Commonly Confused Services on SAP-C02

Deciding signal

WAF operates at Layer 7 and blocks web requests matching rules you define: SQL injection, XSS, IP allow/block lists, rate limiting. Shield Standard is automatic DDoS protection included at no cost; Shield Advanced adds a response team, financial protection, and advanced mitigation for L3/L4/L7 attacks. Firewall Manager is a governance layer — it centrally manages WAF rules, Shield Advanced subscriptions, and Network Firewall policies across multiple accounts and VPCs in an organization. Network Firewall is a stateful, managed firewall deployed within VPCs that inspects and filters traffic at Layer 3–7, including non-HTTP protocols, with IDS/IPS capabilities. The deciding factor is what layer and what scope: web traffic rules (WAF), DDoS absorption (Shield), cross-account policy (Firewall Manager), or VPC-level deep packet inspection (Network Firewall).

Deciding signal

VPC Peering creates a direct connection between exactly two VPCs — traffic routes directly, not through intermediate hops, and peering is non-transitive (A-B and B-C does not enable A-C). It suits small numbers of VPCs. Transit Gateway is a hub: VPCs and on-premises networks attach to it, enabling transitive routing at scale across many VPCs, accounts, and Regions. It is the right answer when more than a handful of VPCs need full-mesh or hub-and-spoke connectivity. PrivateLink is different in kind — it exposes a specific service endpoint (ALB, NLB, or an internal service) to consumers in other VPCs or accounts without requiring full network connectivity. It is the right answer when one VPC needs to expose a service, not open full network access.

Deciding signal

Site-to-Site VPN creates an encrypted IPsec tunnel over the public internet. It is fast to provision, costs less, and is the right answer when the scenario emphasizes speed of setup or when Direct Connect is not yet in place. Direct Connect is a dedicated private network connection from your data center to AWS — it provides consistent bandwidth and latency but takes weeks to provision. A single Direct Connect connection attaches to a single AWS Region. Direct Connect Gateway extends a Direct Connect connection to VPCs in multiple Regions and multiple accounts. When the scenario describes a single on-premises data center connecting to multiple AWS Regions over Direct Connect, Direct Connect Gateway is required.

Deciding signal

Organizations is the foundation: it groups accounts into OUs and enables SCPs for account-level permission guardrails. It does not provision or configure accounts. Control Tower is built on top of Organizations and automates the setup of a multi-account landing zone — it provisions guardrails, baselines accounts with logging and compliance controls, and manages the Account Factory. Service Catalog is about product governance within accounts: it lets administrators define approved infrastructure products (backed by CloudFormation) so that end users can self-provision them without direct IAM access. When the scenario involves establishing a new multi-account environment with baseline security, Control Tower. When it involves managing account-level permission boundaries across an existing organization, Organizations SCPs. When it involves self-service provisioning of pre-approved resources, Service Catalog.

Deciding signal

Cognito manages authentication for customer-facing applications: web and mobile app users sign up, sign in, and receive tokens (JWT). It handles millions of end-users with social federation (Google, Facebook), SAML, and OpenID Connect support. IAM Identity Center is for workforce identities — employees, contractors, partners — who need access to multiple AWS accounts and business applications through a single AWS access portal. It integrates with Active Directory, Okta, and other enterprise IdPs. The exam distinguishes them by who the users are: external customers accessing your application (Cognito) versus internal employees accessing AWS accounts (IAM Identity Center).

Deciding signal

CloudFront Functions run at the viewer request and viewer response stages only, have a sub-millisecond execution budget, and are limited to JavaScript with no network calls, file system access, or external integrations. They are appropriate for simple manipulations: URL rewrites, header additions or removals, simple A/B testing logic. Lambda@Edge runs at all four CloudFront events (viewer request/response, origin request/response), has full Lambda capabilities including network calls and larger memory/timeout limits, and supports Node.js and Python. When the scenario involves calling an external API, reading from DynamoDB, or executing more than trivial request manipulation, Lambda@Edge. When the scenario describes simple header manipulation or URL rewriting with minimal latency overhead, CloudFront Functions.

Deciding signal

S3 Replication (CRR for cross-region, SRR for same-region) automatically copies new objects between S3 buckets — it is S3-to-S3 only and works for continuous object-level replication. DataSync is an online data transfer service for moving large volumes of data between on-premises storage (NFS, SMB, Hadoop), AWS storage (S3, EFS, FSx), and other locations — it is optimized for large-scale migrations with bandwidth scheduling and checksum verification. Transfer Family provides managed SFTP, FTPS, and FTP endpoints that write to S3 or EFS, enabling partners or customers to use existing file transfer tools. When the scenario involves external parties uploading via SFTP, Transfer Family. When it involves migrating or syncing large on-premises datasets, DataSync. When it involves keeping S3 buckets in sync, S3 Replication.

Deciding signal

Glue is an ETL service with a managed Spark environment and a Data Catalog that stores metadata about your data lake. It discovers schemas, transforms data, and catalogs datasets. Athena is a serverless SQL query engine that reads data directly from S3 using schema-on-read — it uses the Glue Data Catalog as its metadata store. Lake Formation builds on Glue and adds a governance layer: it manages fine-grained access control over data lake resources (databases, tables, columns) using a centralized permissions model that goes beyond IAM. When the scenario involves transforming raw data into structured datasets, Glue. When it involves querying S3 data with SQL, Athena. When it involves controlling which users can access which tables or columns in the data lake, Lake Formation.

Deciding signal

RDS Proxy sits between Lambda functions (or other clients) and RDS/Aurora instances, pooling database connections to prevent connection exhaustion — a specific problem when Lambda functions scale to thousands of concurrent instances each opening a new connection. Aurora Serverless automatically scales database capacity up and down based on workload, including scaling to zero during idle periods. ElastiCache adds an in-memory cache in front of the database to serve repeated reads without hitting the database at all. When the scenario involves Lambda and database connection limits, RDS Proxy. When it involves a variable or unpredictable database workload with no traffic at off-hours, Aurora Serverless. When it involves reducing repeated read load on the database, ElastiCache.