Articles on the exam topics you cannot try in a free-tier account, each from the documentation, with a short video and a stage to play, free wherever one fits.https://tracesleuth.com/https://tracesleuth.com/blog/bedrock-or-sagemaker-ai/https://tracesleuth.com/blog/bedrock-or-sagemaker-ai/Bedrock serves foundation models through an API. SageMaker AI builds, trains and hosts your own. The deciding question is where the answer has to come from.Sun, 25 Oct 2026 00:00:00 GMTAIF-C01MLA-C02AIP-C01AI and machine learninghttps://tracesleuth.com/blog/ebs-volume-types-gp3-io2-st1/https://tracesleuth.com/blog/ebs-volume-types-gp3-io2-st1/gp3 includes 3,000 IOPS at any size, io2 is the sub-millisecond volume, st1 sells throughput by the TiB, and the instance sets the last ceiling.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03SAP-C02Core architecturehttps://tracesleuth.com/blog/nat-gateway-private-subnet-internet/https://tracesleuth.com/blog/nat-gateway-private-subnet-internet/A NAT gateway lets private instances start connections out while nothing on the internet starts one in. Follow every hop, and see the address the far end sees.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03Networkinghttps://tracesleuth.com/blog/iam-policy-evaluation-explicit-deny/https://tracesleuth.com/blog/iam-policy-evaluation-explicit-deny/Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03SCS-C03Securityhttps://tracesleuth.com/blog/identity-policy-or-resource-policy/https://tracesleuth.com/blog/identity-policy-or-resource-policy/In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03DEA-C01SCS-C03Securityhttps://tracesleuth.com/blog/security-group-or-network-acl/https://tracesleuth.com/blog/security-group-or-network-acl/Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03SCS-C03Networkinghttps://tracesleuth.com/blog/transit-gateway-route-tables/https://tracesleuth.com/blog/transit-gateway-route-tables/Association picks the table a packet is looked up in. Propagation picks which tables know a VPC. Follow one packet to see how a transit gateway segments.Sun, 25 Oct 2026 00:00:00 GMTSOA-C03SAP-C02SCS-C03Networkinghttps://tracesleuth.com/blog/what-makes-a-subnet-public/https://tracesleuth.com/blog/what-makes-a-subnet-public/Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03SCS-C03Networkinghttps://tracesleuth.com/blog/which-aws-ai-service/https://tracesleuth.com/blog/which-aws-ai-service/Audio, scans, photos, text or rows with known outcomes. The form of the input and the output asked for pick the AWS AI service, and rule out the near misses.Sun, 25 Oct 2026 00:00:00 GMTAIF-C01MLA-C02AIP-C01AI and machine learninghttps://tracesleuth.com/blog/athena-scanned-too-much-data/https://tracesleuth.com/blog/athena-scanned-too-much-data/Athena bills the bytes it scans. Text is read whole; Parquet and ORC read only the columns a query names. How format, compression and file size set the bill.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03DEA-C01MLA-C02Data engineeringhttps://tracesleuth.com/blog/private-subnet-reach-s3-endpoints/https://tracesleuth.com/blog/private-subnet-reach-s3-endpoints/With no internet gateway or NAT, a private subnet can still reach AWS services. A gateway endpoint adds a route; an interface endpoint adds an address.Sun, 25 Oct 2026 00:00:00 GMTSAA-C03SOA-C03SAP-C02Networkinghttps://tracesleuth.com/blog/cloudwatch-ec2-memory-metric/https://tracesleuth.com/blog/cloudwatch-ec2-memory-metric/EC2 publishes CPU, network, disk operations and status checks. Memory and disk space live inside the guest, where the CloudWatch agent reads them.Sun, 25 Oct 2026 00:00:00 GMTSOA-C03DVA-C02DOP-C02Operations and delivery