DEV Community: ExamCert.App

A 3-Week Study Sprint for the GCP Professional Machine Learning Engineer (From Someone Who Nearly Over-Prepared)

ExamCert.App — Fri, 31 Jul 2026 15:15:34 +0000

I spent five weeks preparing for the Google Cloud Professional Machine Learning Engineer and about two of those weeks were wasted. I went deep on model architectures, loss functions, and the maths. The exam barely cares.

What it cares about is whether you can put a model into production on Google Cloud and keep it working. Here is the three-week sprint I would run if I did it again.

First, the reframe

The PMLE is an MLOps exam wearing an ML exam's name. Roughly, the weight sits on:

Framing an ML problem from a business requirement
Architecting the ML solution and data pipeline
Preparing and processing data at scale
Developing models — but at a tooling and decision level, not a research level
Automating and orchestrating pipelines
Monitoring, optimising, and maintaining models in production

Notice that only one of those six is model development, and even there the questions are "which service/approach" rather than "derive this."

The maths you need is conceptual: overfitting and regularisation, class imbalance, precision/recall trade-offs and when to optimise which, data leakage, training/serving skew. You will not be asked to compute a gradient. You will be asked which metric matters when a fraud model flags 0.1% of transactions — and the answer involves precision-recall rather than accuracy, because accuracy is meaningless on that imbalance.

Week 1 — Vertex AI, end to end

Vertex AI is the exam. Almost every question either is about it or is answered with it. Cover:

The training options ladder. AutoML when the team lacks ML expertise or time and the problem is standard. Pre-trained APIs (Vision, Natural Language, Speech, Translation, Document AI) when the problem is a solved commodity — do not train a custom image classifier when a question describes generic object detection. Custom training when you need control. BigQuery ML when the data lives in BigQuery and the team speaks SQL rather than Python. That ladder resolves a large share of questions on its own.

Vertex AI Pipelines — Kubeflow-based orchestration, components, artifacts, and why pipelines beat notebooks for anything that must be repeatable. Notebook-based answers are almost always wrong when reproducibility is mentioned.

Feature Store — the answer whenever a scenario describes the same features being computed differently in training and serving. That is training/serving skew and Feature Store is the canonical fix.

Model Registry, Endpoints, and prediction modes. Online endpoints for low-latency single predictions; batch prediction for large offline scoring. Traffic splitting between model versions for canary rollout. Private endpoints when a question mentions not traversing the public internet.

Model Monitoring — drift detection versus skew detection. Skew is training-vs-serving distribution difference; drift is serving distribution changing over time. The exam tests that distinction directly.

Explainable AI — feature attributions, and the fact that this is the answer for regulated scenarios requiring justification of individual predictions.

Week 2 — the data and pipeline half

This is where non-data-engineers lose the exam.

BigQuery as the default analytics and feature source, and BigQuery ML for in-warehouse modelling. Know that BQML supports a surprising range now and is often the right answer for a SQL-first team even when Python would be more flexible.

Dataflow for large-scale preprocessing, especially streaming feature computation. TensorFlow Transform / TFX conceptually — the point being that preprocessing defined once and applied identically at training and serving eliminates skew.

Data labelling, splitting, and leakage. Time-based splits for temporal data, not random ones. Group splits when multiple rows belong to the same entity. Leakage is a recurring distractor: a question describes a feature that would not be available at prediction time, and the correct answer is to remove it.

Handling imbalance — resampling, class weights, and choosing the right metric. And feature engineering basics: bucketing, crosses, embeddings for high-cardinality categoricals, normalisation.

Distributed training and hardware selection. GPU versus TPU: TPUs for large dense matrix operations in TensorFlow, GPUs for broader framework support and custom ops. Reduction Server for multi-node data-parallel training. Questions about cost usually favour preemptible/Spot VMs for fault-tolerant training jobs with checkpointing.

Week 3 — questions, only questions

By now you know the material. Week three is about learning how Google asks, and it is the week I underinvested in the first time round.

The exam's characteristic question shape is: a business scenario, a constraint you must notice, and four technically plausible options. The constraint is usually one clause — "the team has no ML engineers," "predictions must be returned in under 100 ms," "the model must be explainable to auditors," "cost is the primary concern." That clause picks the answer.

Training yourself to spot the deciding clause is a drill, not a reading exercise. I did a set of twenty questions a night and wrote one line per miss explaining which clause I had ignored. Working through a free GCP Professional Machine Learning Engineer practice test is well suited to this because the volume is what builds the reflex — after a hundred or so, you start reading scenarios for constraints before you read the options, which is exactly the habit the exam rewards.

The full PMLE objective breakdown is useful here as a coverage audit — if your misses cluster in one domain, that is your last-week study plan written for you.

What I would not spend time on

Deriving anything. No backpropagation, no closed-form solutions.
Deep architecture comparisons. You do not need to argue transformer variants.
Framework minutiae. You will not be asked to debug Keras syntax.
Long video courses. The content volume here does not justify forty hours of video; the difficulty is in decision-making, and video is a poor medium for practising decisions.

I burned most of two weeks on the first two bullets. That is the over-preparation I mentioned.

Prerequisites, honestly

This is a professional-tier exam and it assumes you have actually done ML work. If you have never trained and deployed a model, three weeks will not be enough regardless of how efficiently you study — the scenarios assume lived experience with things like a model that performed well offline and badly in production.

If you have shipped models but on another platform, three weeks is realistic. Your gap is Vertex AI's surface, not the concepts.

On explanations

The single most useful change to my study loop was insisting on understanding why the runner-up is wrong rather than only why the answer is right. On this exam two options are frequently both workable and one is eliminated by a single constraint. Running misses through the AI simulator at ai.examcert.app gives that comparative reasoning rather than a bare answer key, and on a decision-shaped exam that is where the learning actually is.

The sprint, in one line each

Week 1: Vertex AI end to end — training ladder, pipelines, feature store, endpoints, monitoring, explainability.
Week 2: data and pipelines — BigQuery/BQML, Dataflow, preprocessing, leakage, splits, imbalance, hardware.
Week 3: timed questions, one line per miss, docs only where misses cluster.

Three focused weeks beats five unfocused ones. I have now done both.

Don't Pay $1,199 for the CEH — Unless One of These Three Things Is True

ExamCert.App — Thu, 30 Jul 2026 15:13:30 +0000

Every time the CEH comes up on this site or on Reddit, the same fight breaks out. One camp says it's a paper cert that teaches nothing. The other says it got them hired.

Both camps are describing real experiences. The difference is why each person took it.

Here's my position after watching a lot of people spend a lot of money on this: the CEH is a bad purchase for most engineers and an excellent purchase for a specific three. Figure out which you are before you spend $1,199.

The numbers first

Cost: roughly $1,199 for the voucher through standard channels; around $950 for EC-Council's own remote proctoring. Plus a $100 eligibility application fee if you don't go the official-training route.
Format: 125 multiple-choice questions, 4 hours.
Passing score: 60–85%, varying by exam form difficulty. Yes, really — the cut score depends on which form you get.
First-attempt pass rate: roughly 30% by most community estimates, which is lower than the exam's reputation suggests.
CEH Practical: a separate 6-hour hands-on exam, separate fee. Passing both gets you CEH Master.

That $1,199 is the number to sit with. It's more than the AWS Solutions Architect Professional. It's more than a CISSP attempt. It's roughly four Azure associate exams.

Reason 1: Your employer's HR system requires it

This is the honest, unglamorous, best reason.

CEH is on the US DoD 8140/8570 approved baseline list. If you work for a defense contractor, a federal agency, or a company that sells into that space, the cert may be a literal contractual requirement for your role. No amount of "but OSCP is a better exam" changes what's written in the contract.

Same story in a lot of government and government-adjacent employers outside the US, and in some large enterprises whose security job families were written a decade ago and still name CEH by name.

If this is you, take it. Your employer is almost certainly paying, the requirement is real, and the debate is irrelevant.

Reason 2: You need to get past keyword filters, right now

Search "penetration tester" on any job board and count how many postings name CEH. It's a lot — more than name OSCP, because the postings are written by recruiters working from templates, not by the security engineers who'll interview you.

If you're trying to move from IT ops or helpdesk into a security role and your résumé keeps vanishing into applicant tracking systems, CEH is a functioning keyword. It gets you to a human. That's a real, measurable outcome and it's worth money to someone stuck at the filter stage.

Be clear-eyed about what happens next: the human who interviews you will ask technical questions the CEH did not prepare you for. The cert opens the door. It doesn't walk you through it.

Reason 3: You need broad vocabulary coverage fast

The CEH's actual pedagogical value is breadth. Reconnaissance, scanning, enumeration, system hacking, malware, sniffing, social engineering, DoS, session hijacking, web app attacks, SQL injection, wireless, mobile, IoT/OT, cloud, cryptography. Twenty modules of "here is a category of attack and the tools associated with it."

For a SOC analyst, a GRC person, an auditor, or a sysadmin who needs to talk about offensive security credibly without doing it daily, that map is genuinely useful. You come out knowing what the words mean and roughly how the pieces fit.

That is a legitimate outcome. It is not the same as being able to compromise a network, and anyone who tells you otherwise is selling something.

When it's a bad purchase

You want to actually do offensive security. Then the money goes to OSCP, PNPT, or a good hands-on lab subscription. The CEH's multiple-choice format cannot test whether you can pop a box, and the industry knows it. Pentest hiring managers weight hands-on certs heavily and CEH lightly.

You're paying out of pocket with a tight budget. $1,199 buys a lot of alternatives — a year of a hands-on lab platform, several cloud security certs, a solid course plus an exam with a hundredth of the price tag.

You think it's a substitute for fundamentals. Networking, operating systems, and scripting are the actual prerequisites for a security career. A CEH on top of a shaky foundation impresses no one for long.

If you're taking it: how to actually pass

The 30% first-attempt rate isn't because the material is hard. It's because people underestimate a broad memorization exam.

Tools and their purpose. The exam is heavy on "which tool does X." Nmap, Nessus, Wireshark, Metasploit, Burp, Hydra, John, Hashcat, Aircrack-ng, Maltego, Nikto, sqlmap, and a long tail of others. Make a two-column list — tool, primary use — and drill it. This alone is a large slice of the exam.

Nmap flags specifically. -sS, -sT, -sU, -sV, -O, -A, -Pn, timing templates. Know what each does and what the scan looks like on the wire. Guaranteed points.

Port numbers. Boring, memorizable, tested. 20/21, 22, 23, 25, 53, 80, 88, 110, 135, 137-139, 143, 161, 389, 443, 445, 636, 1433, 3306, 3389, 5432. Just learn them.

Attack phases in order. Reconnaissance → Scanning → Gaining Access → Maintaining Access → Clearing Tracks. Questions ask which phase a described activity belongs to. Free points.

Crypto basics. Symmetric vs. asymmetric, key lengths, hashing algorithms and their output sizes, what PKI components do. Not deep math — vocabulary.

The exam's writing style is its own obstacle. Questions can be oddly phrased, occasionally ambiguous, and sometimes reference tool versions that feel dated. The counter is volume: see enough questions and the style stops surprising you. I'd drill free CEH practice questions nightly for the last two weeks rather than re-reading the courseware, because the courseware doesn't prepare you for the phrasing.

For the tool-identification questions in particular, ai.examcert.app is useful because you can ask why a given tool is the answer rather than just memorizing the pairing — and understanding the reason means you'll get the variants right too.

My actual advice

Ask yourself one question: is someone else paying, or is a requirement forcing it?

If yes — take it, prepare properly, pass on the first attempt because the retake economics are brutal.

If no, and you want to do offensive security for a living — spend the $1,199 somewhere with a hands-on component. You'll learn more and, in the rooms that matter, it'll count for more.

Either way, sit a diagnostic before you commit. A timed set of CEH practice questions costs nothing and will tell you whether you're four weeks out or four months out. On a $1,199 exam with a 30% first-attempt pass rate, that's the highest-value hour you'll spend.

Unpopular Opinion: Most People Chasing the CMMC CCA Should Stop at the CCP

ExamCert.App — Wed, 29 Jul 2026 15:13:47 +0000

I'm going to argue against a certification on a blog about certifications, which I appreciate is a strange thing to do. But I keep watching people burn five figures and a year of evenings chasing the Certified CMMC Assessor when the credential below it would have got them the outcome they actually wanted.

So: here's the case against, and then the specific case for, so you can work out which one you're in.

What the CCA costs, honestly

Let's start with numbers, because the numbers are the argument.

$50 application processing fee
$350 exam fee
Mandatory CCA training: commonly around $3,995 for a four-day course
$500 annual renewal
Background check, plus you must already hold the CCP — which itself ran you somewhere in the $2,500–$5,000 range with its own mandatory training
You need a 450 or higher to pass

So the CCA alone is roughly $4,400–$5,000. Stacked on top of the CCP you already paid for, you're looking at a $7,000–$10,000 total path, plus annual renewal, plus the experience requirements you have to evidence, plus a few hundred hours.

One contractor on a forum put their real numbers at about $7k for prep, $1k for exams and fees, and roughly $11k in organisational costs to actually operate. That's a business investment, not a professional development line item.

The thing people don't think about: you can't just go be an assessor

This is the part that gets missed and it's the crux of my argument.

A CCA does not freelance. Certification assessments are conducted by C3PAOs — accredited third-party assessment organisations. Being a CCA qualifies you to be on a C3PAO's assessment team. It does not create the C3PAO, the client relationships, the scheduling, the quality process, or the insurance.

So the realistic paths after CCA are:

Get hired by an existing C3PAO. Real jobs, real demand, and this is the sensible path.
Stand up your own C3PAO. Which is its own accreditation process, its own cost, its own multi-year business build.

If your mental model was "get CCA, become an independent CMMC assessor, charge assessor rates" — that model doesn't exist. Solo assessment isn't a thing. I've seen several people discover this after paying for the training, and it's a rough discovery.

What the CCP already lets you do

Here's why I think most people should stop one rung down.

With a CCP you can:

Serve on assessment teams under a certified assessor
Work for a C3PAO
Work as a Registered Practitioner advising companies on readiness
Do internal compliance work at a defence contractor
Consult independently on preparation

That last cluster is where the actual volume of paid work is right now. There are ~200,000 companies in the defence industrial base and a huge proportion of them need someone to explain what CMMC Level 2 means for them, help them scope, help them build evidence, help them write a POA&M. None of that requires a CCA. It requires knowing 800-171 cold and being able to talk to a machine shop owner without using the word "framework."

Readiness consulting is also, bluntly, better business than assessing: you can work with a client repeatedly, there's no independence conflict to manage, and the market is far larger than the assessment market.

If that's the work you want, the CCP is the credential and the CCA is a $5,000 detour. Test your foundation with a set of free CMMC practice questions before you spend anything on either.

The specific cases where CCA absolutely is worth it

I don't want to be unfair to a real credential. Get the CCA if:

You already work at a C3PAO or have an offer contingent on it. Then it's not speculative, it's a job requirement, and often they'll pay.
You're building a C3PAO and need certified assessors on staff — obviously.
You want to lead assessments specifically, understand the ecosystem constraints above, and are going in with eyes open.
Your employer is paying. Then the ROI question mostly evaporates and it's just time.

The pattern: CCA makes sense when there's a specific assessment-side seat waiting for you. It makes much less sense as a speculative "level up" purchase.

If you are going for it, the exam itself

Assuming you're in one of those cases — what's the CCA actually like?

It goes deeper than the CCP on assessment execution. The CCP asks whether you understand the process; the CCA asks whether you can run it and make defensible determinations. Expect heavy weighting on:

Evidence sufficiency. Is this artifact adequate to demonstrate the practice is met? This is judgement, not recall, and it's the hardest part.
Met / not met / not applicable determinations across ambiguous scenarios.
Scoping edge cases. Specialised assets, contractor risk managed assets, external service providers, shared responsibility with cloud providers.
Assessor conduct — independence, conflict of interest, what you do when the client pushes back, when you must escalate.
The CMMC Assessment Process document in genuine detail.

You need a scaled 450 or higher. The training is mandatory and covers most of the ground, but the training is lecture-heavy and the exam is judgement-heavy, which is a mismatch you have to close yourself with practice scenarios.

My advice for that gap: after each training day, don't re-read the slides. Do practice questions on that day's material while it's fresh, and pay more attention to why the wrong answers are wrong than to the correct one. Assessment determinations are all about the margin between "close enough" and "not met," and you only develop a feel for that margin by getting it wrong repeatedly in low-stakes practice. I ran mine through ExamCert between training sessions for exactly that reason.

The actual recommendation

Get the CCP. It's cheaper, it opens the largest slice of the CMMC work that exists today, and it's a prerequisite anyway so nothing is wasted.

Then go do readiness work for six months. You'll learn more about how CMMC lands in real companies than any training will teach you, you'll earn while you learn, and you'll find out whether assessment is genuinely the part of this you want.

Then decide on the CCA — with a specific seat in mind, ideally with someone else paying.

The people I've seen do it in that order are consistently happier than the ones who bought the whole stack up front because a course provider's marketing implied assessors are a scarce resource who name their price. Assessors are on teams. Teams are at C3PAOs. Know that before you spend.

Start where it's free: a practice set, an honest score, and a clear decision about which rung you actually need.

10 Things I Wish I Knew Before Taking the PCEP (PCEP-30-02)

ExamCert.App — Tue, 28 Jul 2026 15:16:11 +0000

I took the PCEP thinking "I know Python, this'll be a formality." I was half right. I passed, but not by the margin I expected, and every point I dropped came from the same place: not code I couldn't write, but code I misread under a timer.

If you're prepping for the PCEP-30-02 (Certified Entry-Level Python Programmer), the exam isn't testing whether you can build things. It's testing whether you know Python's rules cold — the stuff you'd normally just let the interpreter figure out for you. That distinction cost me more than I'd like to admit.

Before I get into the list: if you want to see this style of question before exam day instead of during it, run through some free PCEP practice questions. It's the fastest way to calibrate whether you're actually exam-ready or just "I use Python at work" ready. Those are not the same thing.

Here's what I wish someone had told me.

1. Operator precedence questions are not optional trivia

There will be a question that's just a wall of operators — something like 2 + 3 * 2 ** 2 % 5. No context, no function, just "what does this evaluate to." Python Institute loves these because they test whether you actually know the precedence table (** before unary minus before *///% before +/-) rather than just vibing your way through arithmetic.

print(2 + 3 * 2 ** 2 % 5)  # walk it: 2**2=4, 4%5=4, 3*4=12, 2+12=14

Do a few of these by hand, on paper, no interpreter. If you catch yourself reaching for a REPL to check, that's the sign you need more reps.

2. Integer division and float division are different questions in disguise

/ always returns a float in Python 3, even 4 / 2 gives you 2.0. // is floor division and truncates toward negative infinity, not toward zero — which trips people up on negative numbers.

print(-7 // 2)   # -4, not -3
print(-7 % 2)    # 1, because Python's modulo follows the divisor's sign

If you've mostly worked with positive numbers in real code, this is the exact spot where the exam will bite you.

3. List slicing has more variations than you think you need to memorize

list[start:stop:step] seems simple until they start throwing negative indices, negative steps, and omitted bounds at you in combination.

nums = [0, 1, 2, 3, 4, 5]
print(nums[::-1])     # reversed list
print(nums[1:-1])     # [1, 2, 3, 4]
print(nums[::2])      # [0, 2, 4]

The exam will ask you to predict output, not write the slice yourself, which is harder. Practice reading slices, not just writing them.

4. Mutable default arguments are a classic gotcha, and PCEP knows it

This one shows up in slightly disguised forms. A function with a list or dict as a default parameter value keeps that same object across calls unless you're careful.

def add_item(item, basket=[]):
    basket.append(item)
    return basket

print(add_item("a"))  # ['a']
print(add_item("b"))  # ['a', 'b']  <- surprise

You don't need to fix it on the exam, just predict the output correctly. Knowing why it happens (default args are evaluated once, at function definition time) is what gets you there.

5. `global` isn't about "does the variable exist," it's about "which one gets written to"

A function can read an outer-scope variable without any keyword. It's only when you try to assign to it that Python decides, at compile time, that the name is local — and then reading it before assignment throws UnboundLocalError. That's the part people don't see coming.

x = 10
def f():
    print(x)      # fine, reads global
    x = 20        # but this makes x local for the WHOLE function
f()  # UnboundLocalError, not 10

The exam will test exactly this ordering trap. global x inside the function is what fixes it.

6. The exception hierarchy questions expect you to know what's a subclass of what

You'll get questions like "which exception should you catch to also catch IndexError and KeyError?" The answer path runs through LookupError. Same idea with ZeroDivisionError being a subclass of ArithmeticError, and basically everything eventually rolling up to Exception, then BaseException.

You don't need to memorize the entire tree, but know the common ones: LookupError → IndexError/KeyError, ArithmeticError → ZeroDivisionError, and that except Exception catches nearly everything except things like SystemExit and KeyboardInterrupt.

7. Order of `except` blocks actually matters and the exam will test it

If you put a broad except Exception before a specific except ValueError, that second block is dead code — unreachable. PCEP will show you a stack of except clauses in the "wrong" order and ask what happens. Read top to bottom, most specific first, always.

8. The exam phrases questions to reward careful reading, not fast reading

A lot of PCEP questions are "select all correct statements" or "what will this code output" with four answers that differ by one character. This isn't a knowledge exam disguised as a reading exam — it genuinely rewards slowing down. I lost time re-reading questions I'd skimmed too fast the first pass. Read every line of code like it might contain the trick, because on this exam, it usually does.

9. Gap-fill and drag-drop questions test syntax memory you don't normally need

Because you're not in an IDE with autocomplete, questions that ask you to complete a for loop or pick the right keyword from a drag-and-drop bank expose gaps that don't matter day-to-day (like exact keyword order in try/except/else/finally, or whether it's elif not else if). Muscle-memory syntax, not conceptual understanding, is what gets tested here — so type out full programs by hand at least a few times during prep instead of only reading code.

10. Don't expect any OOP depth — but do expect solid coverage of collections

PCEP stays in the shallow end on object-oriented programming (that's PCAP's job). What it does go deep on: lists, tuples, dictionaries, sets, string methods, and how they behave differently — mutability, hashability, what you can and can't index into. If you're strong on functions and control flow but shaky on "when do I reach for a dict vs a set," that's worth another pass before exam day.

The format, briefly

PCEP-30-02 runs around 40 questions in roughly 45–50 minutes, mixing single-select, multiple-select, and gap-fill/drag-drop formats across basic syntax, data types, control flow, functions, data collections, and exceptions. It's proctored, closed-book, and moves fast if you're not fluent in reading code without running it.

One thing that helped me close the gap in my last week of prep: instead of just grinding practice questions and hoping I understood the wrong ones, I ran through sets on the ExamCert AI exam simulator, which explains why each answer is right or wrong on the spot. Way faster than googling every miss.

Good luck — and seriously, do the operator precedence drills. That's where I lost points I shouldn't have.

What Each CISA Domain Actually Tests (Not What the Outline Says)

ExamCert.App — Mon, 27 Jul 2026 15:15:21 +0000

Most people fail the CISA on the first attempt for one reason: they study it like an engineer. They memorize control names, encryption acronyms, and framework diagrams, then walk into the exam and get punished for picking the "technically correct" answer instead of the "auditor's answer." ISACA's Certified Information Systems Auditor is not a security-engineering test. It is an audit test. Every question is quietly asking, "What would a disciplined, independent auditor do here?" — and that is a very different question from "What is the best technical fix?"

Before we walk the five domains, the logistics: 150 questions, 4 hours, scaled score of 450 out of 800 to pass, exam fee roughly $575 for members and $760 for non-members, plus a five-year IS audit experience requirement to earn the actual credential. You can sit the exam before you have the experience, but the cert isn't granted until you do. If you want to feel how the question logic works before spending that fee, run a free CISA practice test and pay attention to why the "obvious" answer is often the wrong one.

Now, domain by domain — what each one really tests.

Domain 1: Information Systems Auditing Process (18%)

The outline calls this "planning and execution of audits." What it actually tests is whether you understand independence and evidence. This is the domain where CISA decides if you think like an auditor at all.

Expect a wall of questions on risk-based audit planning, sampling (statistical vs. judgmental), and the hierarchy of evidence. The exam loves to ask which evidence is most reliable — and the answer is almost always the one obtained directly by the auditor from an independent source, not something management handed you. You'll see scenarios where you must choose between "re-perform the control yourself" and "ask the control owner if it works." The auditor re-performs. Always favor corroboration over inquiry.

The other trap here is scope creep and independence. If a question describes an auditor who helped design the control they're now auditing, the answer is that independence is impaired — full stop. Memorize the difference between a finding, a criterion, and a recommendation, because the exam tests whether you can structure an observation correctly, not just spot a problem.

Domain 2: Governance and Management of IT (18%)

Officially this is about "IT governance frameworks." Practically, it tests whether you can tell the difference between governance (the board sets direction) and management (execution) — and whether you keep escalating problems to the right level.

The recurring question pattern: something is broken, and you must pick who is ultimately accountable. The answer is usually senior management or the board, never the IT team, because CISA hammers the idea that accountability cannot be delegated. You'll see COBIT referenced, along with IT strategy alignment, steering committees, and policies-versus-procedures distinctions.

Watch for the "policy first" reflex. When a scenario shows chaos — no standards, inconsistent controls — the root cause the exam wants is almost always a missing or unenforced policy at the governance level, not a missing tool. Also nail the vocabulary: a policy is a high-level intent, a standard is mandatory, a procedure is step-by-step, and a guideline is optional. The exam will deliberately swap these to see if you flinch.

Domain 3: Information Systems Acquisition, Development and Implementation (12%)

The outline says "SDLC and project management." What it tests is whether you know where auditors insert controls into a project without becoming part of the project team.

This is the domain of the SDLC, feasibility studies, and — the exam's favorite topic — testing types. Know cold the difference between unit, integration, system, UAT, and regression testing, and specifically who signs off on each (users own UAT acceptance, not IT). Change management and post-implementation reviews show up constantly. When a question describes a migration or go-live, the auditor's concern is nearly always data integrity during conversion and whether a fallback/rollback plan exists.

The classic trap: a question implies the auditor should approve the project or fix the code. Wrong. The auditor evaluates whether controls exist and whether management approved the phase gates. If you catch yourself picking the answer where the auditor makes a business decision, stop and reread it.

Domain 4: Information Systems Operations and Business Resilience (26%)

This is the biggest domain, and it rewards operational discipline. It covers day-to-day IT operations, service management, backups, and — heavily — business continuity and disaster recovery.

You must own the metrics: RTO (how fast you must recover) versus RPO (how much data you can afford to lose), and how each drives backup frequency and site strategy (hot, warm, cold, and mirrored sites). The exam will hand you a scenario with a tight RPO and expect you to reject an infrequent backup schedule. Know that the first step after any disaster is protecting human life and safety — CISA slips this in and people miss it while reasoning about servers.

BCP/DRP testing is a guaranteed topic. Understand the ladder from checklist review to walk-through to simulation to parallel to full-interruption testing, and which ones actually prove recovery works versus merely reviewing the plan. When asked how to validate a DR plan, the answer is almost never "read the document" — it's the test that exercises it.

Domain 5: Protection of Information Assets (26%)

Tied for largest, this is the closest CISA gets to "security" — but still through an auditor's lens. It spans logical and physical access controls, encryption concepts, network security, and data classification.

The dominant theme is least privilege and segregation of duties. Expect many scenarios where one person can both initiate and approve a transaction; the answer is that SoD is violated and a compensating control (like independent review or logging) is needed. Identity and access management shows up everywhere: provisioning, deprovisioning (terminated employees whose access lingers is a favorite finding), and periodic access recertification.

On the technical side, understand encryption conceptually — symmetric vs. asymmetric, what a digital signature proves (integrity and non-repudiation, not confidentiality) — but don't expect to configure anything. The exam wants you to assess whether a control is adequate for the risk, not to build it.

The mindset that ties it together

Across all five domains, the winning instinct is the same: identify the risk, verify independently, escalate to the right level of accountability, and never let the auditor make a management decision. Drill that pattern with real questions until it's automatic. The AI simulator that explains every answer instantly at ai.examcert.app is built exactly for that — it tells you not just which option is right, but why the tempting engineer's answer is wrong, which is the entire game with CISA.

Study the reasoning, not the acronyms. That's how you pass.

My 3-Week DP-300 Sprint: What I Actually Did Each Block

ExamCert.App — Sun, 26 Jul 2026 15:11:26 +0000

I've been a SQL Server DBA for the better part of a decade, mostly on-prem, and the last two years I've been dragged kicking and screaming into Azure. DP-300 (Administering Microsoft Azure SQL Solutions) had been sitting on my "should probably do that" list forever. In June my manager finally tied a small bonus to it, so I gave myself three weeks and kept a rough log of what I did each block. This is that log, cleaned up a bit. Maybe it saves you some flailing.

Quick note before the day-by-day: the thing that made the biggest difference wasn't a course. It was hammering a free DP-300 practice test early and often so I could see where my on-prem instincts were wrong. More on that below.

Week 1 — Find out how wrong you are

Block 1 (Sat morning). I did not read anything. I went straight to a practice set cold, no studying, just to get a baseline. Scored badly, obviously, but that was the point. The wrong answers told me exactly which topics my SQL Server background did not cover: purchasing models (DTU vs vCore), the difference between Azure SQL Database, Managed Instance, and SQL on a VM, and the whole elastic pool concept. If you're coming from on-prem like me, that PaaS-vs-IaaS decision tree is where you'll bleed points.

Block 2 (Sat afternoon). Read the official Microsoft Learn "Administer a SQL Server database infrastructure" and "Deploy and configure Azure SQL" paths. I skimmed the stuff I already knew (indexes, statistics, query plans — that transfers straight over) and slowed way down on deployment options. I made a one-page cheat sheet: when do you pick Managed Instance vs single database vs VM. Cross-database queries and SQL Agent? That pushes you toward MI. Full OS control or unsupported features? VM. Wrote it in my own words, which forced me to actually understand it.

Block 3 (Sun). Spun up an actual Azure SQL Database and a Managed Instance in a throwaway subscription. Do this. Reading about "the Managed Instance takes ~4 hours to deploy" is nothing like watching your portal blade spin for the whole afternoon and understanding why that matters for a migration plan. I configured a firewall rule, connected from SSMS, locked myself out, fixed it. That mistake stuck harder than any flashcard.

Block 4 (Sun evening). Security. Azure AD (Entra) authentication, contained users, Transparent Data Encryption with customer-managed keys, Always Encrypted, dynamic data masking, row-level security. This is heavily weighted on the exam. I set up an Entra admin on my test DB and created a contained database user, because "CREATE USER ... FROM EXTERNAL PROVIDER" is the kind of syntax detail they love to test.

By the end of week 1 I retook a practice set. Went from embarrassing to merely bad. Progress.

Week 2 — The boring, heavily-tested middle

This week was HA/DR and automation, which is where most of the exam weight actually lives.

Block 5. High availability and disaster recovery. Active geo-replication vs auto-failover groups vs the built-in zone-redundant config. I drew the topology for each on paper. The exam wants you to know which one gives you a read-write listener endpoint that survives failover (auto-failover groups) versus which one you have to manually repoint (geo-replication). Also backup retention: the difference between the automatic 7–35 day PITR window and long-term retention policies. Know the defaults.

Block 6. Monitoring. Query Store, Extended Events, Azure Monitor, sys.dm_db_* DMVs, Intelligent Insights, automatic tuning. I turned Query Store on and deliberately wrote a bad query to watch a plan regression show up. The exam loves scenario questions like "queries suddenly got slow after a deployment, what do you check first" — and the answer is almost always Query Store forced plans.

Block 7. Automation. Elastic jobs (the Azure SQL Database replacement for SQL Agent, since single databases don't have Agent), Azure Automation runbooks, and PowerShell/az cli for scaling. I wrote a tiny runbook to scale a database up on a schedule. Even if you never do this at work, seeing the shape of it makes the multiple-choice options obvious.

Block 8. This is where I leaned on the DP-300 exam page to make sure I'd actually covered the whole objective domain and wasn't just studying my favorite topics. I checked my cheat sheet against the skills-measured list and found two gaps I'd skipped entirely: sp_configure-style server config on Managed Instance, and resource governance. Fixed both.

Retook a full-length practice set at the end of the week. Passing range now, but shaky on HA/DR wording.

Week 3 — Drill the wording, not the concepts

At this point I knew the material. The remaining problem was Microsoft's question style: long scenarios, "you need to minimize cost" or "minimize downtime" or "minimize administrative effort" — same tech, different constraint, different correct answer.

Block 9–10. Pure question drilling. I did sets of 20–30, then — and this is the part that mattered — I read the explanation for every single one, including the ones I got right, to check I got them right for the reason and not by luck. When I couldn't articulate why the other three options were wrong, I went back to Learn for that topic. For the trickier scenario questions I ran them through the AI simulator at ai.examcert.app because it gives instant explanations and I could ask follow-up "but what if it were a Managed Instance instead" questions, which is exactly how the exam mutates a scenario.

Block 11. Weak-area cleanup. Mine were auto-failover group endpoints and TDE with customer-managed keys in Key Vault. I re-did those specific labs.

Block 12 (day before). Light. One timed practice set to confirm pacing — you get roughly a couple minutes per question and the long scenarios eat that fast, so practice skipping and flagging. Then I stopped. No cramming the morning of.

What I'd tell past-me

Don't trust your on-prem instincts. The PaaS deployment/HA/DR decisions are the whole game and they're genuinely different.
Lab the security and failover stuff with your own hands. Reading isn't enough for those.
Practice questions aren't a final check — they're your map. Start them day one to find the holes, not week three to confirm you're done.
Read wrong-answer explanations religiously. On DP-300 the constraint word ("cheapest", "least downtime") is the whole question.

Passed it. The bonus cleared. Now I actually reach for auto-failover groups at work without second-guessing, which is worth more than the cert honestly.

What AZ-305 Actually Tests vs the Syllabus: A Domain-by-Domain Breakdown for Architects

ExamCert.App — Sat, 25 Jul 2026 15:11:22 +0000

I sat AZ-305 about six weeks after passing AZ-104, and I walked out with a very different feeling than I did after the 104. With AZ-104 you either know how to create a VNet peering or you don't. AZ-305 doesn't care whether you can click the right blade. It cares whether you can look at a customer's mess and say "here's why you'd pick Cosmos DB over Azure SQL here, and here's the one requirement that kills that choice."

The published skills outline is fine as a checklist, but it flattens everything. It makes "design data storage solutions" sound equal in weight to "design identity solutions." In the actual exam they are not equal, and the way each domain is tested is different from how the outline reads. So here's my domain-by-domain take on what AZ-305 really asks of you. If you want a sense of the question style before you commit, the AZ-305 exam guide on ExamCert lines up well with what I saw, and it's where I did most of my last-week drilling.

One thing up front: do AZ-104 first, or at least have real hands-on Azure. Microsoft "recommends" it. I'd say it's borderline mandatory. AZ-305 assumes you already know what a NSG, a managed identity, and a storage account tier are. It won't teach you. It'll hand you five services that all technically work and ask which one an architect would actually sign off on.

Design identity, governance, and monitoring solutions

This is the domain people underestimate, and it's the one that quietly sinks scores. The outline makes it sound like Entra ID trivia. It isn't. It's mostly about boundaries and blast radius.

Expect a lot of:

Management groups vs subscriptions vs resource groups as governance boundaries. When do you split a subscription? (Answer usually revolves around policy scope, billing separation, or a hard quota — not "because it feels tidy.")
Azure Policy vs RBAC vs Azure Blueprints. The trap is that two of them "would work" and you have to pick the one that enforces at the right layer. Policy governs what resources can exist and how they're configured; RBAC governs who can do things. If the requirement says "prevent anyone from deploying outside West Europe," that's Policy, not RBAC, even though an over-privileged RBAC answer is sitting right there.
Managed identities, and specifically system-assigned vs user-assigned. If the scenario says "multiple resources need the same identity and it must survive the resource being deleted," that's user-assigned. They test that exact distinction constantly.
Monitoring design: Log Analytics workspace topology, when to centralize vs federate, and Azure Monitor vs Application Insights scope.

Governance questions reward the boring, correct answer. Resist the clever one.

Design data storage solutions

This was the largest chunk for me, and it's where the "trade-off" nature of the exam is most obvious. You're rarely asked "what is Cosmos DB." You're asked to match a workload profile to a store.

The mental grid I built and kept in my head:

Relational + transactional + existing SQL skills   -> Azure SQL Database
Global, low-latency, multi-region writes, flexible  -> Cosmos DB (watch the consistency level!)
Big analytical / warehouse                          -> Synapse / dedicated SQL pool
Unstructured blobs, tiers, lifecycle                -> Blob Storage (Hot/Cool/Archive)
Lift-and-shift file shares (SMB)                     -> Azure Files

The consistency-level questions on Cosmos deserve their own warning. Strong, bounded staleness, session, consistent prefix, eventual — you need to know the ordering and what each one costs you in latency and availability. A scenario will say "users must never read their own stale writes but we want the cheapest option that satisfies that" and the answer is session consistency, not strong. If you memorize the five levels as a list without understanding the trade, you'll get these wrong.

Also budget time for Storage account redundancy (LRS / ZRS / GRS / GZRS) framed as a durability requirement. "Must survive a full region loss" = geo-redundant. "Must survive a datacenter/AZ failure but data can't leave the region for compliance" = ZRS. The compliance clause is the tell.

Design business continuity solutions

Backup and disaster recovery, and this domain is more mechanical than the others — which is good news, because you can just learn the numbers.

Know cold:

RPO vs RTO. RPO = how much data you can lose (drives backup frequency / replication). RTO = how long you can be down (drives failover strategy). Half the questions here are just testing whether you can map a sentence to the right acronym.
Azure Site Recovery for VM-level DR and region failover, vs Azure Backup for point-in-time restore.
Availability Zones vs Availability Sets vs region pairs, and the SLA implications. A single VM with premium SSD hits one SLA; spread across zones hits a higher one. They'll ask you to pick the minimum design that meets a stated SLA — over-engineering is a wrong answer here even though it "works."

If you're short on study time, this is the highest points-per-hour domain. The concepts are finite.

Design infrastructure solutions

The biggest and broadest: compute, networking, application architecture, and migrations. It sprawls, but the questions cluster.

Compute is a decision tree you should be able to run in your sleep: full control / legacy / lift-and-shift → VMs; containers with orchestration → AKS; simple containers without managing a cluster → Container Apps or ACI; event-driven glue → Functions; standard web app → App Service. The exam loves handing you a workload and making you eliminate three of these on a single constraint (stateful? needs the OS? has spiky traffic? cost-sensitive at idle?).

Networking design leans on hub-and-spoke topology, when you need a firewall vs an NSG vs Application Gateway (WAF), and private endpoints vs service endpoints. The private-vs-service-endpoint distinction is a repeat offender — private endpoint gives a resource a private IP in your VNet; service endpoint just extends your VNet identity to the service over the backbone. Compliance scenarios that say "traffic must never traverse the public internet and the resource needs a private IP" want private endpoints.

Migrations mostly means knowing the Azure Migrate tooling and the 5 Rs framing (rehost, refactor, rearchitect, rebuild, replace) well enough to match a scenario to one.

How I'd actually prep

Case studies are the real exam within the exam. You get a wall of text — company background, technical requirements, constraints buried mid-paragraph — and several questions hanging off it. Read the requirements and constraints first, then the narrative. The constraint that eliminates the obvious answer is almost always tucked somewhere unglamorous like "the finance team's tooling only supports SQL."

Practice under that pressure. I ran through the free AZ-305 practice test enough times that the trade-off pattern became reflexive — not the specific answers, but the instinct to hunt for the disqualifying constraint before committing. That instinct is basically the whole exam.

If AZ-104 felt like "can you operate Azure," AZ-305 is "can you be trusted to design it and defend the design." Study the trade-offs, not the feature list, and you'll be fine.

My 3-Week DVA-C02 Sprint, Week by Week (What I'd Cut and What I'd Repeat)

ExamCert.App — Fri, 24 Jul 2026 15:11:16 +0000

I passed the AWS Certified Developer – Associate (DVA-C02) with a 841 after three weeks of evening study. Not a heroic all-nighter story — I had a day job writing Python and TypeScript against Lambda and DynamoDB, so a lot of the exam was already muscle memory. But muscle memory is exactly the trap. This exam rewards knowing why AWS wants you to do a thing, not just that your code compiles. Here's how I broke the three weeks down, what actually moved the needle, and what I'd skip if I did it again.

First, the shape of the thing so you're calibrating against reality. DVA-C02 is 65 questions (50 scored, 15 unscored pilots), 130 minutes, multiple choice and multiple response. Passing is 720 on a scaled 100–1000, and it costs $150 USD. Four domains: Development with AWS Services (32%), Security (26%), Deployment (24%), and Troubleshooting and Optimization (18%). Notice Security is the second-biggest slice — bigger than Deployment. If you're a developer who treats IAM as "the thing the platform team handles," that 26% is where you bleed points. I front-loaded my study around that fact.

I ran my whole prep against the DVA-C02 blueprint on ExamCert, which lines the objectives up against practice questions so I wasn't guessing what "Deployment" actually covers on this version. That mattered because DVA-C02 quietly dropped some old SAM/CodeStar trivia and leaned harder into event-driven patterns.

Week 1 — Development + closing the DynamoDB gaps

Domain 1 is a third of the exam and it's the one developers overrate their readiness on. I write Lambda handlers weekly, but the exam probes edges I never touch: the difference between Lambda synchronous invocation (API Gateway, ALB) versus asynchronous (S3 events, SNS) versus poll-based (SQS, Kinesis, DynamoDB Streams), and how each one retries. Async retries twice with jitter and then dumps to a dead-letter queue if you configured one. Poll-based blocks the shard until the batch clears — a classic "why is my Kinesis consumer stuck" question.

DynamoDB ate most of my week. Know this cold:

# Strongly consistent read costs 2x an eventually consistent read
# 1 RCU = 1 strongly consistent read/sec for an item up to 4KB
# 1 WCU = 1 write/sec for an item up to 1KB

I got a question about a hot partition throttling under load — the answer was write sharding by suffixing the partition key, not bumping provisioned capacity. Another wanted me to pick between a GSI and LSI, and the tell was "query on a new attribute after the table already exists" → GSI, because LSIs must be created at table birth. If your DynamoDB is fuzzy, that alone can cost you five questions.

I also drilled the SDK retry/backoff behavior and ExponentialBackoff, plus how the SDK reads credentials in order (env vars → shared config → instance profile). Boring, tested constantly.

By Friday I ran a first timed set of free DVA-C02 practice questions to get a baseline. I scored 68%. Under the passing line, exactly where I expected to be, and useful — it showed me Security was worse than I feared.

Week 2 — Security and Deployment, the underrated middle

This was the heavy week. Security (26%) plus Deployment (24%) is half the exam and it's where most devs are soft.

On the security side, the recurring themes:

IAM roles over hardcoded keys, every time. If an answer option contains an access key in a Lambda env var, it's wrong. The exam is almost dogmatic about this.
KMS envelope encryption. Understand that KMS encrypts a data key, the data key encrypts your data, and you store the encrypted data key alongside the ciphertext. Questions love the phrase "encrypt large objects efficiently."
Cognito user pools vs identity pools. User pools = authentication (who you are, gives you a JWT). Identity pools = authorization to AWS resources (gives you temp AWS credentials). Mixing these up is the single most common Cognito mistake, and there will be Cognito questions.
Secrets Manager vs Parameter Store. Automatic rotation → Secrets Manager. Free and simple config → SSM Parameter Store. Cost-sensitive questions want Parameter Store.

Deployment meant living in the CI/CD services. CodeDeploy deployment configs are a reliable question factory — know canary, linear, and all-at-once, and that Lambda/ECS use traffic-shifting while EC2 uses in-place or blue/green. SAM template.yaml structure, the AWS::Serverless::Function resource, and how sam deploy packages artifacts to S3. Elastic Beanstalk deployment policies (all-at-once, rolling, rolling with additional batch, immutable) show up too — immutable is the "zero downtime, safe rollback, but doubles instances" answer.

I re-tested end of week 2: 79%. Over the line but not comfortable. Comfortable for me is 85%+ on practice, because exam nerves and pilot questions eat a few points.

Week 3 — Troubleshooting, and turning 79% into safe

The final domain (18%) is really "do you understand observability." X-Ray tracing — how you instrument a Lambda with the SDK, what a subsegment is, how sampling rules work. CloudWatch Logs Insights queries. Custom metrics via PutMetricData and the fact that high-resolution metrics cost more. The difference between a CloudWatch metric filter and a subscription filter.

But week 3 was less about new content and more about drilling wrong answers until the patterns stuck. I stopped studying by topic and just did full 65-question timed runs, then spent an hour dissecting every miss. My rule: if I couldn't explain in one sentence why the right answer beat the second-best answer, I didn't actually know it. AWS distractors are plausible on purpose.

I'll be honest about the tools question, since it's the one people ask. I didn't pay for Whizlabs or the Tutorials Dojo mega-bundle this time. ExamCert is $4.99 lifetime access, money-back guarantee if you don't pass — not $300 like Whizlabs/Boson — and for a $150 exam that math is easy. I ran a couple hundred questions across the three weeks and the explanations were enough to close my gaps. Your mileage varies, but I'd rather spend the saved money re-sitting than lock $300 into a subscription I'll cancel.

What I'd cut and repeat

Cut: I over-studied EC2 user-data and AMI trivia. It's barely there on DVA-C02. Cut: memorizing every API Gateway integration type — knowing Lambda proxy vs non-proxy was enough.

Repeat: front-loading Security. Repeat the "explain why the second-best answer is wrong" drill — that's what took me from passing-on-paper to actually confident. And repeat doing a cold baseline in week 1, because it kills the false confidence that you already know Lambda.

If you write AWS code daily, three focused weeks is realistic. If you don't, give it five and spend the extra two on Domains 1 and 2. Either way, do timed full-length sets, not topic quizzes — the pacing (2 minutes a question) is its own skill.

Career-wise: this cert is the standard "I can build on AWS, not just talk about it" signal for backend and full-stack roles, and it pairs well with the Solutions Architect Associate. In the US it tends to sit developers in the $110k–$150k band depending on stack and city — the cert won't hand you that number, but it clears résumé filters that otherwise auto-reject.

Book the exam before week 1. A date on the calendar is the only study hack that has ever worked for me.

5 SOA-C03 Traps That Fail Otherwise-Ready SysOps Candidates

ExamCert.App — Thu, 23 Jul 2026 15:10:32 +0000

The SysOps Associate is the one AWS Associate exam that punishes people who studied like it was the Solutions Architect exam. SAA rewards you for knowing which service to pick. SOA-C03 rewards you for knowing how the service actually behaves in production — the flag that only takes effect after a reboot, the metric that isn't published unless you install an agent, the replication that's async by default. Same service list, completely different failure mode.

SOA-C03 is the current version (it replaced SOA-C02, and notably it dropped the hands-on "exam labs" that SOA-C02 was infamous for — it's now 65 multiple-choice / multiple-response questions, 130 minutes, 720/1000 to pass, USD 150). No labs doesn't mean easier. It means every operational gotcha that used to live in the labs is now baked into the scenario questions. If you're deep in prep, run a set of free SOA-C03 practice questions before you read on — you'll recognize at least two of these traps from questions you got wrong and couldn't explain why.

Here are the five that catch operationally-competent people.

1. CloudWatch doesn't see inside the instance by default

This is the single most common source of "but I set up the alarm" failures. Out of the box, EC2 publishes hypervisor-level metrics: CPUUtilization, NetworkIn/Out, DiskReadOps on the instance store. It does not publish memory utilization or disk space used on an EBS volume's filesystem. Those live inside the guest OS, and the hypervisor can't see them.

If a question says "you need to alarm on memory pressure" or "trigger when the root volume is 90% full," the answer always involves the CloudWatch agent (the unified agent, not the retired legacy scripts), pushing custom metrics.

# The agent config that actually collects memory + disk
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s \
  -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json

Distractor answers will offer "create a CloudWatch alarm on the MemoryUtilization metric" as if it exists natively. It doesn't. If you didn't install the agent, there's no metric to alarm on.

Also know detailed monitoring (1-minute granularity, paid) vs basic (5-minute, free) — and that detailed monitoring changes frequency, not which metrics exist. It will not conjure memory metrics.

2. "Reboot" vs "stop/start" — which config changes actually apply

SOA-C03 loves the difference between a reboot and a stop/start because operationally they are worlds apart:

Reboot: same physical host, same instance store data, same public IP (if not using EIP), same private IP. Kernel-level changes may apply.
Stop/start: instance moves to a new physical host. Instance store data is lost. You get a new public IP (again, unless you attached an Elastic IP). Enhanced networking / instance type changes take effect here.

The classic trap: "Users report the public IP keeps changing after maintenance." The fix isn't a script — it's an Elastic IP, because stop/start reassigns the auto-assigned public IPv4. Another: "We changed the instance type but it's still the old size" — instance type changes require a stop/start, not a reboot.

Bonus reliability gotcha in the same family: EC2 auto recovery. It works via a CloudWatch alarm on StatusCheckFailed_System, recovers the instance on new hardware with the same private IP, EIP, and instance ID — but it does not recover from StatusCheckFailed_Instance (that's your OS/app problem, not AWS hardware).

3. RDS Multi-AZ is for failover, read replicas are for scaling — don't swap them

Deployment/reliability questions bait you into using the wrong RDS feature:

Multi-AZ = synchronous standby in another AZ, automatic failover via DNS CNAME swap. It is a durability/availability feature. You cannot read from the standby. It does nothing for read throughput.
Read replicas = asynchronous replication, you can read from them, they can span regions. They are a scaling feature. Failover to a read replica is manual (promotion) and can lose in-flight data because it's async.

The trap question: "Read-heavy workload is overloading the primary — what do you do?" If you answer "enable Multi-AZ," you're wrong; Multi-AZ adds zero read capacity. Conversely: "We need automatic failover with no data loss." Read replicas can't guarantee that (async lag); Multi-AZ can (sync). Memorize which knob is sync and which is async — half the reliability domain hinges on it.

4. S3 encryption, bucket policies, and Block Public Access all fight each other

The security domain on SOA-C03 is where "I clicked the right checkbox" candidates get humbled. Three overlapping controls, and the exam tests the interaction:

Block Public Access (BPA) overrides bucket policies and ACLs. If a bucket "won't go public" despite a permissive policy, BPA is on — at the account or bucket level. Account-level BPA wins over bucket-level.
Default encryption: SSE-S3 vs SSE-KMS. If objects need encryption and you need an audit trail of who decrypted, it's SSE-KMS (CloudTrail logs the KMS calls). A trap asks "prove which principal accessed the key" — SSE-S3 gives you no key-level audit, so it's KMS.
A bucket policy with "aws:SecureTransport": false deny is how you force HTTPS. If a question says "reject any non-TLS request to the bucket," that's the condition key.

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": { "Bool": { "aws:SecureTransport": "false" } }
}

Know that a KMS key policy can also block access independent of the IAM policy — "user has s3:GetObject but still gets AccessDenied" usually means the KMS key policy doesn't grant them kms:Decrypt.

5. Systems Manager is the answer more often than SSH

If your instinct on any "I need to run a command / patch / gather inventory across the fleet" question is to reach for a bastion host and SSH keys, retrain it. The SOA-C03 answer is almost always AWS Systems Manager:

Session Manager → shell access with no open port 22, no bastion, no SSH keys, fully logged to CloudTrail/S3. Any question that says "reduce attack surface, no inbound SSH" is Session Manager.
Patch Manager → scheduled patching with patch baselines and maintenance windows.
Run Command → run a script on N instances without logging in.
Parameter Store → config and secrets (SecureString via KMS) instead of hardcoding.

The prerequisite everyone forgets: the SSM Agent must be running (it's preinstalled on Amazon Linux 2/2023 and current Ubuntu/Windows AMIs) and the instance needs an IAM role with AmazonSSMManagedInstanceCore. "Instance doesn't show up in Fleet Manager / Session Manager" is nearly always a missing instance-profile role or no route to the SSM endpoints (needs NAT or VPC endpoints in a private subnet).

How to actually prep for these

Reading service docs won't inoculate you — these traps only stick after you've been burned by them in a question and had to reason through why the obvious answer was wrong. Work through scenario sets, and every time you miss one, write the one-line rule (sync vs async, agent vs native metric, reboot vs stop/start) on a card.

Full domain breakdown, cost, and format details are on the SOA-C03 exam page, and you can pressure-test all five of these patterns with the free SOA-C03 practice test before you book the real thing. Get comfortable being wrong in practice so you're right on exam day.

The 5 Traps in the 300-710 SNCF Firepower Exam That Catch Everyone

ExamCert.App — Wed, 22 Jul 2026 15:17:20 +0000

The 300-710 SNCF exam looks approachable on paper. It's a 90-minute CCNP Security concentration exam covering FMC/FTD deployment, NAT, access control, prefilter policies, integrations, and ASA migration. Nothing exotic. And yet the pass rate humbles a lot of engineers who have run firewalls in production for years.

The reason is simple: Firepower's policy model does not behave the way your intuition — trained on ASA or classic packet-forwarding logic — expects. The exam weaponizes exactly those gaps. Below are the five traps that catch almost everyone, drawn from the questions people consistently get wrong.

If you want to pressure-test yourself against these before exam day, run a free 300-710 practice test and watch which of these five categories you fumble. That signal is more useful than any raw score. For the full objective breakdown, the Cisco Secure Firewall / Firepower (SNCF) exam page lists every domain weighting.

Trap 1: Prefilter vs. Access Control policy evaluation order

This is the single most-missed concept. Engineers assume all traffic hits the Access Control Policy (ACP). It doesn't — not first, anyway.

The Prefilter Policy runs before the ACP, at the earliest stage of processing. It has two rule types, and mixing them up is fatal on the exam:

Fastpath — traffic bypasses Snort entirely. No deep inspection, no IPS, no AMP. Great for high-throughput trusted flows (backups, storage replication).
Analyze — hands traffic up to the Access Control Policy for full inspection.
Tunnel rules — the only place you handle non-encapsulated tunnels like GRE and IP-in-IP as a single flow.

The trap question gives you a scenario where an ACP rule "should" block something, but a Prefilter Fastpath rule already sent it around Snort. The ACP never sees it. If you picked the ACP behavior, you're wrong. Always ask: did the Prefilter touch this first?

Trap 2: NAT rule ordering and the Auto NAT vs. Manual NAT hierarchy

FTD NAT inherits ASA's three-section model, and the exam loves to test the order:

Section 1 — Manual NAT (before Auto NAT)
Section 2 — Auto NAT (object NAT)
Section 3 — Manual NAT (after Auto NAT)

The classic trap: a broad Manual NAT rule sits in Section 1 and shadows a more specific Auto NAT rule in Section 2 — so the specific rule never fires. Candidates who think "most specific wins" get burned, because in FTD, section order beats specificity. Auto NAT only auto-sorts within its own section.

The other favorite is access rule design against NAT. On FTD, your Access Control rules reference the real (pre-NAT) IP, not the mapped address — a change from older ASA behavior where you had to think about the post-NAT address. Miss that and your ACP logic is inverted.

Trap 3: The Deploy button — config saved is not config live

Nothing in FMC takes effect until you Deploy. This sounds trivial until the exam frames it as a troubleshooting scenario: "You changed the access policy, verified the rule, but traffic still matches the old behavior. Why?"

The answer is almost always: changes are staged in FMC but not yet pushed to the managed FTD device. The correct action is to deploy to the specific device.

Related gotchas the exam exploits:

Some changes force a Snort process restart, which drops traffic momentarily. Knowing which changes (VDB updates, certain policy changes, MTU changes) trigger a restart is testable.
A device showing "Deployment pending" is not out of sync because of a bug — it's waiting for you.

From the CLI you can confirm what the sensor actually sees:

> show access-control-config
> show nat detail

If the running config on FTD doesn't match FMC, you have a deployment problem, not a policy-logic problem.

Trap 4: Security Intelligence and DNS policy blocking happen before your rules

Security Intelligence (SI) is another early-stage filter that operates ahead of Access Control rule evaluation. It blocks by IP, URL, and DNS reputation using Cisco Talos feeds — and it acts before your carefully crafted ACP allow rules ever run.

The trap scenario: a host can't reach a site, your ACP clearly allows it, and you spend the question hunting through access rules. The real cause is an SI blocklist or a DNS Policy sinkhole silently dropping the connection first.

Key distinctions the exam tests:

DNS Policy blocks at name resolution — the client may get a sinkhole redirect rather than a clean drop, which changes what the user sees.
SI block vs. monitor — monitor only logs; it does not stop traffic. Confusing these two costs points.
SI decisions land in the Security Intelligence event view, not the standard connection events, which is where you'd look to prove the diagnosis.

Rule of thumb for the exam: if traffic dies despite an allow rule, suspect the earlier stages — Prefilter, then SI/DNS — before blaming the ACP.

Trap 5: FTD vs. FMC responsibility boundaries (and the ASA migration edge cases)

The exam consistently probes which box does what. FMC is the management and analysis plane; FTD is the enforcement plane. Get the split wrong and you'll pick impossible answers.

Commonly confused ownership:

FMC owns policy authoring, event correlation, reporting, the intrusion rule database, and the Talos feed distribution.
FTD owns actual packet forwarding, NAT translation, and local event buffering when it loses the FMC connection.
FTD standalone via FDM exists too — but FDM and FMC management are mutually exclusive. You cannot manage the same device from both. The exam will offer "manage via FMC and FDM simultaneously" as a plausible-looking wrong answer.

On the ASA-to-FTD migration side, the Firepower Migration Tool (FMT) is the tested path. The gotcha: FMT migrates supported constructs but flags — and does not auto-convert — things like unsupported NAT combinations, certain ACL objects, and features with no FTD equivalent. Candidates who assume "migration = 100% automatic" miss the questions about post-migration manual remediation. Know that the tool produces a pre-migration report you're expected to review.

The honest takeaway

None of these five traps are hard concepts once you see them clearly. The difficulty is that Firepower's processing order — Prefilter → Security Intelligence/DNS → Access Control → NAT enforcement — runs counter to how most engineers mentally model a firewall. The exam is essentially checking whether you've internalized that pipeline or whether you're still thinking in ASA packet-flow terms.

Study the order of operations until you can recite it cold, and drill the deploy/troubleshooting scenarios until the "changes saved but not live" reflex is automatic. Do that, and the 300-710 stops being a coin flip.

Before you book, take a free 300-710 practice test and specifically track how you do on prefilter ordering and the "allow rule that still blocks" scenarios. If those two feel shaky, you've found exactly where to spend your remaining study time.

CKA Traps That Catch Everyone: Mistakes That Cost You the Exam

ExamCert.App — Tue, 21 Jul 2026 15:12:26 +0000

You know Kubernetes. You've shipped Deployments, debugged CrashLoopBackOff at 2am, written Helm charts you're not proud of. Then you sit the CKA and walk out unsure whether you passed. That gap — between "I use Kubernetes daily" and "I passed a live terminal exam under time pressure" — is where people fall.

The CKA is not a multiple-choice trivia test. It's performance-based: a real terminal, a real cluster (actually several), roughly 15 to 20 hands-on tasks, two hours on the clock, and a 66% cut line to pass. You get one free retake baked into the $445 price, and the cert is valid for two years. The tasks are weighted across five domains — Troubleshooting (30%), Cluster Architecture, Installation & Configuration (25%), Services & Networking (20%), Workloads & Scheduling (15%), and Storage (10%). Notice that Troubleshooting is the single biggest chunk. People who study "how to create resources" and skip "how to fix broken ones" are optimizing for the wrong exam.

Before we go deeper, one honest plug: I ran timed reps on the ExamCert CKA prep and the thing that moved my score wasn't more theory, it was building muscle memory under a clock. Below are the traps that actually cost points.

Trap 1: Fighting the exam instead of the cluster

The number one killer is time, and the number one time-sink is typing YAML from memory. Do not do this. kubectl is imperative for a reason. Generate the skeleton, then edit.

kubectl create deployment web --image=nginx --replicas=3 \
  --dry-run=client -o yaml > web.yaml

--dry-run=client -o yaml is the single most valuable string on the exam. It gives you a valid manifest in one second that you'd otherwise fumble for three minutes. Same for pods, services, configmaps, secrets, jobs, cronjobs — all of them can be scaffolded imperatively.

And when a task literally says "create a pod that runs nginx," just run it:

kubectl run web --image=nginx

People lose minutes hand-writing a Pod spec for a task that was one command. Read what's actually being asked.

Trap 2: Ignoring the context switch

Every task lives on a specific cluster and namespace, and each task page starts with a command like:

kubectl config use-context k8s-cluster-3

Run it. Every single time. I have watched people build a perfect solution on the wrong cluster and score zero because the grader checked a different context. Muscle-memory this: read the task, copy the context command, run it, then start working.

The namespace trap is the same disease. A task says "in namespace venus" and you create the resource in default because you forgot -n. It's silent — no error, no warning, just a wrong answer.

kubectl config set-context --current --namespace=venus

Set the namespace at the start of a multi-step task and stop retyping -n venus on every command.

Trap 3: Not actually using the docs

You are allowed one browser tab open to the official Kubernetes documentation. Candidates treat this like cheating they're too proud to use. Wrong mindset. The docs are part of the environment — use them ruthlessly for the YAML you don't have memorized: PersistentVolume specs, NetworkPolicy selectors, securityContext fields, RBAC Role/RoleBinding shapes.

But here's the nuance: don't rely on the docs for the common stuff. If you're searching kubernetes.io to remember how to scale a Deployment, you've already lost the time war. The docs are for the awkward 10% (a nodeAffinity block, a volumeClaimTemplate), not the daily 90%. Practice enough that you only reach for the tab when you genuinely need a field name.

Trap 4: Treating etcd backup as optional

etcd backup and restore shows up under Cluster Architecture and it trips people who never touch etcd in their day job. You need to know this cold, including passing the certs and endpoint explicitly:

ETCDCTL_API=3 etcdctl snapshot save /opt/backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

The restore path is where people freeze — a restore goes to a new data directory and you have to point the static etcd pod manifest at it, then wait for the apiserver to come back. If you've never rehearsed this end to end, you will not improvise it correctly in the two-minute window your brain allots. Do it three times before exam day, from cold, without notes, until the sequence is automatic and you're not second-guessing the certificate flags.

Trap 5: `kubectl edit` on things you can't edit

You'll want to kubectl edit a Deployment to change an image or add a resource limit — fine. But you cannot kubectl edit your way through certain immutable fields, and static pods (kubelet, etcd, apiserver) aren't edited via the API at all. Those live as manifests in /etc/kubernetes/manifests/ on the control plane node. Change the file, and the kubelet restarts the pod. If you try to kubectl delete a static pod, it just comes back — because the kubelet, not the scheduler, owns it. Knowing where a thing is actually managed is half of the Troubleshooting domain.

Trap 6: Skipping the "why is this node NotReady" muscle

Troubleshooting is 30% and it is the domain you can't fake. A classic task: a node shows NotReady. The fix is almost always a systematic walk, not a guess.

kubectl get nodes
ssh node01
systemctl status kubelet
journalctl -u kubelet --no-pager | tail -30

Nine times out of ten it's the kubelet being stopped, a wrong config path, or a swap issue. The point isn't memorizing the one answer — it's having a sequence you run without thinking: check node status, SSH in, check the kubelet service, read its logs, fix, verify Ready. Candidates who don't drill this stare at the terminal and burn eight minutes deciding where to look.

If you want to pressure-test that reflex before exam day, run through a free CKA practice test and time yourself on the broken-cluster scenarios specifically.

Trap 7: Not verifying, and not flagging

Two habits separate passers from near-misses.

First: verify every task before moving on. Created a Service? kubectl get endpoints <svc> and confirm it actually selected pods — an empty endpoints list means your selector is wrong and the task scores zero even though the Service "exists."

Second: use the flag/skip feature. Some tasks are worth 4% and some are worth 12%. If a low-weight task is fighting you, flag it and move on. Chasing one stubborn 4% task while three easy 8% tasks sit untouched is how good engineers fail. Do a first pass grabbing every task you can finish in under five minutes, then circle back.

Trap 8: Ignoring the little productivity setup

Spend the first 60 seconds setting up your shell. These aliases are allowed and they compound over 20 tasks:

alias k=kubectl
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"
source <(kubectl completion bash)
complete -F __start_kubectl k

Now k create deploy web --image=nginx $do scaffolds a manifest, tab-completion stops your typos, and k delete pod x $now kills a pod instantly. Twenty seconds saved per task times twenty tasks is a task-and-a-half of extra time.

The real lesson

None of these traps are about Kubernetes knowledge. They're about operating under a clock in a real terminal: use imperative commands, respect the context and namespace, drill etcd and node troubleshooting, verify everything, and don't let one hard task sink three easy ones. The people who fail the CKA usually knew the material — they just never rehearsed the exam as a physical, timed skill. Treat it like one, and 66% stops feeling scary.

ADM-201, Domain by Domain: What Each Section Actually Tests (From a Dev Who Sat It)

ExamCert.App — Mon, 20 Jul 2026 15:19:09 +0000

I write Apex for a living and I put off ADM-201 for four years because I assumed it was beneath me. Then I spent a full sprint debugging a data issue that turned out to be a sharing rule interacting with an owner-based criteria rule, and I realised I did not actually understand the platform I was writing code on top of.

So I sat it. Passed with room to spare, but not for the reasons I expected — the sections I found hardest were the ones I'd dismissed as "clicky stuff."

Here's the current blueprint, domain by domain, with what each one really asks you. The outline was refreshed effective December 2025, so if you're reading a guide written before that, the weightings you've got are wrong.

The format, quickly

60 scored multiple-choice questions plus up to 5 unscored, 105 minutes, 65% to pass. That's 39 of 60. You can drop 21 and still walk out certified. $200 to sit, $100 for a retake, and it's valid for three years with free maintenance modules each release.

Before you read the rest of this, go take a free ADM-201 practice test cold. Developers consistently overrate themselves here. I scored 61% on my first untimed run and I'd been in the ecosystem for years.

Data and Analytics Management — 17%

The biggest single domain now, which surprised a lot of people. Roughly 10 questions.

What it tests: import wizard versus Data Loader (record limits, which objects each supports, when you must use Data Loader for hard deletes), duplicate and matching rules, and then a solid block of reports and dashboards.

The report questions are where devs lose points. Know the difference between a joined report and a matrix report, what a bucket field does, when you need a custom report type versus a standard one, and how cross filters work. Dashboard running user is a classic: with a dynamic dashboard, the viewer's own permissions apply; with a static one, everyone sees the running user's data. That's a security question dressed up as a reporting question, and it appears constantly.

Configuration and Setup — 15%

About 9 questions. Company settings, fiscal years, business hours, the UI settings that nobody touches until a stakeholder asks why the currency is wrong.

This is also where the security model lives, and this is the part I'd tell any developer to study hardest. Org-wide defaults, role hierarchy, sharing rules, manual sharing, team access — in that order, because that's the order access is granted and it's never revoked by a later step. Profiles set the baseline of what a user can do; permission sets add. Nothing subtracts. If you internalise "OWD is the floor, everything else opens doors," half these questions answer themselves.

Delegated administration and login access policies show up once or twice. Know they exist.

Object Manager and Lightning App Builder — 15%

Another 9 or so. Custom fields and their gotchas: which field types can't be changed after creation, what happens to data when you convert a text field to a picklist, why you can't delete a field that's referenced in a formula or a flow.

Relationships: master-detail cascades deletes and enables roll-up summaries; lookup doesn't and can't. Record types plus page layouts plus picklist value assignment is a three-part interaction that the exam enjoys tangling.

For App Builder: dynamic forms, component visibility filters, and knowing that a Lightning record page can be assigned by app, record type and profile simultaneously.

Automation — 15%

Roughly 9 questions, and as a developer this was my easiest section — with one caveat.

Flow dominates. Record-triggered flows (before-save versus after-save, and why before-save is faster because it doesn't re-run the save), scheduled flows, screen flows, approval processes. Know that Workflow Rules and Process Builder are retired and that questions phrased around them are asking you to migrate.

The caveat: the exam wants the declarative answer unless declarative genuinely can't do it. My instinct on three questions was "write a trigger," and on all three the right answer was a before-save flow. Recalibrate. Apex is correct only when you need callouts, complex bulk logic across many objects, or something with no clicks-based equivalent.

Order of execution is worth memorising as a sequence. Validation rules, before-save flows, triggers, duplicate rules, assignment rules, workflow field updates — write it out until you can reproduce it in ten seconds.

Sales and Marketing Applications — 10%

About 6 questions. Lead conversion (what becomes an Account, Contact and Opportunity, and what happens to custom lead fields if you haven't mapped them), opportunity products and price books, forecasting, campaign influence.

Price books are the quiet killer. Standard price book versus custom, why a product with no entry in the active price book can't be added to an opportunity. If you've never sold anything in a Salesforce org, spend an hour on this.

Service and Support Applications — 10%

Another 6. Case assignment rules, escalation rules, entitlements, milestones, Knowledge, omni-channel, email-to-case versus web-to-case.

Assignment rules run in order and stop at the first match — that ordering behaviour is a common question. Entitlement processes and milestones are worth knowing at a definition level; you won't be asked to configure one end to end.

Productivity and Collaboration — 10%

6 questions covering activities, tasks and events, Chatter, Salesforce mobile, Slack integration basics, and the newer productivity tooling.

Genuinely the least interesting domain and the easiest to pick up in an evening. Don't skip it — 6 questions is worth more than the effort it takes.

Agentforce — 8%

New. Around 5 questions. You need to know what an agent topic and an action are, how Agent Builder differs from Prompt Builder, what permissions an agent user needs, and where you monitor agent activity.

You are not being asked to build production AI. You are being asked whether you know the vocabulary and the admin-side guardrails. A couple of hours on the Agentforce basics trailmix covers it.

What I'd do differently

I studied breadth-first and it was wrong. The security model and reports together are about a third of the exam and they're the two areas where "I use Salesforce every day" doesn't save you, because the exam asks about configurations you'd never build yourself.

If I ran it again: two weeks on security and sharing until I could diagram OWD-to-manual-share from memory, one week on reports and dashboards, one week on Flow and order of execution, then a week of nothing but timed practice sets.

Book the exam before you feel ready. Sixty questions in 105 minutes is about 1 minute 45 each, which is comfortable — the pressure isn't time, it's the second-guessing on the eight or nine questions with two plausible answers. Flag them, move, come back.

Was it worth it for a developer?

More than I expected. Certified admins in the US sit somewhere around the $95k–$130k band depending on region and experience, but the salary wasn't the point for me. The point was that I stopped writing code to solve problems the platform had already solved, and I stopped filing bugs that were actually sharing settings.

Full exam breakdown and practice sets are on ExamCert if you want to check where you stand. Get to a consistent 80% on practice before booking — 65% is the pass mark, not the target.