Blog Post
Struggling with AWS exam questions on IAM, VPCs, S3 consistency, or RDS failover? Here are the 10 concepts that trip up even experienced engineers, explained clearly with real architectural context.
Checking sign-in status...
Most AWS exam mistakes don’t come from topics you never studied. They come from topics you thought you understood. Below are ten concepts that reliably produce this problem, not because they are obscure, but because common explanations are incomplete or the exam tests a nuance most materials gloss over.
Related: AWS SAA-C03 Study Plan ↗
Identity‑based policies attach to IAM principals (users, groups, roles) and define what they can do. Resource‑based policies attach to resources (S3 buckets, SQS queues, KMS keys) and define who can access them.
For cross‑account access, you typically need both: the resource‑based policy must grant access to the external account, and the identity‑based policy must permit the action. Exception: a resource‑based policy can delegate trust directly to a principal in another account, eliminating the need for an explicit identity policy.
Since late 2020, S3 provides strong read‑after‑write consistency for all operations in all regions. After a PUT, any GET returns the new object; after a DELETE, GET returns 404; LIST reflects completed writes.
What this does not mean: S3 is now a strongly consistent database for read‑modify‑write loops. Concurrent writes or atomic operations are not supported. For transactional needs, look elsewhere.
Multi‑AZ provides high availability. It maintains a synchronous standby in another AZ. It supports automatic failover. Standby is not accessible for reads. Read Replicas provide read scaling. They use asynchronous replication. They do not support automatic failover and require manual promotion. You can have multiple replicas.
Multi‑AZ is for surviving failures. Read Replicas are for surviving load. They are complementary.
Security Groups are stateful. Allowing inbound traffic automatically permits return traffic. They do not support explicit deny rules. Network ACLs are stateless. They require separate inbound and outbound rules for ephemeral ports (1024‑65535). They support explicit deny rules.
Troubleshooting hint: if inbound looks right but responses don’t return, suspect missing NACL outbound rule.
When a consumer reads a message, it becomes invisible for the visibility timeout. If processing succeeds, the consumer deletes it. If it fails or timeout expires, the message becomes visible again.
This is at‑least‑once, not exactly‑once. Long visibility timeouts delay retries of failed messages. For exactly‑once, use FIFO queues with deduplication IDs.
VPC Peering is a direct, non‑transitive connection between two VPCs. Full mesh for 10 VPCs requires 45 connections. Transit Gateway is a regional hub that supports transitive routing and cross‑account connections. It scales linearly.
Use peering for 2‑3 VPCs with no growth. Use Transit Gateway for many VPCs or transitive routing needs.
To serve updated content immediately, you have two options:
Reducing TTL helps for future updates, but does nothing for content already cached. Versioned filenames are the architectural solution.
Reserved concurrency caps a function’s maximum concurrent executions, protecting it from other functions and limiting its own scale. Provisioned concurrency pre‑initializes execution environments to eliminate cold starts, which incurs costs for idle capacity.
Use provisioned concurrency to solve cold start problems. Use reserved concurrency when you need to guarantee or limit capacity.
Aurora advantages include storage autoscaling up to 128 TB, 15 read replicas, faster failover, Serverless, and Global Database. But Aurora:
Read the engine requirement carefully before picking Aurora.
The line depends on the service type:
For a question asking who patches the RDS OS, the answer is AWS. Do not apply the EC2 model to managed services.
For each concept, ask yourself:
The most effective reinforcement is scenario‑based practice, such as realistic questions that force you to choose between similar options. ExamOS provides this through the Daily Sprint, which makes these distinctions second nature.
The table shows how important each concept is for different certifications.
| Topic | Archictect | Developer | CloudOps |
|---|---|---|---|
| IAM: Identity vs Resource Policies | High | High | Medium |
| S3 Strong Consistency | Medium | High | Medium |
| RDS Multi-AZ vs Read Replicas | High | Medium | High |
| Security Groups vs NACLs | High | Medium | High |
| SQS Visibility Timeout | Medium | High | Medium |
| VPC Peering vs Transit Gateway | High | Low | High |
| CloudFront Invalidation vs TTL | Medium | Medium | Low |
| Lambda Reserved vs Provisioned Concurrency | Medium | High | Medium |
| Aurora vs RDS Tradeoffs | High | Medium | Medium |
| Shared Responsibility Model | Medium | Medium | High |
Legend: High = commonly tested and conceptually important Medium = appears regularly but usually not a primary domain focus Low = possible but less emphasized
Every concept here is a pair of things that look similar but solve different problems. Examples include Multi‑AZ versus Read Replicas, Reserved versus Provisioned concurrency, and identity‑based versus resource‑based policies.
You must know when to use each service and be able to defend that choice. Build that skill, and the exam and the job take care of themselves.
Yes, Amazon S3 provides strong read-after-write consistency for PUT, DELETE, and LIST operations of objects in all AWS regions. This applies to both new objects and overwrites of existing objects.
Standard Multi-AZ standby instances are passive and cannot accept read traffic. To scale read volume, you must deploy read replicas or use a Multi-AZ DB cluster deployment with readable standbys.
Security groups are stateful firewalls. They automatically track connection states and allow return traffic for any permitted inbound request, regardless of outbound rules.
The visibility timeout temporarily hides a message from other consumers while one consumer processes it. If the consumer fails to delete the message before the timeout expires, the message becomes visible again.