Ranked Breakdown
Struggling with AWS exam questions on IAM, VPCs, S3 consistency, or RDS failover? Here are the 10 concepts that trip up even experienced engineers, explained clearly with real architectural context.
Checking sign-in status...
Most AWS exam mistakes don’t come from topics you never studied. They come from topics you thought you understood. Below are ten concepts that reliably produce this problem – not because they’re obscure, but because common explanations are incomplete or the exam tests a nuance most materials gloss over.
Identity‑based policies attach to IAM principals (users, groups, roles) and define what they can do.
Resource‑based policies attach to resources (S3 buckets, SQS queues, KMS keys) and define who can access them.
For cross‑account access, you typically need both – the resource‑based policy must grant access to the external account, and the identity‑based policy must permit the action. Exception: a resource‑based policy can delegate trust directly to a principal in another account, eliminating the need for an explicit identity policy.
Since late 2020, S3 provides strong read‑after‑write consistency for all operations in all regions. After a PUT, any GET returns the new object; after a DELETE, GET returns 404; LIST reflects completed writes.
What this does not mean: S3 is now a strongly consistent database for read‑modify‑write loops. Concurrent writes or atomic operations are not supported. For true transactional needs, look elsewhere.
Multi‑AZ = high availability. Synchronous standby in another AZ. Automatic failover. Standby is not accessible for reads.
Read Replicas = read scaling. Asynchronous replication. No automatic failover (manual promotion only). Can have multiple replicas.
Related: AWS Solutions Architect Associate vs Professional: What Actually Changes?
Multi‑AZ is for surviving failures. Read Replicas are for surviving load. They are complementary.
Security Groups are stateful. Allow inbound = return traffic automatically permitted. No explicit deny rules.
Network ACLs are stateless. Need separate inbound and outbound rules for ephemeral ports (1024‑65535). They support explicit deny rules.
Troubleshooting hint: if inbound looks right but responses don’t return, suspect missing NACL outbound rule.
When a consumer reads a message, it becomes invisible for the visibility timeout. If processing succeeds, the consumer deletes it. If it fails or timeout expires, the message becomes visible again.
This is at‑least‑once, not exactly‑once. Long visibility timeouts delay retries of failed messages. For exactly‑once, use FIFO queues with deduplication IDs.
VPC Peering – direct, non‑transitive connection between two VPCs. Full mesh for 10 VPCs requires 45 connections.
Transit Gateway – regional hub that supports transitive routing and cross‑account connections. Scales linearly.
Use peering for 2‑3 VPCs with no growth. Use Transit Gateway for many VPCs or transitive routing needs.
To serve updated content immediately, you have two options:
Reducing TTL helps for future updates, but does nothing for content already cached. Versioned filenames are the architectural solution.
Related: How to Know If You're Actually Ready for the AWS Solutions Architect Associate Exam
Reserved concurrency caps a function’s maximum concurrent executions, protecting it from other functions and limiting its own scale.
Provisioned concurrency pre‑initializes execution environments to eliminate cold starts (costs for idle capacity).
Cold start problem → provisioned concurrency. Need to guarantee or limit capacity → reserved concurrency.
Aurora advantages: storage autoscaling (128 TB), 15 read replicas, faster failover, Serverless, Global Database.
But Aurora:
Read the engine requirement carefully before picking Aurora.
The line depends on the service type:
A question asking “Who patches the RDS OS?” – answer is AWS. Don’t apply the EC2 model to managed services.
For each concept, ask yourself:
The most effective reinforcement is scenario‑based practice – not flashcards, but realistic questions that force you to choose between similar options. That’s what ExamOS provides: daily scenario practice that makes these distinctions second nature.
The table provides how each of the concept is important for different certifications.
| Topic | Archictect | Developer | CloudOps |
|---|---|---|---|
| IAM: Identity vs Resource Policies | High | High | Medium |
| S3 Strong Consistency | Medium | High | Medium |
| RDS Multi-AZ vs Read Replicas | High | Medium | High |
| Security Groups vs NACLs | High | Medium | High |
| SQS Visibility Timeout | Medium | High | Medium |
| VPC Peering vs Transit Gateway | High | Low | High |
| CloudFront Invalidation vs TTL | Medium | Medium | Low |
| Lambda Reserved vs Provisioned Concurrency | Medium | High | Medium |
| Aurora vs RDS Tradeoffs | High | Medium | Medium |
| Shared Responsibility Model | Medium | Medium | High |
Legend: High = commonly tested and conceptually important Medium = appears regularly but usually not a primary domain focus Low = possible but less emphasized
Every concept here is a pair of things that look similar but solve different problems. Multi‑AZ vs. Read Replicas. Reserved vs. Provisioned concurrency. Identity‑based vs. resource‑based policies.
The skill isn’t knowing what each does. It’s knowing when to use which one – and being able to defend the choice. Build that skill, and the exam (and the job) takes care of itself.
👉 Other Related exams:
AWS Solutions Architect Associate : SAA-C03
AWS Solutions Architect Professional : SAP-C02
AWS Developer Associate : DVA-C02
AWS CloudOps Engineer Associate : SOA-C03
AWS DevOps Engineer Professional : DOP-C02