AWS

Explain how AWS IAM Role assumption works across different AWS accounts securely.

One account can use another account's resources without a password or an access key ever changing hands. The role's trust policy decides who is allowed in, its permissions policy decides what they can do once they're there, and STS hands out credentials that expire on their own.

Your traffic is spiky and unpredictable during business hours. Design an EC2 Auto Scaling policy that reacts fast without overspending overnight.

Target tracking should be the default scaling policy, since it only needs one metric and handles the math itself. Layer scheduled actions on top for the predictable part of the day, and treat step scaling as the exception for spikes that need a bigger, immediate jump than target tracking gives you.

When would you use EC2 Spot Instances in production, and how do you design a workload to survive interruptions?

Spot is unused EC2 capacity sold at a steep discount, usually 60 to 90 percent off On-Demand, with the trade that AWS can reclaim it with two minutes of warning. It's a good fit for anything stateless, retryable, or checkpointed, and a bad fit for anything that can't tolerate an interruption.

Reserved Instances, Savings Plans, Spot, and On-Demand: how do you decide what mix to run for a given EC2 workload?

The decision runs on one axis: how predictable is the usage, not how important the workload is. Steady, known baseline load goes on Savings Plans, spiky or unknown load stays On-Demand, and anything interruption- tolerant goes on Spot. Reserved Instances are mostly the older, less flexible version of a Savings Plan today.

How do you get visibility into what's happening on an EC2 fleet, and who changed what, without SSHing into boxes to find out?

These are two different questions wearing one sentence. CloudWatch answers "what is the fleet doing right now," metrics, logs, alarms. CloudTrail answers "who did what to it," an audit log of every API call. Confusing the two is the most common way this question goes wrong.

Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.

Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.

A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.

A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.

Two EC2 instances in the same VPC can't reach each other over a port that should be open. Walk through how you'd find out why.

Work outward from the instance rather than guessing at the network: confirm the app is actually listening, then check Security Groups, then NACLs, then the route table, then Flow Logs to see what AWS's own network actually did with the packet. Each layer either clears itself or points straight at the next thing to check.

Multiple teams share one AWS account. How do you structure IAM so each team can only touch the resources they own?

Individual users each get their own IAM role via SSO federation, never a shared login or a long-lived access key, and permissions are grouped by team into roles scoped with resource tags rather than hardcoded ARNs. Past a certain team count, the real fix is separate AWS accounts per team, not tighter policies inside one shared account.

How do you make sure data is encrypted everywhere it lives in AWS, both at rest and in transit, without it becoming a project unto itself?

At rest, nearly every AWS storage service takes a KMS key as a one-time setting at creation, and the actual work is deciding who can use that key, not the encryption itself. In transit, TLS terminated with a Certificate Manager certificate covers the external hop, but internal service-to- service traffic needs its own explicit decision, since nothing enforces it by default.

Multi-AZ deployments, read replicas, and Aurora all get mentioned as RDS availability features. What's actually different between them, and when do you use each?

Multi-AZ is a synchronous standby that exists purely for failover, not for serving traffic. A read replica is asynchronous and exists to serve read traffic, with failover as a secondary, slower use. Aurora replaces both mechanisms with a shared, distributed storage layer, which is why an Aurora Replica can do double duty that a standard RDS replica can't.

Your application suddenly can't connect to its RDS database. Walk through how you'd diagnose it.

Rule out the database's own health first, since that's a two-second check in the console, then work through the network path in order: security groups, subnet and public accessibility, DNS, and connection limits. A sudden failure that used to work points hardest at something that changed recently, not at a fundamentally broken setup.

Design a backup and recovery strategy for a production RDS database, including what point-in-time recovery can and can't actually do for you.

Automated backups and point-in-time recovery cover the everyday case, restoring to any second within the retention window, but every restore creates a brand-new instance rather than repairing the existing one, and neither protects against a whole-region outage on its own. Cross-region snapshot copies and manual snapshots fill the two gaps that leaves.

Your RDS bill keeps climbing every month. What levers do you actually have to bring it down?

RDS cost breaks into three independent knobs: compute (instance type and purchase option), storage (type and provisioned amount), and everything that scales with those two but isn't obviously tied to them, like snapshot retention and cross-AZ data transfer. Most real savings come from right-sizing and switching purchase options, not from a single trick.

A company hires an external cost-optimisation vendor that needs read access to resources in the company's AWS account. The vendor runs from its own AWS account and serves many other customers. Which solution meets this requirement MOST securely?

Third-party access is an IAM role the vendor assumes from their own account, never an IAM user with access keys. The detail that separates a good answer from a nearly-good one is the external ID condition in the trust policy, which is what stops another of the vendor's customers from tricking them into acting on your account.

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A compliance review finds that an existing Amazon EBS volume attached to a production EC2 instance is unencrypted. The data on the volume must be encrypted at rest with an AWS KMS key. Which sequence of steps achieves this?

You cannot turn encryption on for an existing EBS volume in place. The supported path is to snapshot it, copy the snapshot with encryption enabled, create a new volume from the encrypted copy, and swap it onto the instance.

An application on Amazon ECS connects to an Amazon RDS for PostgreSQL database using a username and password stored in the task definition as plaintext environment variables. Security policy now requires that the database password be encrypted at rest and rotated automatically every 30 days. Which solution meets these requirements with the LEAST operational overhead?

Secrets Manager is the service that rotates credentials for you, and it has built-in rotation for RDS. Parameter Store SecureString encrypts a value perfectly well but has no native rotation, so choosing it means writing and owning the rotation yourself.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

An audit discovers that several Amazon S3 buckets across a company's AWS accounts have been made publicly readable by developers. The company must guarantee that no bucket in any account can be made public, and must be alerted to any bucket policy that grants access outside the organization. Which combination of actions meets these requirements?

S3 Block Public Access enforced at the account level is the preventive control, and IAM Access Analyzer is the detective one. The pairing matters: the exam separates stopping something from noticing it, and this stem asks for both.

An ecommerce application sends order events to a processing service. During sales events the processing service is overwhelmed and drops orders. Orders for a given customer must be processed in the sequence they were submitted, and no order may be processed twice. Which solution meets these requirements?

Two requirements in the stem, ordering and no duplicates, point at exactly one service. An SQS FIFO queue guarantees first-in-first-out delivery within a message group and provides exactly-once processing through deduplication. A standard queue gives neither.

An Amazon RDS for MySQL database serves a reporting application. Read queries have grown until they slow down writes, and the business separately requires that the database survive the loss of a single Availability Zone with automatic failover. Which combination meets both requirements?

Multi-AZ and read replicas solve different problems and the exam tests whether you conflate them. A Multi-AZ standby is synchronous and cannot serve reads. A read replica is asynchronous and does serve reads. Needing both availability and read scaling means deploying both.

An AWS Lambda function is triggered by an Amazon SQS queue. A small number of malformed messages cause the function to fail repeatedly. These messages are retried continuously, which delays processing of valid messages and increases cost. What should a solutions architect do to resolve this?

A message that can never succeed will be retried until it expires, blocking the queue behind it. The fix is a dead-letter queue with a maxReceiveCount redrive policy, which moves the poison message aside after a set number of failures so everything else keeps flowing.

A web application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Users report being logged out at random. Investigation shows that session data is held in memory on each instance, so a request routed to a different instance loses the session. Which solution fixes this while keeping the web tier horizontally scalable?

Session state held on an instance makes that instance special, which is what breaks scaling and termination. Moving sessions to a shared store such as ElastiCache or DynamoDB makes every instance interchangeable, which is the property the rest of the architecture assumes.

A media company stores original video files in an Amazon S3 bucket in us-east-1. Regulators require that a copy of every new file exists in a second AWS Region within 15 minutes of upload, and that no file can be permanently deleted by mistake. Which TWO actions should a solutions architect take?

Cross-Region Replication copies new objects to a bucket in another Region automatically, and versioning is its prerequisite as well as the control that makes deletion recoverable. The pair answers both halves of the requirement with one dependency between them.

A product catalogue application backed by Amazon RDS shows rising read latency. Analysis shows that a small number of identical queries account for most of the load, and the underlying data changes only a few times per day. The team wants to reduce latency to single-digit milliseconds with minimal application rework. What should a solutions architect recommend?

Repeated identical reads over rarely changing data is the textbook caching case. Amazon ElastiCache serves those queries from memory in well under a millisecond, and because the data changes a few times a day, staleness is cheap to manage.

An application stores orders in an Amazon DynamoDB table with a partition key of orderId. A new reporting feature must list all orders for a given customerId, sorted by order date. Running the report currently scans the entire table and is slow and expensive. What should a solutions architect recommend?

A scan means the access pattern has no index behind it. A global secondary index with customerId as its partition key and the order date as its sort key turns that scan into a query. Only a global secondary index can introduce a new partition key on an existing table.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

A company stores analytics datasets in Amazon S3. Access is unpredictable: some datasets are queried daily for months, others are never opened again after the first week, and the team cannot tell which is which in advance. All objects are larger than 1 MB and must remain available for immediate retrieval. Which approach is MOST cost-effective?

Lifecycle rules are the cheapest option when access falls off predictably with age. When nobody can predict it, S3 Intelligent-Tiering is the class designed for exactly that: it moves each object between tiers on its own access pattern, with no retrieval fees and no minimum storage duration.

A company runs a steady production workload on Amazon EC2 that has not changed size in two years and is expected to continue for at least three more. The team occasionally changes instance family as new generations are released, and is also beginning to move some services to AWS Fargate. The company wants the largest possible discount without giving up that flexibility. Which purchasing option should a solutions architect recommend?

Predictable long-running usage should never sit on On-Demand pricing. Compute Savings Plans give the deepest commitment discount while staying flexible across instance family, size, Region and even across EC2, Fargate and Lambda, which is what the stem's flexibility requirement is asking for.

A nightly batch job renders video segments. The work is split into thousands of independent tasks, any task can be retried safely if it fails, and the job must finish before 06:00 but has no other timing constraint. The company wants to minimise compute cost. Which approach should a solutions architect recommend?

Independent, retryable tasks with a loose deadline is the definition of an interruption-tolerant workload, and that is what Spot Instances are for. Spreading the request across several instance types and Availability Zones is what keeps a Spot fleet from being reclaimed all at once.

A development team uses several Amazon RDS for MySQL instances that are only needed during working hours on weekdays. The team wants to stop paying for them outside those hours with the least possible engineering effort, and the databases must retain their data and endpoints between sessions. Which solution meets these requirements?

Stopping an RDS instance removes the instance-hour charge while keeping the data, the endpoint and the configuration. The catch worth knowing is the seven-day limit: RDS restarts a stopped instance automatically after seven consecutive days, so a weekday schedule fits and a long shutdown does not.