS; heterogeneous ones (Oracle to Aurora PostgreSQL) need SCT first to convert schema and code objects. SCT also drives data-warehouse migrations to Redshift, and DMS can use S3 as source/target and a Snowball Edge for huge initial loads. Expect 3-4 questions — DMS + SCT for heterogeneous migration is among the most reliable questions on the exam.

Pick by bandwidth math, protocol, and cadence: DataSync for online transfer of NFS/SMB/HDFS/object data into S3/EFS/FSx (schedules, filtering, verification — the answer for recurring or incremental sync over Direct Connect/VPN), Transfer Family for presenting S3/EFS over SFTP/FTPS/FTP/AS2 to partners (ongoing protocol endpoint, not a bulk mover), Snow Family when the network makes online transfer too slow (rule of thumb: weeks of transfer time or more than about 10 TB over a thin pipe), and S3 Transfer Acceleration for distant clients uploading to S3 over the internet. Expect 2-4 questions.

Storage Gateway keeps on-premises apps working while data lives in AWS: S3 File Gateway (NFS/SMB to S3 objects with local cache), Volume Gateway in cached mode (primary data in S3, hot cache local) or stored mode (primary data local, async snapshots to S3), and Tape Gateway (replace physical tape with virtual tapes in S3/Glacier). It is the answer for "extend on-premises storage during or after migration"; DataSync is the answer for "move the data". Expect 1-2 questions.

Map workload traits to platforms: EC2 for OS-level control, licenses, and legacy dependencies (Dedicated Hosts for BYOL socket/core licensing); Elastic Beanstalk to replatform standard web apps with minimal ops; Lambda for event-driven pieces under 15 minutes; App Runner for containerized web apps with zero infrastructure management; Outposts when data residency or latency forces the workload to stay on premises with AWS APIs. Expect 1-2 questions.

Know the container decision tree: ECS for AWS-native simplicity, EKS when Kubernetes compatibility or portability is required, Fargate to remove node management from either (with constraints: no daemon sets, no GPU on Fargate historically, per-vCPU pricing), EC2 launch type for special hardware or heavy sustained utilization, and ECS Anywhere/EKS Anywhere to run on-premises hardware under AWS control planes. ECR with cross-region replication distributes images. Expect 1-2 questions.

The migration-specific storage picks: EFS for shared Linux/POSIX file systems, FSx for Windows File Server for SMB shares with Active Directory integration (the answer for migrated Windows file servers), FSx for NetApp ONTAP for NetApp features (SnapMirror migrations, multiprotocol NFS+SMB), FSx for Lustre for HPC, EBS for single-instance block, S3 for anything object-shaped. Watch for the "Windows + SMB + AD" trigger phrase. Expect 1-2 questions.

Post-migration database choices: RDS for standard engines with managed ops (but check feature parity — some Oracle/SQL Server features force EC2 self-managed), Aurora when MySQL/PostgreSQL compatibility plus higher scale is wanted, DynamoDB when the schema is key-value and the team wants zero ops, OpenSearch for search/log workloads pulled out of relational stores, and self-managed on EC2 only when the scenario names an unsupported engine/feature or demands OS access. Expect 1-2 questions.

Recognize the serverless refactor targets: cron jobs to EventBridge Scheduler + Lambda, file-processing scripts to S3 events + Lambda, web APIs to API Gateway + Lambda (mind the 15-minute and payload limits — long jobs go to Fargate or Step Functions), and static frontends to S3 + CloudFront. Lambda pricing rewards spiky, low-duty-cycle workloads; sustained high utilization often stays cheaper on containers. Expect 2-3 questions.

Monolith-to-microservices questions test choosing the right seam: SQS to buffer between producers and consumers, SNS or EventBridge to broadcast events (EventBridge when you need content-based routing, schema registry, SaaS sources, or cross-account buses; SNS for high-fanout push), Step Functions to replace embedded workflow logic (Standard for long-running with human steps, Express for high-volume short bursts), and Amazon MQ only when the app already speaks AMQP/MQTT/JMS and cannot change protocols. Expect 2-3 questions.

Modernization scenarios move overloaded relational databases to purpose-built stores: session state and hot lookups to ElastiCache or DynamoDB, catalogs and user profiles to DynamoDB (with DAX for read-heavy), variable/intermittent workloads to Aurora Serverless v2, analytics off the OLTP database to Redshift or Athena over S3, and full-text search to OpenSearch. The clue is a relational database doing a job a purpose-built engine does better. Expect 1-2 questions.