This is the heaviest-weighted domain and heavily tests your ability to select the right IAM mechanism for a given scenario — knowing when to use roles vs. policies vs. resource-based policies vs. SCPs is critical. AWS frequently tests least-privilege principles in multi-account environments using AWS Organizations, and scenarios often involve cross-account access patterns. Expect trick questions that conflate authentication with authorization, or that offer overly permissive solutions as distractors.

💡 The most common pitfall is confusing when to use AWS Secrets Manager vs. SSM Parameter Store, and when to use S3 Block Public Access vs. bucket policies. Also watch for questions testing whether you know that Security Groups do NOT deny traffic explicitly — only NACLs support explicit deny rules.

This domain tests your architectural judgment around failure isolation and recovery, not just your knowledge of individual services. You must understand the difference between high availability (minimize downtime) and fault tolerance (zero downtime with no degradation), and AWS maps specific service configurations to each. Multi-AZ vs. Multi-Region trade-offs appear frequently, and you must know which services are inherently regional/global vs. which require explicit configuration.

💡 A common trap is selecting Multi-AZ RDS when the question actually needs a read replica for performance, or vice versa. Also, candidates frequently overlook that S3 is already highly durable and regionally redundant by default — adding cross-region replication is only needed for disaster recovery scenarios, not basic HA.

This domain rewards candidates who understand service-specific performance levers rather than general concepts — you need to know, for example, that ElastiCache with Redis supports complex data structures while Memcached is simpler and multi-threaded, or that EBS gp3 allows you to provision IOPS independently of volume size. Questions are heavily focused on bottleneck identification: given a slow system, which specific AWS feature or service change resolves the constraint.

💡 Candidates frequently confuse Kinesis Data Streams (real-time, custom consumers, retention) with Kinesis Data Firehose (near-real-time, managed delivery to S3/Redshift/Elasticsearch, no custom consumers). Also watch for questions about Global Accelerator vs. CloudFront — GA is for TCP/UDP non-HTTP workloads and static IPs, not for caching.

This domain tests your ability to match AWS purchasing models and storage tiers to workload characteristics — the right answer almost always involves the most specific tool rather than the most powerful one. AWS consistently rewards right-sizing and lifecycle automation over brute-force provisioning. Expect scenarios that require you to balance cost reduction against a minimum service level, meaning you cannot simply choose the cheapest option if it violates the stated availability or performance requirement.

💡 The most common mistake is recommending Reserved Instances for unpredictable or short-lived workloads where Savings Plans or Spot would be cheaper and more flexible. Also, candidates often overlook that S3 Intelligent-Tiering has a monitoring fee per object, making it cost-ineffective for very small objects or infrequently accessed buckets with millions of tiny files.