The two questions you get most often after launching an EC2 instance are: "Why won't SSH connect?" and "The code is up, so why isn't port 80 open?" Both have the same root cause — a misunderstanding of network control and the bootstrap mechanism. Where SAA asks from the architect's vantage point — "which SG goes where?" — DVA goes all the way down to "how do you create that SG with the SDK/CLI, how do you call Secrets Manager from inside User Data, and how do you enforce IMDSv2?" Same security group, but a single line of code or one ARN is what separates the right exam answer from the wrong one.