Exam Service Picker
💡 Most Pro-level questions boil down to "which service." Read the cue in the left column, know the answer on sight. Drill this page until every row is instant.
Messaging & Eventing
| Cue in the question | Answer |
|---|
| "Decouple producer/consumer, buffer work, retry until processed" | SQS |
| "Order matters / exactly-once processing" | SQS FIFO |
| "Push one message to many subscribers (email, SMS, Lambda, SQS)" | SNS |
| "Fan out to multiple queues, each consumer independent" | SNS → SQS fan-out |
| "React to AWS service events / route by content / cron" | EventBridge |
| "SaaS (Stripe, Datadog) events into AWS" | EventBridge partner bus |
| "Real-time streaming, replayable, multiple consumers reading same data" | Kinesis Data Streams |
| "Just deliver the stream to S3/Redshift/OpenSearch, no code" | Kinesis Data Firehose |
| "SQL on a live stream" | Managed Flink (Kinesis Analytics) |
| "Lift-and-shift RabbitMQ/ActiveMQ" | Amazon MQ |
Monitoring & Audit (the Trifecta + friends)
| Cue | Answer |
|---|
| "WHAT is happening — metrics, alarms, dashboards" | CloudWatch |
| "WHO made this API call" | CloudTrail |
| "WHAT CHANGED in resource configuration / compliance over time" | AWS Config |
| "Trace one request across microservices, find the slow hop" | X-Ray |
| "Is it AWS's outage or mine / EC2 scheduled maintenance events" | AWS Health |
| "Alarm on text appearing in logs" | Metric filter → alarm |
| "Stream logs elsewhere in near-real-time" | Subscription filter → Kinesis/Lambda |
| "Top-N contributors (which IP causes most errors)" | Contributor Insights |
| "Monitor endpoint with synthetic traffic before users notice" | CloudWatch Synthetics |
| "Anomaly-based alarm, threshold varies by time of day" | CloudWatch Anomaly Detection |
Security Findings
| Cue | Answer |
|---|
| "Active threat, compromised instance, crypto mining, anomalous behavior" | GuardDuty |
| "Known CVEs / vulnerabilities in EC2, ECR images, Lambda" | Inspector |
| "PII or secrets sitting in S3" | Macie |
| "One dashboard aggregating all findings + compliance standards" | Security Hub |
| "Investigate/visualize how a finding unfolded" | Detective |
| "Hardcoded secrets in source code at PR time" | CodeGuru Reviewer Secrets Detector |
| "Who can access this resource from outside the account" | IAM Access Analyzer |
| Cue | Answer |
|---|
| "Deploy app revisions to EC2/on-prem/Lambda/ECS with hooks + rollback" | CodeDeploy |
| "PaaS — give AWS the code, it provisions everything" | Elastic Beanstalk |
| "Chef/Puppet cookbooks mentioned" | OpsWorks (deprecated but still tested) |
| "Serverless shorthand on CloudFormation + local testing" | SAM |
| "Infrastructure in TypeScript/Python" | CDK |
| "Approved self-service templates for developers, governed" | Service Catalog |
| "Same stacks to 50 accounts/regions, auto-deploy to new OU accounts" | CloudFormation StackSets (service-managed) |
| "Static/SSR web app hosting with Git-push deploys and PR previews" | Amplify |
| "Golden AMI build/test/distribute pipeline" | EC2 Image Builder |
Deployment Strategies
| Cue | Answer |
|---|
| "Zero extra infrastructure, downtime OK" | All at once / in-place |
| "No downtime, reduced capacity OK, no new instances" | Rolling |
| "No downtime, full capacity, temporary extra instances" | Rolling with additional batch (Beanstalk) / Immutable |
| "Instant rollback by swapping environments/traffic" | Blue/Green |
| "Small % first, watch alarms, then shift all" | Canary |
| "Steady gradual traffic shift" | Linear |
| "Test with copy of production traffic, no user impact" | Traffic mirroring / shadow testing |
Configuration Management & State
| Cue | Answer |
|---|
| "Run a command on 500 instances, no SSH" | SSM Run Command |
| "Keep configuration continuously applied (drift back)" | SSM State Manager |
| "OS patching on schedule with compliance reporting" | SSM Patch Manager + Maintenance Windows |
| "Multi-step operational runbook (snapshot → patch → verify)" | SSM Automation |
| "Shell access, audited, no bastion/port 22" | SSM Session Manager |
| "Inventory software across fleet" | SSM Inventory (+ Athena via Resource Data Sync) |
| "Manage on-premises servers with AWS tooling" | SSM Hybrid Activation |
| "Feature flags / gradual config rollout with rollback on alarm" | AppConfig |
Secrets & Keys
| Cue | Answer |
|---|
| "Automatic rotation of DB credentials" | Secrets Manager |
| "Free config/secret storage, no rotation needed" | SSM Parameter Store |
| "Encrypt data / control the keys / envelope encryption" | KMS |
| "FIPS 140-2 Level 3 / single-tenant hardware / you control everything" | CloudHSM |
| "TLS certificates, auto-renewal" | ACM |
Permissions Model
| Cue | Answer |
|---|
| "Cap what an entire ACCOUNT can ever do" | SCP |
| "Cap what one role/user can do (prevent privilege escalation)" | Permissions boundary |
| "Grant permissions to identity" | IAM identity policy |
| "Grant cross-account access on the resource itself" | Resource-based policy |
| "Access by team/project tags, no per-team policies" | ABAC |
| "Workforce SSO to many accounts" | IAM Identity Center |
| "On-prem servers need AWS credentials via X.509 certs" | IAM Roles Anywhere |
| "Third party assumes your role safely" | ExternalId condition |
Multi-Account Governance
| Cue | Answer |
|---|
| "Consolidated billing + account grouping + SCPs" | Organizations |
| "Landing zone, guardrails, Account Factory" | Control Tower |
| "Share resources (subnets, AMIs, Image Builder) across accounts" | RAM |
| "Same CloudFormation stack in every account" | StackSets |
| "Aggregate Config/Security Hub/GuardDuty org-wide" | Delegated administrator + aggregator |
Resilience & DR (cheapest → fastest recovery)
| Cue | Answer |
|---|
| "Cheapest DR, hours of RTO" | Backup & Restore |
| "Core services replicated but switched off" | Pilot Light |
| "Scaled-down copy running, minutes RTO" | Warm Standby |
| "Zero RTO, both sites serve traffic" | Multi-Site Active/Active |
| "DNS-level failover" | Route 53 failover + health checks |
| "Database global, <1s RPO, <1min RTO" | Aurora Global Database |
| "Prove the system survives failure (chaos)" | AWS Fault Injection Service |
Compute & Containers
| Cue | Answer |
|---|
| "Containers, AWS-native simplicity, CodeDeploy blue/green" | ECS |
| "Kubernetes / portability / existing k8s tooling" | EKS |
| "Containers without managing instances" | Fargate |
| "Event-driven code, <15 min, no servers" | Lambda |
| "Long-running batch, interruptible, cheapest" | EC2 Spot (+ ASG capacity rebalancing) |
| "Web app PaaS with managed platform updates" | Beanstalk |
Storage
| Cue | Answer |
|---|
| "Block device for one EC2 instance" | EBS |
| "Shared POSIX filesystem, many instances/Lambdas" | EFS |
| "Objects, events, lifecycle, replication" | S3 |
| "Windows shares / Active Directory" | FSx for Windows |
| "On-prem apps need cloud storage via NFS/SMB/iSCSI" | Storage Gateway (File/Volume/Tape) |