CertKata

AWS Certified Solutions Architect - Professional — Free Essentials

Key facts distilled from CertKata's SAP-C02 question bank. Free to read — no account needed.

SCPs are a ceiling, never a grant

IAM policy evaluation order: an explicit deny always wins, then an explicit allow is considered, and anything not explicitly allowed is implicitly deniedAPI requestAny explicit Deny?DENYYESNOAny explicit Allow?ALLOWYESNOImplicit DENY(the default)an explicit Deny can never be overridden by an Allowa permissions boundary caps what any Allow can grant

An SCP sets the maximum permissions available anywhere in its scope. An explicit IAM allow can never exceed it, so an SCP deny beats a local allow - which is the usual explanation when a developer is refused an action their own policy permits. That makes the SCP the right tool wherever enforcement must survive a local administrator: denying LeaveOrganization, restricting Regions, requiring a permissions boundary on role creation, or an allow-list that permits only approved services and denies the rest by default. Attached at a parent OU or the root, it is inherited by anything created beneath, so a new OU is covered without anyone remembering a step.

Matching consistency to the requirement

Apply strong consistency where correctness depends on it and eventual consistency where it does not, rather than forcing one model across an application. Browsing tolerates stale stock; the checkout reservation must be authoritative, so strong consistency belongs there and nowhere else on the page. A leaderboard tolerates seconds of staleness while a tournament's final result takes a strongly consistent read from the authoritative store. Across Regions the same choice appears as DynamoDB Global Tables, which accept writes everywhere, against Aurora Global Database, which centralises writes and replicates for local reads.

Read the symptom before changing capacity

Vertical scaling increases the size of a single instance, while horizontal scaling increases the number of instances sharing the loadVERTICALSCALE UP / DOWN1x4xsame instance,more capacityHORIZONTALSCALE OUT / IN1x1x1x1xmore instances, load sharedstateless workloads scale out; stateful ones resist itautoscaling groups implement the horizontal case

A bigger instance is the reflex that usually misses. A larger node is still a single point of failure; a larger instance buys time against an algorithmic mismatch such as a relational scan doing geospatial work; a bigger database defers rather than removes a per-query ceiling. A hot partition is key design, not capacity - overall throughput does not help one overloaded partition, and the fix is a write-sharding suffix. Rising Kinesis iterator age means consumption lags production, so scale consumers rather than cutting retention. Distance to a single-Region origin is fixed by edge caching, not by scaling the origin.

The 7 Rs, and choosing one per workload

Rehost moves an application largely unchanged and is fastest when optimisation is deliberately deferred. Replatform makes a moderate change during the move, such as containerising, without a deeper re-architecture. Refactor genuinely re-architects - moving from scheduled batch to event-driven, or parallelising a calculation to meet a runtime the sequential design cannot. Repurchase swaps the component, for instance a commercial database for a managed equivalent to shed licensing. Retire is correct when the assessment says the application no longer earns its keep. The choice is per workload: a rarely changed application gains little from refactoring.

Choosing compute for the shape of the load

Match the purchasing and execution model to the demand curve. A few weeks of extreme demand then near-zero suits elastic On-Demand or Spot over any commitment sized for the peak; a genuinely spiky pattern suits Fargate or Lambda, which scale from zero; a periodic interruption-tolerant GPU job suits Spot. Known event timing calls for scheduled scaling ahead of the moment traffic arrives, with reactive scaling catching the overflow. AWS Batch fits queued parallel work by scaling to queue depth, and a Capacity Reservation actually holds capacity in an AZ, which an Auto Scaling group is merely permitted to request.

This is a preview. Get the full SAP-C02 cheat sheet — every domain, bundled with the practice question bank.

Sign up for the full version