AWS

Explain how AWS IAM Role assumption works across different AWS accounts securely.

One account can use another account's resources without a password or an access key ever changing hands. The role's trust policy decides who is allowed in, its permissions policy decides what they can do once they're there, and STS hands out credentials that expire on their own.

How do you architect a highly available, zero-downtime database migration in AWS RDS?

Zero downtime means you never ask for a maintenance window. Bring the new database up next to the old one, keep it in sync while the old one carries all the traffic, check the data constantly, then switch connections over in a few seconds, with a way back you set up before you need it.

Your EC2 instances in a private subnet need to reach S3 and a third-party API, but must never be reachable from the internet. Design the networking.

Outbound-only access comes from a NAT Gateway in a public subnet, but S3 traffic should skip it entirely through a VPC endpoint, which is free and never leaves the AWS network. Nothing can reach in because there's no route for it to take, not because a rule is blocking it, and that distinction is usually the real follow-up question.

Your traffic is spiky and unpredictable during business hours. Design an EC2 Auto Scaling policy that reacts fast without overspending overnight.

Target tracking should be the default scaling policy, since it only needs one metric and handles the math itself. Layer scheduled actions on top for the predictable part of the day, and treat step scaling as the exception for spikes that need a bigger, immediate jump than target tracking gives you.

When would you use EC2 Spot Instances in production, and how do you design a workload to survive interruptions?

Spot is unused EC2 capacity sold at a steep discount, usually 60 to 90 percent off On-Demand, with the trade that AWS can reclaim it with two minutes of warning. It's a good fit for anything stateless, retryable, or checkpointed, and a bad fit for anything that can't tolerate an interruption.

Reserved Instances, Savings Plans, Spot, and On-Demand: how do you decide what mix to run for a given EC2 workload?

The decision runs on one axis: how predictable is the usage, not how important the workload is. Steady, known baseline load goes on Savings Plans, spiky or unknown load stays On-Demand, and anything interruption- tolerant goes on Spot. Reserved Instances are mostly the older, less flexible version of a Savings Plan today.

How do you cut EC2 costs for workloads that sit idle nights and weekends, without relying on someone remembering to turn things off?

Automate the stop and start instead of asking anyone to remember it. Scheduled Auto Scaling actions or AWS Instance Scheduler both work; the choice mostly comes down to whether the fleet is already behind an Auto Scaling group. Either way, tag-based scoping is what keeps it from ever touching something that shouldn't be stopped.

How do you prepare an EC2-based application to fail over to a second AWS region if the primary region has an outage?

Disaster recovery for EC2 is really three separate problems: getting a bootable image into the DR region ahead of time, having a way to launch capacity there fast, and having something outside both regions to redirect traffic. The RTO and RPO you're targeting decide how much of that you keep running warm versus building on demand.

How do you get visibility into what's happening on an EC2 fleet, and who changed what, without SSHing into boxes to find out?

These are two different questions wearing one sentence. CloudWatch answers "what is the fleet doing right now," metrics, logs, alarms. CloudTrail answers "who did what to it," an audit log of every API call. Confusing the two is the most common way this question goes wrong.

Your application needs to feel fast for users spread across multiple continents. What would you put in front of it, and why?

Amazon CloudFront is a CDN that terminates connections and caches content at edge locations close to the user, so most requests never travel back to the origin region at all. It helps static content the most, but modern CloudFront also improves dynamic requests through TCP/TLS termination at the edge and origin connection reuse.

Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.

Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.

You have a dozen VPCs that all need to reach each other and a shared-services VPC. Would you use VPC Peering or Transit Gateway, and why?

Peering connects two VPCs directly and doesn't scale past a handful of them, since connections grow quadratically and traffic can't transit through a peered VPC to reach a third. Transit Gateway is a central routing hub that turns the same problem into one connection per VPC, and it's the right call anywhere past three or four VPCs.

How would you securely connect an on-premises data center to a VPC, and when would you reach for Direct Connect instead of a Site-to-Site VPN?

A Site-to-Site VPN is fast to set up, encrypted by default, and runs over the public internet, which is also its ceiling: bandwidth and latency aren't guaranteed. Direct Connect is a dedicated physical link with predictable performance, but it takes weeks to provision and isn't encrypted on its own. Most serious hybrid setups end up running both.

A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.

A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.

Two EC2 instances in the same VPC can't reach each other over a port that should be open. Walk through how you'd find out why.

Work outward from the instance rather than guessing at the network: confirm the app is actually listening, then check Security Groups, then NACLs, then the route table, then Flow Logs to see what AWS's own network actually did with the packet. Each layer either clears itself or points straight at the next thing to check.

Multiple teams share one AWS account. How do you structure IAM so each team can only touch the resources they own?

Individual users each get their own IAM role via SSO federation, never a shared login or a long-lived access key, and permissions are grouped by team into roles scoped with resource tags rather than hardcoded ARNs. Past a certain team count, the real fix is separate AWS accounts per team, not tighter policies inside one shared account.

How do you make sure data is encrypted everywhere it lives in AWS, both at rest and in transit, without it becoming a project unto itself?

At rest, nearly every AWS storage service takes a KMS key as a one-time setting at creation, and the actual work is deciding who can use that key, not the encryption itself. In transit, TLS terminated with a Certificate Manager certificate covers the external hop, but internal service-to- service traffic needs its own explicit decision, since nothing enforces it by default.

How do you continuously monitor an AWS account for security and compliance drift, instead of only finding out during an annual audit?

Point-in-time audits catch a configuration that was wrong when someone happened to look. AWS Config evaluates resources continuously against rules and records every configuration change, CloudTrail records who made it, and Security Hub aggregates both into one place with a severity score so drift gets flagged the hour it happens, not the quarter someone checks.

Multi-AZ deployments, read replicas, and Aurora all get mentioned as RDS availability features. What's actually different between them, and when do you use each?

Multi-AZ is a synchronous standby that exists purely for failover, not for serving traffic. A read replica is asynchronous and exists to serve read traffic, with failover as a secondary, slower use. Aurora replaces both mechanisms with a shared, distributed storage layer, which is why an Aurora Replica can do double duty that a standard RDS replica can't.

Your application suddenly can't connect to its RDS database. Walk through how you'd diagnose it.

Rule out the database's own health first, since that's a two-second check in the console, then work through the network path in order: security groups, subnet and public accessibility, DNS, and connection limits. A sudden failure that used to work points hardest at something that changed recently, not at a fundamentally broken setup.

Design a backup and recovery strategy for a production RDS database, including what point-in-time recovery can and can't actually do for you.

Automated backups and point-in-time recovery cover the everyday case, restoring to any second within the retention window, but every restore creates a brand-new instance rather than repairing the existing one, and neither protects against a whole-region outage on its own. Cross-region snapshot copies and manual snapshots fill the two gaps that leaves.

Your RDS bill keeps climbing every month. What levers do you actually have to bring it down?

RDS cost breaks into three independent knobs: compute (instance type and purchase option), storage (type and provisioned amount), and everything that scales with those two but isn't obviously tied to them, like snapshot retention and cross-AZ data transfer. Most real savings come from right-sizing and switching purchase options, not from a single trick.

How do you safely rotate IAM credentials or database secrets without downtime?

The safe pattern is overlapping validity. Create the new secret while the old one still works, get code that accepts either one deployed everywhere, confirm the new one is actually being used, then revoke the old one. Rotating in a single step guarantees a window where something is still holding a credential that no longer works.

What happens if an Auto Scaling instance never becomes healthy?

Auto Scaling terminates and replaces an instance that never passes health checks, which is fine once and expensive in a loop. How long you burn depends on the grace period, the check thresholds, and which health check type the group is actually using. The fix is working out why it's unhealthy: usually startup config, a wrong health endpoint, or a grace period shorter than boot time.

Your app writes 2 TB/month of logs that are queried heavily for 7 days, rarely after 30, and must be kept 7 years. Which S3 setup is most cost-effective?

S3 storage classes trade cheap storage for slow, sometimes paid retrieval. When you already know how access drops off with age, the cheapest setup is a lifecycle rule that walks the data down the tiers as it ages. A single class overpays, and Intelligent-Tiering solves a problem this question doesn't have.

A company hires an external cost-optimisation vendor that needs read access to resources in the company's AWS account. The vendor runs from its own AWS account and serves many other customers. Which solution meets this requirement MOST securely?

Third-party access is an IAM role the vendor assumes from their own account, never an IAM user with access keys. The detail that separates a good answer from a nearly-good one is the external ID condition in the trust policy, which is what stops another of the vendor's customers from tricking them into acting on your account.

An application running on Amazon EC2 instances in an Auto Scaling group needs to read objects from an Amazon S3 bucket. The instances are replaced frequently as the group scales. Which approach for granting access requires the LEAST operational overhead?

Anything running on EC2 gets its permissions from an instance profile, not from credentials placed on the instance. The role is attached to the launch template, so every instance the Auto Scaling group creates is already authorised and there is nothing to distribute or rotate.

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A compliance review finds that an existing Amazon EBS volume attached to a production EC2 instance is unencrypted. The data on the volume must be encrypted at rest with an AWS KMS key. Which sequence of steps achieves this?

You cannot turn encryption on for an existing EBS volume in place. The supported path is to snapshot it, copy the snapshot with encryption enabled, create a new volume from the encrypted copy, and swap it onto the instance.

An application on Amazon ECS connects to an Amazon RDS for PostgreSQL database using a username and password stored in the task definition as plaintext environment variables. Security policy now requires that the database password be encrypted at rest and rotated automatically every 30 days. Which solution meets these requirements with the LEAST operational overhead?

Secrets Manager is the service that rotates credentials for you, and it has built-in rotation for RDS. Parameter Store SecureString encrypts a value perfectly well but has no native rotation, so choosing it means writing and owning the rotation yourself.

A company uses AWS Organizations with all features enabled. For compliance reasons, workloads may only run in two approved AWS Regions. Account administrators in member accounts currently hold the AdministratorAccess policy. The company must prevent resources from being created in any other Region. What should a solutions architect do?

A service control policy is the only control that an account administrator cannot remove, because it caps what identities in a member account may do no matter what their IAM policies say. IAM policies and permissions boundaries can both be edited by the very administrators you are trying to constrain.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

An audit discovers that several Amazon S3 buckets across a company's AWS accounts have been made publicly readable by developers. The company must guarantee that no bucket in any account can be made public, and must be alerted to any bucket policy that grants access outside the organization. Which combination of actions meets these requirements?

S3 Block Public Access enforced at the account level is the preventive control, and IAM Access Analyzer is the detective one. The pairing matters: the exam separates stopping something from noticing it, and this stem asks for both.

An ecommerce application sends order events to a processing service. During sales events the processing service is overwhelmed and drops orders. Orders for a given customer must be processed in the sequence they were submitted, and no order may be processed twice. Which solution meets these requirements?

Two requirements in the stem, ordering and no duplicates, point at exactly one service. An SQS FIFO queue guarantees first-in-first-out delivery within a message group and provides exactly-once processing through deduplication. A standard queue gives neither.

An Amazon RDS for MySQL database serves a reporting application. Read queries have grown until they slow down writes, and the business separately requires that the database survive the loss of a single Availability Zone with automatic failover. Which combination meets both requirements?

Multi-AZ and read replicas solve different problems and the exam tests whether you conflate them. A Multi-AZ standby is synchronous and cannot serve reads. A read replica is asynchronous and does serve reads. Needing both availability and read scaling means deploying both.

A company runs a business-critical application in one AWS Region. The disaster recovery plan requires a recovery time objective of 10 minutes and a recovery point objective of 1 minute in a second Region. The company wants to avoid paying for a full duplicate of the production fleet. Which disaster recovery strategy should a solutions architect choose?

RTO and RPO in minutes rule out backup and restore and pilot light, because both require standing infrastructure up before traffic can move. Warm standby keeps a scaled-down copy always running, which is what buys minutes instead of hours without paying for a second full fleet.

An AWS Lambda function is triggered by an Amazon SQS queue. A small number of malformed messages cause the function to fail repeatedly. These messages are retried continuously, which delays processing of valid messages and increases cost. What should a solutions architect do to resolve this?

A message that can never succeed will be retried until it expires, blocking the queue behind it. The fix is a dead-letter queue with a maxReceiveCount redrive policy, which moves the poison message aside after a set number of failures so everything else keeps flowing.

A web application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Users report being logged out at random. Investigation shows that session data is held in memory on each instance, so a request routed to a different instance loses the session. Which solution fixes this while keeping the web tier horizontally scalable?

Session state held on an instance makes that instance special, which is what breaks scaling and termination. Moving sessions to a shared store such as ElastiCache or DynamoDB makes every instance interchangeable, which is the property the rest of the architecture assumes.

A media company stores original video files in an Amazon S3 bucket in us-east-1. Regulators require that a copy of every new file exists in a second AWS Region within 15 minutes of upload, and that no file can be permanently deleted by mistake. Which TWO actions should a solutions architect take?

Cross-Region Replication copies new objects to a bucket in another Region automatically, and versioning is its prerequisite as well as the control that makes deletion recoverable. The pair answers both halves of the requirement with one dependency between them.

A content management application runs on Amazon EC2 Linux instances spread across three Availability Zones. All instances must read and write the same set of files using standard file system semantics, and the storage must grow automatically as content is added. Which storage solution should a solutions architect recommend?

Multiple Linux instances, multiple Availability Zones, shared file system semantics and automatic growth describe Amazon EFS exactly. EBS attaches to a single Availability Zone, and S3 is object storage without file system semantics.

A company is migrating a Windows application to AWS. The application requires shared storage accessed over the SMB protocol, with Windows NTFS permissions and integration with the company's Active Directory. Which AWS service meets these requirements?

SMB, NTFS permissions and Active Directory together name exactly one AWS service. Amazon FSx for Windows File Server is the managed Windows file system, and the other FSx variants and EFS all serve different protocols.

A product catalogue application backed by Amazon RDS shows rising read latency. Analysis shows that a small number of identical queries account for most of the load, and the underlying data changes only a few times per day. The team wants to reduce latency to single-digit milliseconds with minimal application rework. What should a solutions architect recommend?

Repeated identical reads over rarely changing data is the textbook caching case. Amazon ElastiCache serves those queries from memory in well under a millisecond, and because the data changes a few times a day, staleness is cheap to manage.

A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?

UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.

An application stores orders in an Amazon DynamoDB table with a partition key of orderId. A new reporting feature must list all orders for a given customerId, sorted by order date. Running the report currently scans the entire table and is slow and expensive. What should a solutions architect recommend?

A scan means the access pattern has no index behind it. A global secondary index with customerId as its partition key and the order date as its sort key turns that scan into a query. Only a global secondary index can introduce a new partition key on an existing table.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

A company stores analytics datasets in Amazon S3. Access is unpredictable: some datasets are queried daily for months, others are never opened again after the first week, and the team cannot tell which is which in advance. All objects are larger than 1 MB and must remain available for immediate retrieval. Which approach is MOST cost-effective?

Lifecycle rules are the cheapest option when access falls off predictably with age. When nobody can predict it, S3 Intelligent-Tiering is the class designed for exactly that: it moves each object between tiers on its own access pattern, with no retrieval fees and no minimum storage duration.

A company runs a steady production workload on Amazon EC2 that has not changed size in two years and is expected to continue for at least three more. The team occasionally changes instance family as new generations are released, and is also beginning to move some services to AWS Fargate. The company wants the largest possible discount without giving up that flexibility. Which purchasing option should a solutions architect recommend?

Predictable long-running usage should never sit on On-Demand pricing. Compute Savings Plans give the deepest commitment discount while staying flexible across instance family, size, Region and even across EC2, Fargate and Lambda, which is what the stem's flexibility requirement is asking for.

A nightly batch job renders video segments. The work is split into thousands of independent tasks, any task can be retried safely if it fails, and the job must finish before 06:00 but has no other timing constraint. The company wants to minimise compute cost. Which approach should a solutions architect recommend?

Independent, retryable tasks with a loose deadline is the definition of an interruption-tolerant workload, and that is what Spot Instances are for. Spreading the request across several instance types and Availability Zones is what keeps a Spot fleet from being reclaimed all at once.

A VPC spans three Availability Zones, each with a private subnet running application instances. All three private subnets route internet-bound traffic through a single NAT gateway in the first Availability Zone. A solutions architect must remove the dependency on that one Availability Zone and reduce cross-Availability Zone data transfer charges. What should the architect do?

A NAT gateway lives in one Availability Zone, so routing all three subnets through it creates both a single point of failure and a cross-zone data transfer charge on most of the traffic. Deploying one NAT gateway per Availability Zone fixes both problems at once.

A development team uses several Amazon RDS for MySQL instances that are only needed during working hours on weekdays. The team wants to stop paying for them outside those hours with the least possible engineering effort, and the databases must retain their data and endpoints between sessions. Which solution meets these requirements?

Stopping an RDS instance removes the instance-hour charge while keeping the data, the endpoint and the configuration. The catch worth knowing is the seven-day limit: RDS restarts a stopped instance automatically after seven consecutive days, so a weekday schedule fits and a long shutdown does not.