The traps that recur across every certification level

Speaker notes

• Trap 1, assuming transitivity: VPC Peering is not transitive, and neither is a route through a NACL that happens to allow traffic in one direction, always trace the actual path, never assume connectivity implies a return path or a multi-hop path exists just because two individual hops do.
• Trap 2, conflating similar-sounding mechanisms: NAT Gateway vs. NAT Instance, PrivateLink vs. VPC Lattice, CloudFront vs. Global Accelerator, ALB vs. NLB vs. GWLB. Every one of these pairs is a distractor pattern on real exam questions specifically because the names or use cases sound adjacent.
• Trap 3, assuming a managed service is redundant by default: Transit Gateway is Regional, not automatically multi-region; a single Direct Connect connection has zero built-in redundancy; a NAT Gateway is zonal, not automatically spanning AZs. Managed does not mean redundant, resiliency is still something you explicitly architect for. Trap 4, forgetting cost is a design input, not an afterthought: Transit Gateway, Interface Endpoints, and Direct Connect Gateway all carry real per-hour and per-GB charges that shape which architecture is actually appropriate at a given scale, not just which one is technically possible. Trap 5, treating security layers as substitutes for each other: a Security Group is not a NACL, a NACL is not Network Firewall, WAF is not Shield, each catches a different attack class, and removing one is a real, specific gap, not redundant overlap.

Deck map