DEV Community: ExamCert Study Notes

Cloud Certification Roadmap 2026 (AWS, Azure, GCP) + Free Practice Resources

ExamCert Study Notes — Sun, 21 Jun 2026 07:57:34 +0000

People ask me almost weekly: "Which cloud cert should I start with in 2026, and in what order?" Here's the roadmap I give them, with a free practice resource for every stop so you can actually test yourself instead of just reading.

Step 0 — Pick a cloud (or don't)

If your employer uses one cloud, start there. If you're job-hunting broadly: AWS has the most listings, Azure dominates enterprise/Microsoft shops, GCP is strong in data/ML. You don't need all three — depth in one beats shallow in three.

The roadmap

Tier 1 — Foundational (start here, ~2–4 weeks each)

The "is cloud for me" tier. Cheap, broad, no deep technical prereqs.

AWS Certified Cloud Practitioner (CLF-C02) → https://www.examcert.app/exams/aws-clf-c02/free-practice-test/
Azure Fundamentals (AZ-900) → https://www.examcert.app/exams/azure-az-900/free-practice-test/
Google Cloud Digital Leader (CDL) → https://www.examcert.app/exams/gcp-cloud-digital-leader/free-practice-test/

Tier 2 — Associate (the ones that get you hired, ~6–10 weeks each)

This is the tier that actually moves your résumé.

AWS Solutions Architect Associate (SAA-C03) — the single most valuable cloud cert by demand → https://www.examcert.app/exams/aws-saa-c03/free-practice-test/
Azure Administrator (AZ-104) → https://www.examcert.app/exams/azure-az-104/free-practice-test/
Google Associate Cloud Engineer (ACE) → https://www.examcert.app/exams/gcp-associate-cloud-engineer/free-practice-test/

Tier 3 — Professional / specialty (deep, ~3 months each)

Go here once you have hands-on experience, not before.

AWS Solutions Architect Professional (SAP-C02) → https://www.examcert.app/exams/aws-sap-c02/free-practice-test/
Azure Solutions Architect (AZ-305) → https://www.examcert.app/exams/azure-az-305/free-practice-test/
Google Professional Cloud Architect → https://www.examcert.app/exams/gcp-professional-cloud-architect/free-practice-test/

Specializations worth it in 2026

Data: Azure DP-203 / GCP Professional Data Engineer
Security: AWS Security Specialty (SCS-C03) / Azure AZ-500 / CCSP
AI/ML: Azure AI-102 / GCP Professional ML Engineer / AWS MLA-C01

A sane study cadence

Read the official exam objectives once — they ARE the syllabus.
Do a hands-on lab per domain (free tier is enough for associate-level).
Take a timed practice test early to find weak domains — don't save it for the end.
Re-drill only the weak domains. Repeat until you're at a steady 85%+.
Book the exam the moment you hit that — momentum matters.

Every exam above links to a free, no-signup practice test so you can run step 3 today. Full guides and objective breakdowns for ~150 certs live at https://www.examcert.app/exams/.

What track are you on this year? Drop it below and I'll suggest the next exam.

10 Tough AWS SAA-C03 Practice Questions (Scenario-Based, 2026)

ExamCert Study Notes — Sun, 21 Jun 2026 07:53:36 +0000

The AWS Certified Solutions Architect – Associate (SAA-C03) exam isn't a vocabulary test — it's scenario reasoning. Below are 10 questions in the exam's style. Try each before opening the answer.

Format reminder: 65 questions, 130 minutes, pass ≈ 720/1000, ~$150. Domains: Secure Architectures (30%), Resilient Architectures (26%), High-Performing Architectures (24%), Cost-Optimized Architectures (20%).

1. A web app must store session state so any instance behind an ALB can serve any user. Lowest-latency managed option?

Answer*ElastiCache for Redis.* DynamoDB works but Redis is the lowest-latency session store; "any instance" rules out local/sticky sessions.

2. You need to give an EC2 app access to S3 without storing credentials. How?

Answer*IAM role attached to the instance (instance profile).* Never embed access keys.

3. Cross-region disaster recovery with RPO of seconds for an RDS database. Best fit?

Answer*Amazon Aurora Global Database* (sub-second cross-region replication). Read replicas have higher lag; snapshots are minutes/hours.

4. A fleet must scale to zero at night and handle spiky daytime traffic with no server management. Compute?

Answer*AWS Lambda* (or Fargate if containers). "Scale to zero, no server management" = serverless.

5. Static site must be globally fast and cheap, served from S3. What in front?

Answer*CloudFront* with an Origin Access Control to a private S3 bucket.

6. Decouple a burst-prone order service from a slower fulfillment service, guaranteeing no message loss.

Answer*Amazon SQS* between them. Buffers bursts; fulfillment polls at its own pace.

7. Block SQL-injection and common web exploits at the edge for an ALB-fronted app.

Answer*AWS WAF* (managed rule groups) on the ALB/CloudFront.

8. Petabyte-scale analytics over data sitting in S3, queried occasionally, no clusters to manage.

Answer*Amazon Athena* (serverless, query-in-place on S3). Redshift = always-on cluster.

9. Private, non-internet connectivity from a VPC to S3 to avoid data-transfer charges and exposure.

Answer*Gateway VPC endpoint for S3* (free; keeps traffic off the public internet).

10. Reduce cost for steady, predictable EC2 baseline running 24/7 for 3 years.

Answer*Compute Savings Plans / Standard Reserved Instances* (up to ~72% off). Spot is for fault-tolerant, interruptible workloads — not steady baseline.

The pattern behind the answers

Almost every SAA-C03 question is really asking one of: managed > self-managed, decouple with a queue, least-privilege IAM roles not keys, the right storage/redundancy tier for the stated RPO/RTO, and cheapest option that still meets the requirement. Once you internalize those, the wording stops tricking you.

Where to drill more

The only way to get fast at these is volume under time pressure. I used a free SAA-C03 question bank to find weak domains, then re-drilled:

Free AWS SAA-C03 practice test: https://www.examcert.app/exams/aws-saa-c03/free-practice-test/
Full SAA-C03 exam guide & domains: https://www.examcert.app/exams/aws-saa-c03/

Aim for a steady 85%+ across all four domains before you book. Post your score in the comments.

AZ-104 Azure Administrator Cheat Sheet — 2026 Exam Notes

ExamCert Study Notes — Sun, 21 Jun 2026 07:51:41 +0000

I sat the AZ-104: Microsoft Azure Administrator exam recently and pulled my revision notes into a single cheat sheet. If you're in the final week before the test, this is the stuff worth memorizing.

Exam at a glance

Questions: ~40–60 (mix of multiple choice, case studies, and the occasional drag-and-drop / hot-area)
Time: ~120 minutes
Pass score: 700 / 1000 (scaled — not a raw 70%)
Cost: ~$165 USD
Prereqs: none official, but you'll struggle without hands-on Azure portal + a little CLI/PowerShell

Domain weights (2026 objectives)

Domain	Weight
Manage Azure identities & governance	20–25%
Implement & manage storage	15–20%
Deploy & manage Azure compute resources	20–25%
Configure & manage virtual networking	15–20%
Monitor & maintain Azure resources	10–15%

Networking + compute are the heaviest combined. If you're short on time, drill those two first.

The services that actually show up

Identity & governance

Entra ID (formerly Azure AD): users, groups, RBAC vs. Azure Policy (RBAC = who can do what; Policy = what is allowed to exist). This distinction is tested constantly.
Management groups → subscriptions → resource groups → resources (know the scope hierarchy cold).
Custom roles, Conditional Access basics, self-service password reset.

Storage

Storage account tiers: Hot / Cool / Cold / Archive — and the rehydration latency for Archive.
Redundancy: LRS / ZRS / GRS / GZRS — know which survives a region loss (GRS/GZRS) vs. a zone (ZRS).
SAS tokens, access keys, Azure Files vs. Blob, AzCopy, lifecycle management rules.

Compute

VM sizing/resizing, availability sets vs. availability zones vs. VMSS.
Custom images, the difference between a VM Scale Set and a single VM with a load balancer.
App Service plans, container instances, and when to pick which.

Networking

NSG rule evaluation order (priority, lowest number wins) — a classic trick question.
VNet peering (non-transitive!), service endpoints vs. private endpoints.
Public vs. private load balancer, Application Gateway (L7) vs. Load Balancer (L4), Azure DNS.

Monitoring

Azure Monitor, Log Analytics + KQL basics, Metrics vs. Logs, alerts + action groups.
Network Watcher (connection troubleshoot, NSG flow logs), Backup + Recovery Services vault.

Gotchas that cost people the pass

VNet peering is NOT transitive — A↔B and B↔C does not give A↔C.
NSG priority: lower number = higher priority; the first match wins and stops evaluation.
Archive tier blobs can't be read until rehydrated (hours) — watch for "immediate access" wording.
ZRS protects a zone, not a region. If the question says "survive a regional outage," you need GRS/GZRS.
RBAC ≠ Policy. "Prevent anyone from creating resources outside Europe" → Azure Policy, not RBAC.

Two quick practice questions

Q1. You must guarantee blob data survives a full Azure region outage at lowest cost. Which redundancy?
A: GRS (geo-redundant; GZRS also works but costs more — "lowest cost" → GRS).

Q2. A subnet has an NSG allowing 3389 at priority 300 and denying 3389 at priority 200. Is RDP allowed?
A: No. Priority 200 (deny) is evaluated before 300 and wins.

How I drilled

Reading objectives only gets you so far — the exam is scenario-heavy, so timed question banks are what move the needle. I used a free AZ-104 practice test (no signup, full objective breakdown) to find weak domains, then re-drilled those:

Free AZ-104 practice test: https://www.examcert.app/exams/azure-az-104/free-practice-test/
Full AZ-104 study guide & objectives: https://www.examcert.app/exams/azure-az-104/

Drill to a consistent 85%+ across all five domains before booking. Good luck — drop your exam date in the comments and I'll send a focused revision list.