Cheatsheets on Album69

Domain 1 Cheatsheet: Design Solutions for Organizational Complexity

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 1 overview and the linked service guides.

Focus: governance, identity, multi-account operations, hybrid connectivity, and shared services. Use the current exam guide for exact objective wording.

Governance and Identity

Need	Prefer	Remember
Account vending and governed multi-account baseline	AWS Organizations + Control Tower	Landing zone, OUs, account factory, centralized logging/security; plan customization and drift
Set maximum permissions for accounts/OUs	SCP	Does not grant permissions; IAM still must allow
Central workforce sign-in to many AWS accounts	IAM Identity Center	Permission sets provision roles; integrate identity source and lifecycle
Limit access to supported resources across an organization	RCP	Resource-side maximum guardrail; does not grant access
Share supported resources across accounts	AWS RAM	Share only needed resource types/scopes; understand owner/consumer responsibilities
Delegate security administration	Service delegated admin + Organizations	Keep management account use limited; centralize findings and response
Access AWS APIs from workloads/users	IAM role + temporary credentials	Prefer federation/roles over long-lived access keys

Policy evaluation: explicit deny wins. SCP/RCP set ceilings; identity/resource policies must still allow access.
Organization design: separate accounts by environment, workload, and ownership; use OUs for policy inheritance without making OU depth unmanageable.
Break glass: tightly controlled emergency access, tested, monitored, and independent of ordinary federation failure modes.

Network and Hybrid Patterns

Requirement	Pattern	Watch for
Many VPCs and on-premises sites	Transit Gateway hub-and-spoke	Route tables, propagation/association, segmentation, attachment scale, cross-Region design
Dedicated private connectivity	Direct Connect	Not encrypted by default; use VPN/IPsec over DX when encryption is required
Quick encrypted site connectivity	Site-to-Site VPN	Internet path can vary; design redundant tunnels/endpoints and routing
Centralized outbound/inbound inspection	Network Firewall / inspection VPC via TGW	Symmetric routing, stateful inspection, AZ failure behavior, capacity
Private access to AWS services	VPC endpoints	Gateway endpoints for S3/DynamoDB; interface endpoints use PrivateLink and have cost/DNS considerations
Hybrid DNS	Route 53 Resolver inbound/outbound endpoints	Resolver rules, forwarding direction, on-premises DNS, endpoint security groups
Global DNS failover	Route 53 health checks and routing policy	DNS TTL/caching means failover is not instant

Cross-Account Design Checklist

Use IAM roles with explicit trust, external IDs where appropriate, and scoped session permissions.
Centralize CloudTrail, Config, security findings, and log retention in dedicated accounts.
Share networks/resources through approved mechanisms; avoid broad peering meshes.
Design account bootstrap, identity, quota, and regional enablement before migrating workloads.
Apply encryption/key policies across account boundaries and test the consumer role path end to end.

Common Traps

SCPs and RCPs do not grant access.
Direct Connect is private connectivity, not automatically encrypted or redundant.
VPC peering is non-transitive; do not use it as a scalable hub-and-spoke substitute.
Control Tower guardrails do not replace workload-specific security architecture.
A shared-services account is not a reason to centralize every workload permission or failure domain.
Route 53 health checks and low TTLs cannot eliminate resolver/client caching delays.

30-Second Review

Identify account boundary and who owns the resource.
Separate authentication, authorization, and organization guardrails.
Pick hub-and-spoke or private service access based on traffic flow and segmentation.
Add resilience, encryption, centralized logging, and tested break-glass access.
Verify current policy behavior, service support, and quotas in official docs.

Official References

Domain 2 Cheatsheet: Design for New Solutions

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 2 overview and the linked service guides.

Focus: choose an architecture that meets scale, availability, security, performance, and cost requirements. Pick the simplest service model that satisfies explicit constraints.

Compute and Networking

Requirement	Candidate	Decision cue
Full OS control / specialized software	EC2	Own patching, AMI lifecycle, capacity, and host hardening
Fleet size changes with demand	Auto Scaling	Pair with health checks and appropriate load balancing
AWS-native container orchestration	ECS	Strong default when Kubernetes compatibility is not required
Kubernetes APIs/ecosystem	EKS	More cluster/add-on/upgrade operations; justify with requirements/team skills
Event-driven short execution	Lambda	Check runtime, duration, concurrency, payload, and downstream limits
HTTP application load balancing	ALB	Layer 7 routing; path/host rules and supported targets
Static IP / high-performance Layer 4	NLB	TCP/UDP/TLS use cases; validate source-IP and target behavior
Inspect and route network appliances	GWLB	Transparent insertion of virtual appliances
Global static anycast IPs and fast endpoint failover	Global Accelerator	TCP/UDP global entry point; not a content cache
Cache and accelerate web content	CloudFront	Edge caching, origin protection, TLS/WAF integration
Managed API front door	API Gateway	Auth, throttling, stages, transformations, private APIs; select API type by need

Storage and Databases

Need	Candidate	Key distinction
Object storage, lifecycle, replication	S3	Strong consistency; choose class from access/retrieval/retention economics
Block storage for EC2	EBS	Choose volume type by IOPS/throughput; snapshots for backup, multi-attach where supported
Shared Linux file system	EFS	NFS, elastic shared file access
Windows SMB / Windows semantics	FSx for Windows File Server	AD integration and SMB feature fit
High-performance parallel/HPC file data	FSx for Lustre	Link to S3 and validate workload throughput/metadata needs
NetApp ONTAP feature compatibility	FSx for ONTAP	Multi-protocol, snapshots, replication; assess operational fit
Relational database with managed HA	RDS/Aurora	Multi-AZ for HA; read replicas for read scaling/DR patterns, not substitutes
Key-value/document at scale	DynamoDB	Access-pattern-first schema, partition design, consistency and capacity mode
In-memory cache	ElastiCache	Cache is not the system of record; handle invalidation/failures
Search and log analytics	OpenSearch	Search/index workload; plan shard sizing, ingestion, and domain operations

Messaging and Integration

Requirement	Prefer
Decouple work with durable competing consumers	SQS
Fanout notifications to subscribers	SNS
Filter/route domain or SaaS events	EventBridge
Ordered/replayable high-volume streaming	Kinesis Data Streams
Managed Apache Kafka ecosystem	MSK
Durable orchestration with retries/branches	Step Functions

Use queues to buffer bursts and protect downstream capacity.
Design consumers for duplicate delivery and idempotency; use DLQs and replay procedures.
Choose synchronous APIs only when the caller needs an immediate response and dependency availability/latency are acceptable.

Infrastructure as Code

CloudFormation: declarative AWS resource stacks, drift/change sets, nested or StackSets patterns.
CDK: define infrastructure in programming languages, synthesize to CloudFormation; review generated templates and construct versions.
Make deployments repeatable; keep secrets out of templates and parameter values; plan rollback and stateful-resource replacement carefully.

Common Traps

Multi-AZ database deployment improves availability; a read replica is for read scale/DR and may require promotion.
Global Accelerator routes users to healthy endpoints; CloudFront caches content at edge.
SQS, SNS, EventBridge, Kinesis, and MSK solve different messaging/streaming shapes.
S3 storage class savings can be offset by retrieval, request, transition, and minimum-duration costs.
Adding a cache improves performance only if the access pattern and invalidation strategy fit.
Managed services reduce infrastructure tasks, not IAM, network, quota, monitoring, or cost responsibilities.

30-Second Review

State latency, data consistency, RTO/RPO, scale, and operational constraints.
Select compute and persistence independently; avoid forcing one service to do everything.
Identify failure domains and scaling bottlenecks.
Add least privilege, encryption, observability, and tested recovery.
Compare plausible alternatives on total operational cost, not service price alone.

Official References

Domain 3 Cheatsheet: Continuous Improvement

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 3 overview and the linked service guides.

Focus: improve an existing workload using evidence. Measure first, identify the bottleneck or risk, apply the smallest effective change, and verify the outcome.

Observability and Operations

Question	Service / pattern
What are metrics, logs, alarms, dashboards?	CloudWatch
Who made an AWS API call or changed a resource?	CloudTrail
Where is latency/failure occurring across service calls?	X-Ray / distributed tracing
How do I automate fleet operations and patching?	Systems Manager
How do I assess architecture against best practices?	Well-Architected Tool / Framework
How do I monitor/request service quotas?	Service Quotas + CloudWatch alarms where supported

Use correlation IDs and traces across service boundaries; metrics alone rarely pinpoint distributed latency.
Separate audit logs (CloudTrail) from application logs and performance telemetry.
Automate repeatable operational actions with Systems Manager, controlled roles, approvals, and audit trails.

Reliability and Recovery

Requirement	Pattern
Recover after AZ failure	Multi-AZ architecture, health checks, automated failover
Recover after Region loss with lowest cost	Backup and restore
Faster recovery with some standby footprint	Pilot light / warm standby
Near-continuous service across Regions	Multi-site active-active, with explicit data consistency design
Centralized policy-driven backups	AWS Backup; cross-account/cross-Region copy where supported

RTO = acceptable recovery time; RPO = acceptable data loss window.
Replication is not backup; protect against logical corruption/deletion and test restore.
Distinguish high availability within one Region from disaster recovery across Regions.
Test runbooks, failover, failback, DNS/traffic behavior, and data promotion—not only backup completion.

Cost and Performance

Tool / practice	Use
Cost Explorer	Historical cost, trends, forecasts, filters, rightsizing views
Compute Optimizer	Utilization-based rightsizing recommendations for supported resources
Trusted Advisor	Broad best-practice checks; available checks/features depend on support plan/current offering
Savings Plans / Reserved options	Commit to steady eligible usage after analyzing duration and flexibility
S3 lifecycle/storage analysis	Tier data based on access and retrieval economics
Load/performance testing	Confirm bottleneck before scaling or caching

Optimization loop: baseline -> identify idle/oversized or bottleneck -> choose low-risk change -> measure cost/performance/reliability -> document rollback.

Domain 4 Cheatsheet: Migration and Modernization

Fri, 09 Oct 2026 00:00:00 +0000

Deeper notes: Domain 4 overview and the linked service guides.

Focus: select the right workload strategy, tool, target, and cutover plan. Validate service availability and current exam-guide objectives.

The 7 Rs (Terminology Varies)

Strategy	Cue
Retire	Decommission an unneeded workload after dependency/owner validation
Retain	Keep due to timing, compliance, technical constraints, or business need
Rehost	Move with minimal changes; MGN can replicate eligible servers to EC2
Relocate	Move a supported platform/environment with limited redesign; confirm current support
Repurchase	Replace with SaaS or a different product
Replatform	Make limited cloud optimizations without a full redesign
Refactor / re-architect	Change architecture to achieve business outcomes unavailable through smaller changes

Tool Selection

Work unit / requirement	Tool or pattern	Not this
Physical/virtual server rehost with block replication	AWS Transform MGN	DMS or Migration Hub
Database full load + ongoing CDC	AWS DMS; schema conversion assessed separately	MGN
Online file/object copy, repeatable tasks, integrity checks	DataSync	Transfer Family for bulk NAS migration
Partner SFTP/FTPS/AS2 interface to S3/EFS	Transfer Family	DataSync for per-user protocol access
Migration inventory and wave progress	Migration Hub / discovery tools	Data replication engine
Structured migration program, assessment, mobilization	AWS MAP	Technical migration service
Physical/offline transfer	Current eligible physical transfer option	Assume Snowball Edge is open to new customers

Cutover Checklist

Inventory owners, dependencies, data classification, source/target regions, licenses, and network flows.
Define RTO/RPO, allowed outage, freeze strategy, validation checks, go/no-go authority, and rollback.
Verify agent/endpoints, routes, DNS, identity, encryption, security groups, quotas, target capacity, and service compatibility.
Test representative workloads in target; confirm application behavior, not just infrastructure status.
Monitor replication/CDC lag or transfer errors; set a measurable cutover threshold.
Keep source systems/data recoverable until the acceptance window closes.

Modernization Choices

Microservices: independent business capabilities need separate scale/release/ownership; avoid distributed monoliths and shared writable databases.
Containers: package compatible applications; choose ECS for AWS-native simplicity, EKS for Kubernetes needs; state must live in durable external services.
Serverless: event-driven or variable workloads with managed operations; design for retries, idempotency, quotas, and downstream limits.
Database modernization: assess engine semantics, schema conversion, CDC, application SQL, performance, and cutover consistency separately.

Common Traps

Migration Hub tracks; it does not copy data.
DMS moves database data; it does not automatically convert every schema object or application query.
MGN rehosts servers; it does not containerize/refactor them.
Replication is not backup, nor proof of application consistency.
Physical transfer may meet bandwidth constraints but has eligibility, shipment, import, and scheduling risks.
“Zero downtime” requires a precise write and rollback strategy, not only a replication product.

Official References

Original SAP-C02 Practice Scenarios

Fri, 09 Oct 2026 00:00:00 +0000

These are free, original architecture exercises, not actual or reconstructed exam questions and not a timed/scored mock exam. Use a separate practice exam for full-length test simulation. Map each exercise to the current guide and decide before reading the recommendation.

Domain 1: Organizational Complexity

1. Organization-Wide Data Guardrails

Problem: A company has dozens of AWS accounts. Security requires that teams cannot disable central audit logging, while workload teams must still create resources independently. A small set of security administrators needs centralized findings.

SAP-C02 All-Services Review

Fri, 09 Oct 2026 00:00:00 +0000

One-line decision cues for final review. A service name is not an architecture: validate the workload, integration, limits, cost, and failure behavior in the linked notes and current AWS documentation.

Domain 1: Organizational Complexity

Service / topic	Recall cue
AWS Organizations	Multi-account hierarchy, consolidated governance, delegated administration
Service Control Policies	Account/OU maximum permissions; does not grant permissions
AWS Control Tower	Governed landing zone, account provisioning, controls
Landing zones	Account, identity, network, logging, security foundations
IAM	Workload/user authorization, roles, policies, federation
IAM Identity Center	Workforce SSO and permission sets across accounts
Resource Control Policies	Resource-side organization guardrails; does not grant access
AWS RAM	Share supported resources across accounts/OUs
AWS Config	Resource configuration history, rules, and compliance
Security Hub	Centralize security findings and standards checks
Security service selector	GuardDuty threat detection; Inspector vulnerability scanning; Macie S3 data discovery; WAF/Shield/Firewall Manager boundaries
Cost visibility	Cost Explorer analysis, Budgets alerts, billing exports, tags, commitments
Deployment strategies	CodePipeline orchestration, CodeBuild, CodeDeploy, canary/blue-green/rollback
Purpose-built database selector	Document, wide-column, graph, time-series, warehouse, search, cache, relational
AWS Elastic Disaster Recovery	Server replication to staging, recovery drills, launch, and failback
Transit Gateway	Scalable routed hub for VPCs and hybrid attachments
Direct Connect	Dedicated hybrid connectivity; encryption is not automatic
Site-to-Site VPN	IPsec tunnels for encrypted hybrid connectivity
Advanced VPC design	Routing, endpoints, inspection, segmentation, and hybrid DNS
Route 53	DNS, routing policies, health checks, and resolver integration

Domain 2: New Solutions

Service / topic	Recall cue
EC2	OS/instance control, specialized software, lift-and-shift
Auto Scaling	Replace/scale fleet capacity from demand and health signals
ECS	AWS-native container orchestration
EKS	Kubernetes API/ecosystem and associated operations
Lambda	Event-driven functions within runtime and quota constraints
CloudFront	Edge content delivery and caching
API Gateway	Managed API front door, auth, throttling, and integrations
Elastic Load Balancing	ALB L7, NLB L4, GWLB appliance insertion
Global Accelerator	Anycast static IPs and health-based global traffic routing
S3	Durable object storage, lifecycle, replication, and access controls
EFS	Shared elastic NFS file storage
FSx	Managed file systems for Windows, Lustre, ONTAP, and OpenZFS use cases
RDS / Aurora	Managed relational engines, HA, read scaling, and recovery
DynamoDB	Key-value/document access-pattern-first design
ElastiCache	In-memory cache; plan invalidation and fallback
OpenSearch	Search and log analytics with index/shard operations
Step Functions	Durable orchestration, retries, branches, and state
EventBridge	Event routing and filtering across services/accounts
SQS / SNS	Queue-based decoupling versus pub/sub fanout
Kinesis	Ordered/replayable streaming ingestion patterns
Amazon MSK	Managed Apache Kafka for Kafka-compatible workloads
CloudFormation	Declarative AWS infrastructure lifecycle and drift management
AWS CDK	Programmatic infrastructure synthesized to CloudFormation

Domain 3: Continuous Improvement

Service / topic	Recall cue
CloudWatch	Metrics, logs, alarms, dashboards, and operational signals
CloudTrail	AWS API audit events and governance evidence
X-Ray	Distributed request tracing and service maps
Systems Manager	Fleet operations, patching, sessions, automation
Cost Explorer	Analyze historical spend, trends, and forecasts
Compute Optimizer	Utilization-based rightsizing recommendations
Trusted Advisor	Broad best-practice checks; capabilities vary by plan
Well-Architected Tool	Review workloads against the six pillars
AWS Backup	Centralized policy-based backup and recovery
Resilience patterns	RTO/RPO, DR choices, failover, and fault isolation
Service Quotas	Monitor/request regional service capacity before limits

Domain 4: Migration and Modernization

Service / topic	Recall cue
AWS Transform MGN	Server block replication and EC2 rehost cutover
AWS DMS	Database full load, CDC, and supported engine migrations
DataSync	Online managed file/object transfers and recurring tasks
Snow Family	Physical data transfer concept; verify current eligibility/availability
Transfer Family	Managed SFTP/FTPS/FTP/AS2 and browser transfer interfaces
Migration Hub	Inventory and progress tracking, not replication
AWS MAP	Migration assessment/mobilization program, not a data mover
Microservices	Decompose by business boundary; migrate incrementally
Container migration	Package workloads; select ECS/EKS/Fargate based on fit
Serverless migration	Event-driven managed compute with retries/idempotency
Database migration patterns	Separate engine conversion, replication, validation, and cutover

Cross-Domain Rules

Explicit constraints outrank general preferences; reject any option that violates a hard requirement.
Identify the failure domain: host, AZ, Region, account, data store, network, or dependency.
Replication is not backup; multi-AZ is not multi-Region; a private connection is not automatically encrypted.
“Managed” does not remove the need for IAM, network, quotas, observability, testing, and cost controls.
Verify version-sensitive service availability, limits, pricing, and exam facts in current official sources.

🎯 Architecture Decision Notes

Textract — choose document intelligence, not just OCR

When the input is a scanned or photographed document and the requirement goes beyond “read the characters,” prefer a managed document-analysis service to building an OCR pipeline. The decision ladder:

SAP-C02 Exam Strategy

Fri, 09 Oct 2026 00:00:00 +0000

Confirm the current exam format and policies on the official AWS certification page before exam day. The study materials currently use 75 questions and 180 minutes as a planning baseline; if that changes, adjust all pacing below.

Time and Pacing

At 75 questions in 180 minutes, the arithmetic average is about 2.4 minutes per question. Long scenarios may need more time; short ones should give time back.

First pass: answer questions you can reason through confidently; mark uncertain or unusually long items and move on when progress stalls.
Second pass: return to marked items, compare the remaining options against the hard constraints, and use remaining time deliberately.
Final check: review unanswered questions, multi-select count, and accidental changes. Keep a time buffer rather than spending the whole exam on one scenario.
Avoid imposing an exact per-question deadline if the current exam interface or format differs; use checkpoints and adjust.

Parse Each Scenario

Name the business outcome: migrate by a deadline, reduce cost, increase availability, improve performance, meet compliance, or simplify operations.
Extract hard constraints: RTO/RPO, outage window, data loss, throughput/latency, protocols, region/account boundaries, encryption, licensing, budget, and “no code change” requirements.
Separate constraints from preferences: words such as “must,” “cannot,” and “minimum” usually disqualify options; “prefer” and “ideally” are optimization goals.
Identify the workload unit: account, network, server, database, file set, event stream, API, or application capability.
Choose the right layer: governance/planning, connectivity, migration execution, compute, data, or observability.
Check operational ownership: who patches, scales, restores, rotates credentials, tests failover, and responds to errors?

Eliminate Options

Reject options that:

SAP-C02 Final Exam Tips

Fri, 09 Oct 2026 00:00:00 +0000

The Last Review

Recheck the official exam guide, domain names, question count, duration, and test-day policies.
Review weak-domain cheatsheets first; spend remaining time on service comparisons and original scenarios.
Prioritize architecture decisions and trade-offs over memorizing console click paths or unstable quotas.
Sleep, prepare identification and appointment details, and follow the current testing-provider instructions.

High-Value Distinctions

SCP/RCP: permission ceilings, not grants.
Direct Connect/VPN: dedicated connectivity versus encrypted IPsec tunnels; DX is not encrypted by default.
ALB/NLB/GWLB: Layer 7 application routing / Layer 4 network performance / virtual appliance insertion.
CloudFront/Global Accelerator: content caching / global anycast routing to healthy endpoints.
SQS/SNS/EventBridge/Kinesis/MSK: queue / fanout / event routing / streaming data / Kafka-compatible event streaming.
Multi-AZ/read replica/backup/DR: availability / read scaling or recovery option / point-in-time protection / regional or broader recovery strategy.
CloudWatch/CloudTrail/X-Ray: telemetry / AWS API audit / distributed tracing.
MGN/DMS/DataSync/Transfer Family/Migration Hub: server rehost / database migration / file-object copy / partner protocol endpoint / migration tracking.

Scenario Habits

Underline non-negotiable requirements: downtime, data loss, encryption, access boundary, latency, compatibility, and budget.
Determine if the problem is new design, migration, modernization, or improvement of an existing system.
Draw the data and control flows. Mark trust boundaries, failure domains, and source of truth.
Pick the smallest viable architecture that meets the hard requirements.
Check the failure case, recovery path, and operational owner.
Eliminate options that add unneeded code changes, manual steps, or cost when a managed fit exists.

Common Traps — the 30 that decide pass/fail

Identity & access

SAP-C02 In-Scope Service Coverage Map

Fri, 09 Oct 2026 00:00:00 +0000

Version: SAP-C02, compared with AWS’s official in-scope service list and domain tasks on October 8, 2026. AWS states that the service list is non-exhaustive and subject to change; inclusion does not imply equal exam weight. This repo is not SAP-C03 material.

Use this map to distinguish deep study notes from short awareness cues. A service without a standalone file can still appear in an architecture scenario; use its official guide when a requirement depends on detailed feature behavior.

SAP-C02 Readiness Tracker

Fri, 09 Oct 2026 00:00:00 +0000

This is a study aid, not a score predictor. AWS reports a scaled score and does not define a raw-practice percentage that guarantees a pass. Use the official exam guide and AWS practice resources alongside this tracker.

Requested 90% Practice Target

Use 90% raw accuracy on two separate, fresh, timed full-length practice sets as a personal stretch target, with no domain below 85%. Take those mock exams separately through AWS or a provider such as Tutorial Dojo; this repository contains study notes and original scenario exercises, not full-length mock exams. Review every miss and retest the underlying objective with different questions before treating a result as evidence of readiness.