Title: AWS Saa C03 Exam Cheatsheet — LearnCoachAssist

Q: Which AWS service is best for object storage with 11 9s durability?
A: Amazon S3 — durability 99.999999999%.

Q: Cheapest S3 class for rarely-accessed data with 12h retrieval?
A: S3 Glacier Deep Archive.

Q: S3 class for unknown/changing access patterns?
A: S3 Intelligent-Tiering — auto-moves objects, no retrieval fees.

Q: Feature that prevents accidental S3 object deletion?
A: S3 Versioning + MFA Delete.

Q: Best way to share S3 objects with third parties temporarily?
A: Pre-signed URLs.

Q: AWS service to auto-scale reads for a relational DB?
A: RDS Read Replicas or Aurora Replicas.

Q: Service for multi-region globally-distributed DB?
A: DynamoDB Global Tables or Aurora Global Database.

Q: DynamoDB capacity mode for bursty traffic?
A: On-Demand.

Q: DynamoDB index for non-key attribute queries?
A: Global Secondary Index (GSI) or LSI.

Q: Service to decouple microservices with at-least-once delivery?
A: Amazon SQS (Standard or FIFO).

Q: Service for pub/sub fan-out to multiple subscribers?
A: Amazon SNS.

Q: Real-time stream of millions of events/sec with replay?
A: Amazon Kinesis Data Streams.

Q: Managed Kafka on AWS?
A: Amazon MSK.

Q: How does Auto Scaling decide to add instances?
A: Tracks a CloudWatch metric and triggers via alarms + scaling policies.

Q: Target-tracking vs Step scaling?
A: Target-tracking: keep a metric at a target.
Step: scale by N per alarm step.

Q: Layer-7 load balancer that supports path/host routing?
A: Application Load Balancer (ALB).

Q: Layer-4 load balancer for static IPs and TCP/UDP?
A: Network Load Balancer (NLB).

Q: Service for cross-region anycast IPs in front of ALBs?
A: AWS Global Accelerator.

Q: Why use a NAT Gateway?
A: Allow private-subnet instances to make outbound internet calls.

Q: Free VPC endpoint type for S3/DynamoDB?
A: Gateway VPC Endpoint.

Q: VPC endpoint for arbitrary AWS services?
A: Interface VPC Endpoint (powered by PrivateLink).

Q: Hub-and-spoke connectivity between many VPCs and on-prem?
A: AWS Transit Gateway.

Q: Difference between IAM user, group, role?
A: User: long-lived ID.
Group: shared policies.
Role: temporary credentials assumed by services or federation.

Q: How should EC2 get S3 permissions?
A: Attach an IAM Instance Profile with a role granting s3:GetObject.

Q: Service for automatic DB secret rotation?
A: AWS Secrets Manager.

Q: S3 Server-Side Encryption options?
A: SSE-S3, SSE-KMS, SSE-C.

Q: Service to filter HTTP attacks (OWASP) at the edge?
A: AWS WAF.

Q: DDoS protection service?
A: AWS Shield (Standard or Advanced).

Q: How to require HTTPS in CloudFront?
A: Set Viewer Protocol Policy to HTTPS Only or Redirect HTTP→HTTPS.

Q: Route 53 routing for failover?
A: Failover routing with primary/secondary records and health checks.

Q: Aurora storage replication?
A: 6 copies across 3 AZs, automatic.

Q: Aurora Serverless v2 use case?
A: Variable demand — granular ACU scaling in seconds.

Q: ElastiCache: Memcached vs Redis?
A: Memcached: simple cache, multi-threaded.
Redis: persistence, replication, pub/sub, structures.

Q: Run stateless containers without managing servers?
A: AWS Fargate (with ECS or EKS).

Q: ECS vs EKS?
A: ECS: AWS-native.
EKS: managed Kubernetes.

Q: VM migration service?
A: AWS Application Migration Service (MGN).

Q: Hybrid file storage with on-prem cache?
A: AWS Storage Gateway.

Q: Lambda max execution time?
A: 15 minutes.

Q: Default Lambda regional concurrency?
A: 1,000.

Q: How to give Lambda VPC access?
A: Configure VPC, subnets, and security groups (creates ENIs).

Q: Schedule a Lambda?
A: EventBridge rule with cron/rate.

Q: EventBridge vs SNS?
A: SNS: simple pub/sub.
EventBridge: rich rules, SaaS events, schema registry.

Q: API management with throttling and auth?
A: API Gateway.

Q: Enforce TLS 1.2+ on ALB?
A: Set the listener security policy that excludes TLS 1.0/1.1.

Q: Log + metrics + alarms service?
A: CloudWatch.

Q: Insights vs Athena?
A: Insights: CloudWatch Logs queries.
Athena: SQL over S3.

Q: Distributed tracing service?
A: AWS X-Ray.

Q: Backup, Snapshot, AMI difference?
A: Snapshot: EBS point-in-time.
AMI: snapshot + launch metadata.
AWS Backup: cross-service policies.

Q: Cross-account S3 access — recommended?
A: Bucket policy granting account B's role + IAM role in B with required permissions.

Q: ML model training + hosting?
A: Amazon SageMaker.

Q: Disaster recovery strategies (cheapest→fastest)?
A: Backup & Restore → Pilot Light → Warm Standby → Multi-site Active/Active.

Q: RPO vs RTO?
A: RPO: max data loss.
RTO: max downtime.

Q: Account compliance / config tracking?
A: AWS Config.

Q: Consolidated billing across accounts?
A: AWS Organizations.

Q: Managed Active Directory?
A: AWS Directory Service.

Q: Push static SPA assets globally?
A: S3 + CloudFront with versioned filenames.

Q: Shared POSIX filesystem from many EC2s?
A: Amazon EFS.

Q: HPC parallel filesystem?
A: FSx for Lustre.

Q: C, M, R, T instance families?
A: C: CPU.
M: balanced.
R: memory.
T: burstable/cheap.

Q: Spot vs Reserved vs Savings Plans?
A: Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family.

Q: PII discovery in S3?
A: Amazon Macie.

Q: EC2/ECR vulnerability scanning?
A: Amazon Inspector.

Q: Aggregate security findings?
A: AWS Security Hub.

Q: ML threat detection from logs?
A: Amazon GuardDuty.

Q: Limit allowed actions across an OU?
A: Service Control Policies (SCPs).

Q: Root account best practice?
A: Hardware MFA, no access keys, locked away.

Q: Encrypt existing RDS?
A: Snapshot → copy with encryption → restore (you can't encrypt in place).

Q: Multi-AZ vs Read Replica for RDS?
A: Multi-AZ: synchronous standby for HA.
Read Replica: async copy for read scaling.

Q: Aurora failover time?
A: Typically <30 seconds.

Q: Petabyte-scale columnar DW?
A: Amazon Redshift.

Q: Query S3 with SQL, serverless?
A: Athena.

Q: Catalog/crawl data in S3?
A: AWS Glue Data Catalog + Crawlers.

Q: Spark ETL without managing clusters?
A: AWS Glue.

Q: Stream processing service?
A: Kinesis Data Analytics (Apache Flink) or Lambda.

Q: Batch + deliver streaming to S3/Redshift?
A: Kinesis Data Firehose.

Q: Managed Elasticsearch?
A: Amazon OpenSearch Service.

Q: Cheap parameter store?
A: SSM Parameter Store.

Q: Detect drift in IaC?
A: CloudFormation Drift Detection.

Q: IaC with TS/Python that compiles to CloudFormation?
A: AWS CDK.

Q: Centrally apply firewall rules across accounts?
A: AWS Firewall Manager.

Q: Managed stateful network firewall in VPC?
A: AWS Network Firewall.

Q: Batch container jobs (genomics, render)?
A: AWS Batch.

Q: Managed Airflow?
A: Amazon MWAA.

Q: Managed Prometheus + Grafana?
A: AMP + Amazon Managed Grafana.

Q: Archive CloudWatch Logs cheaply?
A: Subscription filter → Firehose → S3 with lifecycle to Glacier.

Q: VPC peering limits?
A: No transitive routing; one-to-one only.

Q: Give on-prem DNS access to private hosted zones?
A: Route 53 Resolver Inbound/Outbound Endpoints.

Q: ML cost anomaly detection?
A: AWS Cost Anomaly Detection.

Q: Pre-deploy bill estimate?
A: AWS Pricing Calculator.

Q: Replace SSH bastion with…?
A: SSM Session Manager — no inbound ports, IAM-controlled.

Q: CloudTrail vs CloudWatch?
A: CloudTrail: who did what (API audit).
CloudWatch: operational metrics & logs.

Q: CloudTrail default retention in console?
A: 90 days; ship to S3 for longer.

Q: Object storage with 1-minute retrieval but very cheap?
A: S3 Glacier Instant Retrieval.

Q: Glacier flexible retrieval times?
A: Standard 3–5 hr, Expedited 1–5 min (extra cost), Bulk 5–12 hr.

Q: How to lock S3 objects against deletion/edit?
A: S3 Object Lock (Governance or Compliance mode).

Q: S3 replication between regions?
A: Cross-Region Replication (CRR); must enable versioning.

Q: Replicate within a region?
A: Same-Region Replication (SRR).

Q: How to deploy CloudFront in front of a static S3 site privately?
A: Use Origin Access Control (OAC); restrict bucket policy to the OAC principal.

Q: Pricing tier for CloudFront where you pay only NA/EU edge?
A: PriceClass_100.

Q: Cross-account image deployment for EC2?
A: Share AMI from source account; grant launch permissions to target account.

Q: Default region for newly created S3 bucket?
A: Whatever you specify at create — there is no global default; bucket names are global but data is regional.

Q: Limit on S3 bucket names per account?
A: 100 buckets by default; raise to 1,000 via support.

Q: Single S3 object max size?
A: 5 TB.

Q: Use multipart upload for files larger than…?
A: Recommended above 100 MB; required above 5 GB.

Q: S3 strong consistency for what operations?
A: Read-after-write, list, and overwrite/delete are all strongly consistent.

Q: How does a Spot interruption notify your app?
A: 2-minute notice via instance metadata at http://169.254.169.254/latest/meta-data/spot/instance-action, plus EventBridge event.

Q: Service to centrally control AWS account creation?
A: AWS Control Tower — sets up org, guardrails, account factory.

Q: Service for centralized chat with security teams during incident?
A: AWS Chatbot — pipes alarms/security alerts to Slack/Teams.

Q: Where do you see Service Quotas for an account?
A: Service Quotas console — raise via request, tracked per service+region.

Q: Service for federated SSO with SAML/OIDC?
A: IAM Identity Center.