Day 2 is your structured reference for the foundations of machine learning, the SageMaker toolbox, and the AWS pre-built AI services. By the end you should be able to look at any exam scenario and answer two questions instantly: "What ML problem is this?" and "Which AWS service fits?" That's the whole game.
Before any AWS service or specific algorithm, you need a clean mental map of what machine learning is, what kinds of problems it solves, and how a project flows from raw data to a deployed model. This section gives you that map.
Every exam scenario is a walk down this four-step ladder:
| Step | Question to ask |
|---|---|
| 1 | What type of ML is this? (supervised / unsupervised / RL / semi-supervised) |
| 2 | What problem type? (classification / regression / clustering / anomaly / recommendation) |
| 3 | Which AWS service fits? (SageMaker / Rekognition / Textract / Bedrock / etc.) |
| 4 | Which deployment / inference type? (real-time / batch / async / serverless) |
Master this ladder and the exam stops being a memorization contest. Every story — a hospital detecting tumors, a streaming service suggesting movies, a factory finding defects — is a guided walk down those four rungs.
The intuition: A child learning what a cat is. You show photos and say "this is a cat" or "this is not a cat." Each example has the right answer attached.
Mechanics:
| Flavor | Output | Example |
|---|---|---|
| Classification | A category | Spam or not spam |
| Regression | A number | Predicted house price |
Real examples:
The intuition: Same child, but now you dump a pile of photos with no labels and say "sort these however you want." The child finds structure that was already there but hidden.
Mechanics:
Real examples:
The intuition: Training a dog. The dog tries something → you give a treat (reward) or say "no" (penalty). Over many trials, the dog learns which actions lead to treats.
Mechanics:
Real examples:
The intuition: You have 1,000 medical X-rays carefully labeled by a radiologist (very expensive!) and 100,000 unlabeled X-rays sitting in a database. Throwing away the unlabeled ones is wasteful.
Mechanics:
Real examples:
The "problem type" answers: What shape is the output?
This is different from "type of ML." A supervised problem can be classification or regression — those are different problem types.
Output is discrete (a finite set of choices).
| Input | Output |
|---|---|
| Email text | Spam / Not spam |
| Transaction | Fraud / Legitimate |
| X-ray image | Disease / No disease / Inconclusive |
Output is continuous (a number on a scale).
| Input | Output |
|---|---|
| House details | Price ($427,500) |
| Last 30 days of sales | Revenue forecast ($1.2M) |
| Weather data | Energy demand (450 MWh) |
Key distinction from classification: "Will this customer churn?" = classification. "How many days until they churn?" = regression.
No labels exist. Model finds groups.
Examples:
Find rare events that don't match the normal pattern.
Examples:
Why it's special: You usually have very few anomaly examples. So pure supervised learning struggles. Often handled as unsupervised or one-class.
Predict what a user will like based on their history and similar users' behavior.
Examples:
| Problem | ML Type | Problem Type |
|---|---|---|
| Spam filter | Supervised | Classification |
| Predict tomorrow's stock price | Supervised | Regression |
| Group products by similarity | Unsupervised | Clustering |
| Find rare network attacks | Unsupervised (usually) | Anomaly detection |
| "You may also like..." | Specialized | Recommendation |
Every real ML system moves through these 7 stages. Each AWS feature you'll memorize maps to one of them.
| # | Stage | What happens |
|---|---|---|
| 1 | Data collection | Gather raw data from databases, logs, sensors, websites |
| 2 | Preprocessing | Clean: handle missing values, remove duplicates, normalize, fix formats |
| 3 | Feature engineering | Transform raw data into useful inputs (e.g., DOB → age) |
| 4 | Training | Algorithm learns patterns from data, adjusts parameters |
| 5 | Evaluation | Test on unseen data, measure accuracy/F1/etc. |
| 6 | Deployment | Put model into production (real-time / batch / async / edge) |
| 7 | Monitoring | Watch for drift, errors, latency, bias |
💡 Exam trap: When a scenario describes a model producing biased/unfair results, the fix is usually the data, not the algorithm.
"A logistics company predicts whether packages arrive late. They gather 3 years of shipment records (collection), fill missing weather data and unify weight units (preprocessing), convert timestamps to day-of-week features (feature engineering), train an XGBoost classifier (training), check F1 on the last 6 months (evaluation), put the model behind a real-time endpoint for the checkout page (deployment), and 9 months later detect drift when a new carrier joins (monitoring) — triggering a retrain."
That's the 7-stage loop, end to end.
Once you understand what ML is, the next layer is the materials and machinery. Data, parameters vs hyperparameters, and training vs inference. These distinctions create most of the exam traps.
Adding the correct answer to each training example. Required for supervised learning.
Never use all data for training. Split it:
| Split | Typical % | Purpose |
|---|---|---|
| Training | 70-80% | What the model learns from |
| Validation | 10-15% | Tune hyperparameters, pick best model |
| Test | 10-15% | Final, honest evaluation — only used at the END |
⚠️ Cardinal rule: Never train on the test set. Never tune on the test set. The moment you peek, your accuracy number becomes a lie.
When one class dominates (fraud is 1% of transactions, rare disease is 0.1% of patients).
Why accuracy lies here: A model that always predicts "legitimate" is 99% accurate but useless.
Fixes:
| Technique | What it does |
|---|---|
| Oversampling minority class | Duplicate (or synthesize) fraud examples |
| Undersampling majority class | Drop some legit examples |
| SMOTE | Generates synthetic minority samples |
| Class weights | Penalize minority-class mistakes more |
| Switch metric | Use F1 / recall instead of accuracy |
Artificially expand your training set by creating modified versions of existing examples.
| Modality | Augmentation tricks |
|---|---|
| Images | Rotate, crop, flip, brightness, noise, zoom |
| Text | Synonym replacement, back-translation |
| Audio | Time stretch, pitch shift, add background noise |
Why it works: More effective data + teaches model to be robust to variations.
This distinction is small but heavily tested.
What: Numbers the model learns automatically during training.
Examples:
You never set these by hand. They emerge from training.
What: Numbers you choose before training.
Examples:
You don't know the best values in advance — you search.
| Type | Set by | Example |
|---|---|---|
| Parameter | The model (during training) | Neural net weights |
| Hyperparameter | You (before training) | Learning rate |
💡 Mnemonic: Parameters are the model's homework. Hyperparameters are the rules you set for the homework.
You search for good hyperparameters. AWS: SageMaker Automatic Model Tuning (uses Bayesian optimization).
Two phases in the life of a model. Different characteristics, different costs.
| Aspect | Training | Inference |
|---|---|---|
| When | Periodic (once, then occasional retrains) | Continuous (every request) |
| Compute | Heavy (GPUs often required) | Lighter (but adds up at scale) |
| Latency | Hours to weeks | Milliseconds (usually) |
| Model state | Parameters being updated | Parameters frozen |
| Type | Use when | Example |
|---|---|---|
| Real-time endpoint | Sub-second latency required | Fraud check during a payment |
| Batch transform | Offline, large dataset, no rush | Score all 50M customers overnight |
| Asynchronous inference | Large payload OR long processing time | 1GB video analysis (10 min) |
| Serverless inference | Sporadic, unpredictable traffic | Internal tool used a few times/day |
| Phrase | Pick |
|---|---|
| "sub-second", "real-time", "during transaction" | Real-time endpoint |
| "overnight", "large dataset", "no real-time requirement" | Batch transform |
| "large payload", "long processing", "async response OK" | Async inference |
| "unpredictable traffic", "rarely used" | Serverless |
A model that runs is not a model that works. This section teaches you to recognize subtle failures, describe them with bias/variance language, and pick the right metric.
The single most important concept in ML.
The intuition: A student who memorized every practice exam answer. Aces practice exams. Fails the real one. They never learned — they memorized.
Symptom:
| Training accuracy | Validation/Test accuracy | |
|---|---|---|
| Overfit | Very high (e.g., 99%) | Much lower (e.g., 65%) |
Big gap = overfitting.
Causes:
Fixes:
| Fix | What it does |
|---|---|
| More training data | Harder to memorize |
| Regularization (L1, L2) | Penalty for being too complex |
| Reduce model complexity | Fewer params, simpler architecture |
| Dropout (NN) | Randomly turn off neurons during training |
| Early stopping | Stop training when validation accuracy plateaus |
| Cross-validation | Better estimate of true performance |
| Data augmentation | Artificially expand training set |
The intuition: A student who only studied the chapter titles. Fails practice exams. Fails the real one. Never learned anything substantive.
Symptom:
| Training accuracy | Validation/Test accuracy | |
|---|---|---|
| Underfit | Low (e.g., 60%) | Also low (e.g., 58%) |
Both low, small gap = underfitting.
Causes: Too-simple model, too few features, too little training, wrong algorithm.
Fixes: More complex model, more features, train longer, less regularization.
| Training acc | Validation acc | Diagnosis |
|---|---|---|
| 98% | 71% | Overfitting (big gap) |
| 55% | 58% | Underfitting (both low) |
| 92% | 90% | Healthy (close, both reasonable) |
Mathematical language for the same overfit/underfit story.
| Bias | Variance | |
|---|---|---|
| Means | Error from over-simple assumptions | Error from too much sensitivity to training data |
| Mnemonic | Bias = Bad assumptions | Variance = Volatile output |
| High = | Underfitting | Overfitting |
| Behavior | Misses the pattern systematically | Different training set → very different model |
💡 The bias-variance tradeoff: Simple model = high bias, low variance. Complex model = low bias, high variance. Sweet spot = both low enough.
| Team | Model | Bias | Variance | |
|---|---|---|---|---|
| A | Linear regression on sq ft only | High (line can't bend) | Low | |
| B | Deep NN on 1000 homes | Low | High (memorizes quirks) | |
| C | XGBoost on full dataset | Low | Low | ✅ |
Team C wins.
The single most heavily tested area. Wrong metric = wrong answer.
| Actual: Positive | Actual: Negative | |
|---|---|---|
| Predicted Positive | True Positive (TP) | False Positive (FP) |
| Predicted Negative | False Negative (FN) | True Negative (TN) |
Accuracy = (TP + TN) / Total
Plain English: Of all predictions, how many were right?
Use when: Classes are roughly balanced.
⚠️ The accuracy trap: On imbalanced data (99% legit / 1% fraud), a model that always says "legit" is 99% accurate and useless. Switch to F1 / recall.
Precision = TP / (TP + FP)
Plain English: Of everything I flagged as positive, how many actually were?
Use when: False positives are expensive. You want to be sure when you say "positive."
Classic example — Spam filter:
Recall = TP / (TP + FN)
Plain English: Of all the actual positives out there, how many did I catch?
Use when: False negatives are expensive. Can't afford to miss a positive case.
Classic example — Cancer screening:
You trade one for the other by adjusting the decision threshold.
Choose based on what's costlier in your domain.
F1 = 2 × (Precision × Recall) / (Precision + Recall)
Plain English: Harmonic mean. Single number balancing both. Bad if either is bad.
Use when:
💡 F1 is your default for imbalanced classification. AWS loves to ask "imbalanced fraud dataset, which metric?" → F1 or recall.
ROC curve: Plots True Positive Rate vs False Positive Rate at every threshold. AUC: Area Under that Curve, a single number 0–1.
| AUC | Meaning |
|---|---|
| 1.0 | Perfect separation |
| 0.5 | Random guessing |
| < 0.5 | Worse than random (flip predictions) |
Use when: Comparing classifiers without committing to a threshold.
| Metric | What it measures |
|---|---|
| MAE (Mean Absolute Error) | Average of absolute errors |
| MSE (Mean Squared Error) | Average of squared errors (penalizes big errors more) |
| RMSE (Root MSE) | Same units as target — easier to interpret |
| R² | Fraction of variance explained (0–1) |
| Scenario | Best Metric |
|---|---|
| Balanced classes, just want overall correctness | Accuracy |
| Imbalanced fraud detection | F1 or recall |
| Spam filter (FPs hurt) | Precision |
| Cancer screening (FNs hurt) | Recall |
| Compare two binary classifiers without fixed threshold | AUC-ROC |
| Regression: predict house prices | RMSE or MAE |
The engines of modern AI. Tested at conceptual level — understand intuitions, no math required.
Each neuron:
Weights and biases = parameters (learned during training).
| Layer | Role |
|---|---|
| Input layer | Receives raw features (pixels, customer attributes, etc.) |
| Hidden layer(s) | Where pattern-finding happens |
| Output layer | Produces final prediction |
Deep learning = many hidden layers.
| Function | Used for |
|---|---|
| ReLU (Rectified Linear Unit) | Default for hidden layers — fast, simple, works well |
| Sigmoid | Output for binary classification (squashes to 0–1 probability) |
| Softmax | Output for multi-class classification (probabilities sum to 1) |
| Tanh | Older, used in some sequence models |
💡 Without activation functions, a neural net is just linear math no matter how many layers.
Three architectures dominate three kinds of data. Memorize this.
Best for: images and visual data.
Why: Uses small filters that slide over the image to detect local patterns (edges → textures → shapes → objects).
Use cases:
Best for: sequential data where order matters.
Why: Has memory — output at each step depends on current input + hidden state from previous step.
Use cases:
Weakness: Struggles with long-range dependencies — forgets the start of a long sequence.
Modern variants: LSTM, GRU (better memory).
Best for: language and generative AI. The architecture behind every modern LLM (GPT, Claude, Llama).
Why they dominate: Instead of step-by-step like RNNs, transformers use an attention mechanism that lets every token directly look at every other token.
Use cases:
| Data shape | Use |
|---|---|
| Images, video | CNN |
| Time series, sensor streams | RNN (or LSTM/GRU) |
| Text, language, generative tasks | Transformer |
A model in a notebook is not a useful model. MLOps is the discipline of getting them into production safely.
MLOps = DevOps applied to ML.
Track every version of every model.
Why:
| Stage | Meaning |
|---|---|
| CI (Continuous Integration) | Test code, data pipelines, training scripts on every change |
| CD (Continuous Delivery) | Deploy new models safely (canary, blue-green) |
| CT (Continuous Training) | Retrain automatically when triggers fire |
| Monitor | Why |
|---|---|
| Accuracy / business metric | Is the model still useful? |
| Latency | Is inference still fast? |
| Errors | Are requests failing? |
| Data drift | Has input distribution shifted? |
| Model drift (concept drift) | Has the input → output relationship changed? |
| Bias | Is the model fair across groups? |
You retrain when:
AWS service: SageMaker Pipelines automates this loop end to end.
"A fraud model worked great in January. In May, complaints spike that legit transactions are being declined. Model Monitor shows data drift since a new payment processor came online. The team rolls back to v1, fixes the retraining pipeline, and v3 deploys via canary release in 2 days."
That's the MLOps loop in action — possible only because the tooling was already in place.
The AWS flagship ML platform. The single most heavily tested service on the exam.
The exam tests which feature handles which stage of the ML lifecycle. Memorize these.
| Scenario | Feature |
|---|---|
| Healthcare team has CSV, no production ML experience, wants a model | Autopilot |
| Compliance team needs bias audit before approval | Clarify |
| 9-month-old recommender making weird suggestions | Model Monitor |
| Labeling 30K satellite images | Ground Truth |
| Multiple teams computing customer features differently | Feature Store |
| Want to deploy a Llama 2 fine-tune on AWS infra | JumpStart |
Three options, trade off control vs effort.
| Option | What you provide | Use when |
|---|---|---|
| Built-in algorithm | Just data + hyperparameters | Common problem (XGBoost, K-Means, DeepAR, Linear Learner, RCF, etc.) |
| Script mode | Your training script in TF/PyTorch/sklearn | Custom logic, but standard framework |
| Custom container | Full Docker image | Exotic dependencies, niche frameworks |
💡 Rule: Use the simplest option that fits. Most problems → built-in.
| Algorithm | Problem type |
|---|---|
| XGBoost | Classification / regression (most popular general-purpose) |
| Linear Learner | Linear regression / classification |
| K-Means | Clustering |
| Random Cut Forest (RCF) | Anomaly detection |
| Factorization Machines | Recommendations |
| DeepAR | Time series forecasting |
| Object Detection / Image Classification | Computer vision |
| Type | Pattern | Use when |
|---|---|---|
| Real-time endpoint | Always-on, ms latency | Live fraud check, chatbot, web recommendations |
| Batch transform | One-shot offline job | Score 50M customers overnight |
| Asynchronous inference | Queue + result later | 1GB video, 10-min processing |
| Serverless inference | Scales to zero | Sporadic / unpredictable traffic |
| Phrase | Pick |
|---|---|
| "sub-second", "during transaction" | Real-time |
| "overnight", "large dataset", "no rush" | Batch transform |
| "large payload", "long processing" | Async |
| "unpredictable traffic", "rarely used" | Serverless |
You're not building a model — you're calling a service that already has one. Faster, cheaper, no ML expertise needed.
Both deal with visual input but answer different questions.
What: Image and video analysis.
Capabilities:
What: Document data extraction (OCR + structure).
Capabilities:
| Question | Pick |
|---|---|
| What's shown in the picture? (faces, objects) | Rekognition |
| What does the document say? (line items, fields) | Textract |
⚠️ A scanned invoice of food → Textract (you want the text/numbers, not the picture of the food).
What: Natural language processing on text.
Capabilities:
What: Language translation (real-time + batch).
What: Speech to text.
Capabilities:
What: Text to speech (the opposite of Transcribe).
Capabilities:
💡 Mnemonic: Transcribe writes down what was said. Polly reads things out loud.
What: Chatbot service (same engine as Alexa).
Two key concepts:
What: Intelligent enterprise search (NL question answering across documents).
Capabilities:
| Need | Pick |
|---|---|
| Multi-turn dialogue collecting info | Lex |
| One-shot question against many docs | Kendra |
What: Time-series forecasting service.
Use cases: Demand forecasting, sales forecasting, inventory planning, workforce demand.
What: Recommendation engine (same tech as amazon.com).
Use cases: Product recommendations, content recommendations, personalized rankings, similar items.
| Question | Pick |
|---|---|
| Predict a number over time (next month's sales) | Forecast |
| Recommend items to a user (next movie) | Personalize |
What: Dedicated fraud detection (online payments, fake accounts, transaction risk).
⚠️ Important: As of November 7, 2025, AWS stopped accepting new customers for Fraud Detector. Existing customers continue. New fraud projects → SageMaker. Know the concept; don't expect deep questions.
What: Detect anomalies in business/operational metrics (revenue, traffic, conversion rates).
| Service | Use case |
|---|---|
| Lookout for Vision | Industrial defect detection in images |
| Lookout for Equipment | Predictive maintenance from sensor data |
What: Fully managed service for foundation models (Claude, Llama, Titan, etc.).
Capabilities:
⚠️ Important: Customized (fine-tuned) Bedrock models require Provisioned Throughput for hosting — they're not available on standard on-demand.
What: Generative AI assistant (finished product, built on foundation models).
| Flavor | For |
|---|---|
| Amazon Q Business | Enterprise users — answers questions over company data |
| Amazon Q Developer | Software engineers — code generation, IDE integration |
| Need | Pick |
|---|---|
| Managed API for foundation models, no infra | Bedrock |
| Pretrained / foundation models inside SageMaker, full control | JumpStart |
| Finished AI assistant for business users or developers | Amazon Q |
⭐ Memorize this table cold. Cover the right column, quiz yourself row by row.
| Use case | AWS service |
|---|---|
| Detect objects, faces, scenes in images/video | Amazon Rekognition |
| Moderate unsafe image/video content | Amazon Rekognition |
| Extract text from scanned documents (OCR) | Amazon Textract |
| Extract tables, forms, key-value pairs from invoices | Amazon Textract |
| Convert speech/audio to text | Amazon Transcribe |
| Convert text to natural-sounding speech | Amazon Polly |
| Translate text between languages | Amazon Translate |
| Analyze sentiment in customer reviews | Amazon Comprehend |
| Extract entities and key phrases from text | Amazon Comprehend |
| Build a chatbot with intents and slots | Amazon Lex |
| Forecast future demand or sales | Amazon Forecast |
| Recommend products or content to users | Amazon Personalize |
| Search across enterprise docs in natural language | Amazon Kendra |
| Detect fraud (existing customers) | Fraud Detector or SageMaker |
| Detect anomalies in business KPIs | Amazon Lookout for Metrics |
| Detect defects in manufacturing images | Amazon Lookout for Vision |
| Predict equipment failure from sensor data | Amazon Lookout for Equipment |
| Build, train, deploy a custom ML model | Amazon SageMaker AI |
| Label training data for supervised learning | SageMaker Ground Truth |
| Auto-build ML models with minimal code | SageMaker Autopilot |
| Detect bias and explain predictions | SageMaker Clarify |
| Monitor a deployed model for drift | SageMaker Model Monitor |
| Store and reuse ML features across teams | SageMaker Feature Store |
| Use pretrained / foundation models inside SageMaker | SageMaker JumpStart |
| Automate end-to-end ML workflows | SageMaker Pipelines |
| Sub-second predictions | SageMaker Real-time Endpoint |
| Offline bulk predictions on large datasets | SageMaker Batch Transform |
| Long-running inference with large payloads | SageMaker Async Inference |
| Sporadic / unpredictable inference traffic | SageMaker Serverless Inference |
| Build generative AI apps with foundation models | Amazon Bedrock |
| Enterprise GenAI assistant for business users | Amazon Q Business |
| AI coding assistant in IDE | Amazon Q Developer |
| # | Trap | Truth |
|---|---|---|
| 1 | High accuracy on imbalanced data | Switch to F1 / recall / AUC-ROC |
| 2 | Rekognition vs Textract | Visual content = Rekognition. Text in document = Textract |
| 3 | Transcribe vs Polly | Transcribe = audio→text. Polly = text→audio |
| 4 | Comprehend vs Kendra | Comprehend analyzes text. Kendra searches documents |
| 5 | Forecast vs Personalize | Forecast = numbers over time. Personalize = items to users |
| 6 | SageMaker vs pre-built service | Use pre-built if it fits. SageMaker only for custom |
| 7 | Inference deployment | Real-time / batch / async / serverless are NOT interchangeable |
| 8 | Underfitting fix | Make model more complex (regularization is for overfitting) |
| 9 | Bias misdirection | Bias often means fix the data or use Clarify |
| 10 | JumpStart vs Bedrock | JumpStart = inside SageMaker. Bedrock = managed API |
Pre-exam revision. Read it three times the night before.
| Order | What | Time |
|---|---|---|
| 1 | Read Parts 1–10 in order (foundations + metrics) | 60 min |
| 2 | Drill Part 10 metrics aloud — quiz yourself on each scenario | 20 min |
| 3 | Read Parts 11–13 (NN, deep learning, MLOps) | 30 min |
| 4 | Read Parts 14–21 (SageMaker + AI services) | 60 min |
| 5 | Memorize Part 22 (master service table) — cover right column, quiz | 30 min |
| 6 | Read Part 23 (top 10 traps) twice | 15 min |
| 7 | Use Part 24 (memory sheet) as last 5 min before exam | 5 min |
Answer aloud before reading the answer:
→ F1 / recall. Always-legit predicts 99.9% accurate but useless.
→ Unsupervised, clustering.
→ Overfitting. More data, regularization, dropout, simpler model, early stopping.
→ Amazon Textract.
→ SageMaker Model Monitor.
→ Batch Transform.
→ Amazon Lex.
→ Parameter = learned by model (NN weights). Hyperparameter = set by you (learning rate).
→ Transformers — attention lets every token see every other token, scales massively.
→ Bedrock = managed API for foundation models, no infra. SageMaker = custom training, full control.
If you got 8+ right, you're ready. Move to practice exams. If under 8, find the weak sections and reread.