DEV Community: Nagesh Raj

AWS SAA-C03 Exam Traps That Almost Failed Me (And How to Dodge Them)

Nagesh Raj — Sun, 20 Jul 2025 18:06:05 +0000

I scored 825/1000 on my AWS SAA-C03 exam — but only after falling face-first into every trap AWS could throw at me. Here’s how to avoid the mistakes that nearly cost me my certification.

💥 Trap 1: IAM’s Silent Assassin — DENY rule

The Trap: You think an ALLOW policy grants access, but a hidden DENY in another policy nukes it.

The Fix:
IAM evaluates policies in this order:
1️⃣ Explicit DENY → 2️⃣ Explicit ALLOW → 3️⃣ Default DENY.

Imagine DENY is Thanos — it snaps ALLOW out of existence.
Always check for sneaky DENY rules!

💥 Trap 2: Security Groups vs. NACLs

The Trap: Mixing up stateful (Security Groups) and stateless (NACLs) rules.

The Fix:

NACLs are like airport security — check everyone in and out.
SGs are lounge staff — once you’re in, you’re good to go!

💥 Trap 3: S3 Versioning

The Trap: Enabling versioning, then realizing you can’t disable it — only suspend it.

The Fix:

Use versioning only for critical data.
Need to “disable”? Start fresh with a new bucket.

S3 versioning is like tattoos: easy to add, impossible to remove fully.

💥 Trap 4: Route 53

The Trap: Using a CNAME for example.com (instead of www.example.com).

The Fix:

ALIAS records for apex domains.
CNAME only for subdomains.
CNAMEs can’t be used at the zone apex; you must use ALIAS or A records.

CNAMEs at the apex are like using a phone charger as a Wi-Fi antenna — it just doesn’t work that way.

💥 Trap 5: RDS Multi-AZ vs. Read Replicas

The Trap: Using Multi-AZ for read scaling (spoiler: it’s for failover only).

The Fix:

Multi-AZ is for survival — failover and resilience.
Read Replicas are for growth — read scaling and performance.

💥 Trap 6: CloudTrail vs. CloudWatch Logs

The Trap: Using CloudWatch for API audits (it’s for app logs).

The Fix:

CloudTrail: Who deleted my S3 bucket? (API tracking).
CloudWatch: Why is my app crashing? (debugging).

💥 Trap 7: Spot Instances

The Trap: Running mission-critical apps on Spot Instances (they can vanish mid-task).
The Fix:

Spot instances should be used for:

Batch processing
Stateless workloads
Non-urgent tasks

Spot Instances are like tinder dates: cheap, fun, but don’t expect commitment.

💥 Trap 8: Time Management

The Trap: Spending 4–6 minutes on one question.

The Fix:

Answer easy questions first (2 mins each) and flag the rest.
If you’re not sure and need to take a guess, try to eliminate one or two wrong answers before making a choice.
Once you eliminate the wrong ones, look for word differences between the remaining options. One of them will make more sense than the rest :)

AWS Well-Architected Framework: Ultimate Cheat Sheet for Solutions Architect Associate 2025

Nagesh Raj — Sun, 20 Jul 2025 17:56:17 +0000

The Well-Architected Framework heavily influences the AWS Solutions Architect Associate (SAA) exam, and this can be your make-or-break. Here’s how to turn its 6 pillars into exam gold.

Why the Well-Architected Framework Dominates the SAA Exam

The AWS SAA exam isn’t just about memorizing services. It’s about designing solutions that are secure, reliable, and cost-effective — which is exactly what the Well-Architected Framework emphasizes.

Key Stats for SAA Candidates:

30–50% of questions relate to the 6 pillars.
Top topics: Security (IAM, encryption), Cost Optimization (Reserved Instances) , Reliability (Multi-AZ).
Scenarios often ask, “What is the MOST cost-effective/reliable/securable solution?”

This cheat sheet breaks down each Well-Architected Framework pillar for the SAA exam: what you must know, plus real exam-style examples and pro tips.

Let’s dive in :)

📌 Pillar 1: Operational Excellence

Exam Focus: Automation, monitoring, and CI/CD pipelines.

What You MUST know:

Infrastructure as Code (IaC):

AWS CloudFormation vs. AWS CDK (CloudFormation questions appear prominently in the exam).
Core YAML components to know: Resources, Parameters, Outputs.

CI/CD Tools:

AWS CodePipeline (orchestration), CodeBuild (build), CodeDeploy (deploy).

Monitoring:

CloudWatch Alarms (e.g., CPU utilization >80%) vs. CloudTrail (audit logs).

Exam Scenario:

“A company wants an automated rollback if deployment fails. Which service should they use?”
Answer: AWS CodeDeploy with deployment configurations.

📌 Pillar 2: Security

Exam Focus: Least privilege, encryption, and compliance.

What You MUST Know:

IAM Best Practices:

Use roles instead of access keys.
Policy Conditions (e.g., aws:SourceIp to restrict IP ranges).

Encryption:

AWS KMS for managing keys (SSE-KMS for S3, RDS).
SSL/TLS for data in transit (use ACM for free certificates).

Security Tools:

AWS Shield (DDoS protection), GuardDuty (threat detection).

Exam Scenario:

“How to ensure S3 bucket data is encrypted at rest and accessible only from a corporate VPN?”
Answer: Enable SSE-KMS and add a bucket policy with aws:SourceIp condition.

📌 Pillar 3: Reliability

Exam Focus: High availability, fault tolerance, backups.

What You MUST Know:

Multi-AZ vs. Multi-Region:

Multi-AZ (RDS, EC2) for failover in the same region.
Multi-Region (S3 Cross-Region Replication) for disaster recovery.

Auto Scaling:

Scaling policies (target tracking, step scaling).
Use ALB (Application Load Balancer) to distribute traffic.

Backups:

RDS automated backups vs. snapshots (manual).

Exam Scenario:

“A workload must remain available if an AZ fails. Which architecture is BEST?”
Answer: Deploy EC2 instances in an Auto Scaling group across multiple AZs behind an ALB.

📌 Pillar 4: Performance Efficiency

Exam Focus: Right-sizing, caching, and serverless.

What You MUST Know:

Compute Options:

Lambda for event-driven, sporadic workloads.
EC2 Instance Types: General-purpose (M5) vs. Compute-optimized (C5).

Caching:

CloudFront (CDN) for static assets.
ElastiCache (Redis/Memcached) for database query caching.

Storage Tiers:

S3 Standard vs. S3 Intelligent-Tiering (automatic cost savings).

Exam Scenario:

“How to reduce latency for global users accessing a static website?”
Answer: Host the site on S3 and distribute via CloudFront.

📌 Pillar 5: Cost Optimization

Exam Focus: Pricing models, budgeting, and waste reduction.

What You MUST Know:

Pricing Models:

Reserved Instances (up to 72% savings) vs. Savings Plans (flexible).
Spot Instances for fault-tolerant, non-critical workloads.

Cost Tools:

AWS Cost Explorer for forecasting.
AWS Budgets to set spending alerts.

Waste Reduction:

Terminate orphaned EBS volumes .
Use Trusted Advisor’s cost optimization checks.

Exam Scenario:

“Which is MOST cost-effective for a steady-state production database?”
Answer: Reserved Instances (1-year term).

📌 Pillar 6: Sustainability

Note: I don’t recall seeing a direct question on this topic

Exam Focus: Indirectly tested via Cost Optimization & Performance Efficiency.

What You MUST Know:

Energy-Efficient Compute:

Graviton Instances (ARM): 40% better performance per watt than x86.
Serverless (Lambda/Fargate): Scale to zero to avoid idle resource waste.

Storage Optimization:

Use S3 Intelligent-Tiering to auto-archive unused data.
Delete obsolete snapshots and EBS volumes.

Region Selection:

Deploy in AWS’s green regions (e.g., Oregon, Frankfurt) powered by renewable energy.

Exam Scenario ( I don’t recall a question based on this ):

“Which EC2 instance type reduces costs and energy consumption?”
Answer: Graviton instances (e.g., C7g).

🚀 Bonus Exam-Day Pro Tips

Pillar Priority: Security and Cost Optimization are the most tested.

Eliminate Wrong Answers: Cross out options violating pillars (e.g., public S3 buckets).

Multi-AZ > Multi-Region: Unless the question explicitly mentions disaster recovery.

Keywords Matter:
“MOST secure” = IAM roles, encryption, least privilege.
“MOST cost-effective” = Reserved Instances, Spot, serverless.

AWS Solutions Architect Associate Questions Decoded: What They’re Really Asking You

Nagesh Raj — Mon, 30 Jun 2025 05:50:06 +0000

A company wants to migrate its workloads to AWS in a cost-effective, scalable, and highly available way…

If you’re prepping for the AWS Solutions Architect Associate exam, you already know the questions are less “What does S3 do?” and more like:

Your house is on fire, your internet is down — what’s the best cost-effective, highly available solution to deploy a global application that stores data in multiple formats while solving world hunger?

Okay, maybe not that dramatic. But you get the vibe.

The real trick isn’t just knowing the services — it’s knowing how to think like AWS. Let’s break down how these questions are structured, what they’re secretly testing, and how you can read between the lines like a cloud whisperer.

1. Every Word Is a Clue (Even the Boring Ones)

AWS loves keywords. Some are loud and flashy:

Cost-effective
Highly available
Durable
Low latency
Globally distributed

Others are sneakier:

Intermittent access → Use S3 Infrequent Access or Glacier
Spiky traffic → Auto Scaling
Decoupled → Hello, SQS/SNS
Stateless web tier → Load balancers + Auto Scaling
Horizontal scaling → Use a service that plays well with load balancers (e.g., stateless EC2 or Lambda)

Pro Tip: Read the question like a detective, not a student. You’re not answering what they ask, you’re answering what they mean.

2. It’s Not a Quiz — It’s a Design Interview

These aren’t trivia questions. They’re tiny architecture challenges. The question isn’t testing if you know what a service does — it’s testing whether you know when to use it, instead of something else.

Here’s how they sneak that in:

Question:

“A mobile gaming company needs to store user session data that must be accessible with microsecond latency. The data should automatically expire after 24 hours. Which solution is the MOST cost-effective and scalable?”

A. Amazon RDS with a scheduled cleanup job
B. Amazon S3 with lifecycle policies
C. Amazon DynamoDB with TTL enabled
D. Amazon ElastiCache for Redis with a 24-hour TTL

✅ Best Answer:
D. Amazon ElastiCache for Redis with a 24-hour TTL

Why?

Microsecond latency → That screams in-memory database.
TTL (Time-To-Live) → ElastiCache and DynamoDB both support this, but…
Scalability + performance at that speed → Redis wins here.
Cost-effective for session-based, ephemeral data → Redis is built for this use case.

What they’re really asking:
“Do you know the go-to service for ultra-low latency and temporary data, and why traditional databases would slow you down (or cost you more)?”

3. When in Doubt, Go Serverless or Managed

If two options both technically work, the one that is more managed, more scalable, and less hands-on will usually win.

Unless:

You need fine-grained control
It’s a legacy system migration
Or the question screams “compliance/custom config required!”

Otherwise:

S3 > EBS for static assets
Lambda > EC2 for light, bursty logic
RDS > EC2+MySQL for standard relational needs
Aurora Serverless > RDS for unpredictable workloads

Translation: “You could do this on EC2… but why would you punish yourself?”

4. “Cost-Effective” ≠ “Cheapest”

This is a trap that got me the first time

“Cost-effective” in AWS-speak often means:
The right balance of performance, scalability, and price.

Not just what is the cheapest service in terms of money

Example:
A startup needs to serve images globally, with low latency, but also wants to minimize cost.

Don’t say S3 alone.
Don’t say EC2 with Nginx (you monster).
The smart move? S3 + CloudFront — globally cached, highly available, cheap bandwidth over time.

Tip: If latency or scalability is a concern, and you’re leaning toward the cheapest option — think again.

5. How They Trick You with Too Much Info

They’ll often bury the real clue in a haystack of distractions.

Example:

“A financial services company based in Frankfurt is building a high-performance trading platform. The system must comply with local data residency laws, process large amounts of real-time data, and maintain uptime even if a single Availability Zone fails.”

This looks like a networking question… but it’s not.

Focus:

Frankfurt = Region choice (EU Central 1)
AZ failover = Multi-AZ architecture (not just single EC2 instance)
Real-time data = Maybe Kinesis? Not batch-processing S3.

Answer might involve:

Multi-AZ RDS for high availability
Local AZs or Outposts if ultra-low latency
Kinesis or MSK for real-time ingestion

How to approach it: Highlight keywords. Strike out irrelevant detail. Reverse-engineer what AWS wants you to prioritize.

📌 Final Cheat Sheet: What AWS Really Means

Thanks for reading and All the best :')

AWS SAA Cheat Sheet: 5 Things I Wish I Knew Before the Exam

Nagesh Raj — Sun, 29 Jun 2025 08:43:34 +0000

I scored 825/1000 on the AWS Solutions Architect Associate (SAA-C03) exam — but only after making every mistake in the book. Here’s what I wish I knew before wasting 40+ hours on useless study tactics.

📌 1. The Exam is Scenario-Based (Not Fact Recall)

What I Thought: “I need to memorize every AWS service and its limits.”
Reality: 80% of questions are real-world scenarios like:

Your company needs a multi-region database with the lowest latency. Which service combo should you use?

Tip: Focus on use cases for:
✅ S3 (storage tiers, lifecycle policies)
✅ EC2 (instance types, spot vs. reserved)
✅ RDS vs. DynamoDB (when to use each, key differences)

📌 2. Skip These Low-Yield Topics

Wasted time on AWS Snowball, OpsWorks, and Mechanical Turk — zero questions on them.

Priority Topics:
🔴 High: VPC, IAM, S3, EC2, RDS, Lambda, EFS, FSx (Underrated!)
🟡 Medium: CloudFront, SQS/SNS, KMS, DirectConnect
⚫ Low: AWS Organizations, WorkSpaces

📌 3. The “Rule of 5” for VPCs

VPC questions are 20%+ of the exam. Master:

Subnets (public vs. private)
NAT Gateway vs. Instance (cost vs. control)
Security Groups (stateful) vs. NACLs (stateless)
VPC Peering (no transitive routing!)
Direct Connect vs. VPN (speed vs. cost)

📌 4. EC2 Pricing Tricks

Spot Instances:

Cheapest (up to 90% off) but can be terminated anytime.
Use for stateless, fault-tolerant workloads (e.g., batch processing).

Reserved Instances:

Save up to 75% if you commit to 1–3 years.
Convertible RIs let you change instance types.

📌 5. The 3-Step Exam Strategy

Flag long questions (come back later).
Eliminate 2 wrong answers first (can’t stress this enough).
Watch for absolutes (“always”, “never” = usually wrong).

🚀 Final Tips:
Practice, Practice, Practice — The best and most effective way to guarantee a great score is to take as many practice tests as you can. Review the answers for questions you get wrong or just guessed.

You will feel nervous couple of hours before the exam, but trust your preparation and go for it! You got this! All the best :’)