Based on the DVA-C02 exam guideReport an error
The five services covered in Week 11 - SQS, SNS, Kinesis, Step Functions, and AppSync - all appear on the surface to "move data or work from one place to another." That is why the exam often asks in the form "which one fits this scenario?" Fragmentary memorization tends to wobble on comparisons like SQS vs. Kinesis, SNS vs. EventBridge, and Standard vs. Express. Instead of listing the five services again, this review reorganizes them around a few fundamental questions that divide them. Whatever scenario you meet, asking these questions in order narrows down the answer.
This is the first fork that separates SQS and SNS.
Fan-out (SNS → multiple SQS), which combines the two, is the structure that gets "spread out 1:N while each consumer has a reliable buffer and retries" at once.
This is the most essential question that separates SQS and Kinesis.
If you see "multiple analytics systems on the same stream at once," "reprocess past data after a bug fix," or "hundreds of thousands of events per second + ordering," it is Kinesis.
This is the fork within Kinesis.
"Automatically save to S3," "Parquet conversion," or "serverless ETL" means Firehose. "Ultra-low-latency real time" means Data Streams.
These four questions match the classic classification axes of messaging and integration: (1) point-to-point vs. pub/sub, (2) destructive read vs. log-based, (3) processing vs. delivery, (4) choreography vs. orchestration. Gregor Hohpe's Enterprise Integration Patterns (2003) and Jay Kreps's log-centric philosophy (2013) established these axes. AWS's five services are different coordinates on these universal axes. If instead of memorizing each service's characteristics you locate it by "which side of which axis is this service on," comparison questions turn into coordinate reading.
| Service | Item | Value |
|---|---|---|
| SQS | Max message size | 1 MiB (raised from 256 KiB in August 2025. If exceeded, Extended Client → S3, 2 GB) |
| SQS | Retention period | 60 seconds to 14 days (default 4 days) |
| SQS | Visibility timeout | 0 to 12 hours (default 30 seconds) |
| SQS | Message delay | 0 to 15 minutes |
| SQS FIFO | Throughput | 300 msg/s, batch 3,000, high throughput 70,000+ |
| SNS | Message retention | None (lost if delivery fails) |
| SNS | Subscribers per topic | 12,500,000 |
| Kinesis | Shard write | 1 MB/s or 1,000 records/s |
| Kinesis | Shard read (classic) | 2 MB/s shared / (EFO) 2 MB/s per consumer |
| Kinesis | Retention | 24 hours to 365 days |
| Kinesis | On-Demand limits | 200 MB/s, 200,000 RPS |
| Firehose | Minimum latency | 60 seconds (Near Real-Time) |
| Step Functions | Standard / Express | 1 year, exactly-once / 5 minutes, at-least-once |
⚠️ Trap: These are three boundary values that are especially easy to confuse. (1) Firehose is not real time (minimum 60 seconds). If you see "real time," it is Data Streams. (2) SNS has no retention. For "prevent loss on delivery failure," insert SQS or use a subscription DLQ. (3) The Lambda-SQS visibility timeout is 6 times the function timeout. If you do not follow this, duplicate processing occurs.
| A | B | Key difference |
|---|---|---|
| SQS Standard | SQS FIFO | Unlimited, no ordering, duplicates possible vs. 300/s, ordering, 5-minute dedup |
| SQS | SNS | Pull, 1:1, retained vs. Push, 1:N, not retained |
| SNS | EventBridge | Simple replicated distribution, attribute filters vs. rich event pattern routing, schemas |
| Kinesis Data Streams | SQS | Retained log, multiple consumption, reprocessing vs. destructive read, single consumption |
| Data Streams | Firehose | Direct processing, real time vs. automatic loading, 60 seconds+ |
| Classic | Enhanced Fan-Out | Shared 2 MB/s, polling vs. 2 MB/s per consumer, HTTP/2 push |
| SF Standard | Express | 1 year, exactly-once, expensive vs. 5 minutes, at-least-once, high throughput |
.sync | .waitForTaskToken | Wait for a machine task to complete vs. wait for an external/human callback |
| AppSync | API Gateway | GraphQL, multiple sources, built-in subscriptions vs. REST, single backend |
The distinction between SNS and EventBridge is said to have grown in weight on recent exams. Both "send events to multiple targets," but their strengths differ.
How each service handles "failed messages/tasks" is a comparison point within the exam scope.
maxReceiveCount sends it to a DLQ (same type to same type). Isolates poison messages.BisectBatchOnFunctionError, MaximumRetryAttempts, and failure destinations (SQS/SNS).Retry (backoff) and Catch (error branching), compensating transactions (Saga).📚 Case study: The exam can mix three kinds of DLQ. The SQS DLQ (queue message exceeds maxReceiveCount), the SNS subscription DLQ (subscriber delivery failure), and the Lambda DLQ (Lambda asynchronous invocation failure). Even though they are all "DLQ," the layer of failure each one catches differs. For example: "preserve messages that SNS failed to deliver to an HTTPS endpoint" → SNS subscription DLQ. "Lambda failed to process an asynchronous event" → Lambda DLQ (or Destinations). "An SQS message failed processing 3 times" → SQS DLQ. You need to first pin down "which stage's failure is this?" from the wording.
| Acronym | Full name |
|---|---|
| SQS / SNS | Simple Queue / Notification Service |
| DLQ | Dead Letter Queue |
| KDS / KDF | Kinesis Data Streams / Firehose |
| KCL / KPL | Kinesis Client / Producer Library |
| EFO | Enhanced Fan-Out |
| ESM | Event Source Mapping |
| FSM | Finite State Machine (the foundation of Step Functions) |
| Saga | Distributed transaction compensation pattern |
| APNs / FCM | Apple / Google mobile push |
| WAL | Write-Ahead Log (the root of the log model) |
Click a choice to reveal the answer and explanation.
Question 1
Payment transactions must be processed in per-customer order, without duplicates, exactly once. About 4,000 occur per second. What is an appropriate configuration?
Question 2
One S3 object upload must trigger three tasks - thumbnail generation, virus scanning, and search indexing - independently (the failure of one task must not affect the others). What is the most canonical pattern?
Question 3
You want to run real-time anomaly detection on a clickstream with Lambda while also archiving all the raw data to S3 for later analysis with Athena. What is an appropriate configuration?
Question 4
You are loading logs into S3 with Firehose and there is a complaint that "data arrives about a minute late." If sub-1-second real-time processing is mandatory, what should you do?
Question 5
While pushing directly to Lambda through SNS, notifications published while Lambda was briefly down were permanently lost. How do you secure durability?
Question 6
In a Kinesis stream, only a particular shard throws ProvisionedThroughputExceededException while other shards sit idle. What are the cause and the fix?
Question 7
You need to run multiple Lambdas in order, compensate (roll back) earlier steps upon a mid-way failure, and let operators trace the entire flow visually. What is an appropriate service?
Question 8
In a refund workflow, high-value cases must receive administrator approval, and approval can take several days. What is an appropriate configuration?
Question 9
A mobile app needs to fetch users (DynamoDB), orders (Lambda), and recommendations (OpenSearch) in one go on a single screen, and receive order status changes in real time. What is an appropriate service?
Question 10
A Lambda consumes an SQS queue, but the same message is processed in duplicate. The function timeout is 60 seconds. What is the most appropriate action?
Question 11
You want to preserve and analyze messages that SNS repeatedly failed to deliver to an HTTPS endpoint. What is an appropriate method?
Question 12
Three consumers must each read the same Kinesis stream with latency of tens of ms, and they must not take throughput from each other. What is the appropriate feature?