SAP-C02 Cheat Sheet

How much data you can afford to lose. RPO=0 → no data loss. RPO=1h → you can lose up to 1h of transactions.

How long the system can be down. RTO=0 → no downtime (Active-Active). RTO=4h → restore within <4h.

RPO: hours (backup frequency). RTO: hours (restore time). Cheapest, least HA.

RPO: minutes (DB replication). RTO: 10-30 min (power on and scale EC2). Minimal resources always active.

RPO: seconds. RTO: 1-5 min. Full environment at small scale, scale up on failure.

RPO: 0. RTO: seconds or zero. Both regions active, Route 53 diverts traffic. More expensive.

Pilot Light: only DB and core services active, EC2 off. Warm Standby: everything active but at minimal scale.

An SCP only restricts the maximum possible permissions. The user still needs an IAM allow policy. SCP is a filter.

An SCP deny at a higher level blocks access even if there is an allow at a lower level. An explicit deny always wins.

SCPs do NOT affect the management account (root). They only affect member accounts.

An SCP attached to an OU is inherited by all children (sub-OUs and accounts). Useful for global security restrictions.

Delegate administration of services (GuardDuty, Security Hub) to member accounts without granting them access to the management account.

SCP = account-level boundary (Organizations). Permission Boundary = IAM entity-level boundary (user/role).

Automated landing zone built on top of Organizations. Creates an OU structure, guardrail baseline, and predefined accounts (Log Archive, Audit).

1 Gbps, 10 Gbps, or 100 Gbps. Direct connection from your hardware to the DX Location. Provisioning: weeks/months.

50 Mbps to 10 Gbps (variable capacities). Provided by an AWS Partner. Faster setup than dedicated.

Private VIF: accesses VPC resources. Public VIF: accesses public AWS services. Transit VIF: accesses TGW.

DX as primary (high BGP preference). VPN as automatic backup. Failover via BGP within seconds.

Two DX connections from two different DX Locations/providers. AWS guarantees 99.99% SLA. Eliminates physical SPOF.

Lets you connect a DX (via Transit VIF) to multiple VPCs across different regions or accounts. No extra peering needed.

Native L2 (layer 2) encryption on Direct Connect. Available on 10G/100G dedicated connections. No VPN overhead.

Stack = resources in a single account/region. StackSet = deploy the same stack across multiple accounts/regions automatically.

Required when the template creates IAM resources. CAPABILITY_NAMED_IAM for roles with a specific name.

Detects differences between the actual state of resources and what is defined in the template. Does not fix automatically.

Lambda-backed. Runs custom logic during stack create/update/delete. For resources without native CFN support.

Pre-processed template transformations. SAM transform converts a SAM template into standard CFN.

cfn-init (cfn helper): installs packages, creates files declaratively. UserData: raw bash script. cfn-init is more robust.

AWS Organizations manages automatic deployment to new accounts and OUs. No manual per-account roles required.

TGW = transitive (A→TGW→B→C). VPC Peering = NOT transitive. TGW has per-attachment and data-processing costs.

Each attachment has a route table association. You can segment traffic between VPCs using multiple route tables.

TGW Peering between regions. Traffic travels over the private AWS network (not the internet). The peering attachment is billed.

Share a TGW across accounts in the organization via AWS Resource Access Manager (RAM). No need to create a TGW per account.

Works across different accounts and different regions (inter-region peering). Requires peer acceptance. Not transitive.

PrivateLink = expose a specific service (endpoint service) without full peering. More secure, does not expose the whole VPC.

GuardDuty = runtime threat detection (suspicious behavior). Inspector = vulnerability assessment (CVEs in software/OS).

Macie = sensitive data in S3 (PII, credentials). GuardDuty = security threats (suspicious access, malware).

AWS Managed Rules (OWASP Top 10, Bot Control) or Marketplace. Applied to ALB, CloudFront, API Gateway, AppSync.

Standard = automatic, free, layer 3/4. Advanced = L7-specific DDoS, cost protection credits, 24/7 DRT team, $3000/month.

KMS = AWS-managed, shared (multi-tenant), FIPS 140-2 L2. CloudHSM = dedicated hardware, FIPS 140-2 L3, greater control.

Secrets Manager = automatic rotation, RDS integration, higher cost. Parameter Store = free (standard), no native rotation.