When a scenario gives you three or four technically valid services, “what does service A do?” is the wrong question. The right question is: “what requirement makes A a better fit than B, and what am I giving up by choosing it?” Study these pairs that way.

Three different storage interfaces, not three flavors of the same thing. Choose S3 when you’re storing objects accessed through keys — data-lake style. Choose EBS when a single EC2 instance needs a disk. Choose EFS when multiple instances need to share the same file system at once. Trap: a durable object store is not a mountable file system, no matter how “storage” the question sounds.

Choose RDS/Aurora when the workload is genuinely relational — joins, transactions, SQL. Choose DynamoDB when your access pattern is key-value or document-style and you need managed horizontal scale. Trap: “NoSQL is faster” is not a decision rule the exam rewards — access pattern is.

Multi-AZ exists for availability and automatic failover. Read replicas exist to offload read traffic. Trap: candidates treat these as interchangeable “scaling” features. They solve different problems — one is about staying up, the other is about handling more reads.

ALB understands HTTP — routing by path, host, or header. NLB operates at the transport layer for extreme performance or static IP needs. Trap: pick based on protocol and routing requirements, not which one you’ve heard of more.

SQS is a queue — messages wait for a consumer to pull them, one at a time, at the consumer’s pace. SNS is a publisher — it pushes a message out to every subscriber at once. Trap: a fan-out notification pattern and a work-buffering queue are solving different problems, even though both “decouple.”

NAT Gateway lets a private subnet reach out to the internet without being reachable from it. An Internet Gateway is what actually connects a VPC to the internet for resources with public routing. Trap: a NAT Gateway does not make a private subnet directly addressable from the internet — that’s the whole point of it.

Peering connects two VPCs directly, one relationship at a time. Transit Gateway acts as a hub for many VPCs and on-prem connections at once. Trap: the deciding factor is topology and scale, not latency alone — peering doesn’t scale cleanly past a handful of VPCs.

CloudFront caches content at the edge to speed up delivery. Global Accelerator optimizes the network path to your application’s actual endpoints. Trap: both live at the edge, but they’re solving different problems — caching content versus routing traffic.

Lambda removes server management for workloads that fit its event-driven model. EC2 gives you full host and runtime control. Trap: the deciding factors are operational overhead, execution duration, and packaging needs — not which one sounds more “modern.”

ECS is AWS’s own container orchestrator. EKS is managed Kubernetes. Trap: knowing Kubernetes doesn’t automatically make EKS the simplest answer — if the question values simplicity and you don’t need Kubernetes-specific tooling, ECS may win.

Aurora is a cloud-native relational engine compatible with select database engines, built for AWS. RDS supports a broader set of managed relational engines. Trap: Aurora isn’t a universal upgrade — it doesn’t replace every RDS engine or workload constraint automatically.

Security groups are stateful and apply at the instance/interface level. Network ACLs are stateless and apply at the subnet boundary. Trap: don’t answer a subnet-level requirement with an instance-level control, or vice versa — they operate at different layers.

Simple, weighted, latency-based, failover, geolocation, multivalue — each expresses a different intent. Trap: “global users” alone doesn’t point to one policy. You need the actual goal: lowest latency, geographic control, or failover.