Master Collection

What is Cloud Computing and what are the three primary service models (IaaS, PaaS, SaaS)?

Cloud computing is the on-demand delivery of compute power, database storage, applications, and other IT resources via the internet with pay-as-you-go pricing.

• IaaS (Infrastructure as a Service): Provides raw compute (EC2, Azure VMs, GCE), storage, and networking. Customer manages the OS, runtime, and applications; CSP manages physical hardware and hypervisors.
• PaaS (Platform as a Service): Provides managed application runtimes (Elastic Beanstalk, App Service, App Engine). Customer manages application code and data; CSP manages OS, patching, and scaling.
• SaaS (Software as a Service): Fully managed applications accessible over the web (Google Workspace, GitHub, Slack). Customer manages user access; CSP manages all underlying infrastructure and application maintenance.

Explain the Cloud Shared Responsibility Model across IaaS, PaaS, and Serverless.

Security in the cloud is shared between CSP and customer:

• Security OF the Cloud (Provider): Physical security of global data centers, hardware, cables, power, hypervisors, and core networking.
• Security IN the Cloud (Customer): Customer data encryption, IAM policies, security groups, firewall configurations, OS patching (IaaS), and application code.
• In Serverless (Lambda), the CSP assumes responsibility for OS patching, runtimes, and scaling; customer manages code and IAM execution roles.

What is a Cloud Region vs an Availability Zone (AZ) vs a Local Zone / Edge Location?

• Region: A separate geographic area (e.g., us-east-1, eu-west-1) containing multiple isolated AZs.
• Availability Zone (AZ): One or more discrete data centers with independent power, cooling, and networking, connected to other AZs via low-latency ($< 1\text{ms}$) fiber.
• Edge Location (PoP): Globally distributed edge nodes caching static/dynamic content (CloudFront/Cloudflare) close to end users.
• Local Zone: Cloud infrastructure deployed near large metropolitan areas to run latency-sensitive workloads ($< 10\text{ms}$).

What is a Virtual Private Cloud (VPC) / Virtual Network (VNet)?

A logically isolated virtual network dedicated to your cloud account. It allows provisioning compute resources in a custom virtual network with full control over IP address ranges, subnets, route tables, network gateways, and security settings.

Explain Public Subnet vs Private Subnet.

• Public Subnet: A subnet whose route table has a default route (0.0.0.0/0) pointing directly to an Internet Gateway (IGW). Instances can have public IPs and communicate directly with the internet.
• Private Subnet: A subnet whose route table routes outbound internet traffic through a NAT Gateway (or has no internet route). Instances have only private RFC 1918 IPs and cannot receive unsolicited inbound internet traffic.

What is an Internet Gateway (IGW)?

A horizontally scaled, redundant, highly available VPC component that enables communication between resources in public subnets and the internet without bandwidth bottlenecks.

What is a NAT Gateway vs NAT Instance?

• NAT Gateway: A fully managed AWS service providing up to 100 Gbps bandwidth per gateway with automatic scaling, high availability within an AZ, and zero administrative maintenance.
• NAT Instance: A self-managed EC2 instance running Linux iptables NAT. Requires manual patching, AMI updates, and script-based HA failover.

What is a Security Group vs Network ACL (NACL)?

• Security Group (SG): Stateful virtual firewall operating at the instance/ENI level. Supports Allow rules only; all rules are evaluated simultaneously. Return traffic is automatically allowed.
• Network ACL (NACL): Stateless firewall operating at the subnet level. Supports both Allow and Deny rules; evaluated in strict numerical order. Inbound and outbound rules must be configured separately.

What is VPC Peering and what are its limitations?

A direct point-to-point network connection between two VPCs routing traffic over private cloud backbones.

• Limitation: Non-transitive routing (If VPC A peers with B, and B peers with C, VPC A cannot communicate with C through B). Requires $\frac{N(N-1)}{2}$ peering links for a full mesh.

What is AWS Transit Gateway (TGW)?

A centralized hub-and-spoke cloud router connecting hundreds of VPCs, AWS Direct Connect links, and IPsec VPNs through a single managed gateway, supporting transitive routing and centralized network inspection.

What is AWS PrivateLink (Interface VPC Endpoint)?

Enables private connectivity between VPCs, supported AWS services, and third-party SaaS applications using Elastic Network Interfaces (ENIs) with private IP addresses in your subnet, keeping traffic completely off the public internet.

What is an AWS Gateway VPC Endpoint?

A free route table entry connecting VPC subnets directly to Amazon S3 and Amazon DynamoDB over AWS internal networks without using NAT Gateways or public IPs.

What is Elastic Load Balancing (ALB vs NLB vs GLB)?

• ALB (Application Load Balancer - Layer 7): Routes HTTP/HTTPS/gRPC traffic based on host headers, URL paths, query parameters, and HTTP methods; supports SSL termination and redirect rules.
• NLB (Network Load Balancer - Layer 4): Routes TCP/UDP/TLS traffic; provides ultra-high throughput (millions of requests/sec), single-digit millisecond latency, static IP addresses per AZ, and client source IP preservation.
• GLB (Gateway Load Balancer - Layer 3): Routes raw IP packets through third-party virtual security appliances (firewalls, deep packet inspection, IDS/IPS).

What is Elastic Block Store (EBS) vs Simple Storage Service (S3) vs Elastic File System (EFS)?

• EBS: Block storage volumes formatted with filesystems (ext4, XFS) attached to a single EC2 instance (low latency, high IOPS).
• S3: Scalable object storage (binary payload + key + metadata) accessed via HTTP REST APIs with $99.999999999%$ (11 9's) durability.
• EFS: Fully managed POSIX-compliant Network File System (NFS) mountable concurrently across hundreds of compute instances (ReadWriteMany).

What are EBS Volume Types (gp3, io2 Block Express, st1, sc1)?

• gp3 (General Purpose SSD): Baseline 3,000 IOPS and 125 MB/s throughput; independently provision IOPS and throughput without sizing volume size.
• io2 Block Express (Provisioned IOPS SSD): Sub-millisecond latency, up to 256,000 IOPS and 4,000 MB/s throughput for mission-critical relational databases.
• st1 (Throughput Optimized HDD): Low-cost magnetic storage for high-throughput sequential big data workloads.
• sc1 (Cold HDD): Lowest-cost magnetic storage for infrequently accessed sequential files.

What is AWS EC2 Instance Metadata Service v2 (IMDSv2)?

A secure instance metadata service requiring a session-oriented token retrieved via PUT request with a mandatory X-aws-ec2-metadata-token-ttl-seconds header, completely mitigating Server-Side Request Forgery (SSRF) metadata theft attacks.

What is AWS Auto Scaling and Auto Scaling Groups (ASG)?

A service that automatically monitors compute utilization and dynamically adjusts the number of running EC2 instances to maintain predictable performance at the lowest possible cost.

Explain Auto Scaling Policies (Target Tracking, Step, Scheduled, Predictive).

• Target Tracking: Adjusts capacity to maintain a specific metric value (e.g., average CPU at 65% or ALB request count per target at 1,000).
• Step Scaling: Scales capacity in defined increments based on CloudWatch alarm thresholds.
• Scheduled Scaling: Pre-provisions capacity based on predictable recurring traffic schedules.
• Predictive Scaling: Uses machine learning models to forecast future traffic and scale capacity in advance of spikes.

What is Spot Instance and how does Spot Fleet work?

Unused cloud compute capacity offered at up to 90% discount compared to On-Demand rates. A Spot Fleet manages a mix of Spot and On-Demand instances across diverse instance types and AZs to maintain target capacity while minimizing interruption risk.

What are Savings Plans vs Reserved Instances (RIs)?

• Compute Savings Plans: Flexible discount model (up to 72%) applied automatically across EC2, Lambda, and Fargate regardless of instance family, region, or OS in exchange for a 1- or 3-year hourly spend commitment.
• EC2 Instance Savings Plans / Standard RIs: Higher discount tied to a specific instance family in a specific region.

What is AWS Elastic Container Service (ECS)?

A fully managed container orchestration service developed by AWS that runs Docker containers using AWS-native IAM, VPC, and CloudWatch primitives without Kubernetes complexity.

What is AWS Fargate?

A serverless compute engine for containers (supporting ECS and EKS) where AWS provisions, patches, and manages the underlying EC2 worker instances, allowing customers to pay strictly for requested vCPU and memory.

What is AWS Elastic Kubernetes Service (EKS)?

A certified Kubernetes conformant managed service that automates the provisioning, upgrading, patching, and high availability of the Kubernetes control plane across 3 AZs.

What is AWS Lambda and what is its execution model?

A serverless event-driven compute service that executes code in response to triggers (S3 uploads, API Gateway HTTP calls, SQS messages) inside ephemeral Firecracker microVMs, billed per millisecond of execution.

What is AWS Lambda Cold Start and how is it mitigated?

The initialization latency when Lambda downloads the container image, provisions a microVM, and initializes runtime engines. Mitigated using Provisioned Concurrency (pre-warmed microVMs) or Lambda SnapStart (resuming from microVM memory snapshots).

What is Amazon Aurora?

A cloud-native relational database engine compatible with PostgreSQL and MySQL. It decouples compute from storage, utilizing a distributed shared storage volume replicated 6-way across 3 AZs with quorum writes ($4/6$) and reads ($3/6$).

What is Amazon Aurora Serverless v2?

An on-demand auto-scaling configuration for Aurora that dynamically scales database compute capacity (measured in Aurora Capacity Units - ACUs) up and down in fractions of a second without dropping active connections.

What is Amazon DynamoDB?

A fully managed, serverless NoSQL key-value and document database offering single-digit millisecond latency at any scale with multi-AZ replication, continuous backups, and Global Tables.

What is DynamoDB Single-Table Design?

Modeling all business entities and relationships within a single DynamoDB table using composite partition keys (PK) and sort keys (SK) along with Global Secondary Indexes (GSIs) to fetch complex relational data in a single Query API call.

What is Amazon Route 53 and what are its routing policies?

A highly available, authoritative Cloud DNS service supporting:

• Simple Routing: Standard single-record lookup.
• Weighted Routing: Distributes traffic based on assigned percentage ratios.
• Latency-Based Routing: Directs users to the AWS region providing the lowest network latency.
• Failover Routing: Automated DNS health-check failover to backup disaster recovery regions.
• Geolocation / Geoproximity Routing: Directs users based on client geographic coordinates or country.

What is Amazon CloudFront?

A globally distributed Content Delivery Network (CDN) that securely delivers static/dynamic web content, videos, and APIs to users with low latency and high transfer speeds via edge locations.

What is AWS Global Accelerator?

A Layer 4 networking service providing static Anycast IP addresses that ingests client traffic into the closest edge PoP and routes it over the private AWS global fiber backbone directly to backend ALBs/EC2 instances.

What is AWS Direct Connect (DX)?

A dedicated private physical fiber connection linking an on-premise data center directly to the AWS global network, bypassing the public internet to provide consistent bandwidth and low latency.

What is AWS Site-to-Site VPN?

An encrypted IPsec VPN tunnel connecting an on-premise network gateway (Customer Gateway) to an AWS Virtual Private Gateway (VGW) or Transit Gateway over the public internet.

What is AWS IAM (Identity and Access Management)?

A service that centrally manages access permissions and authentication for users, groups, and compute workloads across AWS services.

What is an IAM Policy and what are its core JSON elements?

A JSON document defining authorization:

• Effect: Allow or Deny.
• Principal: The user, account, or service granted or denied access.
• Action: The specific API operations (e.g., s3:GetObject).
• Resource: The Amazon Resource Name (ARN) targeted.
• Condition: Contextual constraints (e.g., source IP, MFA status).

What is IAM Policy Evaluation Logic?

1. Default: Explicit Deny overrides all.
2. If no explicit Deny, check for an explicit Allow.
3. If no explicit Allow, the final decision is an Implicit Deny.

What is an IAM Role vs IAM User?

• IAM User: An identity with long-term static credentials (passwords, access keys). Modern standard: Avoid IAM users; use corporate SSO.
• IAM Role: An identity with temporary, short-lived security credentials assumed by trusted entities (EC2, Lambda, Pods via IRSA, cross-account administrators).

What is AWS IAM Identity Center (AWS SSO)?

A centralized identity service that connects to corporate identity providers (Okta, Azure AD, Google Workspace) to provide unified single sign-on across multi-account AWS Organizations.

What is an AWS Service Control Policy (SCP)?

An organizational policy defining the maximum available permissions across accounts in an AWS Organization. If an SCP denies an action, even the root user of a member account cannot perform it.

What is AWS CloudTrail?

A governance service that records every single API call made in an AWS account (who called what API, when, from which IP, and with what request parameters) for compliance and auditing.

What is Amazon CloudWatch?

A monitoring and observability service that collects performance metrics, aggregates logs (CloudWatch Logs), and evaluates alarm thresholds (CloudWatch Alarms).

What is AWS Systems Manager (SSM) Session Manager?

A fully managed agent-based service that provides secure, one-click shell access to EC2 instances without opening inbound SSH port 22, without bastion hosts, and without public IPs.

What is AWS Key Management Service (KMS)?

A managed service for creating, controlling, and rotating cryptographic encryption keys (KMS Customer Managed Keys) used across AWS storage and applications.

What is AWS Secrets Manager vs Parameter Store?

• Secrets Manager: Supports automated secret rotation (using Lambda), cross-account access, and KMS encryption.
• Parameter Store (SSM): Hierarchical key-value store for configuration data and encrypted strings; cost-effective for general configs.

What is AWS WAF (Web Application Firewall)?

A Layer 7 firewall operating on CloudFront, ALB, API Gateway, and AppSync to block OWASP Top 10 web vulnerabilities (SQLi, XSS, rate floods).

What is AWS Shield Standard vs Shield Advanced?

• Shield Standard (Free): Automatic protection against Layer 3/4 DDoS attacks (SYN floods, UDP reflection).
• Shield Advanced (Paid): 24/7 access to AWS DDoS Response Team (SRT), financial DDoS cost spike protection, and advanced Layer 7 attack analytics.

What is Amazon GuardDuty?

An intelligent threat detection service that continuously analyzes CloudTrail events, VPC Flow Logs, DNS logs, and EKS audit logs via machine learning to detect compromised instances and unauthorized crypto-mining.

What is AWS Security Hub?

A centralized security posture management service that aggregates findings from GuardDuty, Inspector, Macie, and IAM Access Analyzer against CIS Benchmarks and PCI-DSS compliance standards.

What is Amazon Inspector?

An automated vulnerability scanner that scans EC2 instances, Amazon ECR container images, and Lambda functions for software vulnerabilities and network reachability flaws.

What is Amazon S3 Storage Classes (Standard, Infrequent Access, Glacier, Intelligent-Tiering)?

• Standard: High-throughput, low-latency for frequently accessed data.
• Standard-IA: Lower storage cost, retrieval fee per GB for data accessed less frequently.
• Glacier Flexible / Deep Archive: Lowest cost for archival storage (retrieval times from minutes to hours).
• Intelligent-Tiering: Automatically moves objects between tiers based on access patterns with zero operational overhead and no retrieval fees.

What is Amazon S3 Versioning and MFA Delete?

• Versioning: Keeps multiple historical variants of an object in the same bucket, protecting against accidental overwrites or deletions.
• MFA Delete: Requires physical multi-factor authentication codes to permanently delete an object version.

What is S3 Object Lock and WORM Storage?

Implements Write-Once-Read-Many (WORM) storage, preventing objects from being deleted or overwritten by any user (including the AWS root account) for a fixed retention period.

What is Amazon S3 Cross-Region Replication (CRR)?

Automatically replicates newly uploaded objects across buckets in different AWS regions asynchronously for disaster recovery and low-latency local access.

What is Amazon S3 Event Notifications?

Automatically publishes events (s3:ObjectCreated:*, s3:ObjectRemoved:*) to Amazon SQS, SNS, EventBridge, or Lambda functions when objects are manipulated.

What is Amazon EventBridge?

A serverless event bus that ingests events from AWS services, custom microservices, and SaaS partners (Datadog, PagerDuty), routing them to downstream targets using declarative JSON filtering rules.

What is Amazon SQS (Standard vs FIFO)?

• Standard SQS: Unlimited throughput, at-least-once message delivery (occasional duplicate messages), best-effort ordering.
• FIFO SQS: Strictly first-in-first-out ordering, exactly-once processing (deduplication IDs), limited throughput (3,000 msgs/sec with batching).

What is Amazon SNS (Simple Notification Service)?

A fully managed pub/sub messaging service that coordinates message delivery to thousands of subscriber endpoints (Lambda, SQS, HTTP webhooks, SMS, email).

What is AWS Step Functions?

A visual serverless workflow orchestrator that coordinates distributed microservices, Lambda functions, and human approvals using declarative JSON state machines.

What is AWS CloudFormation vs Terraform?

CloudFormation is AWS's proprietary declarative IaC engine managed natively by AWS; Terraform is an open-source, multi-cloud declarative IaC engine supporting hundreds of providers.

Compare Core Cloud Architecture Concepts across AWS, Azure, and GCP.

Explain the GCP Global VPC Architecture.

In GCP, a VPC is a global resource spanning all worldwide regions. Subnets are regional resources within the global VPC. Instances in different regions communicate over Google's internal global fiber backbone using private RFC 1918 IPs without needing VPNs or VPC peering.

What is Google Kubernetes Engine (GKE) Autopilot?

A mode of operation in GKE where Google manages the entire cluster infrastructure, including node provisioning, auto-scaling, auto-repairing, OS security patching, and node hardening, billing customers strictly for requested Pod resources.

What is Google Cloud Run?

A fully managed serverless compute platform that runs stateless container images directly, automatically scaling from 0 to thousands of instances based on incoming HTTP traffic or Pub/Sub events.

What is Google Cloud Spanner?

A globally distributed, horizontally scalable, relational database service that provides external consistency (ACID) at global scale without violating the CAP theorem, powered by Google's hardware-synchronized TrueTime API (atomic clocks and GPS receivers).

What is Google BigQuery?

A fully managed, serverless, highly scalable cloud data warehouse that enables petabyte-scale SQL queries using columnar storage (Capacitor) and distributed execution (Dremel).

What is GCP Workload Identity Federation?

Enables external workloads (GitHub Actions, on-prem servers, AWS workloads) to authenticate directly to GCP APIs using OIDC tokens without downloading or storing long-lived static service account JSON keys.

What is Azure Resource Manager (ARM) and Bicep?

• ARM: The management layer that processes API requests and provisions resources within Azure Resource Groups.
• Bicep: A domain-specific, declarative language developed by Microsoft that compiles down to ARM templates, providing clean syntax for Azure IaC.

What is Azure Managed Identity (System-Assigned vs User-Assigned)?

An automatically managed identity in Microsoft Entra ID (Azure AD) used by Azure resources (VMs, App Service) to authenticate to other Azure services (Key Vault) without storing credentials in code:

• System-Assigned: Tied to the lifecycle of a single specific resource; deleted automatically when the resource is deleted.
• User-Assigned: Standalone identity lifecycle managed independently and shareable across multiple resources.

What is Azure Virtual WAN?

A managed networking service that aggregates branch office connectivity (VPN/SD-WAN), on-premise data centers (ExpressRoute), and multi-region VNets into a single centralized transit hub.

What is Azure Front Door vs Azure Application Gateway?

• Azure Front Door (Global Layer 7): Global web application accelerator and CDN providing Anycast routing, global load balancing, and SSL offloading at edge PoPs.
• Azure Application Gateway (Regional Layer 7): Regional application load balancer managing traffic within a specific Azure region with built-in WAF.

What is Azure Cosmos DB and its consistency models?

A globally distributed, multi-model NoSQL database offering five well-defined consistency levels: Strong, Bounded Staleness, Session (default), Consistent Prefix, and Eventual.

What is GCP Cloud Pub/Sub?

A globally distributed, asynchronous messaging service providing high-throughput, low-latency pub/sub message streams with automatic horizontal scaling and dead-letter queues.

What is GCP Anthos (Google Distributed Cloud)?

An application management platform that extends Google Cloud services and Kubernetes management to on-premise data centers and multi-cloud environments (AWS/Azure).

What is Multi-Cloud Strategy and what are its trade-offs?

Deploying workloads across multiple cloud providers (AWS + Azure + GCP) to prevent vendor lock-in and optimize best-of-breed services.

• Trade-offs: Extreme complexity, fragmented IAM and security tooling, high cross-cloud egress data transfer costs, and lowest-common-denominator feature sets.

What is AWS Control Tower and Landing Zones?

A service that automates setting up a well-architected multi-account AWS environment with centralized identity (IAM Identity Center), automated guardrails (SCPs), and centralized logging.

What is an AWS Organization Unit (OU)?

A logical grouping of AWS accounts within an AWS Organization used to apply hierarchical Service Control Policies (e.g., Core OU, Workloads OU).

What is Cloud FinOps and what is the FinOps Lifecycle?

Cloud Financial Management framework optimizing cloud spending across three continuous phases: Inform (tagging, cost allocation), Optimize (right-sizing, discount commitments), and Operate (continuous governance).

What is AWS Cost & Usage Report (CUR)?

The most comprehensive dataset of AWS cost and usage data, delivering hourly or daily CSV/Parquet files to an S3 bucket for analysis in Amazon Athena and QuickSight.

What is Infracost in FinOps?

A CLI tool that parses Terraform code in CI/CD pull requests, calculates the exact monthly cloud cost impact of proposed changes, and posts an interactive breakdown comment onto the PR.

What is Kubernetes Right-Sizing in Cloud Optimization?

Tuning container CPU and memory requests and limits to match actual historical resource utilization, eliminating over-provisioned idle cloud waste.

What is Cloud Egress Traffic Cost and how is it minimized?

Charges incurred when data moves outbound from a cloud provider to the public internet or across cloud regions. Minimized using CDNs (CloudFront), VPC Endpoints, and keeping high-volume communication within the same AZ.

What is Cross-AZ Data Transfer Cost?

Cloud providers charge data transfer fees (e.g., $0.01 per GB) for traffic traveling between two different Availability Zones within the same region.

What is AWS Network Firewall?

A stateful, managed network firewall and intrusion detection/prevention system (IDS/IPS) deployed inside VPCs to inspect Layer 3–7 traffic using Suricata-compatible rules.

What is AWS Security Lake?

Automatically centralizes security telemetry data (CloudTrail, VPC Flow Logs, Route 53, GuardDuty) from AWS and third-party sources into an Amazon S3 data lake formatted in the Open Cybersecurity Schema Framework (OCSF).

What is AWS IAM Access Analyzer?

Evaluates resource-based policies (S3 bucket policies, KMS keys, IAM roles) using formal mathematical reasoning to identify resources accessible to external unauthorized accounts.

What is AWS Macie?

A data security and privacy service that uses machine learning and pattern matching to discover, classify, and alert on Sensitive Personal Identifiable Information (PII) stored in S3 buckets.

What is Cloud Security Posture Management (CSPM)?

Continuous automated assessment of cloud infrastructure configurations against compliance standards (CIS, NIST, PCI-DSS) to detect security misconfigurations and compliance drift.

What is Cloud Workload Protection Platform (CWPP)?

Security tools that protect workloads (VMs, containers, serverless) at runtime using behavioral anomaly detection, vulnerability scanning, and intrusion detection.

What is Cloud Infrastructure Entitlement Management (CIEM)?

Managing and enforcing least-privilege identity access across multi-cloud environments, detecting over-privileged service accounts and unused IAM permissions.

What is AWS App Runner?

A fully managed service that makes it easy for developers to deploy containerized web applications and APIs directly from source code or container images without managing VPCs or load balancers.

What is AWS Copilot CLI?

An open-source command-line tool that allows developers to build, release, and operate production-ready containerized applications on AWS ECS and AWS Fargate.

What is AWS SAM (Serverless Application Model)?

An open-source framework and CLI extending CloudFormation with shorthand syntax to define Lambda functions, API Gateways, and DynamoDB tables.

What is Serverless Framework?

An open-source multi-cloud framework that automates deploying serverless applications (AWS Lambda, Azure Functions, Google Cloud Functions) via declarative YAML manifests.

What is AWS CDK (Cloud Development Kit)?

An open-source software development framework to define cloud infrastructure using familiar programming languages (TypeScript, Python, Go, Java) which synthesizes into CloudFormation templates.

What is Pulumi in Cloud Architecture?

An open-source Infrastructure as Code platform that provisions cloud resources (AWS, Azure, GCP, Kubernetes) using general-purpose programming languages with real-time state management.

What is Crossplane Composite Resource Definition (XRD)?

A custom Kubernetes API defined by platform teams that bundles multi-cloud resources (e.g., an S3 bucket + IAM role + RDS instance) into a single developer abstraction.

What is AWS Lattice (VPC Lattice)?

An application-layer networking service that consistently connects, monitors, and secures service-to-service communication across VPCs and compute types (EKS, ECS, Lambda, EC2) without complex routing or proxies.

What is AWS Cloud WAN?

A managed wide area networking (WAN) service that builds, manages, and monitors global networks connecting multiple cloud regions, VPCs, and on-premises data centers via a central policy dashboard.

What is AWS App Mesh?

A managed service mesh based on Envoy Proxy that provides application-level networking, traffic splitting, and end-to-end telemetry across ECS, EKS, and EC2.

Scenario: Architect a Multi-Region Active-Active web application across us-east-1 and eu-west-1 with conflict-free data replication.

1. Global Ingress: AWS Global Accelerator / Route 53 Latency-Based routing directs users to the nearest regional Application Load Balancer.
2. Compute Layer: Amazon EKS clusters deployed in each region running identical containerized microservices managed via ArgoCD.
3. Data Layer: Amazon Aurora Global Database with Write-Forwarding, or DynamoDB Global Tables with multi-region active-active replication and Last-Write-Wins (LWW) conflict resolution.
4. Caching Layer: Amazon ElastiCache (Redis) Global Datastore replicating caches across regions.
5. Static Assets: S3 Cross-Region Replication (CRR) behind CloudFront with multi-origin failover.

Scenario: Your company receives an unexpected $50,000 monthly cloud bill spike caused by CloudWatch Logs and S3 API calls. How do you remediate?

1. Investigation: Query AWS Cost Explorer and Cost & Usage Report (CUR) filtered by Usage Type to identify runaway microservices writing verbose DEBUG logs.
2. Log Remediation: Enforce a 30-day retention policy on all CloudWatch log groups; configure application logging frameworks to switch from DEBUG to INFO/WARN.
3. S3 Remediation: Fix microservice backup scripts executing un-batched ListObjectsV2 loops in tight while-loops.
4. Governance: Set up AWS Budgets with anomaly detection alerts on Slack when spend exceeds forecasted thresholds.

Scenario: Design an automated disaster recovery failover system for PostgreSQL with RPO < 1 minute and RTO < 5 minutes.

1. Database: Deploy Amazon Aurora Global Database across Primary (us-east-1) and DR (us-west-2) regions (storage replication latency $< 1$ second, satisfying RPO $< 1$ min).
2. Monitoring: Route 53 health check probes a synthetic /healthz endpoint verifying database read/write queries.
3. Automated Failover Lambda (Under 2 minutes, satisfying RTO $< 5$ min):
   • Promotes Aurora secondary cluster to standalone Primary (aws rds failover-global-cluster).
   • Updates Route 53 DNS records to point traffic to the DR region.

How do you implement Zero-Trust Cloud Network Segmentation without managing hundreds of firewall appliances?

Deploy AWS Network Firewall centrally in an inspection VPC attached to AWS Transit Gateway, combined with AWS VPC Lattice and Service Mesh (Istio) mTLS to enforce identity-based Layer 7 access controls between microservices.

Compare EKS Managed Node Groups vs Self-Managed Node Groups vs Karpenter Nodes.

• Self-Managed: Manual ASG provisioning, manual AMIs, manual rolling node updates.
• EKS Managed Node Groups: AWS manages ASG provisioning and automated rolling node updates.
• Karpenter: Bypasses ASGs; provisions right-sized nodes directly via EC2 Fleet API in seconds, dynamically packing diverse Spot/On-Demand instance mixes.

How do you securely connect an on-prem data center to AWS VPCs with automatic failover?

1. Primary Link: AWS Direct Connect (DX) with Direct Connect Gateway connected to AWS Transit Gateway.
2. Backup Link: IPsec Site-to-Site VPN connected to the same Transit Gateway.
3. BGP Routing: Direct Connect routes advertised with higher BGP priority (shorter AS-Path). If Direct Connect fails, BGP fails over traffic to the IPsec VPN tunnel within seconds.

What is Google Cloud Spanner and how does it achieve global consistency without violating the CAP theorem?

Cloud Spanner uses the TrueTime API (synchronized atomic clocks and GPS receivers in every Google data center) to bound clock uncertainty ($\epsilon \le 7\text{ms}$). This global clock assigns monotonically increasing commit timestamps without distributed locking overhead, providing strict external consistency (Serializability).

Design an enterprise AWS Multi-Account Organization Structure.

[ Root Management Account ]
  ├── 📂 Core OU
  │     ├── 🔒 Log Archive Account (Centralized S3 CloudTrail / VPC Flow Logs)
  │     └── 🛡️ Security Tooling Account (SecurityHub, GuardDuty, IAM Identity Center)
  ├── 📂 Infrastructure OU
  │     ├── 🌐 Shared Network Account (Transit Gateway, Direct Connect, Inspection VPC)
  │     └── 🛠️ Shared Services Account (Artifact Registry, CI/CD Runners, Vault)
  └── 📂 Workloads OU
        ├── 🧪 Dev / Staging Workload Accounts
        └── 🚀 Production Workload Account

What is Azure Confidential Computing and AWS Nitro Enclaves?

Hardware-isolated trusted execution environments (TEE) with no persistent storage, no interactive access (no SSH), and no external networking, connected only via a virtual socket (vsock) to process sensitive cryptographic keys, PII data, and confidential machine learning models.

Scenario: An engineer accidentally modifies a production security group to open port 22 (0.0.0.0/0) to the entire internet. How do you detect and auto-remediate this in under 30 seconds?

1. Detection: AWS Config rule incoming-ssh-disabled detects non-compliant change via CloudTrail.
2. Trigger: AWS Config publishes compliance state change to Amazon EventBridge.
3. Remediation: EventBridge triggers an AWS SSM Automation Document or Lambda function.
4. Execution: The script calls aws ec2 revoke-security-group-ingress to delete the 0.0.0.0/0 rule and alerts SecOps on Slack within 30 seconds.

What is AWS Graviton and how does it improve Cloud Unit Economics?

Custom 64-bit ARM-based processors designed by AWS (Graviton3, Graviton4) that deliver up to 40% better price-performance and 60% lower energy consumption compared to equivalent x86-64 (Intel/AMD) instances.

What is AWS Nitro System?

A collection of dedicated hardware cards and a lightweight hypervisor that offloads virtually all virtualization and security functions (networking, storage, security monitoring) from the main host CPU, dedicating nearly 100% of host CPU/RAM to customer workloads.

What is AWS EBS Fast Snapshot Restore (FSR)?

Eliminates the latency of I/O operations on blocks when creating EBS volumes from snapshots by pre-warming blocks immediately upon creation.

What is Amazon Aurora Global Database Write-Forwarding?

Allows secondary read-only Aurora database clusters in remote regions to accept SQL write statements directly, automatically forwarding the transaction to the primary writer cluster in the primary region over AWS internal networks.

What is DynamoDB Streams and what is its integration with Lambda?

An ordered, time-sequenced log of item-level modifications (insert, update, delete) in a DynamoDB table. Lambda functions consume streams to trigger asynchronous real-time event-driven processing (e.g., updating search indexes, sending notifications).

What is DynamoDB Global Tables?

A fully managed multi-region, multi-active database that replicates DynamoDB tables across chosen AWS regions with single-digit millisecond latency, resolving write conflicts using Last-Write-Wins (LWW).

What is AWS ElastiCache (Redis vs Memcached)?

• Redis: In-memory data store supporting rich data structures (hashes, sorted sets), persistence, Pub/Sub, replication, and automatic failover.
• Memcached: Simple, multi-threaded in-memory key-value caching system designed for caching pure HTML/database queries.

What is Amazon OpenSearch Service?

A fully managed search and analytics engine derived from open-source Elasticsearch, used for real-time application search, log analytics, and time-series monitoring.

What is AWS DMS (Database Migration Service)?

A managed service that migrates relational databases, data warehouses, and NoSQL databases to AWS with continuous data replication (Change Data Capture - CDC) to ensure zero downtime during cutovers.

What is AWS DataSync?

An online data transfer service that simplifies, automates, and accelerates copying terabytes of data between on-premises storage and AWS S3, EFS, or FSx over Direct Connect or VPN.

What is Amazon FSx for Lustre?

A fully managed, high-performance POSIX filesystem optimized for compute-intensive workloads (machine learning training, high-performance computing, video rendering) with sub-millisecond latencies and hundreds of gigabytes/sec throughput.

What is AWS Backup?

A centralized backup service that automates and manages data protection across AWS services (EBS, RDS, DynamoDB, EFS, S3) using declarative backup plans and automated cross-region replication.

What is AWS Route 53 Resolver DNS Firewall?

A managed firewall that allows filtering and blocking outbound DNS queries from VPC resources to known malicious domains or DNS data exfiltration tunnels.

What is AWS WAF Managed Rule Groups?

Pre-configured security rule sets maintained by AWS and security partners (Core Rule Set, Known Bad Inputs, SQLi, Bot Control) applied in 1 click.

What is AWS IAM Permission Boundary?

An advanced IAM feature using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity, preventing developers from elevating their own privileges.

What is AWS KMS Multi-Region Keys?

Primary KMS keys in one region that can be replicated into other regions with the exact same key material and Key ID, allowing client-side encrypted data to be decrypted in multiple regions without re-encrypting.

What is AWS Secrets Manager Automatic Secret Rotation?

A built-in feature that triggers an AWS Lambda function every $N$ days to generate a new database password, apply it to the database engine, and update the secret value in Secrets Manager without downtime.

What is AWS Resource Access Manager (RAM)?

A service that allows sharing AWS resources (Transit Gateways, Subnets, License Manager rules) securely across multiple AWS accounts within an AWS Organization.

What is AWS VPC Flow Logs and how are they analyzed?

Captures IP traffic information going to and from network interfaces in a VPC. Streamed to CloudWatch Logs or Amazon S3 and analyzed using SQL queries in Amazon Athena.

What is AWS Cost Anomaly Detection?

Uses advanced machine learning to continuously monitor cost and usage telemetry, detecting unusual spend spikes and sending root-cause alert emails or Slack notifications.

What is AWS Compute Optimizer?

A machine learning service that analyzes historical CloudWatch utilization metrics to recommend optimal EC2 instance types, EBS volume configurations, and Lambda memory sizes to reduce costs.

What is Cloud Custodian YAML Policy Structure?

A framework defining resource (e.g., ec2), filters (e.g., tag:Environment: absent), and actions (e.g., stop, notify) to automate cloud compliance and cost governance.

What is AWS Health Dashboard (Personal Health Dashboard)?

Provides personalized alerts and remediation guidance when AWS is experiencing events that may impact your specific infrastructure and resources.

What is AWS X-Ray?

A distributed tracing service that collects telemetry across microservices, generating service graphs and identifying performance bottlenecks.

What is Amazon Managed Grafana (AMG) and Amazon Managed Prometheus (AMP)?

Fully managed, highly available, secure serverless Prometheus time-series storage and Grafana visualization services operating in AWS.

What is AWS Fault Injection Service (FIS)?

A managed chaos engineering service that injects controlled faults (CPU stress, network latency, AZ outages) across AWS workloads to test system resilience.

What is AWS CodeArtifact?

A secure, highly scalable, managed artifact repository service that makes it easy to publish and store software packages (npm, PyPI, Maven, NuGet) inside private VPCs.

What is Amazon Bedrock in Cloud Architecture?

A fully managed service that offers choice of high-performing foundation models (FMs) from leading AI companies via a single API, along with built-in security, privacy, and responsible AI guardrails.

What is AWS Private CA (Certificate Authority)?

A managed private certificate authority service that automates issuing, configuring, and renewing private X.509 TLS certificates for internal microservices and IoT devices.

What is AWS AppConfig?

A capability of AWS Systems Manager that enables teams to deploy application configurations and feature flags to production workloads dynamically with built-in validation and automated rollback alarms.

What is Amazon Athena?

An interactive serverless query service that allows analyzing petabytes of data stored in Amazon S3 using standard SQL queries without managing database infrastructure.

What is AWS Glue and AWS Glue Data Catalog?

A serverless data integration service that automates discovering, preparing, and combining data for analytics. The Data Catalog acts as a centralized metadata repository for table definitions.

What is Amazon Redshift?

A fully managed, petabyte-scale cloud data warehouse service that uses columnar storage and massively parallel processing (MPP) to execute complex analytical queries.

What is AWS Lambda Function URLs?

A dedicated HTTP(S) endpoint for Lambda functions, providing direct web invocation without requiring an API Gateway or Application Load Balancer.

What is AWS Lambda Extensions API?

Enables integrating Lambda functions with external monitoring, observability, and security tools (Datadog, Dynatrace, New Relic) by running companion processes inside the Lambda execution environment.

What is AWS Serverless Express / Mangum?

Adapter packages allowing standard Node.js Express or Python FastAPI/ASGI web applications to execute seamlessly inside AWS Lambda behind API Gateway.

What is AWS SQS Long Polling vs Short Polling?

• Short Polling: Queries a subset of SQS servers and returns immediately, even if the queue is empty (increases empty response costs).
• Long Polling (WaitTimeSeconds: 20): Waits up to 20 seconds for messages to arrive, reducing empty responses and lowering API costs by over 90%.

What is SQS Message Visibility Timeout?

The period during which a message is hidden from other consumers after being fetched by a worker. If the consumer crashes before deleting the message, the message becomes visible again for another consumer to retry.

What is an SQS Dead Letter Queue (DLQ) Redrive Policy?

Directs messages to a DLQ after maxReceiveCount failed processing attempts, allowing engineers to inspect poisoned messages and redrive them back to the source queue after fixing bugs.

What is Amazon SNS Message Filtering?

Allows subscriber queues to declare JSON filter policies so they receive only messages matching specific attribute criteria, eliminating unnecessary Lambda invocations.

What is Amazon EventBridge Schema Registry?

A registry that stores event schemas (OpenAPI, JSONSchema) generated by your applications, generating typed code bindings for Python, Java, and TypeScript.

What is AWS AppSync?

An enterprise-level, fully managed GraphQL and Pub/Sub API service with real-time subscriptions, offline programming support, and built-in caching.

What is AWS Elastic Beanstalk vs AWS App Runner?

• Elastic Beanstalk: Provisions and exposes underlying EC2 instances, ASGs, and Load Balancers (more infrastructure control).
• App Runner: Abstract serverless container deployment directly from source code or container images (zero infrastructure management).

What is AWS Batch?

A fully managed batch computing service that plans, schedules, and executes containerized batch workloads across dynamically provisioned EC2 and Spot instance fleets.

What is AWS CloudFormation StackSets?

Enables provisioning, updating, or deleting CloudFormation stacks across multiple AWS accounts and multiple AWS regions in a single automated operation.

What is AWS CloudFormation Drift Detection?

Identifies when actual cloud infrastructure configurations have been manually modified outside of CloudFormation management templates.

What is AWS CloudFormation Custom Resources?

Allows executing Lambda functions during CloudFormation stack provisioning to execute custom code (populating databases, calling external APIs).

What is Amazon VPC Reachability Analyzer?

A configuration analysis tool that performs formal mathematical verification of network paths between VPC resources without sending real test packets.

What is AWS Network Access Analyzer?

Validates whether network architectures comply with security and regulatory segmentation policies (e.g., verifying database subnets have no path to the internet).

What is AWS Global Accelerator vs Amazon CloudFront?

• CloudFront: Caches HTTP/HTTPS web content and media at edge locations worldwide.
• Global Accelerator: Routes non-HTTP and HTTP TCP/UDP traffic over private fiber backbones directly to backend endpoints without caching.

What is AWS Transfer Family?

A fully managed service for transferring files securely into and out of Amazon S3 or Amazon EFS over SFTP, FTPS, and FTP protocols.

What is Amazon MQ?

A managed message broker service for open-source industry-standard messaging protocols (Apache ActiveMQ and RabbitMQ) for migrating legacy enterprise systems to the cloud.

What is Amazon Kinesis Data Streams vs Amazon SQS?

• SQS: Individual message queue; messages are consumed and deleted; independent worker consumers.
• Kinesis: Ordered, real-time data stream; records are retained for days; multiple independent consumer applications read from shards concurrently.

What is Amazon Kinesis Data Firehose?

A fully managed streaming ETL service that captures, transforms, and automatically loads streaming data into Amazon S3, Redshift, OpenSearch, and Splunk in near-real-time.

What is AWS Glue DataBrew?

A visual data preparation tool that allows data analysts to clean, normalize, and enrich data visually with over 250 pre-built transformations without writing code.

What is AWS Lake Formation?

A service that simplifies building, securing, and managing data lakes on Amazon S3, providing centralized fine-grained column- and row-level access control.

What is Amazon QuickSight?

A cloud-scale, serverless Business Intelligence (BI) service with built-in machine learning insights and interactive dashboards.

What is AWS Directory Service (AWS Managed Microsoft AD)?

A fully managed Microsoft Active Directory service running on real Windows Server domain controllers in AWS.

What is AWS Single Sign-On (IAM Identity Center) SCIM Protocol?

Automatically synchronizes users, groups, and permissions from external identity providers (Okta, Azure AD) into AWS IAM Identity Center via System for Cross-domain Identity Management (SCIM).

What is Amazon Cognito (User Pools vs Identity Pools)?

• User Pools: User directories providing sign-up, sign-in, and MFA authentication for web/mobile applications.
• Identity Pools (Federated Identities): Authorizes users to obtain temporary AWS IAM credentials to access AWS services directly.

What is AWS CloudEndure Disaster Recovery / AWS Elastic Disaster Recovery (DRS)?

Continuously replicates block storage volumes of physical, virtual, or cloud-based servers into AWS at the block level, orchestrating rapid failover in minutes during disasters.

What is AWS Application Migration Service (MGN)?

The primary migration service for lift-and-shift server migrations to AWS, utilizing block-level continuous data replication with minimal downtime.

What is AWS Migration Hub?

A central location to track the progress of application migrations across multiple AWS and partner tools.

What is AWS Well-Architected Framework?

Six architectural pillars for designing reliable, secure, efficient, and cost-effective cloud systems: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

What is AWS Well-Architected Tool?

A service in the AWS Console that provides a consistent process to review workloads against AWS best practices and generates remediation milestone plans.

What is AWS Trusted Advisor?

An automated online tool that provides real-time recommendations to optimize AWS infrastructure across cost, performance, security, fault tolerance, and service quotas.

What is AWS Service Quotas (Limits)?

A central service to view and request quota increases for AWS service limits across accounts and regions.

What is AWS Budgets?

A service allowing organizations to set custom cost and usage limits, triggering automated email and SNS alerts when actual or forecasted spend exceeds thresholds.

What is AWS Cost Categories?

Groups cost and usage information into custom categories (e.g., by business unit, project, or application team) using rule-based mappings over cost allocation tags.

What is Amazon Athena Federated Query?

Allows executing SQL queries across data stored in relational, non-relational, object, and custom data sources (S3, DynamoDB, PostgreSQL, Redis) using Lambda connectors.

What is AWS Clean Rooms?

Helps companies securely collaborate and analyze collective datasets without sharing raw underlying customer records.

What is AWS Audit Manager?

Continuously audits AWS usage to simplify risk assessment and compliance reporting against industry standards (HIPAA, GDPR, PCI-DSS).

What is Amazon CodeWhisperer / Amazon Q Developer?

A generative AI-powered coding assistant that generates code recommendations, writes unit tests, and conducts security vulnerability scans directly in IDEs and CLI.

What is AWS SimSpace Weaver?

A managed service that enables building dynamic, massive-scale spatial simulations (modeling entire cities) across distributed compute instances.

What is AWS Wickr?

An end-to-end encrypted enterprise communications service providing secure messaging, calling, and file sharing.

What is AWS Data Exchange?

A service that makes it easy to find, subscribe to, and use third-party data in the cloud from thousands of commercial data providers.

What is Amazon Kendra?

An intelligent search service powered by machine learning that searches unstructured enterprise documents using natural language queries.

What is Amazon Lex?

A service for building conversational interfaces (chatbots) using natural language understanding and automatic speech recognition (powers Amazon Alexa).

What is Amazon Polly?

A service that turns text into lifelike speech using advanced deep learning technologies.

What is Amazon Rekognition?

A computer vision service that analyzes images and videos to detect objects, faces, text, and inappropriate content.

What is Amazon Transcribe?

An automatic speech recognition service that converts speech audio to text with timestamps and speaker identification.

What is Amazon Comprehend?

A natural language processing (NLP) service that extracts insights, sentiment, and key phrases from unstructured text.

What is Amazon SageMaker?

A fully managed machine learning platform that provides tools to build, train, tune, and deploy machine learning models at scale.

What is Amazon SageMaker JumpStart?

A hub of pre-trained open-source and proprietary foundation models that can be evaluated and deployed in 1 click.

What is AWS Panorama?

An appliance and SDK that brings computer vision to existing on-premises IP cameras to automate inspection at the edge.

What is AWS IoT Core?

A managed cloud platform that lets connected IoT devices securely interact with cloud applications over MQTT, HTTP, and WebSockets.

What is AWS IoT Greengrass?

An open-source edge runtime and cloud service that helps build, deploy, and manage intelligent device software at the edge.

What is AWS Outposts?

A fully managed service that delivers physical AWS infrastructure (servers and racks) directly to on-premises data centers for consistent hybrid cloud operations.

What is AWS Wavelength?

Embeds AWS compute and storage services within 5G telecommunications networks to deliver ultra-low-latency applications to mobile devices.

What is AWS Snowcone / Snowball / Snowmobile?

• Snowcone: Ultra-portable, ruggedized edge computing device (8TB).
• Snowball Edge: Petabyte-scale data migration and edge compute device (80TB).
• Snowmobile: 45-foot ruggedized shipping container truck for migrating up to 100 Petabytes of data to AWS.

Scenario: How do you design a secure, cost-effective VPC architecture for a three-tier web application?

1. Public Subnet: Application Load Balancer and NAT Gateway.
2. Private Application Subnet: Containerized application pods (EKS/ECS) routing outbound traffic through the NAT Gateway.
3. Isolated Database Subnet: Relational database cluster (Aurora) with zero internet routes, accessible only via Security Group ingress from the application tier.
4. VPC Endpoints: S3 Gateway Endpoint to eliminate NAT Gateway data charges for static asset uploads.

Scenario: Your API is experiencing DDoS attack traffic exceeding 500,000 req/sec. How do you mitigate this in AWS?

1. Place Amazon CloudFront with AWS Shield in front of the Application Load Balancer to absorb Layer 3/4 SYN and UDP floods at the global edge.
2. Enable AWS WAF Rate-Based Rules (e.g., block client IPs sending $> 2,000$ requests in 5 minutes).
3. Apply AWS Managed Core Rule Set and Bot Control to block automated scrapers and bad user-agents.
4. Configure origin cloaking so only CloudFront can reach the ALB via custom header verification.

Scenario: How do you migrate an on-premise Oracle database to Amazon Aurora PostgreSQL with minimal downtime?

1. Schema Conversion: Use AWS Schema Conversion Tool (SCT) to convert Oracle PL/SQL stored procedures, triggers, and schemas into PostgreSQL DDL.
2. Initial Load & Replication: Deploy AWS Database Migration Service (DMS) to execute full initial data load and enable ongoing Change Data Capture (CDC).
3. Validation: Verify data integrity between source Oracle and target Aurora.
4. Cutover: Point application connection strings to the Aurora endpoint during a scheduled 2-minute maintenance window and stop CDC replication.

Scenario: How do you implement Cross-Account IAM access securely without static credentials?

1. In Account B (Target): Create an IAM Role with a Trust Policy specifying Principal: { "AWS": "arn:aws:iam::AccountA:root" } and an sts:ExternalId condition to prevent the Confused Deputy problem.
2. In Account A (Source): Grant the calling IAM User/Role permission to execute sts:AssumeRole on the target ARN.
3. Workload in Account A calls STS AssumeRole to receive temporary, 1-hour credentials for Account B.

Scenario: EC2 instances in a private subnet cannot download software updates from GitHub. How do you troubleshoot?

1. Check Route Table: Verify the private subnet route table has 0.0.0.0/0 pointing to an active NAT Gateway.
2. Check NAT Gateway Subnet: Ensure the NAT Gateway resides in a Public Subnet whose route table points to an Internet Gateway.
3. Check Security Groups: Verify the EC2 instance Security Group allows outbound TCP traffic on port 443 (HTTPS).
4. Check Network ACLs: Ensure subnet NACLs allow outbound ephemeral ports (1024-65535) and inbound response traffic.

Scenario: An S3 bucket with public access disabled was accessed from an external unauthorized IP. How do you investigate?

1. Query AWS CloudTrail logs in Amazon Athena: filter by eventSource: "s3.amazonaws.com" and the bucket name.
2. Identify the eventName (GetObject), sourceIPAddress, and the userIdentity that made the call.
3. Check if an IAM Role had overly permissive Trust Policies or if temporary STS credentials were leaked.
4. Revoke the compromised IAM session immediately (aws iam put-role-policy with an explicit deny).

Scenario: What causes high latency in Amazon DynamoDB and how is it fixed?

1. Hot Partitioning: High read/write activity concentrating on a single partition key. Fix: Add randomized hash suffixes (salting) to distribute writes.
2. Throttling: Requests exceed provisioned Read/Write Capacity Units (RCUs/WCUs). Fix: Switch to On-Demand capacity mode or enable auto-scaling.
3. Inefficient Scan Operations: Application executes full table scans instead of indexed Query operations. Fix: Create Global Secondary Indexes (GSIs).

Scenario: How do you achieve 99.999% SLA for static website hosting?

Host static assets in Amazon S3 behind Amazon CloudFront with CloudFront Origin Groups:

• Primary Origin: S3 Bucket in Region 1 (us-east-1).
• Secondary Origin: S3 Bucket in Region 2 (eu-west-1) synchronized via Cross-Region Replication (CRR).
• CloudFront automatically fails over to the secondary origin on HTTP 500/502/503/504 errors in under 1 second.

Scenario: How do you ensure compliance for HIPAA / PCI-DSS data storage in AWS?

1. Encryption at Rest: Enforce KMS Customer Managed Keys with mandatory key rotation across S3, EBS, and RDS.
2. Encryption in Transit: Enforce TLS 1.3 on all ALBs and API Gateways.
3. Audit Trails: Enable multi-region CloudTrail with log file validation writing to an isolated, WORM-protected Log Archive account.
4. Automated Governance: Deploy AWS Config rules and Security Hub compliance packs to continuously alert on unencrypted resources.

Scenario: How do you automate the retirement of unused cloud resources across 100 AWS accounts?

Deploy Cloud Custodian centrally using an EventBridge rule that triggers cross-account IAM roles:

• Scans for unattached EBS volumes older than 14 days and unattached Elastic IPs.
• Identifies untagged EC2 instances, sends Slack warnings to owners, and stops instances after 72 hours of inactivity.

What is AWS Network Access Control List (NACL) Ephemeral Ports?

When a client in a private subnet connects to the internet, the return traffic comes back on an ephemeral port (1024-65535). NACLs must explicitly allow inbound traffic on ephemeral ports because NACLs are stateless.

What is AWS Direct Connect Public VIF vs Private VIF vs Transit VIF?

• Public VIF: Accesses public AWS services (S3, DynamoDB) over Direct Connect without public internet routing.
• Private VIF: Connects directly to a specific VPC via a Virtual Private Gateway.
• Transit VIF: Connects to an AWS Transit Gateway to reach hundreds of VPCs over a single 100 Gbps connection.

What is AWS Local Zones vs AWS Wavelength?

• Local Zones: AWS infrastructure deployed in metropolitan areas for latency-sensitive enterprise apps (video processing, real-time analytics).
• Wavelength: AWS compute/storage deployed directly inside 5G telecom data centers for ultra-low-latency mobile apps.

What is AWS Snowball Edge Compute Optimized?

A ruggedized data device providing 104 vCPUs, 416GB RAM, and an optional GPU to execute ML inference and data analytics in disconnected edge environments (ships, oil rigs).

What is AWS PrivateLink for Amazon S3?

Interface VPC Endpoints for S3 that assign private IPs from your subnet to S3, allowing on-premises data centers to access S3 over Direct Connect without public IPs.

What is AWS IAM Session Policies?

Advanced policies passed when programmatically assuming an IAM role (sts:AssumeRole) to further restrict the permissions granted by the role's identity-based policy for that specific session.

What is AWS KMS Envelope Encryption DEK Lifecycle?

1. Call KMS GenerateDataKey $\rightarrow$ returns plaintext DEK and encrypted DEK.
2. Encrypt bulk data in application memory with plaintext DEK.
3. Erase plaintext DEK from memory; store encrypted DEK alongside ciphertext.
4. To decrypt: Call KMS Decrypt on encrypted DEK $\rightarrow$ get plaintext DEK $\rightarrow$ decrypt data in memory.

What is AWS Secrets Manager Rotation Lambda Architecture?

A multi-step Lambda workflow executed during rotation: createSecret $\rightarrow$ setSecret (updates database password) $\rightarrow$ testSecret (verifies new login) $\rightarrow$ finishSecret (marks new version as AWSCURRENT).

What is Amazon EBS Elastic Volumes?

A feature allowing dynamic modification of volume size, IOPS, and volume type on running EC2 instances with zero downtime and zero detachment.

What is Amazon RDS Multi-AZ vs Multi-Region Deployments?

• Multi-AZ: Synchronous standby replica in a separate AZ within the same region for automated high availability and $< 60$s failover.
• Multi-Region: Asynchronous replication to an independent database in a different geographic region for disaster recovery and local read performance.

What is Amazon RDS Read Replica Lag?

The asynchronous replication delay between the primary database and read replicas, measured via CloudWatch metric ReplicaLag.

What is Amazon ElastiCache Cluster Mode Enabled vs Disabled?

• Cluster Mode Disabled: Single shard with 1 primary writer and up to 5 read replicas (limited to 1 node write throughput).
• Cluster Mode Enabled: Data partitioned across up to 500 shards using consistent hashing, providing horizontal write and read scaling.

What is Amazon DynamoDB Time to Live (TTL)?

A feature that automatically marks items for deletion after a designated timestamp attribute expires, purging expired records within 48 hours at zero capacity unit cost.

What is Amazon DynamoDB Transactions?

Provides ACID transaction guarantees across multiple items within one or more tables (TransactWriteItems, TransactGetItems) in a single coordinated operation.

What is Amazon S3 Batch Operations?

A managed feature that executes large-scale batch operations (replacing tags, modifying ACLs, copying objects, invoking Lambdas) across billions of S3 objects.

What is Amazon S3 Storage Lens?

An analytics feature that provides organization-wide visibility into object storage usage, cost optimization opportunities, and security protection posture.

What is Amazon CloudFront Field-Level Encryption?

Encrypts sensitive user input fields (credit card numbers) in web forms at the edge location using public key cryptography before forwarding the request to backend origins.

What is Amazon CloudFront Functions vs Lambda@Edge?

• CloudFront Functions: Lightweight JavaScript functions executing in sub-millisecond runtimes at 450+ edge locations (URL rewrites, header manipulations, token validation).
• Lambda@Edge: Full Node.js/Python runtimes executing complex network calls and database queries at regional edge caches.

What is AWS Route 53 Traffic Flow?

A visual routing policy editor that manages complex routing topologies combining geolocation, latency, and failover routing rules.

What is AWS Route 53 DNSSEC?

Adds cryptographic digital signatures to DNS records in public hosted zones to protect applications from DNS spoofing and cache poisoning attacks.

What is AWS API Gateway REST API vs HTTP API?

• HTTP API: Modern, lightweight API Gateway optimized for serverless workloads with lower latency and up to 70% cost reduction.
• REST API: Legacy API Gateway supporting API keys, usage plans, request validation, and WAF integration.

What is AWS API Gateway WebSocket API?

Maintains persistent bidirectional stateful connections between client browsers and backend Lambda/SQS services for real-time applications (chat, live notifications).

What is AWS Lambda Dead Letter Queue (DLQ)?

Directs asynchronous event payloads to an SQS queue or SNS topic after 2 failed Lambda execution retries to prevent data loss.

What is AWS Lambda Layers?

Reusable ZIP archives containing custom runtimes, shared libraries, or dependencies mounted into the /opt directory of Lambda execution environments.

What is AWS Lambda Container Images?

Packaging and deploying Lambda functions as OCI container images up to 10GB in size, enabling large dependencies and custom runtimes.

What is AWS AppConfig Feature Flags?

Enables deploying dynamic configuration settings and boolean/multivariate feature flags with automated validation and alarm-based rollbacks.

What is AWS Systems Manager Patch Manager?

Automates scanning and applying OS security patches across large fleets of Linux and Windows instances according to custom patch baselines.

What is AWS Systems Manager State Manager?

A secure configuration management service that automates maintaining target OS software configurations and agent states.

What is AWS CloudFormation Stack Policy?

A JSON document that prevents accidental updates or deletions of critical cloud resources (RDS databases) during CloudFormation stack updates.

What is AWS CloudFormation Modules?

Packages resource configurations into reusable building blocks that can be shared across teams to enforce organizational infrastructure standards.

What is AWS IAM Roles Anywhere?

Enables workloads running outside AWS (on-premise servers, Kubernetes pods in other clouds) to use X.509 digital certificates to obtain temporary AWS IAM credentials via STS.

What is AWS VPC Traffic Mirroring?

Clones raw network traffic from Elastic Network Interfaces (ENIs) and streams it out-of-band to security appliances for deep packet inspection and intrusion detection.

What is AWS Verified Access?

Provides secure, zero-trust VPN-less access to internal corporate web applications using identity and device security signals.

What is Amazon GuardDuty EKS Protection?

Analyzes Kubernetes control plane audit logs and runtime container behavior to detect compromised pods, privilege escalations, and cryptocurrency mining in EKS.

What is Amazon Detective?

Automatically collects security data from VPC Flow Logs, CloudTrail, and GuardDuty, using machine learning to visualize interactive graph models for root-cause incident investigations.

What is AWS KMS Asymmetric Keys?

KMS keys representing RSA or ECC public/private key pairs used for signing, signature verification, and asymmetric encryption outside AWS.

What is AWS SQS Deduplication ID?

A unique token used by SQS FIFO queues to identify and discard duplicate messages sent within a 5-minute deduplication interval.

What is AWS EventBridge Pipes?

A point-to-point integration service that connects event producers (DynamoDB Streams, SQS, Kinesis) to targets with optional filtering and enrichment steps without writing glue code.

What is AWS FinOps Cost Allocation Tags?

User-defined metadata tags (Environment, Owner, CostCenter, Project) activated in the Billing console to organize and track cloud expenditures by business unit.

What is AWS Well-Architected Sustainability Pillar?

Designing cloud architectures to minimize environmental impact by maximizing hardware utilization, adopting ARM Graviton processors, and eliminating idle compute waste.