SAP-C02 v2 Cheatsheet — Keyword Triggers từ 96 câu dump tháng 4/2026

Học vặt: trigger phrase → service. Mỗi dòng = 1 câu hỏi. Format: Keyword trong question → Service/Pattern. (Q#)

⚡ TRIGGER → ANSWER (học thuộc 3 phút)

Network & Connectivity

Trigger keyword	→	Service / Pattern
UDP + static IPs + multi-region	→	Global Accelerator (Q34)
Static IPs cho ALB	→	Global Accelerator (ALB không nhận EIP) (Q42)
Cross-account private API trên EC2/ALB	→	NLB → ALB target group → PrivateLink endpoint service (Q10, 29, 78)
Overlapping CIDRs + cross-account share	→	PrivateLink (decouples IP space) (Q22, 79)
On-prem dedicated private + central management + multi-region	→	Cloud WAN + Direct Connect attachments (Q80)
Centralized traffic inspection + TGW	→	Inspection VPC + GWLB + appliance mode trên TGW attachment (Q72)
Firewall appliance HA	→	2 appliances ở 2 AZ + GWLB + GWLB endpoint (Q49)
Remote individual users + MFA + AD	→	Client VPN + AD Connector + MFA (Q36, 77)
TGW shared services, dev attach thường xuyên	→	RAM share TGW + auto-accept, dev tự create attachment (Q63)
Multi-AZ HA cho NAT	→	1 NAT gateway mỗi AZ (1 NAT là SPOF) (Q74, 91)

Compute & Containers

Trigger	→	Service
Lambda chain timeouts (function-to-function)	→	Step Functions orchestration (Q66)
Long batch (giờ) + idle phần lớn ngày	→	ECS Fargate + Step Functions + EventBridge (Q95)
Lambda 15-min limit vượt	→	KHÔNG dùng Lambda → ECS/Fargate
Spot launch failures (single instance type)	→	Attribute-based instance type selection trong launch template (Q32)
5 EC2 high-throughput low-latency, no fault tolerance	→	Cluster placement group + enhanced networking (Q43)
EKS pod resilience burst scaling	→	Topology spread constraints theo AZ (Q67)
Java Tomcat + JAR, traffic spike hàng tháng, least overhead	→	Elastic Beanstalk + RDS PostgreSQL + ALB + CloudFront (Q87)
Per-section Docker + cost-per-container	→	ECS Fargate + run-task --tags (Q45)
Python 5-min script every 10 min	→	Lambda + S3 event notification (5 < 15 min OK) (Q17)

Database

Trigger	→	Service
Microsecond reads + persistent + Multi-AZ failover	→	MemoryDB (Redis nhưng có durability!) (Q6)
ElastiCache Redis	→	in-memory only, KHÔNG durable → loại nếu cần persist
Oracle/SQL Server → AWS managed, min downtime	→	DMS + SCT → Aurora PostgreSQL (Q5)
SQL Server license elimination + no rewrite	→	Aurora PostgreSQL + Babelfish (Q28)
Multi-region active-active DB sub-second	→	Aurora Global Database + write forwarding (Q30)
Lambda + RDS connection storms	→	RDS Proxy + move connection code OUT of handler (Q7)
DynamoDB DR independent of primary	→	Global Tables (Q48)
DynamoDB peak weekly + cost	→	Auto Scaling + reserved capacity cho baseline (Q54)
DynamoDB unused tables	→	metric ConsumedRCU/WCU + giảm provisioned về 1 + Standard-IA (Q59)
DocumentDB upgrade no-downtime + có change streams	→	DMS migrate-and-replicate (CDC qua change streams) (Q90)
RDS cross-account private + manage connections	→	RDS Proxy + PrivateLink + NLB (Q22)

Storage & Data Movement

Trigger	→	Service
Auto transfer existing + new daily, encrypted in transit, no custom dev	→	DataSync (Q1)
One-shot bulk 100TB+, không cần incremental	→	Snowball (NHƯNG hiếm khi đúng nếu có "new files daily")
S3 cost với NAT gateway egress lớn	→	S3 Gateway VPC Endpoint (FREE!) (Q14, 88)
S3 cross-account copy CLI	→	bucket policy on source (cho dest user) + IAM policy on dest user + run as dest account (B+D+F) (Q9)
S3 cross-region 15-min SLA + alert nếu miss	→	S3 RTC + OperationMissedThreshold + SNS (Q53)
S3 prevent tampering	→	AWS Backup Vault Lock COMPLIANCE mode (governance = mutable!) (Q47)
Two-region S3 active-active	→	S3 Multi-Region Access Point + bidirectional CRR (Q52)
S3 versioning required	→	CẢ source VÀ destination buckets
Backfill existing objects vào replication	→	S3 Batch Replication
Cross-region cross-account encrypted backup	→	Multi-Region CMK + cross-account backup plan (Q27)
EC2+EBS daily backup cross-region	→	AWS Backup với cross-region copy (Q40)

Security / IAM / Encryption

Trigger	→	Service
Restrict role assumption to org + AWS services	→	RCP at root: deny `sts:AssumeRole` when `aws:PrincipalOrgID != orgID` AND `aws:PrincipalIsAWSService = false` (Q24, 50)
Block actions org-wide	→	SCP
Account NOT in org	→	IAM policy trên roles/groups (SCPs KHÔNG áp dụng!) (Q64 ⚠️ dump sai)
Read-only IAM nhưng access denied	→	check SCPs + Permissions Boundaries (Q65)
Find sensitive data trong S3	→	Macie (Inspector = vulnerability, KHÔNG phải data!) (Q26)
Drift detection giữa regions	→	AWS Config custom rules + SSM Automation auto-remediation (Q51)
WAF deployment không break legitimate traffic	→	Count → log → analyze → flip to Block (Q33)
CloudFront Field-Level Encryption	→	RSA key pair (asymmetric, KHÔNG phải KMS symmetric) (Q11)
S3 access points VPC-only	→	SCP at root với condition `s3:AccessPointNetworkOrigin == VPC` (Q57)
Revoke ALL access to secrets (in-org + outside-org)	→	modify resource policies trên secrets (SCP chỉ catch in-org) (Q89)
AWS managed KMS keys	→	KHÔNG modify policy được, KHÔNG multi-region được
Multi-region encryption	→	Multi-Region customer-managed CMK
CloudFront + ALB không bị bypass	→	CloudFront thêm custom header + ALB conditional forward (Q58)

Cost & Billing

Trigger	→	Service
ECS task cost → business group	→	Split cost allocation data (CUR feature) (Q2)
Multi-account cost reports + per-OU view	→	CUR từ management account + QuickSight (Q46)
Cost anomaly per team/account	→	Cost Anomaly Detection — Linked account monitor (Q96)
Cost anomaly per service	→	Cost Anomaly Detection — AWS services monitor
Budget alerts cross-account	→	AWS Budgets ở management account + Cost Explorer (Q35)
API throttle + quota cho external client	→	API Gateway usage plan + API key (handle 429) (Q20, 71)
Always-on EC2	→	Savings Plans
Interruptible workload	→	Spot Instances
24/7 + peak few hours	→	Auto Scaling 4↔28 + RIs cho baseline (Q3, 61)
TCO before migration	→	AWS Migration Evaluator (cũ tên TSO Logic) (Q60)
Athena query slow theo time (logs tích lũy)	→	Partition by date/time (Firehose dynamic partitioning + partitioned table) (Q41, 93)

Migration

Trigger	→	Service
App servers on-prem → AWS, minimal downtime	→	Application Migration Service (MGN) + DMS cho DB (Q84)
Containerize legacy	→	App2Container
TCO assessment	→	Migration Evaluator
.NET app + scale + cost	→	API Gateway + Lambda + Aurora Serverless v2 (port .NET Framework → .NET Core) (Q37)
Event-driven serverless retail	→	EKS Fargate + Aurora Serverless + Redshift Serverless + EventBridge (Q38)

DR / HA / Failover

Trigger	→	Service
Fastest failover với CloudFront + R53	→	CloudFront origin group + origin failover (KHÔNG phải R53 TTL!) (Q4, 92)
RPO 5min / RTO 15min ECS+Aurora+S3 + tamper protection	→	ECR cross-region replication + Aurora Global Database + Backup Vault Lock compliance + S3 PITR/CRR + R53 failover routing (Q47, 81)
Single-AZ ASG → Multi-AZ	→	NAT gw mỗi AZ + Multi-AZ RDS + ASG min/max=3 across AZs (Q74, 91)

Application Integration

Trigger	→	Service
Decouple sudden write spikes + giữ data model	→	SQS + Lambda consumer (KHÔNG migrate to DDB) (Q44)
WebSocket pub/sub serverless	→	AppSync Events (feature 2024) (Q56)
VPC Flow Logs → on-prem Splunk	→	Firehose → Splunk + Lambda transform + CloudWatch subscription filter (Q31)
Force HTTPS, no error to HTTP users	→	CloudFront viewer protocol = Redirect HTTP→HTTPS (KHÔNG dùng "HTTPS Only" — sẽ error) + S3 bucket policy `aws:SecureTransport` + CF origin "HTTPS Only" (Q68)
Logs survive ASG scale-in	→	CloudWatch Logs unified agent trên instances (Q8)

IAM Identity Center / Workspaces

Trigger	→	Service
Workspaces auth qua IdP của bên thứ 3 trong member account	→	IAM Identity Center account instance (member-level) + B's SAML IdP (Q94)

CI/CD

Trigger	→	Service
Frequent deploys + fast rollback	→	Elastic Beanstalk environment URL swap (blue/green) (Q25, 85)

🎯 GOTCHAS / Common Traps

"Account NOT in organization" → SCP không áp dụng được

SCPs chỉ hoạt động cho accounts trong AWS Organizations. Nếu câu nói "outside the organization" hoặc "cannot be in org", PHẢI dùng IAM policy thay thế. (Q64 dump sai vì lý do này)

Inspector ≠ Macie

Inspector = vulnerability scanning (CVE, OS patches)
Macie = sensitive data discovery (PII trong S3)
"Find sensitive data" → ALWAYS Macie

EBS Multi-Attach = SINGLE AZ ONLY

Nếu instances ở multiple AZs → KHÔNG dùng EBS Multi-Attach. Phải dùng FSx ONTAP Multi-AZ với iSCSI LUNs cho block storage cross-AZ. (Q76)

CloudFront Origin Group ≠ Route 53 failover

Origin Group failover xảy ra trong giây (health-check based, intra-distribution). R53 TTL phụ thuộc DNS resolver caches → chậm hơn nhiều. → "Fastest failover" → ALWAYS Origin Group.

Backup Vault: Compliance vs Governance

Compliance mode (Vault Lock) = immutable, không xóa được dù root user → "prevent tampering"
Governance mode = có thể disable bằng quyền cao → KHÔNG đủ cho tamper-proof requirement

CloudFront FLE = RSA, KHÔNG phải KMS

Field-Level Encryption dùng public-key cryptography (RSA). Public key trên CF, private key ở backend microservice. KMS symmetric KHÔNG áp dụng cho FLE.

PrivateLink endpoint service yêu cầu NLB

ALB KHÔNG thể trực tiếp làm endpoint service target. Pattern: NLB với ALB-type target group → PrivateLink. Nếu thấy option "PrivateLink directly for ALB" → SAI.

Lambda 15-minute hard limit

Bất kỳ task nào nói "takes hours" → loại Lambda. → ECS Fargate / EC2 / Batch.

S3 Replication versioning

CRR yêu cầu versioning trên CẢ HAI source AND destination. Option chỉ enable trên 1 → SAI.

RAM share được: Subnets, TGW, Route 53 resolver rules, License Manager, etc. RAM KHÔNG share: API Gateway APIs, S3 access points (chia sẻ qua resource policies trực tiếp).

Aurora Global Database vs read replica

Global Database = cross-region, sub-second replication, 1 writer/region với write forwarding → DR active-passive HOẶC active-active
Read replica = single-region readonly scale (RDS), HOẶC cross-region readonly (RDS only)
"DR independent" + sub-second RPO → Global Database

Resource Control Policy (RCP) vs SCP

SCP = giới hạn principals trong org (org members chỉ được làm gì)
RCP = giới hạn ai có thể use resources trong org (ai bên ngoài cũng bị block)
"Restrict who can ASSUME roles" (call sts:AssumeRole on resources in org) → RCP vì cần block external principals.

Babelfish = magic

Aurora PostgreSQL với Babelfish nhận TDS protocol + T-SQL → SQL Server app chạy không cần đổi code, license SQL Server biến mất. Cứ thấy "SQL Server" + "minimize licensing" + "no rewrite" → Babelfish.

MemoryDB ≠ ElastiCache

ElastiCache Redis = in-memory cache, mất data khi restart
MemoryDB = Redis-compatible DURABLE với multi-AZ transaction log
"microsecond + persistent + failover < 1min" → MemoryDB

Split cost allocation data

Feature đặc biệt cho ECS/EKS: chia EC2 instance cost theo từng task/pod usage. Không phải tag thông thường. Trong CUR (không phải Cost Explorer pure).

Cost Anomaly Detection monitor types

Linked account = phát hiện anomaly per account → mapping tới TEAM
AWS services = anomaly per service → mapping tới WORKLOAD
"identify costs for each team" → Linked account

Multivalue answer routing vs failover routing

Multivalue answer = trả về nhiều IP healthy → DNS-level load balancing (active-active)
Failover = primary → secondary on health check fail (active-passive DR)

📌 SERVICE QUICK-REF (mặt sau flashcard)

Khi nào dùng nó

Service	Sweet spot
Global Accelerator	UDP, static IPs, multi-region client→AWS, sub-30s failover, AWS backbone
CloudFront	TCP/HTTP cacheable content, edge POPs, origin failover, viewer protocol redirect
Cloud WAN	Centrally managed multi-region/multi-account/on-prem, policy-driven
Transit Gateway	Hub-and-spoke VPC connectivity within region (or peer cross-region)
PrivateLink	Cross-account private service exposure, decouples CIDRs (vào VPC consumer qua ENI)
AWS Backup	Centralized cross-region/cross-account backup (EFS, EC2/EBS, RDS, DynamoDB)
DataSync	Continuous, scheduled, encrypted file transfer (on-prem ↔ AWS)
DMS	DB migration with CDC (continuous replication during cutover)
MGN (Application Migration Service)	Block-level rehost of full server with continuous replication
Migration Evaluator	TCO assessment before migration
Macie	Discover PII / sensitive data trong S3
Inspector	Vulnerability scan (EC2 OS, ECR images, Lambda)
AWS Config	Configuration state tracking + drift detection + auto-remediation
Cost Explorer	Interactive cost analytics UI (per-account, per-service)
Cost & Usage Report (CUR)	Raw billing data → S3 → Athena/QuickSight (org-wide)
Cost Anomaly Detection	ML-based anomaly alerts
Budgets	Threshold-based cost alerts
MemoryDB	Durable Redis: μs reads, ms writes, multi-AZ
ElastiCache Redis	In-memory cache (volatile)
DynamoDB Global Tables	Multi-region active-active NoSQL
Aurora Global Database	Multi-region SQL with sub-second cross-region replication
Aurora Serverless v2	On-demand scaling for SQL workloads
Babelfish	SQL Server compatibility on Aurora PostgreSQL
AppSync Events	Serverless WebSocket pub/sub (2024)
Step Functions	Lambda orchestration (replace function-to-function chaining)
Application Auto Scaling	DynamoDB / ECS / Aurora capacity scaling
GWLB (Gateway Load Balancer)	Inline traffic inspection appliances (GENEVE encapsulation)
Identity Center account instance	Member-account-scoped Identity Center (separate from org instance)
RCP	Resource Control Policy (org-level resource access guardrail)
SCP	Service Control Policy (org-level principal action guardrail)
Permissions boundaries	Per-IAM-entity max permissions
Resource policies	Cross-account / cross-org access on individual resources

🧠 30-second decision tree

Câu hỏi liên quan tới...

CONNECTIVITY
├─ on-prem ↔ AWS dedicated, multi-region central → Cloud WAN + Direct Connect
├─ remote individual users + MFA → Client VPN + AD Connector
├─ cross-account + overlapping CIDR → PrivateLink
└─ TGW hub + dynamic attach → RAM share + auto-accept

DATABASE CHOICE
├─ μs read + persistent + multi-AZ → MemoryDB
├─ Multi-region active-active SQL → Aurora Global Database (write forwarding)
├─ Multi-region active-active NoSQL → DynamoDB Global Tables
├─ SQL Server license elimination → Aurora PostgreSQL Babelfish
└─ Lambda + RDS → RDS Proxy + connection outside handler

DR
├─ "fastest failover" + CloudFront → Origin Group origin failover
├─ "prevent tampering" → Backup Vault Lock COMPLIANCE mode
├─ Multi-AZ HA → 1 NAT/AZ + Multi-AZ RDS + ASG ≥ AZ count
└─ Cross-region cross-account → Multi-Region CMK + cross-account backup plan

ACCESS CONTROL
├─ "account NOT in org" → IAM policy (NOT SCP!)
├─ "restrict role assumption from outside org" → RCP at root
├─ "block action org-wide" → SCP
├─ "revoke ALL secret access (in + outside org)" → modify resource policy
└─ "S3 access points VPC-only" → SCP with s3:AccessPointNetworkOrigin

COST
├─ ECS task → team attribution → Split cost allocation data
├─ Multi-account budget alerts → Budgets in management account
├─ Anomaly per team → Cost Anomaly Detection (Linked account)
└─ Pre-migration TCO → Migration Evaluator

LAMBDA TROUBLE
├─ Function chain timeouts → Step Functions
├─ DB connection storms → RDS Proxy + code outside handler
├─ Photo processing concurrency → SQS buffer + adjust WCU
└─ "takes hours" → KHÔNG Lambda, dùng Fargate/Batch

API GATEWAY
├─ Throttle external client → usage plan + API key
├─ Multi-region active-active → Multivalue answer routing + multi-region keys
└─ Private cross-account → Private REST API (chú ý: KHÔNG share via RAM)

S3
├─ NAT gw cost cao do S3 traffic → Gateway VPC Endpoint (FREE)
├─ Cross-account copy CLI → bucket policy on src + IAM on dest user + run as dest
├─ 15-min cross-region SLA → S3 RTC + OperationMissedThreshold + SNS
├─ Active-active 2 region → Multi-Region Access Point + bidirectional CRR
└─ Force HTTPS + no error → CF viewer protocol Redirect (NOT HTTPS Only)

CONTAINER WORKLOAD
├─ Per-task cost attribution → ECS Fargate + run-task --tags + Split cost allocation
├─ Pod resilience (burst) → Topology spread constraints (AZ)
└─ Long-running batch with idle time → Fargate + Step Functions + EventBridge

WORKLOAD TIMING
├─ Always-on production → Savings Plans
├─ Interruptible analytics → Spot
├─ 24/7 + peak few hours → ASG min=baseline + RI for baseline
└─ Weekly peak DDB → App Auto Scaling + reserved capacity for avg

🪞 Anti-patterns (nếu thấy → loại ngay)

"Allocate Elastic IP to ALB" → ALB KHÔNG nhận EIP. (NLB nhận, ALB không.)
"Lambda với .NET Framework" → Lambda chạy .NET Core/6/8, KHÔNG phải Framework.
"PrivateLink directly for ALB" → Phải qua NLB-with-ALB-target-group.
"Modify AWS managed KMS key policy" → Không cho phép.
"DAX cho write-heavy workload" → DAX là read cache, không giúp write.
"DynamoDB stored procedures" → DynamoDB không có stored procs (NoSQL).
"S3 as RDS storage backend" → Không phải feature.
"VPN CloudHub cho remote workers" → CloudHub là site-to-site hub, không cho user MFA.
"WorkLink cho VPN" → WorkLink đã deprecated.
"SCP ở account ngoài org" → SCP chỉ áp dụng trong org.
"Replace NAT gw bằng VGW" → VGW không làm NAT.
"Latency-based routing cho fastest failover" → Latency routing không phải failover.
"CloudFront cho UDP" → CloudFront chỉ TCP/HTTP. UDP → Global Accelerator.
"WAF rules tới Block ngay từ đầu" → Best practice là Count → analyze → Block.
"Aurora multiple writer instances cross-region" → Không tồn tại. Aurora 1 writer/cluster.

📝 The 1 Wrong Dump Answer

Q64 — Restrict EC2 launches in account NOT in AWS Organizations to t3.small in us-east-2. - Dump nói: B (SCP) ❌ - Đúng: D (IAM policy) - Lý do: Account NOT in org → SCP không áp dụng. Phải dùng IAM policy với conditions ec2:InstanceType + aws:RequestedRegion.

Cứ thấy "account is not part of the organization" / "cannot be added to the organization" trong câu hỏi → tự động loại bất kỳ option nào nói SCP.