SAP-C02 Exam Notes

Global Tables = multi-master, any region accepts writes, eventual consistency, last-writer-wins. Use for globally distributed low-latency reads AND writes where occasional conflict overwrites are acceptable. Aurora Global = single writer region, other regions are read-only replicas, strong consistency for writes. Use when write consistency is non-negotiable but you want multi-region reads and fast DR failover.

Standard = long-running (up to 1 year), exactly-once, full execution history visible in console, costs per state transition. Use for business workflows, human-in-the-loop, anything needing audit trails. Express = short-lived (max 5 min), at-least-once, high throughput, costs per execution duration. Use for IoT event processing, high-volume data pipelines, streaming transformations. The exam will give you a human approval step — that is always Standard.

Reserved Concurrency = sets a hard cap on how many concurrent executions a function can have. Guarantees that capacity is available (no competition) but also acts as a throttle. Provisioned Concurrency = pre-warms execution environments to eliminate cold starts. Costs money even when no invocations are happening. If the question is about protecting downstream services from Lambda bursts, choose reserved. If the question is about eliminating cold start latency for latency-sensitive APIs, choose provisioned.

Kinesis Data Streams = real-time (<200ms), custom consumer logic, multiple independent consumers, configurable retention (1-365 days), requires shard management or on-demand mode. Firehose = fully managed delivery to S3/Redshift/OpenSearch/Splunk, minimum 60-second buffer, no custom consumer, auto-scales. If the question asks for real-time processing with custom logic, use Streams. If the question just needs data reliably delivered to a destination, Firehose is simpler.

CloudFront Functions = viewer request/response only, sub-millisecond, no network access, 10 KB code limit, lowest cost. Use for URL rewrites, header manipulation, cache key normalization. Lambda@Edge = all four CloudFront trigger points, up to 30 seconds (origin), full Node.js/Python, can make network calls. Use for auth at edge, A/B testing, dynamic origin selection. The key disqualifier for CloudFront Functions: any network call or computation beyond simple string manipulation.

Standard = unlimited throughput, at-least-once delivery, best-effort ordering. Messages may arrive out of order or be processed multiple times — design consumers to be idempotent. FIFO = 300 TPS (3,000 with batching), exactly-once processing within a message group, strict ordering within groups. Use FIFO when order matters and duplicate processing would cause incorrect results (financial transactions, sequential state changes).

SCPs = applied at the account or OU level, restrict all principals in that account (except management account and service-linked roles). Set by the organization admin. Permission Boundaries = applied to a specific IAM user or role, restrict that entity's max permissions. Set by an account admin. Both restrict but neither grants. Use SCPs for org-wide governance, use permission boundaries for safe delegation (e.g., allowing a team to create roles but only up to a defined ceiling).

Transit Gateway = regional network hub connecting VPCs, VPN connections, and Direct Connect. Handles VPC-to-VPC routing and on-premises routing in one place. Supports route table segmentation. Direct Connect Gateway = allows a single Direct Connect connection to access VPCs in multiple regions without a separate connection per region. Does NOT route VPC-to-VPC traffic. Choose TGW when you need transitive routing. Use DXGW when you just need one DX link to reach multiple regions.

Control Tower = a governance and account vending product. Sets up the landing zone, account factory, mandatory guardrails, centralized logging. Uses StackSets internally. CloudFormation StackSets = a deployment mechanism that pushes a CloudFormation stack to multiple accounts and regions. Use Control Tower to govern your org. Use StackSets to deploy specific infrastructure across accounts. They complement each other — Control Tower even supports deploying custom StackSets alongside its own guardrails.

PrivateLink = one-directional, service-level exposure. A provider creates an Endpoint Service backed by an NLB; consumers create Interface VPC Endpoints to reach that specific service. No routing changes needed, works across overlapping CIDRs, provider cannot initiate connections. VPC Peering = bidirectional, full network-level connectivity between two VPCs. Any resource in one VPC can reach any resource in the other. Requires non-overlapping CIDRs. PrivateLink is more secure for service-to-service exposure; peering for when full network access is needed.

Organization Trail = created in the management account, automatically applies to all current and future member accounts, centrally managed, stored in a central S3 bucket in the Log Archive account. Member accounts cannot modify or delete it. Per-Account Trail = created within each account independently, each account manages its own. For enterprise compliance, always use the Organization Trail — it provides tamper-resistant centralized audit logs.

Lazy Loading = application checks cache first; on miss, reads from DB and writes to cache. Pro: only caches requested data. Con: cache miss adds latency, data can go stale until TTL expires. Write-Through = every write to DB also writes to cache. Pro: cache is always fresh. Con: write latency increases, cache fills with data that may never be read. If the scenario says 'some stale data is acceptable' or asks to 'minimize write latency', lazy loading wins. If 'data freshness is critical', write-through wins.

Compute Optimizer = uses ML to analyze CloudWatch utilization data and recommend optimal instance types, memory settings (Lambda), volume types (EBS). Actionable rightsizing recommendations. Cost Explorer = financial analytics tool showing spend trends, forecasts, reserved instance coverage, savings plan recommendations based on spend patterns. For 'reduce cost by rightsizing infrastructure', choose Compute Optimizer. For 'analyze where money is being spent', choose Cost Explorer.

Pilot Light = only the data tier (database) is running in the DR region. Compute is pre-configured but stopped or not yet launched. RTO is tens of minutes (time to start/scale compute). RPO is minutes (last replication point). Warm Standby = a scaled-down but fully operational copy of the production environment runs in the DR region. Can serve traffic immediately at reduced capacity, then scale out. RTO is minutes. More expensive than Pilot Light. When a question gives you a specific RTO target and asks for the cheapest solution that meets it, Pilot Light works for RTO ~30 min. Warm Standby for RTO ~5-15 min.

Lifecycle Policies = rule-based transitions based on object age (e.g., move to IA after 30 days, Glacier after 90 days). Best when access patterns are predictable and known upfront. Intelligent-Tiering = monitors access patterns per object and automatically moves between frequent/infrequent/archive tiers. No retrieval fees for frequent/infrequent. Small per-object monitoring fee (~$0.0025/1,000 objects/month). Minimum 128 KB object size for cost benefit. Use Intelligent-Tiering when access patterns are unknown or unpredictable.

DMS = migrates and replicates DATABASES. Supports Full Load (bulk copy) + CDC (ongoing change replication). Handles heterogeneous migrations with SCT. Source/target engines: Oracle, SQL Server, MySQL, PostgreSQL, MongoDB, DynamoDB, and more. DataSync = transfers FILE and OBJECT data at high speed with scheduling and integrity verification. Works with NFS, SMB, HDFS, S3, EFS, FSx. Cannot read database transaction logs or handle schema conversion. Never use DMS for files, never use DataSync for databases.

MGN = one-time migration. Replicates servers to AWS, you perform test migrations, then cutover and decommission the source. Purpose is to move workloads off the source environment permanently. DRS = ongoing DR. Continuously replicates production servers to a low-cost staging area in AWS. On a real disaster, launch the recovery instances. Source keeps running normally. Use MGN to migrate, use DRS for ongoing DR after you're on AWS.

Rehost = move the application to AWS with NO changes to the application code or architecture. Uses MGN to replicate and launch the same server image on EC2. Fastest, lowest risk, lowest cloud benefit. Replatform = make targeted optimizations without changing core architecture. Example: swap self-managed MySQL on EC2 for Amazon RDS (same MySQL, managed service), swap self-managed Tomcat for Elastic Beanstalk. Some code or config changes required but the application logic is unchanged. Better cloud benefit, more effort than Rehost.

Agentless = deploys as a VMware appliance into vCenter. Collects basic VM info (IP, MAC, hostname, CPU/memory allocation, running processes). Only works for VMware vCenter environments. Agent-based = installs a lightweight agent on each server (Windows/Linux). Collects detailed performance data, process info, and network connection data to map application dependencies. Works on any OS, physical or virtual. When question says 'map application dependencies' or 'unknown dependencies', agent-based is required.

File Gateway = permanent hybrid integration. On-premises applications continue to access files via NFS/SMB as if it were a local file share, but data is stored in S3. Local cache stores frequently accessed files. No migration timeline — it is an ongoing solution. DataSync = scheduled or one-time high-speed data transfer. Optimized for bulk transfers, supports scheduling, provides integrity verification. Use File Gateway when on-premises apps need continuous S3 access. Use DataSync for bulk migration or recurring scheduled transfers.