AWS_Practical_Interview_601 800

AWS Practical Interview Questions (601-800)

AWS Real-World Scenarios

Q601: How do you migrate on-premises application to AWS?

What it is: AWS migration applies the 7 Rs per application, then networking, compute, data migration and cutover in a planned sequence.

Why it is used: To move an on-premises estate to AWS with controlled risk instead of a big-bang lift-and-shift.

Assess and plan (6 Rs: Rehost, Replatform, Repurchase, Refactor, Retain, Retire)
Create VPC and networking
Set up EC2 instances or containers
Migrate database (using DMS)
Migrate application code
Test and validate
Cutover and go live

Interview talking point: “Rehost is the majority of real migrations; the hard part is data migration and testing, not servers. Order matters: network first, then compute, then data with DMS and CDC, then cutover. Dependency discovery and a rehearsed rollback are the two most underestimated risks.”

Q602: How do you set up disaster recovery in AWS?

What it is: Disaster recovery trades four patterns against two numbers: RTO, how fast you must recover, and RPO, acceptable data loss.

Why it is used: To survive a region or site failure within stated recovery objectives rather than hoping backups exist.

RTO/RPO based approach:

Backup & Restore (RTO hours, RPO days): Use S3 cross-region replication
Pilot Light: Minimal version of core services running
Warm Standby: Scaled-down version in DR region
Multi-Region Active-Active: Full deployment in multiple regions

Interview talking point: “Backup and restore, pilot light, warm standby and active-active, in rising cost and falling RTO and RPO. Choose by what downtime costs the business, then rehearse, because an untested DR plan is only a hypothesis. S3 CRR, Aurora Global Database and DynamoDB global tables beat compute-only options on RPO.”

Q603: How do you implement high availability for web application?

What it is: A highly available web app layers Route 53 health checks, a multi-AZ ALB, an Auto Scaling group, stateless nodes, Multi-AZ RDS and a cache.

Why it is used: To survive an instance failure, an availability zone failure and a bad deploy without downtime.

# Architecture:
# 1. Route 53 with health checks
# 2. Multi-AZ deployment
# 3. ALB across AZs
# 4. Auto Scaling Group
# 5. EFS for shared files
# 6. RDS Multi-AZ
# 7. ElastiCache for sessions

Interview talking point: “The ALB must span at least two AZs, and the ASG health check should match what the ALB checks. RDS Multi-AZ gives a standby writer, not scale. Session state belongs in ElastiCache or DynamoDB, never on local disk, or the ASG cannot replace instances.”

Q604: How do you design for scalability?

What it is: Scalability design removes fixed constraints: stateless horizontal compute behind a load balancer, layered caching, queue-based async work and a read-scalable database.

Why it is used: To grow by adding instances rather than buying a bigger one, so cost grows with load.

Use auto-scaling for compute
Implement caching (CloudFront, ElastiCache)
Use managed services
Design stateless applications
Implement database sharding if needed
Use SQS for async processing
Enable read replicas for database scaling

Interview talking point: “Statelessness is the precondition, because a stateful instance cannot be replaced cheaply. Cache at each layer since a hit beats a compute cycle, and decouple with SQS so slow downstreams do not reach users. Writes stay serialised by one writer, which is why sharding is a last resort.”

Q605: How do you secure a 3-tier web application?

What it is: Securing a three-tier app means each tier’s security group references the tier in front, with tiers in public and private subnets.

Why it is used: To block lateral movement, so compromising the public tier never exposes the database.

Security Groups:

ALB: Allow 443 from internet
App Servers: Allow 443 from ALB only
DB: Allow 3306 from App SG only

Additional:

WAF on ALB
CloudTrail for auditing
KMS for encryption
IAM for access control
VPC with public/private subnets

Interview talking point: “The ALB security group allows 443 from anywhere, the app security group allows its port from the ALB security group ID rather than a CIDR, and the database allows 3306 from the app security group. Any CIDR in place of a security group reference breaks the model, so name the port explicitly.”

AWS Migration Scenarios

Q606: How do you migrate Oracle to Aurora?

What it is: Oracle to Aurora migration uses Schema Conversion Tool for schema assessment, then a DMS full load plus CDC until cutover.

Why it is used: To move Oracle onto a managed MySQL-compatible engine with near-zero downtime.

Use Schema Conversion Tool (SCT)
Create DMS replication instance
Set up source and target endpoints
Start full load + CDC
Validate data
Cutover

Interview talking point: “SCT reports what converts automatically, what needs a rule you write, and what is manual; that manual count is your risk estimate. DMS moves the data and CDC makes cutover safe. Oracle packages and PL/SQL will not run on Aurora MySQL, so the application is the real work.”

Q607: How do you migrate from on-prem file server to S3?

What it is: Moving a file server to S3 means picking a transfer mechanism by volume, then replacing file shares with bucket access patterns.

Why it is used: To stop running a file server and gain durability, versioning and lifecycle management instead.

Use AWS Transfer Family (SFTP) or
Use DataSync for online transfer
Use Snowball for offline transfer
Set up lifecycle policies
Configure access

Interview talking point: “DataSync for ongoing online sync of SMB or NFS shares, Transfer Family when consumers need SFTP semantics, Snowball above roughly 10 TB. The forgotten work is consumer migration: an SMB share is a filesystem while S3 is an API, so every mounted client needs changing.”

Q608: How do you migrate VM to EC2?

What it is: VM Import/Export converts a single VM image to an AMI, while Application Migration Service replicates and cuts over whole fleets.

Why it is used: To migrate existing virtual machines to EC2 without reinstalling everything.

Use VM Import/Export
Or use Application Migration Service (aws mgn)
Or rebuild the server as an AMI and recreate it with IaC
Convert to AMI
Launch in AWS

Interview talking point: “aws vmimport create-import-task —source-uri takes a VHD or VMDK from S3 and produces an AMI, and you must hold OS licence migration rights. For dozens of VMs use aws mgn, because SMS was folded into MGN and Migration Hub is the wrong tool here.”

Q609: How do you migrate container workload to EKS?

What it is: Containerising for EKS means building an image, pushing it to ECR, creating the cluster, then deploying with kubectl or Helm.

Why it is used: To get reproducible deployments and access to the Kubernetes ecosystem tooling.

Containerize application (Docker)
Push images to ECR
Create EKS cluster
Deploy with kubectl or Helm
Set up Fargate or node groups
Configure monitoring

Interview talking point: “Fargate removes instance management but costs more per hour and has no GPU, daemon or privileged workloads; node groups are cheaper but you own patching. Never deploy with the latest tag, since a redeploy becomes a no-op, so tag immutably. EKS add-ons version separately from the cluster.”

Q610: How do you migrate monolithic to microservices?

What it is: Decomposing a monolith identifies bounded contexts and extracts them one at a time behind a strangler fig facade.

Why it is used: To modernise incrementally so each extraction is independently shippable and reversible.

Identify bounded contexts
Extract service one at a time
Use strangler fig pattern
Implement API Gateway
Set up service mesh
Configure distributed tracing

Interview talking point: “Put an ALB, API Gateway or proxy in front, route one capability to the new service, leave the rest on the monolith. Data is the hard part, since two copies create a consistency problem, and cross-service transactions force sagas or eventual consistency. Extract for a scaling or ownership boundary, not for style.”

AWS Troubleshooting Scenarios

Q611: EC2 instance not reachable - troubleshooting steps?

What it is: An unreachable EC2 instance is diagnosed by walking the network path in order: status checks, security groups, NACLs, routes, gateway.

Why it is used: Because unreachable is almost always one link in a chain, found fastest by checking in order.

Check Security Groups
Check NACLs
Check Route Tables
Check Internet Gateway
Check NAT Gateway (for private subnet)
Check instance status
Check CloudWatch logs
Check Systems Manager Session Manager

Interview talking point: “Start with describe-instance-status, then an ingress rule referencing your source, then NACLs, which are stateless so the return path needs an outbound rule, then the route table’s 0.0.0.0/0. Skip SSH debugging and use SSM Session Manager, which needs no inbound rules and confirms the agent is running.”

Q612: RDS connection issues - troubleshooting?

What it is: An RDS connection failure is diagnosed by separating instance state, network reachability, subnet group placement and authentication.

Why it is used: Because cannot connect covers a security group, wrong endpoint, wrong password and a failed over instance.

Check Security Groups
Verify Subnet group has correct subnets
Check IAM permissions (for IAM auth)
Verify endpoint is correct
Check VPC endpoints
Test from EC2 in same VPC

Interview talking point: “Check the instance is available, then the security group allowing 5432 or 3306 from the client security group, then a subnet group spanning two AZs, since a single-AZ group blocks failover. IAM auth failure shows as AccessDenied on rds-db:connect. Prove reachability with nc -zv from a same-VPC instance.”

Q613: S3 bucket not accessible - troubleshooting?

What it is: S3 access failures come from four independent layers: the identity policy, bucket policy, ownership controls and Block Public Access.

Why it is used: Because S3 evaluates several independent controls and any single one can deny a request.

Check bucket policy
Check ACLs
Check public access settings
Verify region
Check IAM user permissions
Check bucket ownership

Interview talking point: “A wrong region returns PermanentRedirect, not AccessDenied, and that is the most common misdiagnosis. Get s3:GetObject on the object ARN versus s3:ListBucket on the bucket ARN, since mixing them denies a call that looks correct. Public read needs both Block Public Access off and a bucket policy allowing GetObject.”

Q614: Lambda function timing out - how to fix?

What it is: A Lambda timeout means finding whether the function does too much work or spends time in init or an untimed network call.

Why it is used: To lower tail latency and stop the function being killed mid-operation.

Increase timeout (max 15 minutes)
Check for cold start
Optimize function code
Use provisioned concurrency
Check VPC configuration
Review CloudWatch logs

Interview talking point: “—timeout caps at 900 seconds, but the real diagnosis is splitting init from handler time using the REPORT line. More memory often finishes faster because CPU scales with memory, and the classic bug is an SDK client call with no timeout whose defaults exceed the Lambda timeout.”

Q615: High latency in CloudFront - how to optimize?

What it is: High CloudFront latency is split into cache misses at the edge, origin response time and the network path to the viewer.

Why it is used: Because CDN latency is nearly always uncached content, a slow origin, or a bad cache policy.

Enable compression
Use signed URLs
Implement caching policies
Use edge functions for dynamic content
Check origin performance
Enable HTTP/2

Interview talking point: “Read the X-Cache header first; a high miss ratio with a short TTL is configuration, not performance, often from Cache-Control no-cache or a zero TTL. A high hit ratio with slow responses means the origin is the bottleneck. Using edge functions for dynamic content is backwards; they add latency to every request.”

AWS Performance Optimization

Q616: How do you optimize EC2 performance?

What it is: EC2 optimisation matches instance type and storage to the workload’s actual CPU, memory, network and I/O profile.

Why it is used: To remove the real bottleneck rather than buying an instance faster at the wrong thing.

Choose right instance type
Use EBSgp3 or io2
Enable Enhanced Networking
Use placement groups for low latency
Optimize OS-level settings
Enable CloudWatch monitoring

Interview talking point: “Check vCPU, the memory-to-vCPU ratio, network performance and EBS bandwidth, since gp3 gives 125 MiB/s baseline. Enhanced Networking is on by default on Nitro, cluster placement groups cut latency between instances and spread spreads across AZs. Measure with CloudWatch CPU credit metrics on T-family instances, not the family name.”

Q617: How do you optimize RDS performance?

What it is: RDS optimisation starts with Performance Insights to identify the actual query, then right-sizes instance, storage and caching around it.

Why it is used: To fix the real bottleneck rather than paying for IOPS you do not need.

Use Provisioned IOPS
Right-size instance
Enable Performance Insights
Use read replicas for read-heavy workloads
Optimize queries
Enable caching (ElastiCache)
Proper indexing

Interview talking point: “Performance Insights first, with its 7-day free retention, then fix queries and indexes, add read replicas for read-heavy load, cache hot lookups with ElastiCache, and right-size. Provisioned IOPS comes last; the original lists it first, which is backwards, because it is expensive and rarely the first fix.”

Q618: How do you optimize DynamoDB performance?

What it is: DynamoDB performance is almost entirely access-pattern design: partition key distribution and whether queries use the key or an index.

Why it is used: To get single-digit millisecond latency at scale, which is a schema problem before a capacity problem.

Choose right billing mode (on-demand/provisioned)
Design efficient partition keys
Use GSIs for query patterns
Implement DAX for read caching
Use TTL for time-based data
Enable auto-scaling

Interview talking point: “Every query needs an equality condition on the partition key or it becomes a scan and a cost problem. Each GSI is a separate item collection with its own capacity, so you pay twice. A single hot key caps throughput regardless of added capacity, so shard the key with a suffix.”

Q619: How do you optimize S3 performance?

What it is: S3 is fast by default, so optimisation is about matching access patterns and knowing which settings are real levers.

Why it is used: To know which S3 settings actually matter and avoid paying for ones that do not.

Use multipart upload for large objects
Enable transfer acceleration
Use CloudFront caching
Implement lifecycle policies
Use appropriate encryption
Enable byte-range fetches

Interview talking point: “Real levers: multipart upload above 100 MB, Transfer Acceleration for distant clients, and CloudFront in front. Byte-range fetches is not a setting to enable; S3 supports range requests natively. Lifecycle rules are cost control, not performance. The omitted lever is prefix design, since a single hot prefix is where throughput limits bite.”

Q620: How do you optimize Lambda performance?

What it is: Lambda performance is dominated by package size driving init time, memory and CPU allocation, and network round-trips per invocation.

Why it is used: To cut both latency and cost, since Lambda bills duration multiplied by memory.

Minimize function package size
Use layers for shared code
Avoid cold starts (provisioned concurrency)
Use appropriate memory allocation
Enable X-Ray tracing
Use VPC endpoints

Interview talking point: “Because you pay memory times duration, the cheapest point is where that product is minimised, so measure at 128, 512, 1024 and 1536 MB. Batch work instead of many small calls, and remember VPC attachment slows init, which argues for VPC endpoints rather than skipping the VPC.”

AWS Cost Optimization Scenarios

Q621: How do you reduce EC2 costs?

What it is: EC2 cost reduction right-sizes first, then picks Reserved Instances or Savings Plans for baseline and Spot for interruptible work.

Why it is used: To spend materially less without changing what the application does.

Use Reserved Instances for steady-state
Use Spot Instances for fault-tolerant workloads
Right-size instances
Use Auto Scaling
Enable scheduled scaling
Use S3 Instance Store for temp data

Interview talking point: “Order by impact: right-size from Compute Optimizer, then Savings Plans across families and regions, then Spot with its two-minute interruption warning, then scheduled scaling. One correction: there is no S3 instance store. Instance store is host-local NVMe on EC2, the cheapest fast scratch option, while S3 is network-attached object storage.”

Q622: How do you reduce RDS costs?

What it is: RDS cost reduction combines right-sizing, purchase models, stopping non-production instances and matching engine configuration to load variability.

Why it is used: To cut database spend without sacrificing the agreed RTO and RPO.

Use Reserved Instances
Right-size during non-peak
Stop Dev/Test instances at night
Use Aurora Serverless for variable workloads
Enable auto-pause for Aurora Serverless

Interview talking point: “A stopped RDS instance still bills for storage, and multi-AZ doubles instance cost, so reserve one AZ and run dev single-AZ. Auto-pause exists only in Aurora Serverless v1; v2 uses a MinCapacity floor as low as 0.5 ACU. Dropping unneeded read replicas is the most-missed saving.”

Q623: How do you reduce S3 costs?

What it is: S3 cost reduction picks storage classes by access pattern, adds lifecycle rules to age data, and avoids unneeded requests.

Why it is used: Because S3 bills storage, requests and data transfer, and the last is where surprises live.

Use lifecycle policies
Move to Glacier for archives
Use Intelligent-Tiering
Enable correct storage class
Use S3 Inventory to identify optimization opportunities

Interview talking point: “Intelligent-Tiering is the safe default for unpredictable access. Traps: IA classes have a 128 KB minimum object size, there is a 30-day minimum charge per object, and noncurrent version expiry needs its own rule on a versioned bucket. S3 Inventory is the tool that tells you what to transition.”

Q624: How do you reduce Lambda costs?

What it is: Lambda cost is duration times memory times invocations, so the levers are fewer invocations, shorter runs and lower memory.

Why it is used: Because raising memory can cut total cost if it reduces duration more.

Optimize function execution time
Right-size memory
Use provisioned concurrency wisely
Clean up old versions
Use arm64 architecture

Interview talking point: “Since you pay memory times duration, raising memory can lower total cost, so measure rather than assume. Batch from SQS rather than one item at a time, delete old versions, and use arm64 for up to 20 percent cheaper GB-seconds. Layers and provisioned concurrency both add cost instead of saving it.”

Q625: How do you reduce data transfer costs?

What it is: Data transfer charges appear on internet egress, cross-AZ traffic, cross-Region traffic and NAT gateway processing, each with a different fix.

Why it is used: Because distributed applications often carry this as their largest and most invisible cost line.

Use VPC endpoints
Use Direct Connect
Enable S3 Transfer Acceleration
Use CloudFront for downloads
Minimize cross-region transfers

Interview talking point: “VPC endpoints eliminate NAT per-GB charges, CloudFront removes S3 download egress, and same-AZ placement removes cross-AZ fees at the cost of needing Multi-AZ anyway. Direct Connect does not remove transfer charges; it only changes the path. NAT gateways bill both per GB processed and per hour.”

AWS Security Scenarios

Q626: How do you secure API Gateway?

What it is: Securing API Gateway layers IAM, Cognito or Lambda authorizers for authentication, plus WAF, throttling and CloudWatch access logging.

Why it is used: So the public entry point to your backend is authenticated, rate-limited and auditable.

Use IAM permissions
Use Cognito for auth
Use custom authorizers (Lambda)
Enable WAF
Use throttling
Enable CloudWatch logging

Interview talking point: “IAM auth verifies SigV4 and needs no Cognito, making the API unreachable without AWS credentials; Cognito user pools suit end users; Lambda authorizers handle bespoke logic. A WAF web ACL protects the edge while API Gateway throttling protects the account, and access logging answers who called what.”

Q627: How do you implement data encryption at rest?

What it is: Encryption at rest means the service encrypts storage before writing, using an AWS-managed key by default or a customer-managed KMS key.

Why it is used: To satisfy compliance and make a lost or stolen disk unreadable.

S3: Enable default encryption, use KMS keys RDS: Enable encryption at creation, use KMS EBS: Enable encryption, use KMS Lambda: Use KMS for environment variables

Interview talking point: “RDS, EBS, DynamoDB and Aurora require encryption at creation and cannot be encrypted in place, so snapshot and restore into an encrypted one. S3 can be set any time but only new objects inherit it. Lambda does not encrypt environment variables by default, so prefer Secrets Manager over hand-rolled KMS.”

Q628: How do you implement data encryption in transit?

What it is: Encryption in transit is TLS on every connection, mostly achieved by making each AWS service’s TLS option mandatory.

Why it is used: To stop credentials and data being readable on the network, including on shared infrastructure.

Use TLS/SSL for all connections
Use HTTPS for APIs
Enable SSL on load balancers
Use certificate manager
Force SSL on RDS

Interview talking point: “RDS uses require_ssl or rds.force_ssl=1, ElastiCache uses transit-encryption-enabled, and CloudFront should use redirect-to-https. AWS internal traffic between services is already TLS, so these questions are about your clients and on-premises legs. Use ACM so certificates auto-rotate; an expired self-managed certificate is a real outage.”

Q629: How do you set up MFA for AWS?

What it is: MFA adds a second authentication factor at the identity provider, with awkward cases around programmatic access and the root account.

Why it is used: Because a stolen password alone should not reach an account, and credentials leak more often than accounts are hacked.

Enable MFA on root account (virtual or hardware)
Enable MFA for IAM users
Use MFA for S3 access
Enable MFA for console login

Interview talking point: “Enforce console MFA with an IAM policy condition on aws:MultiFactorAuthPresent. Programmatic access is handled with short-lived credentials from an assumed role instead of long-lived keys. SMS is weaker than a TOTP app or hardware key, and no IAM policy can enforce MFA on root; that is an account setting.”

Q630: How do you audit AWS resources?

What it is: Auditing AWS is three layers: CloudTrail for API event history, Config for resource state over time, and detection services on top.

Why it is used: To answer who changed this, what this is, and is anything wrong.

Enable CloudTrail
Enable AWS Config
Use GuardDuty
Set up Security Hub
Use Config rules
Regular access reviews

Interview talking point: “CloudTrail is event history, Config is state history and the only way to answer what a resource looked like on date X, and GuardDuty and Security Hub detect on top. Management events log by default while data events are opt-in and cost extra, and logs belong in a separate account admins cannot alter.”

AWS Architecture Patterns

Q631: How do you implement microservices architecture?

What it is: Microservices on AWS compose independently deployed services with their own data behind API Gateway, discovering each other and tracing calls.

Why it is used: So teams deploy independently and each component scales on its own demand profile.

Components:

API Gateway (API Gateway or App Mesh)
Service discovery (Route53, ECS Service Discovery)
Inter-service communication (SQS, EventBridge)
Distributed tracing (X-Ray)
Service mesh (App Mesh)
Container orchestration (ECS/EKS)

Interview talking point: “Use API Gateway at the edge, Cloud Map or native DNS for discovery, and prefer SQS or EventBridge since async removes runtime coupling. X-Ray or OpenTelemetry traces calls, and a service mesh adds mutual TLS. You have replaced function calls with network calls that can fail, so consumers need idempotency and sagas.”

Q632: How do you implement event-driven architecture?

What it is: Event-driven architecture separates producers from consumers with an event bus between them, so no component knows who consumes its events.

Why it is used: To add consumers without touching the producer and to absorb bursts of traffic.

Components:

Event source: S3, DynamoDB, etc.
Event router: EventBridge, SNS, SQS
Event consumers: Lambda, ECS
Event store: DynamoDB, Kinesis

Interview talking point: “At-least-once delivery means consumers must be idempotent. Events are facts, not commands, so name them OrderPlaced rather than SendEmail. EventBridge does not guarantee ordering per key, so order-dependent work needs SQS FIFO or a version field, and a schema registry is required to evolve events safely.”

Q633: How do you implement CQRS pattern?

What it is: CQRS separates the write model, commands validated against an authoritative store, from denormalised read models built for querying.

Why it is used: So heavy aggregate validation never slows the read path serving dashboards and lists.

Components:

Command side: API Gateway → Lambda → DynamoDB
Query side: API Gateway → Lambda → ElastiCache → DynamoDB
Sync: DynamoDB Streams → Lambda → ElastiCache

Interview talking point: “On AWS writes go API Gateway to Lambda to DynamoDB, and DynamoDB Streams project changes into ElastiCache or a denormalised table. The read model is eventually consistent, so a write-then-read may be stale; return 202 with a pending status if that matters. CQRS only pays off when read and write shapes genuinely diverge.”

Q634: How do you implement saga pattern?

What it is: A saga breaks a distributed transaction into local transactions with compensating actions, orchestrated centrally or choreographed between participants.

Why it is used: So a multi-service operation can complete or be undone where no ACID transaction exists.

Orchestration approach:

def order_process():
    # Step 1: Create order
    order = create_order()
    # Step 2: Reserve inventory
    try:
        reserve_inventory(order)
    except Exception:
        cancel_order(order)
        raise
    # Step 3: Process payment
    try:
        process_payment(order)
    except Exception:
        release_inventory(order)
        cancel_order(order)
        raise

Interview talking point: “Every failure path needs an explicit compensating action, which can itself fail. Name the states the naive version misses: pending, compensating and compensate_failed, the last needing manual intervention and a dead-letter path. Choose orchestration with Step Functions for visibility and retries, or choreography with events, which is harder to debug.”

Q635: How do you implement circuit breaker pattern?

What it is: A circuit breaker stops calling a failing dependency after a failure threshold, fails fast during cooldown, then probes to test recovery.

Why it is used: To stop a slow dependency exhausting your thread pool and request budget.

import boto3

class CircuitBreaker:
    def __init__(self, failure_threshold=5):
        self.failure_threshold = failure_threshold
        self.failures = 0
        self.state = "CLOSED"

    def call(self, func):
        if self.state == "OPEN":
            raise Exception("Circuit breaker OPEN")
        try:
            result = func()
            self.failures = 0
            return result
        except Exception as e:
            self.failures += 1
            if self.failures >= self.failure_threshold:
                self.state = "OPEN"
            raise

Interview talking point: “The sample misses HALF_OPEN, the probe state that stops a broken dependency being hammered forever. In Lambda every invocation is a fresh process, so an in-memory breaker resets on each cold start; keep state in DynamoDB or ElastiCache and pair it with backoff, jitter, timeouts and a bulkhead.”

AWS DevOps Scenarios

Q636: How do you set up CI/CD pipeline?

What it is: CI/CD on AWS uses CodePipeline to orchestrate CodeBuild for build and test, a git source, and CodeDeploy for deployment.

Why it is used: So a commit produces a tested, deployable artifact with an auditable history.

Components:

Source: CodeCommit/GitHub
Build: CodeBuild
Test: CodeBuild with test commands
Deploy: CodeDeploy to EC2/ECS/Lambda
Pipeline: CodePipeline

Interview talking point: “Separate build from deploy: CodeBuild produces one immutable artifact that every stage promotes, so you never rebuild between staging and production. ECS deployments use a YAML AppSpec.yaml as AppSpecContent rather than inline JSON, and EC2 groups select instances by tag. Manual approval stages are what separate deploy from release.”

Q637: How do you implement infrastructure testing?

What it is: Infrastructure testing validates templates before deploy, lints them, tests in disposable environments, and asserts the deployed state matches policy.

Why it is used: To catch a broken template in CI within seconds instead of mid-deployment.

Validate the template (aws cloudformation validate-template)
Use cfn-lint
Use taskcat for CloudFormation testing
Use AWS Config rules
Use custom Lambda tests

Interview talking point: “aws cloudformation validate-template is only a syntax and shape check and catches almost nothing; cfn-lint is the real local gate, and taskcat deploys to temporary regions for a real test. The highest-value layer is assertion after deploy with Config rules, the only one that catches a correct template producing an insecure resource.”

Q638: How do you implement blue-green deployment?

What it is: Blue-green runs two identical environments and switches traffic between them atomically, versus canary which ramps a small percentage first.

Why it is used: For one-step, instant rollback releases with no partial visibility.

For EC2:

Create ASG with new version
Deploy to new ASG
Test new environment
Switch ALB to new ASG
Keep old environment for rollback

For ECS:

Create new task definition
Update service with new task
Use ALB weighted routing
Test and confirm
Remove old tasks

Interview talking point: “Blue-green is a switch while canary is a ramp. The manual EC2 steps are not automated blue-green; CodeDeploy with CodeDeployDefault.BlueGreen terminates the old ASG for you, and ECS needs deploymentController CODE_DEPLOY with two weighted target groups so the shift is CodeDeploy’s. Budget roughly double compute during the switch.”

Q639: How do you implement canary deployment?

What it is: A CodeDeploy canary shifts traffic to the new version in increments with a bake time and automatic rollback on alarm.

Why it is used: To limit a release’s blast radius to a small fraction of traffic before committing.

# Using CodeDeploy
aws deploy create-deployment \
  --application-name my-app \
  --deployment-group-name my-group \
  --deployment-config-name CodeDeployDefault.Canary10Percent5Minutes \
  --revision '{"revisionType":"AppSpecContent","appSpecContent":"{\"version\":1,\"Resources\":[{\"target\":{\"ref\":\"arn:aws:ec2:us-east-1:123456789012:instance/i-123\"}}]}\"}'

Interview talking point: “The CLI prefix is deploy, so aws deploy create-deployment, not codedeploy. CodeDeployDefault.AllAtOnce is not a canary since it ships 100 percent immediately; use CodeDeployDefault.Canary10Percent5Minutes or your own TrafficRoutingConfig. ECS revisions use YAML AppSpec.yaml with the service ARN, and without a CloudWatch alarm rollback it is just a slow rollout.”

Q640: How do you implement feature flags?

What it is: A feature flag is a runtime switch read by the application, decoupled from deployment so behaviour changes without a code release.

Why it is used: To separate deployment from release, enable gradual rollout and instant kill switches.

Use AWS AppConfig
Create configuration
Integrate SDK in application
Toggle features without deployment

Interview talking point: “AWS AppConfig is the native answer, with environments, profiles and deployment strategies carrying bake times and alarm-driven rollback, so flag rollouts get canary-grade safety. CloudWatch Evidently adds A/B experiments with statistical analysis. Flags are technical debt with an expiry date: every flag needs an owner and a removal date.”

AWS Monitoring Scenarios

Q641: How do you set up comprehensive monitoring?

What it is: Comprehensive monitoring layers metrics, logs, traces, audit events, configuration state and threat detection into one diagnosable signal set.

Why it is used: So an incident is diagnosed from signals rather than guessed at, cutting MTTD and MTTR.

CloudWatch Metrics + Alarms
CloudWatch Logs + Insights
X-Ray for tracing
CloudTrail for audit
Config for compliance
GuardDuty for threats

Interview talking point: “Metrics tell you something is wrong, logs why, traces where, CloudTrail who. Alarm on symptoms, latency, error rate and saturation, rather than on CPU, and route every alarm to SNS and on-call. Security Hub is the aggregate view, and CloudWatch cross-account observability rolls up a multi-account estate.”

Q642: How do you create custom metrics?

What it is: put_metric_data publishes a custom CloudWatch metric with a namespace, name, dimensions and value for charting and alarming.

Why it is used: To measure your own domain numbers instead of only AWS resource metrics.

import boto3

cloudwatch = boto3.client('cloudwatch')

def send_custom_metric():
    cloudwatch.put_metric_data(
        Namespace='MyApp',
        MetricData=[{
            'MetricName': 'RequestLatency',
            'Value': 125,
            'Unit': 'Milliseconds',
            'Dimensions': [{'Name': 'Service', 'Value': 'API'}]
        }]
    )

Interview talking point: “Dimensions are part of metric identity, so Service=API and Service=Web are different metrics, which gives per-service dashboards and can silently create thousands of metrics and a bill. A call takes up to 1000 entries and returns PartialFailures people never check. HIGH_RESOLUTION costs more and is needed for sub-minute alerting.”

Q643: How do you set up log aggregation?

What it is: Log aggregation installs the CloudWatch agent on instances to ship logs, then adds metric filters and subscription filters on top.

Why it is used: To get logs off the box, searchable, and able to drive metrics and alerts.

Use CloudWatch Logs agent on EC2
Use unified CloudWatch agent
Create log groups
Set up metric filters
Create alarms on patterns

Interview talking point: “The unified amazon-cloudwatch-agent supersedes the separate log-streaming and ECS agents and is configured in TOML. Metric filters turn log patterns into alarmable metrics while subscription filters forward to Lambda or Kinesis. Set retention_in_days on every log group, and use Logs Insights rather than manual search for anything non-trivial.”

Q644: How do you implement distributed tracing?

What it is: Distributed tracing attaches a trace ID to a request and propagates it across services, including into downstream AWS calls.

Why it is used: To find the slow service in a request crossing a dozen components, which logs cannot show.

Enable X-Ray on Lambda
Use X-Ray SDK in code
Instrument HTTP calls
Use sampling rules
Analyze traces in console

Interview talking point: “The header is X-Amzn-Trace-Id, and any HTTP call that drops it breaks the trace, the usual reason X-Ray shows only half a path. X-Ray traces Lambda and downstream AWS calls without patching. Control cost with sampling: errors and slow requests at 100 percent, successful fast ones at a low rate.”

Q645: How do you set up alerting?

What it is: Alerting on AWS uses CloudWatch alarms whose actions target an SNS topic, routed to on-call, escalation and ChatOps.

Why it is used: To get a human or automated action at a threshold rather than a user complaint.

Create CloudWatch alarms
Use SNS for notifications
Create escalation path
Use ChatOps (Slack integration)
Set up incident response

Interview talking point: “Composite alarms fold many fine-grained alarms into one page and can suppress others, which fights alert fatigue. SNS does not escalate on its own, so chain a delayed alarm or use an incident tool. Watch treatMissingData: the default missing state goes to INSUFFICIENT_DATA and stays silent, wrong for a metric that should always report.”

AWS Networking Scenarios

Q646: How do you connect multiple VPCs?

What it is: Connecting VPCs means choosing peering for 1:1, Transit Gateway for hub-and-spoke, PrivateLink for services, or VPN and Direct Connect for hybrid.

Why it is used: So the connectivity option matches the topology: peer, hub, or private service access.

VPC Peering: Simple, no transitive routing
Transit Gateway: Scalable, supports multiple VPCs
PrivateLink: For service-to-service
VPN: For hybrid cloud

Interview talking point: “Peering has no transitive routing, so A-B and B-C gives no A-C, and needs routes on both sides. Transit Gateway scales with transitive routing but bills per attachment and per GB, needing route tables to avoid a flat network. PrivateLink exposes a service rather than VPC-to-VPC networking, and peering has no built-in encryption.”

Q647: How do you implement private API?

What it is: A private API is reachable only from inside a VPC, via an interface endpoint or by keeping the whole stack internal.

Why it is used: For an internal API that must not be reachable from the public internet at all.

Create VPC endpoint for API Gateway
Configure security groups
Use resource policies
Access via VPC endpoint DNS

Interview talking point: “Note a mechanism correction: API Gateway REST APIs do not support a PrivateLink interface endpoint; only HTTP APIs and ALB do, via create-vpc-endpoint —vpc-endpoint-type Interface with service com.amazonaws.region.execute-api. For REST use private API mode with an AWS::ApiGateway::VpcEndpoint and a resource policy on aws:sourceVpce, or simply keep everything in private subnets.”

Q648: How do you set up hybrid DNS?

What it is: Route 53 Resolver bridges on-premises and VPC DNS through inbound endpoints for on-prem queries and outbound endpoints forwarding to on-prem resolvers.

Why it is used: So hybrid DNS resolves internal names in both directions.

Create Route 53 Resolver
Set up inbound endpoints
Set up outbound rules
Conditional forwarding to on-prem DNS

Interview talking point: “Rules are matched by domain suffix with forwarding priority, and anything unmatched falls through to VPC plus two, so add a catch-all for on-prem domains. The endpoints are ENIs needing subnets in two AZs and their own security groups. Most hybrid DNS outages are stale TTL caches, not configuration errors.”

Q649: How do you implement microsegmentation?

What it is: Microsegmentation restricts which workloads may talk to which, so one compromised host cannot move laterally across the environment.

Why it is used: To enforce least-privilege networking between components rather than whole tiers.

Use Security Groups for instance-level
Use NACLs for subnet-level
Use AWS Network Firewall
Use PrivateLink for service access
Implement zero-trust model

Interview talking point: “Security groups give per-ENI granularity and can reference another security group instead of a CIDR, which is the real mechanism. NACLs sit at the subnet boundary and are stateless, so allow the return direction explicitly. Define segmentation by tier or workload class rather than per host, and pair it with IAM for zero trust.”

Q650: How do you set up Direct Connect?

What it is: Direct Connect is a dedicated private circuit from a colocation facility to an AWS location, made usable by a virtual interface.

Why it is used: For predictable, high-bandwidth, low-latency connectivity to AWS that never traverses the internet.

Request connection
Install router
Create VIF (Virtual Interface)
Configure BGP
Attach to VPG

Interview talking point: “It is procurement plus configuration: AWS issues an LOA-CFA you deliver to the colo. create-virtual-interface takes type transit for a TGW or private for a VGW, then BGP with your ASN, required at 1 Gbps+. The original’s VPG does not exist; it is a virtual private gateway or Transit Gateway, and Direct Connect does not remove transfer charges.”

AWS Database Scenarios

Q651: When to use DynamoDB vs RDS?

What it is: Choice between an access-pattern-optimised key-value store and a general-purpose relational engine for your data.

Why it is used: To pick the right database instead of forcing relational workloads onto DynamoDB.

Use DynamoDB when:

Need single-digit millisecond latency
Massive scale needed
JSON-like semi-structured data
Pay-per-request model

Use RDS when:

Complex queries (JOINs, aggregations)
ACID compliance needed
Mature ecosystem (ORMs)
Relational data model

Interview talking point: “If access patterns reduce to get-item-by-key or query-one-attribute, DynamoDB gives single-digit millisecond latency at any scale. For ad-hoc queries, JOINs or multi-row transactions use RDS or Aurora. RDS scales via bigger instances and read replicas; DynamoDB scales by partitioning.”

Q652: When to use ElastiCache?

What it is: In-memory Redis/Valkey or Memcached layer sitting between your application and database, serving reads at memory speed.

Why it is used: To cut database load on hot paths and hold ephemeral shared state like sessions.

Session data
Query caching
Real-time analytics
Leaderboard/ranking
Rate limiting

Interview talking point: “Name leaderboards with sorted sets, rate limiting with atomic INCR plus EXPIRE, and session storage, which is what makes apps horizontally scalable. Choose MemoryDB instead when durability and multi-AZ failover must be the default; that boundary is a common mistake.”

Q653: When to use Aurora?

What it is: AWS managed MySQL/PostgreSQL engine with distributed storage separate from instances, plus Serverless and Global Database options.

Why it is used: For enterprise relational workloads wanting better availability and storage than RDS while keeping SQL compatibility.

Enterprise workloads
MySQL/PostgreSQL compatibility
Need auto-scaling storage
High availability required
Serverless option needed

Interview talking point: “Aurora storage is a six-copy quorum across three AZs, and instance failover takes seconds versus minutes on RDS, though restores stay slow on both. Global Database, Serverless v2, Limitless, Data API and IAM Auth extend it, but a minimum capacity floor makes tiny workloads cheaper on RDS.”

Q654: When to use DocumentDB?

What it is: Managed MongoDB-compatible document database with distributed storage scaling to six replicas across three AZs.

Why it is used: For MongoDB migrations and document workloads at roughly a tenth of RDS storage cost.

MongoDB compatibility needed
JSON document storage
Flexible schema
MongoDB migration

Interview talking point: “It is wire-compatible but not feature-complete: no unique sparse indexes, no retryable writes, no cross-cluster sharding, and read-after-write only on the primary by default. Scale-up only, one writer, max six instances. Pick it to stop managing MongoDB, and name which features you give up.”

Q655: When to use Neptune?

What it is: Managed graph database supporting Gremlin, openCypher and SPARQL on the same data, with separate endpoints.

Why it is used: For relationships as first-class data, where a relational model needs many joins to answer.

Graph data
Knowledge graphs
Social networks
Fraud detection
Recommendation engines

Interview talking point: “Choose Neptune when relationships are the data: two-hop recommendations, fraud rings, knowledge graphs, friends-of-friends. There are no indexes to design, but there is a partitionKey, instances are db.* graph classes priced per NCU, and Neptune Analytics or Neptune ML cover analytics and inference.”

AWS Serverless Scenarios

Q656: When to use Lambda vs ECS/EKS?

What it is: Decision between short-lived event functions and long-running containers, based on duration, resources and management appetite.

Why it is used: So managed simplicity is paid only where it applies and containers stay where genuinely needed.

Use Lambda when:

Event-driven workloads
Short-lived (<15 min)
Infrequent requests
Variable traffic patterns

Use ECS/EKS when:

Long-running containers
Persistent workloads
Complex orchestration
Kubernetes needed

Interview talking point: “Lambda wins for sub-15-minute event-driven work priced per millisecond, Fargate for long-running processes needing a real filesystem, ECS on EC2 for cheapest sustained utilisation, and EKS only when Kubernetes itself is the requirement. Most systems use both, and at sustained load Lambda pricing loses to Fargate.”

Q657: How to handle Lambda cold starts?

What it is: Time to create a Lambda execution environment and initialise your code, seen as latency on first invocation.

Why it is used: To keep user-facing latency predictable when traffic is spiky rather than steady.

Use provisioned concurrency
Reduce function package size
Use arm64 architecture
Avoid VPC if possible
Use async invocation

Interview talking point: “Biggest levers: shrink the package, use arm64, avoid VPC attachment since ENI setup adds hundreds of milliseconds, and reserve provisioned concurrency for functions a user waits on because it bills continuously; SnapStart covers Java. Cold starts usually do not matter because init amortises across warm invocations.”

Q658: How to implement Lambda in VPC?

What it is: Attaching Lambda to a VPC gives it ENIs in your subnets but removes its default internet route.

Why it is used: So the function can reach private resources like RDS or an internal load balancer.

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16

# Create Lambda in VPC
aws lambda create-function \
  --function-name my-function \
  --runtime python3.12 \
  --handler index.handler \
  --role arn:aws:iam::123456789012:role/lambda-vpc-execution-role \
  --code S3Bucket=my-bucket,S3Key=function.zip \
  --vpc-config '{
    "SubnetIds": ["subnet-123"],
    "SecurityGroupIds": ["sg-123"]
  }'

Interview talking point: “The execution role needs AWSLambdaVPCAccessExecutionRole or log delivery fails, and once attached the function loses internet access, so AWS API calls hang until timeout without a VPC interface endpoint. That is the classic sudden-timeout case. Use private subnets plus endpoints, never NAT, whose per-GB charges often exceed Lambda itself.”

Q659: How to use Lambda with S3 events?

What it is: S3 invokes Lambda asynchronously on object events, delivering a JSON envelope with bucket and key fields.

Why it is used: To process files as they land instead of polling, with retries and a dead-letter queue.

import boto3

s3 = boto3.client('s3')

def lambda_handler(event, context):
    for record in event['Records']:
        bucket = record['s3']['bucket']['name']
        key = record['s3']['object']['key']
        print(f"New file: {bucket}/{key}")

Interview talking point: “The object key is URL-encoded, so unquote_plus it or you process a file that does not exist. Delivery is at-least-once, so handlers must be idempotent, and one invocation can carry many records. S3 only ever invokes asynchronously; use S3 Object Lambda to transform bytes on read.”

Q660: How to use Lambda with DynamoDB streams?

What it is: Streams capture item-level changes, and an event source mapping delivers ordered per-shard INSERT, MODIFY and REMOVE records.

Why it is used: To react to data changes for search indexing, cache invalidation, replication or audit trails.

import json

def lambda_handler(event, context):
    for record in event['Records']:
        if record['eventName'] == 'INSERT':
            new_image = record['dynamodb']['NewImage']
            print(f"New item: {json.dumps(new_image)}")

Interview talking point: “Enable streams with StreamViewType NEW_AND_OLD_IMAGES, since NEW_IMAGE alone cannot support change detection; Keys are always present but Images depend on the view. Retention is only 24 hours and ordering holds per partition key only. For search indexing, DynamoDB Pipes usually beat a Lambda in the path.”

AWS Container Scenarios

Q661: When to use ECS vs EKS?

What it is: ECS is AWS proprietary orchestrator with fewer objects and cheaper Fargate; EKS is managed Kubernetes with its ecosystem.

Why it is used: To choose the orchestrator your team can actually operate, not merely the more capable one.

Use ECS when:

Simple container orchestration
AWS-native workloads
Cost-effective for simple needs
Fargate for serverless

Use EKS when:

Kubernetes requirement
Multi-cloud strategy
Complex orchestration
Need K8s ecosystem

Interview talking point: “ECS argues lower operational overhead and AWS-supported simplicity, but has no admission controller or policy engine, a real gap in regulated environments. EKS argues ecosystem, portability and existing Kubernetes skills. Fargate exists on both, so node management is no longer the deciding factor; the ecosystem is.”

Q662: How to implement secrets in containers?

What it is: ECS task definition secrets inject a Secrets Manager or SSM value as an environment variable at task start.

Why it is used: To get credentials into containers without hardcoding them or exposing them in task definition JSON.

# ECS task definition fragment (container definition in a task definition)
{
  "secrets": [
    {
      "name": "DB_PASSWORD",
      "valueFrom": "arn:aws:secretsmanager:region:account:secret:db-password"
    }
  ]
}

Interview talking point: “Environment values are visible to anyone with ecs:DescribeTaskDefinition, while secrets stores only the reference ARN. Limitation: environment variables only, so secret files need the Secrets Manager ECS init plugin writing to /run/secrets, which also supports rotation without restarting the task.”

Q663: How to implement auto-scaling in ECS?

What it is: Registers the ECS service as an Application Auto Scaling target with a target-tracking or step policy on desired count.

Why it is used: To keep task count matched to load so you do not size for peak and pay.

# Enable auto scaling
aws application-autoscaling register-scalable-target \
  --service-namespace ecs \
  --resource-id service/my-cluster/my-service \
  --scalable-dimension ecs:service:DesiredCount \
  --min-capacity 2 \
  --max-capacity 20

# Create scaling policy
aws application-autoscaling put-scaling-policy \
  --policy-name my-scaling-policy \
  --service-namespace ecs \
  --resource-id service/my-cluster/my-service \
  --scalable-dimension ecs:service:DesiredCount \
  --policy-type StepScaling \
  --step-scaling-policy-configuration '{
    "AdjustmentType": "ExactCapacity",
    "Cooldown": 60,
    "StepAdjustments": [
      {"MetricIntervalUpperBound": 0,  "ScalingAdjustment": -2},
      {"MetricIntervalUpperBound": 70, "ScalingAdjustment": 2}
    ]
  }'

# Preferred alternative: target tracking - state the target, let AWS size it.
# aws application-autoscaling put-scaling-policy \
#   --policy-name cpu-tracking \
#   --service-namespace ecs \
#   --resource-id service/my-cluster/my-service \
#   --scalable-dimension ecs:service:DesiredCount \
#   --policy-type TargetTrackingScaling \
#   --target-tracking-scaling-policy-configuration '{
#     "TargetValue": 50.0,
#     "PredefinedMetricSpecification": {
#       "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
#     }
#   }'

Interview talking point: “Step scaling requires —policy-type StepScaling, and later StepAdjustments need a MetricIntervalLowerBound; the shown config is effectively a single step. Target tracking is almost always better: state a target and AWS sizes capacity. Remember desiredCount is a floor, so scaling never drops below it.”

Q664: How to implement health checks in containers?

What it is: A command the runtime runs periodically inside the container, where the exit code decides healthy versus unhealthy.

Why it is used: So a task that is running but broken gets replaced instead of receiving traffic.

# ECS health check
{
  "healthCheck": {
    "command": ["CMD-SHELL", "curl -f http://localhost/ || exit 1"],
    "interval": 30,
    "timeout": 5,
    "retries": 3,
    "startPeriod": 60
  }
}

Interview talking point: “ECS ignores HEALTHCHECK in your Dockerfile; health checks belong in the task definition container definition. The check runs inside the container, so curl may be missing, and Fargate runs commands without a shell unless you use CMD-SHELL. startPeriod stops slow starters being killed in a loop.”

Q665: How to mount EFS in ECS?

What it is: Declares an EFS volume in the task definition with efsVolumeConfiguration, referenced by a container mountPoints entry.

Why it is used: So multiple tasks and containers share one filesystem, enabling horizontally scaled shared content.

{
  "volumes": [{
    "name": "efs-volume",
    "efsVolumeConfiguration": {
      "fileSystemId": "fs-123",
      "transitEncryption": "ENABLED"
    }
  }],
  "mountPoints": [{
    "sourceVolume": "efs-volume",
    "containerPath": "/data"
  }]
}

Interview talking point: “transitEncryption ENABLED requires a security group on the EFS mount target reachable from the task security group, and accessPointId requires a configured POSIX user, which is how you get per-container UIDs. On Fargate the task needs at least 30 GB ephemeral storage. Shared EFS makes apps stateful and harder to scale.”

AWS Data Pipeline Scenarios

Q666: How to implement ETL pipeline?

What it is: A managed job reading from a source, transforming it with your own code and writing to a target.

Why it is used: For repeatable scheduled data transformation without running your own cluster or job runner.

Option 1: Glue
- Create crawler for source
- Create ETL job
- Transform data
- Load to target
Option 2: Lambda + S3
- S3 trigger → Lambda
- Lambda processes data
- Save to target
Option 3: Kinesis + Firehose
- Stream data via Kinesis
- Firehose delivers to S3
- Athena for querying

Interview talking point: “Glue suits large volumes with a crawler, job script and Data Catalog so Athena can query output; Lambda on S3 events wins for small per-file transforms but not large joins; Kinesis plus Firehose streams into partitioned Parquet. The real work is schema management, because a pipeline that silently changes shape is worse than one that fails.”

Q667: How to implement CDC (Change Data Capture)?

What it is: Streaming changes from a source so a downstream system applies them continuously, using DMS, Streams or Kinesis.

Why it is used: To keep two systems in sync, enabling zero-downtime migration and search or cache updates.

Use DMS for database CDC
Use DynamoDB Streams
Use RDS event notifications
Use Kinesis for real-time
Process and apply changes

Interview talking point: “Use DMS CDC for relational sources, DynamoDB Streams with its 24-hour retention, or Kinesis for high-volume feeds. Two design rules dominate: apply changes idempotently with version or LSN tracking so out-of-order delivery is harmless, and handle schema evolution, since a strict consumer breaks on a deploy.”

Q668: How to implement data lake?

What it is: S3 as storage in open formats, with a catalog for schemas, governance for permissions and a query engine.

Why it is used: To store data cheaply and query it with many engines without rewriting into a warehouse.

Create S3 bucket
Set up Lake Formation
Create Glue database/crawlers
Define schema
Enable Athena queries
Use QuickSight for visualization

Interview talking point: “S3 with Parquet and partitioning on filtered columns, Glue Data Catalog populated by crawlers, Lake Formation for per-table and per-column permissions, Athena for querying. File size matters: target 128 MB to 1 GB. Without Lake Formation every consumer needs raw bucket access, so you cannot answer who sees this customer data.”

Q669: How to implement real-time analytics?

What it is: A streaming pipeline of an ingest stream, processing layer, low-latency store and visualisation layer.

Why it is used: To answer questions about the last few minutes rather than the last few months.

Kinesis Data Streams
Kinesis Data Analytics (SQL/Flink)
Kinesis Data Firehose → OpenSearch
OpenSearch/Kibana for visualization

Interview talking point: “The canonical stack is Kinesis Data Streams, Kinesis Data Analytics with SQL or Flink, Firehose into S3, and OpenSearch dashboards. The decisions to name are windowing, event-time processing with watermarks for late data, and state size limits on high-cardinality keys. Keep a batch layer for backfills.”

Q670: How to implement batch processing?

What it is: Running bursty compute-heavy jobs on managed compute that scales to zero between runs.

Why it is used: For genomics, rendering, simulation and ETL where an idle cluster would dominate cost.

AWS Batch for compute-intensive
Glue for ETL
Step Functions / MWAA (Airflow) for orchestration
Step Functions for workflow

Interview talking point: “AWS Batch handles compute on Fargate or EC2 Spot with per-second billing, Glue handles Spark ETL, Step Functions orchestrates workflows and MWAA brings Airflow. Correction: AWS Data Pipeline reached end of support on 7 November 2024, so never name it; use Step Functions, MWAA or EventBridge Scheduler.”

AWS Backup and Recovery

Q671: How to implement backup strategy?

What it is: Matching recovery objectives to mechanisms per service: automated backups, replication, snapshots and AWS Backup centrally.

Why it is used: To have a recoverable copy of every stateful resource on a schedule with a stated RPO.

RDS: Automated backups, point-in-time recovery
S3: Cross-region replication, versioning
EBS: snapshots
EFS: AWS Backup integration
DynamoDB: Point-in-time recovery
Use AWS Backup for centralized management

Interview talking point: “RDS automated backups give 0 to 35 days of point-in-time recovery while manual snapshots persist indefinitely; S3 uses versioning plus cross-region replication; EBS snapshots are incremental chains off the volume parent; DynamoDB PITR spans 35 days. Manage it all with AWS Backup, because the top failure is an untested backup.”

Q672: How to test backup and restore?

What it is: Deliberately restoring into a scratch environment on a schedule, timing the restore and checking data integrity.

Why it is used: Because a backup you have never restored is an assumption, not a control.

Schedule regular restore tests
Document restore procedures
Test RTO/RPO
Verify data integrity
Document findings

Interview talking point: “Restore monthly into a separate account, time it, verify with row counts and checksums, then compare measured RTO to the stated one, which is usually worse once DNS and dependencies count. Document the runbook with commands and roles. Backup reporting showing COMPLETED means the job ran, not that data is restorable.”

Q673: How to implement point-in-time recovery?

What it is: Restores a database to a specific recent moment using the continuously retained transaction log instead of a snapshot.

Why it is used: To recover from an accidental delete, bad migration or corruption without losing a whole day.

DynamoDB:

aws dynamodb restore-table-to-point-in-time \
  --source-table-name my-table \
  --target-table-name my-table-restore \
  --use-latest-restoration-time

RDS:

Enable automated backups
Use console or CLI to restore
Specify timestamp

Interview talking point: “DynamoDB: restore-table-to-point-in-time with source and target table names, because you can never restore in place, only to a new table then cut over. The window is 35 days and PITR must be enabled. On RDS, BackupRetentionPeriod is the PITR window, and the 1-day default is why restoring to yesterday fails.”

Q674: How to implement cross-region disaster recovery?

What it is: Combining per-service replication like S3 CRR, cross-region replicas, global tables and Aurora Global Database into one failover plan.

Why it is used: So a regional failure becomes a documented, tested procedure rather than an outage.

S3 cross-region replication
RDS read replica in another region
DynamoDB global tables
Aurora global database
Multi-region EKS clusters

Interview talking point: “S3 CRR or Multi-Region Access Points for objects, an RDS cross-region read replica promoted with promote-read-replica taking minutes, DynamoDB global tables, and Aurora Global Database for sub-minute RTO. EFS replication is same-Region only, so cross-region needs DataSync or a bucket copy. Rebuild EKS from IaC; the cluster is not the state.”

Q675: How to implement backup encryption?

What it is: Encrypting the backup itself with a key you control, so account access alone cannot read it.

Why it is used: For regulations covering backups and to control key lifecycle independently of live data.

Use KMS keys for encryption
Enable encryption at creation
Use customer-managed keys
Rotate keys regularly

Interview talking point: “RDS encryption is set at creation and immutable, so an unencrypted instance needs copying into an encrypted one; EBS snapshots inherit volume encryption; S3 replicas use S3 keys unless you specify KMS. Crucially, rotating a KMS key does not re-encrypt existing data, so you cannot revoke old key material until those backups expire.”

AWS Compliance

What it is: A shared responsibility where AWS supplies infrastructure controls and a DPA while you implement data-subject rights.

Why it is used: To demonstrate compliance with data protection regulation for personal data held in AWS.

Data encryption
Access control
Data retention policies
Right to erasure (deletion)
Data portability
Audit logging

Interview talking point: “Map encryption, least-privilege IAM with MFA, retention and erasure, portability and CloudTrail evidence, but note backups cannot be selectively deleted, so retention design must account for them. AWS is the processor and you are the controller, so you need a data inventory and record of processing activities to demonstrate anything.”

Q677: How to implement HIPAA compliance?

What it is: Requires HIPAA-eligible AWS services, a signed Business Associate Addendum, and your own safeguards implementation.

Why it is used: To process protected health information lawfully with contractual and technical controls in place.

Enable encryption (at rest/in transit)
Use VPC
Enable CloudTrail
Use IAM for access control
Sign BAA with AWS
Regular audits

Interview talking point: “Order of blockers: only services on the HIPAA-eligible list count, so an architecture using anything outside it is non-compliant by construction; then sign the BAA before touching PHI; then encrypt with a KMS key you control, isolate in VPC, log access. Also document incident response with the 60-day notification, training and risk analysis.”

Q678: How to implement SOC compliance?

What it is: An audited control set: SOC 1 covers financial reporting, SOC 2 security and availability, SOC 3 the public report.

Why it is used: To show customers and auditors that controls operated effectively over a period, not merely exist.

Enable CloudTrail
Use AWS Config
Enable encryption
Implement MFA
Regular access reviews
Document controls

Interview talking point: “Get the labels right: SOC 1 is financial reporting controls, SOC 2 is security, availability and confidentiality and is what people usually mean, SOC 3 is the same criteria for public disclosure. You inherit AWS reports from Artifact only for the AWS portion; your controls need an external auditor and automated evidence, not screenshots.”

Q679: How to implement PCI DSS compliance?

What it is: Card-industry standard with four compliance levels by transaction volume covering network security, encryption, access control and testing.

Why it is used: For handling cardholder data, where the scope boundary determines almost every control you need.

Use VPC isolation
Enable encryption
Use WAF
Enable CloudTrail
Regular vulnerability scanning
Document all changes

Interview talking point: “Everything touching card data is in the cardholder data environment, so compliance cost tracks that graph; minimise it with AWS Payment Cryptography tokenisation and hosted fields so PAN never reaches you. Then WAF, VPC isolation, TLS 1.2+, segmentation into a separate account, plus quarterly ASV scans and annual penetration tests.”

Q680: How to implement ISO 27001 compliance?

What it is: An ISMS standard: scoped security controls, risk assessment, a management system and annual accredited certification audits.

Why it is used: For a certifiable security management system rather than a grab bag of technical controls.

Use IAM properly
Enable encryption
Use CloudWatch monitoring
Document security policies
Regular audits
Risk assessment

Interview talking point: “ISO 27001 certifies the ISMS with a Statement of Applicability, 27002 gives guidance, and Annex A in the 2022 version holds 93 controls across four themes. The controls that catch organisations out are supplier management and key management policy. SOC 2 and ISO 27001 overlap heavily but neither substitutes for the other.”

AWS Advanced Architecture

Q681: How to implement multi-region active-active?

What it is: Every region serves live traffic behind a global entry point, with data replicated across regions.

Why it is used: For no regional single point of failure and ideally zero RTO with no failover.

Components:

Route 53 geolocation/routing
CloudFront CDN
Global Accelerator
DynamoDB global tables
Aurora global database
EBS CRR and S3 CRR cross-region (EFS replication is same-Region only)
S3 cross-region replication

Interview talking point: “Global Accelerator gives static anycast IPs and fast health-based failover while Route 53 is DNS-based and slower; CloudFront serves static content; DynamoDB global tables and Aurora Global Database replicate data but stay eventually consistent cross-region. EFS replication is same-Region only, so cross-region EFS needs DataSync or S3. The real cost is conflict resolution and double infrastructure.”

Q682: How to implement zero-downtime deployment?

What it is: Combining a deployment mechanism, feature-flag release, health verification and automatic rollback so bad releases stay invisible.

Why it is used: So a bad release never becomes a user-visible outage and rollback is fast under pressure.

Blue-green deployments
Canary releases
Feature flags
Auto-scaling
Health checks
Rollback capability

Interview talking point: “Blue-green buys instant rollback by switching back, canary limits exposure first, and feature flags decouple release from deploy, the most valuable item on the list. Verify with synthetic checks and CloudWatch alarms, and automate rollback in CodeDeploy. Auto-scaling is not a deployment technique; it multiplies a bad release.”

Q683: How to implement multi-tenant architecture?

What it is: Serving multiple customers from one deployed system while keeping their data and configuration isolated.

Why it is used: To avoid running a fleet of databases and deployments per customer, which scales badly.

Use account isolation per tenant
Or use VPC with security groups
Use DynamoDB with tenant ID
Implement row-level security
Use S3 bucket policies

Interview talking point: “Account-per-tenant gives strongest isolation but real quota and billing overhead, shared-everything with a tenantId in every key is cheap but a missing filter is a breach, and schema-per-tenant sits between. Put the tenant discriminator in every primary key and index so queries physically cannot span tenants; for S3 use access points with per-tenant prefixes, not per-tenant buckets.”

Q684: How to implement edge computing?

What it is: Running compute in edge locations such as CloudFront, Outposts, Wavelength Zones or Snowball Edge rather than a Region.

Why it is used: To process data where it is created when the round trip to a Region dominates latency.

Use Lambda@Edge
Use CloudFront Functions
Use AWS Wavelength
Use Outposts
Use Snowball Edge

Interview talking point: “CloudFront Functions do fast header and URL work with no body access; Lambda@Edge adds a full runtime but latency on every request, no environment variables and a 5-second viewer timeout; Outposts is a physical rack, Wavelength is the only mobile option. Snowball Edge is portable storage, not edge compute.”

Q685: How to implement IoT architecture?

What it is: Layers of IoT Core for connection, rules for routing, streaming and storage, plus an analytics and alerting back end.

Why it is used: For millions of devices needing secure enrolment, message routing and offline-tolerant processing.

IoT Core for device management
IoT Rules for processing
Kinesis for data streaming
S3 for storage
QuickSight for analytics

Interview talking point: “IoT Core differentiator is the registry, rules and fleet Jobs firmware updates over MQTT. Security rests on X.509 mutual TLS with per-device certificates plus a thing policy restricting each device to its own topics, issued via fleet provisioning rather than baked into firmware. Watch publish and connection rate quotas when sharding devices.”

AWS Automation

Q686: How to implement infrastructure as Code?

What it is: Declaring infrastructure in version-controlled CloudFormation, CDK or Terraform instead of clicking through the console.

Why it is used: So changes are reviewable, repeatable and auditable, and environments can be recreated from scratch.

Tools:

CloudFormation (native)
CDK (CloudFormation)
Terraform (3rd party)

Best Practices:

Version control
Modular templates
Parameterization
Drift detection
CI/CD integration

Interview talking point: “CloudFormation and CDK both deploy through CloudFormation since CDK synthesises to it, whereas Terraform is third-party and calls provider APIs, which is why Terraform has state and CloudFormation does not. CDK being a real language beats YAML for loops and reuse. Drift detection matters because console changes are inevitable.”

Q687: How to implement policy as code?

What it is: Expressing security and compliance rules as machine-readable rules enforced automatically via Config, SCPs or CloudFormation Guard.

Why it is used: To make policy continuously enforced and testable instead of relying on people remembering it.

Use AWS Config Rules
Use CloudFormation Guard
Use SCPs
Use AWS Organizations
Use EventBridge for remediation

Interview talking point: “Config rules evaluate actual running state and raise findings, CloudFormation Guard validates templates before deploy in CI, and SCPs cap maximum permissions including for root. The layered pattern is Guard in the pipeline, Config in production, SCP as backstop, and EventBridge with Lambda to remediate, turning reports into enforcement.”

Q688: How to implement runbook automation?

What it is: Encoding an operational procedure as an SSM Automation document or Lambda so it runs identically every time.

Why it is used: To make routine and emergency procedures repeatable, auditable and safe to run at 3am.

Use Systems Manager Automation
Create documents
Define runbooks
Use change calendar
Integrate with incidents

Interview talking point: “An Automation document uses mainSteps like aws:runInstances, aws:createSnapshot and aws:waitForAutomationExecution, plus nested aws:executeAutomation. Good runbooks add an assume role scoped to that procedure, maximumConcurrency limits, per-step onFailure handling and Change Manager approval. Automate boring deterministic work first; leave novel incidents to humans.”

Q689: How to implement self-healing infrastructure?

What it is: Detecting failure and restoring service without humans, using health checks, auto scaling and alarm-triggered remediation.

Why it is used: So transient failures stop becoming incidents and the system returns to a known-good state.

Use Auto Scaling
Use Health Checks
Use Lambda for remediation
Use CloudWatch alarms
Use EventBridge rules

Interview talking point: “Three layers: react by replacing unhealthy instances or tasks, repair through EventBridge rules on alarm state invoking SSM or Lambda, and prevent with patching and headroom. Health checks must be application-level since EC2 sees a full disk as healthy, remediation must be idempotent and circuit-broken, and it only covers known failures with known fixes.”

Q690: How to implement cost optimization automation?

What it is: Applying pricing models, right-sizing and scheduling decisions on a recurring basis rather than reviewing the bill manually.

Why it is used: To capture savings continuously and react to anomalies before they become a large invoice.

Use AWS Budgets with alerts
Use Compute Optimizer
Use Lambda for scheduling
Use rightsizing recommendations
Use scheduled scaling

Interview talking point: “Right-size first, then buy Reserved Instances or Savings Plans, because committing to an over-provisioned instance locks in waste for a year. Combine scheduled ASG scaling, Compute Optimizer with a Lambda acting on recommendations, budget forecast alerts and Cost Anomaly Detection. Treat recommendations as input, since history can misjudge seasonal workloads.”

AWS Integration Patterns

Q691: How to implement pub/sub pattern?

What it is: Publishers send to a topic without knowing subscribers, using SNS with SQS per subscriber or EventBridge.

Why it is used: To decouple producers from consumers and fan one event out to many interested parties.

import boto3

sns = boto3.client('sns')

# Publish
sns.publish(
    TopicArn='arn:aws:sns:us-east-1:123456789012:my-topic',
    Message='{"event": "order_created"}',
    Subject='Order Update'
)

Interview talking point: “Plain SNS endpoints get the message immediately and lose it if delivery fails, so the production pattern is an SNS topic with an SQS queue per subscriber, giving each consumer its own buffer and retries. Use filter policies for selective delivery. EventBridge matches on event content, SNS is plain fan-out.”

Q692: How to implement message queue pattern?

What it is: SQS buffers work between producer and consumer so bursts are absorbed and retries happen independently.

Why it is used: For load levelling, decoupling and retrying failed work, the workhorse asynchronous pattern on AWS.

import boto3
import json

sqs = boto3.client('sqs')

# Send message
sqs.send_message(
    QueueUrl='https://sqs.us-east-1.amazonaws.com/123456789012/my-queue',
    MessageBody=json.dumps({'order_id': '123'})
)

# Receive (long polling; MaxNumberOfMessages max is 10)
response = sqs.receive_message(
    QueueUrl='https://sqs.us-east-1.amazonaws.com/123456789012/my-queue',
    MaxNumberOfMessages=10,
    WaitTimeSeconds=20
)
for msg in response.get('Messages', []):
    handle(msg['Body'])
    # Receiving does NOT delete: the message reappears after the
    # visibility timeout unless it is deleted.
    sqs.delete_message(
        QueueUrl='https://sqs.us-east-1.amazonaws.com/123456789012/my-queue',
        ReceiptHandle=msg['ReceiptHandle']
    )

Interview talking point: “Receiving does not delete: the message reappears after the visibility timeout unless you call delete with the receipt handle, and MaxNumberOfMessages is capped at 10. Guarantees are at-least-once, so consumers must be idempotent. Use 20-second long polling, MaxReceiveCount to route poison messages to a DLQ, and FIFO when order matters at 300 TPS.”

Q693: How to implement API Gateway integration?

What it is: Maps an API method to a backend such as a Lambda proxy integration, HTTP service or AWS action.

Why it is used: As the single front door for a serverless API handling TLS, auth, throttling and transformation.

# API Gateway integration
Integration:
  Type: AWS_PROXY
  IntegrationHttpMethod: POST          # proxy integration always POSTs
  Uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:my-function/invocations
  # Required: without Credentials you get AccessDenied at runtime.
  Credentials: arn:aws:iam::123456789012:role/api-gateway-invoke-role
# The function also needs a resource policy allowing apigateway.amazonaws.com:
#   aws lambda add-permission \--function-name my-function
#     --statement-id apigw \--action lambda:InvokeFunction
#     --principal apigateway.amazonaws.com

Interview talking point: “Proxy integration needs a Credentials role and a Lambda resource policy allowing apigateway.amazonaws.com, otherwise you get AccessDenied at runtime, not deploy. IntegrationHttpMethod stays POST even when the caller sends GET. HTTP APIs are roughly 70 percent cheaper with JWT authorisers but lack request validation, VPC links and edge-optimised behaviour.”

Q694: How to implement webhook processing?

What it is: Verifying a sender signature with a shared secret using HMAC and constant-time comparison before acting on the payload.

Why it is used: So you only process requests from the legitimate provider, not someone who guessed your URL.

import boto3
import json
import hmac
import hashlib

def verify_signature(payload, signature, secret):
    # Providers send "sha256=<hex>" - strip the prefix or nothing ever matches.
    if signature.startswith('sha256='):
        signature = signature[len('sha256='):]
    expected = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    # compare_digest needs str/bytes, never None - so default to an empty string.
    return hmac.compare_digest(expected, signature)

def lambda_handler(event, context):
    signature = event['headers'].get('X-Signature', '')
    if not verify_signature(event['body'], signature, 'secret'):
        return {'statusCode': 401}
    # Process webhook
    return {'statusCode': 200}

Interview talking point: “Strip the sha256= prefix before comparing or nothing ever matches, and compare with hmac.compare_digest, never equals, which leaks timing. Signatures cover raw body bytes, so any re-serialisation by API Gateway or middleware breaks verification. Add timestamp tolerance for replay protection and deduplicate on event ID, because providers retry.”

Q695: How to implement webhook retry logic?

What it is: Retrying failed operations with exponential backoff and jitter so transient faults resolve without hammering dependencies.

Why it is used: To make distributed calls robust against the network faults that are normal, not exceptional.

import time
import random

lambda_client = boto3.client('lambda')

def retry_with_backoff(func, max_retries=3):
    for i in range(max_retries):
        try:
            return func()
        except Exception:
            if i == max_retries - 1:
                raise
            # Exponential backoff with FULL JITTER. Without jitter every
            # client retries in lockstep (thundering herd).
            time.sleep(random.uniform(0, 2 ** i))

# Prefer the service's own retry + DLQ over a hand-rolled loop:
#   Lambda async invokes  -> retries twice, then dead-letter queue
#   SQS                   -> redrive policy, MaxReceiveCount
#   Step Functions         -> Retry/Catch on the state
# Either way, make the handler idempotent.

Interview talking point: “time.sleep blocks the Lambda environment and should be asyncio.sleep, and the shown loop lacks full jitter, so every client retries in lockstep. The bigger point: on AWS a retry is usually the service job, Lambda async retries twice then DLQs, SQS redrives to MaxReceiveCount, Step Functions uses Retry and Catch. Your job is idempotency.”

AWS Best Practices

Q696: What are EC2 best practices?

What it is: Defaults keeping instances secure and operable: IAM roles, private placement, tight security groups, encrypted storage, patching.

Why it is used: As the answer to what every EC2 instance in the account should have configured.

Use IAM roles
Use security groups
Enable termination protection
Use VPC
Regular patching
Backup EBS volumes
Use appropriate instance types
Monitor with CloudWatch

Interview talking point: “IAM instance profile with SSM Session Manager so port 22 need not exist, private subnets, security groups referencing other groups, IMDSv2 required with http-tokens required to block SSRF credential theft, encrypted EBS on a KMS key and SSM Patch Manager. EBS should hold no state so instances stay replaceable.”

Q697: What are S3 best practices?

What it is: Keeping buckets private, durable, organised and cheap: Block Public Access, ACL-free ownership, versioning, lifecycle, encryption and logging.

Why it is used: So a bucket stays secure as it grows and accumulates years of data.

Enable versioning
Use lifecycle policies
Enable encryption
Use bucket policies
Block public access
Enable logging
Use prefix for performance
Enable transfer acceleration

Interview talking point: “Correct the prefix item: prefixes scale and organise request throughput rather than making S3 faster, so you spread objects across many prefixes instead of concentrating them on one hot prefix. Then Block Public Access with BucketOwnerEnforced, versioning, default KMS encryption, lifecycle rules as the cost control, and Transfer Acceleration only for long-distance clients.”

Q698: What are Lambda best practices?

What it is: Practices around package size, configuration, security, error handling and observability, mostly about cost and reliability.

Why it is used: For the operational answer to how to run Lambda well, which is what the question means.

Minimize package size
Use layers
Avoid hardcoding credentials
Use VPC appropriately
Handle errors properly
Use provisioned concurrency
Enable X-Ray tracing
Monitor with CloudWatch

Interview talking point: “Small packages since init time is billed, right-size memory by measurement because CPU scales with memory, arm64 where possible, no credentials in code, VPC only when needed plus endpoints over NAT, structured JSON logs and X-Ray tracing. Provisioned concurrency is a latency trade with continuous cost, not a blanket practice, and idempotency is missing from the list.”

Q699: What are RDS best practices?

What it is: Multi-AZ for availability, real backups with tested retention, parameter groups, encryption, security groups and proactive monitoring.

Why it is used: As the practical answer to running a production relational database safely on AWS.

Use Multi-AZ
Enable backups
Use parameter groups
Enable encryption
Use security groups
Monitor performance
Use read replicas
Regular maintenance

Interview talking point: “Multi-AZ buys sub-minute failover at roughly double instance cost, and the 1-day backup default is why past restores fail. Use a custom parameter group, since your own max_connections raise can exhaust memory, keep storage autoscaling on, and set delete_automated_backups and skip_final_snapshot false with DeletionProtection enabled to avoid the costliest mistake.”

Q700: What are VPC best practices?

What it is: Deliberate network design: multiple AZs, tiered private subnets, security groups referencing each other, planned CIDRs, flow logs, endpoints.

Why it is used: So the network is a designed, auditable artefact that can be extended without renumbering.

Use multiple AZs
Use private subnets
Use NAT Gateway
Use VPC endpoints
Enable flow logs
Use security groups
Use NACLs appropriately
Plan IP ranges

Interview talking point: “Plan the CIDR first, because VPCs and subnets cannot be resized and overlap forces a rebuild. Tier into public, private-with-NAT and private-with-endpoints-only, the tier most architectures skip. Run one NAT gateway per AZ, reference security groups from security groups, restrict default egress, ship flow logs, and prefer endpoints to NAT per-GB charges.”

AWS Interview Scenarios

Q701: Design a URL shortener service

What it is: A URL shortener maps a short key to a long URL via an API with a key-value store and redirect responses.

Why it is used: For design exercises focused on read-heavy, write-rare traffic requiring global availability.

API Gateway + Lambda
DynamoDB for storage
S3 for static assets
Route 53 for DNS
CloudFront for CDN

Interview talking point: “The critical part is the read path at the edge (CloudFront/Lambda@Edge redirect) so reads bypass the account. DynamoDB with conditional writes avoids collisions, and choosing 302 over 301 prevents permanent breakage if destinations change.”

Q702: Design a real-time chat application

What it is: Real-time chat requires bidirectional WebSocket connections, auth, message storage and presence tracking.

Why it is used: To test WebSocket APIs, connection state, and stateless compute trade-offs.

API Gateway WebSocket
DynamoDB for messages
Cognito for auth
ElastiCache for sessions
SQS for async processing

Interview talking point: “API Gateway WebSocket runs Lambda per message while connections stay stateful, creating stale connection and fan-out challenges. For long-lived high-fan-out cases, a persistent service may be more suitable than Lambda.”

Q703: Design a video transcoding service

What it is: Video transcoding converts uploaded videos to streaming renditions using a queue, workers and status storage.

Why it is used: To decouple uploads from long-running, asynchronous media processing jobs.

S3 for input/output
Lambda or ECS for processing
MediaConvert for transcoding
SQS for job queue
DynamoDB for job status

Interview talking point: “Using MediaConvert is preferred over self-managed FFmpeg for its job queues and retry behavior. Key concerns include idempotency for redelivered SQS messages and presigned URLs to keep files off the API path.”

Q704: Design an e-commerce platform

What it is: An e-commerce platform combines static content, API, catalogue, orders, cart and asynchronous workflows.

Why it is used: To demonstrate choosing the right database per data type under transactional constraints.

CloudFront for static
API Gateway + Lambda for API
DynamoDB for product data
RDS for orders
ElastiCache for sessions
SQS for async processing
Step Functions for workflows

Interview talking point: “Product catalog fits DynamoDB for read-heavy access, while orders need RDS/Aurora for atomic transactions. Step Functions handle the checkout saga with compensation, and cart state must live outside Lambda memory.”

Q705: Design a log aggregation system

What it is: Log aggregation collects logs from many sources into a searchable store with query and visualization.

Why it is used: For high-volume logs needing cross-service correlation and interactive querying.

CloudWatch Logs
Kinesis for streaming
Firehose to S3
Athena for querying
QuickSight for visualization

Interview talking point: “CloudWatch Logs Insights is the default for most cases. For larger volumes use Kinesis+Firehose to S3 with Parquet and Athena; OpenSearch suits full-text search. Structured JSON logs are essential for cost and usability.”

AWS Additional Interview Questions 706-800

Q706: How do you set up cross-account access?

What it is: Cross-account access grants permissions from one AWS account to another without long-lived credentials.

Why it is used: To keep accounts isolated while enabling controlled resource sharing.

Use IAM roles
Use resource policies
Use STS assume role

Interview talking point: “Use an IAM role in the target account with a trust policy to the requesting account, or a resource-based policy where supported. Include ExternalId for confused-deputy protection and prefer RAM for organization-wide sharing.”

Q707: How do you implement rate limiting?

What it is: Rate limiting caps request volume to protect shared resources from abuse or runaway clients.

Why it is used: To preserve availability and control costs at multiple architectural layers.

Use WAF rate-based rules
Use API Gateway throttling
Use Lambda concurrency limits

Interview talking point: “WAF rate-based rules protect at the edge by IP, API Gateway throttles aggregate traffic, and Lambda reserved concurrency caps concurrent executions. Return 429 with Retry-After so clients back off appropriately.”

Q708: How do you handle session management?

What it is: Session management stores user session state outside individual instances for horizontal scaling.

Why it is used: To prevent sessions from being tied to a single server during load balancing or deploys.

Use ElastiCache
Use DynamoDB
Use RDS

Interview talking point: “ElastiCache offers speed but can evict data; DynamoDB provides durability but adds latency. Stateless JWTs scale best but cannot be revoked before expiry, so short expirations or deny-lists are needed.”

Q709: How do you implement caching strategy?

What it is: A layered caching strategy places data in edge, in-memory and accelerator caches based on access patterns.

Why it is used: To reduce latency and cost by avoiding repeated computation and fetches.

CloudFront for static
ElastiCache for dynamic
DAX for DynamoDB

Interview talking point: “CloudFront caches static/public content at the edge, ElastiCache caches computed or hot dynamic data with TTLs, and DAX accelerates DynamoDB reads. Design for graceful degradation if the cache becomes unavailable.”

Q710: How do you implement search functionality?

What it is: Search functionality builds an inverted index over documents for full-text, faceted relevance search.

Why it is used: Because SQL LIKE cannot scale for full-text search with ranking and facets.

Use OpenSearch
Use Elasticsearch Service
Use OpenSearch Service (or OpenSearch Serverless)

Interview talking point: “OpenSearch Service is the current managed solution; avoid CloudSearch for new work. Real-time indexing via DynamoDB Streams plus Lambda is common, but must handle eventual consistency between source data and the index.”

Q711: How do you implement file processing?

What it is: File processing triggers on S3 uploads and runs compute based on file size and job duration.

Why it is used: To handle document conversions, thumbnails or media without maintaining always-on servers.

Use S3 triggers
Use Lambda for small files
Use ECS for large files

Interview talking point: “Lambda suits small bounded files under 15 minutes; ECS/Fargate or Batch handle large or long-running jobs. Queue S3 events via SQS for burst tolerance, and ensure idempotent processing of at-least-once deliveries.”

Q712: How do you implement image processing?

What it is: Image processing resizes and transforms uploads, optionally adding analysis or moderation.

Why it is used: To generate thumbnails, optimize formats, and assess uploaded content at scale.

Use Lambda + Sharp
Use Rekognition for analysis
Use CloudFront for delivery

Interview talking point: “S3 events trigger Lambda with Sharp for fast transforms, while CloudFront can serve on-demand variants. S3 Object Lambda enables read-time generation, and Rekognition can analyze content, though moderation needs careful tool selection.”

Q713: How do you implement notifications?

What it is: Notifications deliver messages across channels like email, SMS, mobile push and webhooks.

Why it is used: To reach users through appropriate channels with tracking and fan-out.

Use SNS for pub/sub
Use Pinpoint for user engagement
Use SES for email

Interview talking point: “SES handles transactional and bulk email with bounce handling; SNS provides pub/sub fan-out; Pinpoint supports campaigns and journeys. Design for best-effort delivery with retries, and ensure resource policies allow delivery targets.”

Q714: How do you implement analytics?

What it is: Analytics spans ad-hoc querying, a data warehouse, and BI dashboards for business insights.

Why it is used: To answer questions at different scales from exploration to production reporting.

Use QuickSight
Use Athena
Use Redshift

Interview talking point: “Athena queries S3 data with per-TB pricing, favoring Parquet and partitioning; Redshift handles high-concurrency structured reporting; QuickSight provides BI with SPICE or direct queries. Athena and Redshift complement rather than replace each other.”

Q715: How do you implement ML pipeline?

What it is: An ML pipeline automates data prep, training, evaluation, registration, deployment and monitoring.

Why it is used: To build, version and operate models reproducibly without managing full training clusters.

Use SageMaker
Use Ground Truth for labeling
Use Batch Transform

Interview talking point: “SageMaker Pipelines orchestrate steps with caching to save costs. Model Registry tracks versions, Batch Transform scores offline data, and Model Monitor detects drift. Ground Truth supports labeled datasets for supervised learning.”

Q716: How do you implement IoT data pipeline?

What it is: An IoT data pipeline ingests device telemetry and routes messages for filtering, storage and analysis.

Why it is used: To handle high-volume device data without each device maintaining persistent back-end connections.

Use IoT Core
Use Kinesis
Use S3 + Athena

Interview talking point: “IoT Core receives MQTT messages, IoT Rules filter and transform them, and downstream services like Kinesis or Timestream store them. Topic hierarchy, per-device quotas and batching are key to scaling safely.”

Q717: How do you implement blockchain?

What it is: Blockchain on AWS provides tamper-evident ledgers for shared recordkeeping across participants.

Why it is used: When multiple parties need a verifiable, append-only history without trusting each other.

Use Amazon QLDB (ledger database) for an internal tamper-evident ledger
Use Managed Blockchain only for a cross-organisation permissioned Fabric network

Interview talking point: “QLDB is the practical choice for internal tamper-evident ledgers with SQL queries and ACID transactions. Managed Blockchain suits cross-organization permissioned networks, though availability is more limited than QLDB.”

Q718: How do you implement serverless workflow?

What it is: Serverless workflows orchestrate multi-step processes with retries, waits, branching and approvals.

Why it is used: To coordinate business logic that is too complex to manage in a single function.

Use Step Functions
Use Lambda + EventBridge
Use SQS

Interview talking point: “Step Functions uses Amazon States Language to model control flow, with Standard for exactly-once long-running workflows and Express for high-volume short ones. Keep durable state in Step Functions, not in Lambda execution contexts.”

Q719: How do you implement message ordering?

What it is: Message ordering guarantees sequence for related messages within defined partitions.

Why it is used: To prevent incorrect results when later events must not be processed before earlier ones.

Use FIFO queues
Use DynamoDB with sort keys
Use Kinesis with partitions

Interview talking point: “SQS FIFO orders within a message group ID; DynamoDB orders via sort key in a partition; Kinesis orders within a shard by partition key. Since no global order exists, design consumers to be idempotent and handle out-of-order messages.”

Q720: How do you implement idempotency?

What it is: Idempotency ensures repeated operations produce the same result as the first execution.

Why it is used: To safely handle retries, at-least-once queues, duplicate webhooks and user double-clicks.

Use idempotency keys
Use database transactions
Use conditional writes

Interview talking point: “Use client-generated idempotency keys with atomic check-and-claim (e.g. DynamoDB conditional write), return the original response on replay, and favor naturally idempotent operations like SET over ADD to avoid double-counting.”

Additional Practical Scenarios 721-800

Q721: How to secure Lambda with VPC?

What it is: Securing VPC-attached Lambda restricts network paths while allowing access to private resources.

Why it is used: To prevent a function from gaining unrestricted internet access when reaching internal services.

Use VPC endpoints
Use NAT Gateway
Use security groups

Interview talking point: “Place Lambda in private subnets with no default route to internet, use VPC interface endpoints for AWS APIs, and scope security groups tightly. Avoid relying on NAT Gateway as a security control; it only provides connectivity.”

Q722: How to debug Lambda issues?

What it is: Debugging Lambda issues requires examining logs, traces and configuration to isolate root causes.

Why it is used: To resolve failures quickly without relying on repeated guess-and-deploy cycles.

Check CloudWatch logs
Use X-Ray
Enable verbose logging

Interview talking point: “Use structured JSON logs with correlation IDs and Logs Insights for queries, X-Ray to trace latency across dependencies, and check Init/Duration from the REPORT line. Also verify memory, timeout, environment variables and concurrency.”

Q723: How to handle Lambda errors?

What it is: Handling Lambda errors means predictable failure behavior with retries and dead-letter queues.

Why it is used: To ensure failures are visible, recoverable and do not silently drop events.

Use dead letter queues
Implement retry logic
Use circuit breakers

Interview talking point: “For async invocations, Lambda retries with backoff then sends events to a DLQ after exhaustion. Synchronous invocations propagate errors to callers. Design handlers to be idempotent so at-least-once delivery remains safe.”

Q724: How to optimize Lambda cold start?

What it is: Cold start optimization reduces initialization time for new Lambda execution environments.

Why it is used: To improve predictable latency for functions where init dominates total runtime.

Use provisioned concurrency
Reduce package size
Use arm64

Interview talking point: “Minimize package size and avoid heavy top-level work, use arm64 where possible, avoid unnecessary VPC attachment, and consider SnapStart for Java. Use provisioned concurrency only when latency requirements justify continuous cost.”

Q725: How to use Lambda with VPC endpoints?

What it is: Lambda uses VPC endpoints to privately reach AWS services without traversing the internet.

Why it is used: To eliminate NAT Gateway dependency, reduce cost, and limit outbound exposure.

Create VPC endpoint
Configure security groups
Access AWS services privately

Interview talking point: “Create interface endpoints in each AZ for required services with private DNS enabled, or use free gateway endpoints for S3 and DynamoDB. Apply endpoint policies and restrict security groups to allow only the Lambda ENIs.”

Q726: How to secure EKS cluster?

What it is: Securing an EKS cluster protects both the Kubernetes API and the AWS resources workloads use.

Why it is used: To prevent compromised workloads or leaked credentials from escalating privileges.

Use RBAC
Use network policies
Enable audit logging

Interview talking point: “Enforce least-privilege RBAC with no cluster-admin for humans, use network policies to restrict pod traffic, enable audit logging, and use IRSA with scoped pod roles. EKS access entries replace the aws-auth ConfigMap.”

Q727: How to monitor EKS?

What it is: Monitoring EKS collects cluster, pod, container and application metrics and traces.

Why it is used: To detect crash loops, scheduling issues, resource pressure and latency problems early.

Use CloudWatch Container Insights
Use Prometheus + Grafana
Use X-Ray

Interview talking point: “CloudWatch Container Insights provides managed metrics and dashboards with minimal setup. Prometheus+Grafana offers more flexibility; combine with ADOT/X-Ray for tracing. Alert on restarts, OOMKilled and pending pods, not just CPU.”

Q728: How to backup EKS?

What it is: Backing up EKS preserves persistent data and enables recovery of cluster resources.

Why it is used: To recover from accidental deletion or data loss without rebuilding everything from scratch.

Use Velero
Snapshot etcd
Backup persistent volumes

Interview talking point: “The control plane is managed and reproducible from IaC; persistent volumes hold critical data and need EBS snapshots or Velero backups. Velero can back up Kubernetes resources and snapshot volumes in one operation.”

Q729: How to secure ECS?

What it is: Securing ECS means protecting task IAM roles, network placement and container images.

Why it is used: To prevent compromised containers from accessing AWS resources or the broader network.

Use IAM roles
Use security groups
Use private subnets

Interview talking point: “Use separate execution and task roles with least privilege, run tasks in awsvpc mode in private subnets, restrict security groups, scan images in ECR, and run containers as non-root. Each awsvpc task consumes an ENI from the subnet.”

Q730: How to optimize ECS costs?

What it is: Optimizing ECS costs involves choosing the right compute model and right-sizing workloads.

Why it is used: To reduce spend without sacrificing capacity or resilience.

Use Fargate
Right-size containers
Use spot instances

Interview talking point: “Fargate fits spiky or low-utilization workloads with less ops overhead; EC2 with Spot or Graviton fits steady high-utilization workloads. Right-size CPU/memory using Container Insights, use scheduled scaling, and track log retention costs.”

Q731: How to secure RDS?

What it is: Securing RDS requires network isolation, encryption, authentication and TLS enforcement.

Why it is used: To protect sensitive databases from unauthorized access or data exposure.

Use security groups
Enable encryption
Use IAM auth
Use VPC

Interview talking point: “Keep RDS not publicly accessible with SGs referencing only the app tier, enable KMS encryption at rest, use IAM database authentication with enforced TLS, enable deletion protection, and store credentials in Secrets Manager.”

Q732: How to optimize RDS?

What it is: Optimizing RDS starts with identifying bottlenecks before scaling resources.

Why it is used: To fix the actual constraint rather than over-provisioning compute or storage.

Use read replicas
Use proper indexing
Enable caching

Interview talking point: “Use Performance Insights to find expensive queries and wait events, then optimize indexes and queries first. Add ElastiCache for hot reads, read replicas for read-heavy workloads, and scale instance/storage only after those fixes.”

Q733: How to secure DynamoDB?

What it is: Securing DynamoDB uses fine-grained IAM, encryption and private network access.

Why it is used: To enforce least privilege on a NoSQL table where access patterns determine risk.

Use IAM policies
Use VPC endpoints
Enable encryption

Interview talking point: “Scope IAM policies to specific tables and indexes, use KMS encryption at rest, and prefer a free gateway VPC endpoint with aws:sourceVpce conditions to block external access. Note IAM credential revocation can take up to 15 minutes to propagate.”

Q734: How to optimize DynamoDB?

What it is: Optimizing DynamoDB depends primarily on access-pattern-driven schema design and capacity choices.

Why it is used: Because most performance and cost issues stem from poor partition keys and scans.

Use DAX
Design proper keys
Use GSIs

Interview talking point: “Design for queries that use the partition key, avoid hot partitions by sharding or better key distribution, add GSIs only for necessary access patterns, use DAX for cacheable reads, and apply TTL to time-based data.”

Q735: How to secure S3?

What it is: Securing S3 requires multiple independent layers for private-by-default configuration.

Why it is used: To prevent accidental public exposure as buckets and permissions grow.

Use bucket policies
Block public access
Enable encryption

Interview talking point: “Enable all Block Public Access settings, set bucket ownership to BucketOwnerEnforced to disable ACLs, apply least-privilege bucket policies with aws:SecureTransport deny, enable KMS encryption, versioning, and use VPC endpoints with conditions where appropriate.”

Q736: How to optimize S3?

What it is: Optimizing S3 matches storage classes and delivery to access patterns to control cost.

Why it is used: To reduce storage and request costs without losing data or degrading user experience.

Use lifecycle policies
Use correct storage class
Enable multipart upload

Interview talking point: “Use lifecycle policies to transition cold data to appropriate classes, place CloudFront in front of buckets to reduce read requests, and use multipart uploads for large files. Remember minimum size and retention charges for IA classes.”

Q737: How to secure API Gateway?

What it is: Securing API Gateway controls authentication, authorization, traffic filtering and logging at the entry point.

Why it is used: To prevent an open API from becoming an unbounded, unaudited attack surface.

Use auth
Use WAF
Use throttling

Interview talking point: “Choose appropriate auth (IAM, Cognito, Lambda authorizer, or OIDC), apply least-privilege integration roles, use WAF with rate-based rules, configure stage throttling/quotas, and enable access logging. Never leave methods with authorization set to NONE unintentionally.”

Q738: How to optimize API Gateway?

What it is: Optimizing API Gateway reduces latency and cost by choosing the right API type and caching strategy.

Why it is used: To improve performance for high-traffic entry points without unnecessary compute.

Enable caching
Use compression
Use HTTP API

Interview talking point: “Prefer HTTP APIs over REST when advanced validation/mapping is not needed, enable caching only for safe non-user-specific responses, and use compression. Consider direct service integrations instead of proxying everything through Lambda.”

Q739: How to secure CloudFront?

What it is: Securing CloudFront protects the origin and controls viewer access to distributed content.

Why it is used: To keep private content private while using a CDN for delivery.

Use signed URLs
Use OAI
Enable WAF

Interview talking point: “Use Origin Access Control so the S3 origin stays private, apply signed URLs or cookies for restricted content with key groups, attach WAF to the distribution, and enforce HTTPS. Remember WAF for CloudFront must be in us-east-1.”

Q740: How to optimize CloudFront?

What it is: Optimizing CloudFront improves cache hit ratio and reduces origin load for lower latency.

Why it is used: To maximize CDN benefits for viewers and minimize origin traffic costs.

Enable caching
Use compression
Use edge functions

Interview talking point: “Tune cache policies and TTLs, use long TTLs on versioned/fingerprinted assets, enable compression, and prefer CloudFront Functions over Lambda@Edge for simple header/URL rewrites. Monitor X-Cache and CacheHitRate to diagnose issues.”

Q741: How to use CloudFormation drift detection?

What it is: CloudFormation drift detection identifies differences between stack templates and live resource state.

Why it is used: To detect manual changes that undermine infrastructure-as-code as the source of truth.

Use drift detection
Use cfn-lint
Use cfn-nag

Interview talking point: “Drift detection reports differences but does not auto-remediate; fix by updating the stack or importing drifted resources. Pair with template validation tools like cfn-lint and policy checks to prevent drift-causing changes.”

Q742: How to use CDK pipelines?

What it is: CDK Pipelines deploy infrastructure changes through a self-mutating pipeline defined in CDK.

Why it is used: To ensure pipeline definition changes go through the same review and deploy process as application code.

Create pipeline construct
Add stages
Deploy

Interview talking point: “Self-mutate allows the pipeline to update itself on changes. Use cross-region/cross-account constructs when deploying to multiple environments, and commit cdk.context.json if using lookups to ensure deterministic behavior.”

Q743: How to use SAM local?

What it is: SAM local runs serverless applications on a developer machine without full deployment.

Why it is used: To enable fast iteration and testing of functions, APIs and events locally.

sam local start-api
sam local invoke
sam local generate-event

Interview talking point: “Use sam local start-api for local endpoints, sam local invoke with sample events, and sam local generate-event to create realistic inputs. Local execution differs from Lambda, so treat it as a development aid, not a substitute for deployed validation.”

Q744: How to use Terraform state?

What it is: Terraform state tracks managed resources and must be shared safely across teams.

Why it is used: To enable collaboration and prevent state corruption or accidental resource destruction.

Use S3 backend
Use DynamoDB locking
Use remote state

Interview talking point: “Store state in a remote backend like S3 with versioning and encryption, enable DynamoDB locking to prevent concurrent applies, and never commit state files. Treat state as sensitive since it can contain secret values.”

Q745: How to use Ansible with AWS?

What it is: Ansible with AWS uses dynamic inventory and idempotent modules for configuration management.

Why it is used: To configure and converge existing resources without managing static host lists.

Use ec2 module
Use inventory plugin
Use dynamic inventory

Interview talking point: “Use the EC2 inventory plugin with tag-based filtering for dynamic targets, prefer SSM Session Manager over SSH for connectivity, and keep Terraform responsible for resource lifecycle while Ansible handles configuration to avoid overlap.”

Q746: How to use Packer with AWS?

What it is: Packer builds reproducible machine images by baking configuration into AMIs or containers.

Why it is used: To ensure instances boot with consistent, hardened configuration rather than manual setup.

Create template
Use builder
Use provisioner

Interview talking point: “Define builders and provisioners in a template so images are reproducible, encrypt AMIs with customer-managed KMS keys, and tag them for traceability. EC2 Image Builder offers a managed alternative for AMI pipelines.”

Q747: How to use Jenkins with AWS?

What it is: Jenkins with AWS integrates build pipelines with AWS services using credentials and plugins.

Why it is used: To extend existing Jenkins workflows to deploy to AWS without replacing the CI system.

Use EC2 plugin
Use S3 plugin
Use ECR plugin

Interview talking point: “Prefer OIDC with AssumeRoleWithWebIdentity over long-lived access keys, scope roles per environment with conditions, and use Jenkins credentials only when unavoidable. Containerized agents reduce infrastructure management overhead.”

Q748: How to use GitHub Actions with AWS?

What it is: GitHub Actions with AWS uses OIDC to obtain short-lived credentials for deployments.

Why it is used: To eliminate long-lived AWS secrets from GitHub repositories.

Use aws-actions/configure-aws-credentials
Deploy resources
Use OIDC

Interview talking point: “Use aws-actions/configure-aws-credentials with id-token: write and a role trust policy that requires both aud and sub conditions scoped to the repo/ref. Pin third-party actions to commit SHAs and use environments for production approvals.”

Q749: How to use GitLab CI with AWS?

What it is: GitLab CI with AWS leverages OIDC tokens from runners to assume roles for pipeline deployments.

Why it is used: To run secure, auditable CI/CD in GitLab without storing cloud credentials.

Use GitLab AWS integration
Deploy with terraform
Build images

Interview talking point: “Configure ID tokens in runners and a role trust policy with aud and sub conditions matching the GitLab project/ref. Use GitLab’s Terraform HTTP backend for state with locking, and push images to ECR with immutable tags and digests.”

Q750: How to use Spinnaker with AWS?

What it is: Spinnaker is a multi-cloud CD platform for controlled deployments with advanced strategies.

Why it is used: For teams needing canary, blue-green and red/black deployments beyond simple CI/CD pipelines.

Deploy Spinnaker
Configure AWS provider
Create pipelines

Interview talking point: “Its microservice components (Gate, Orca, Clouddriver, Fiat, Front50, Rosco, Echo) orchestrate complex rollouts, often on Kubernetes. While powerful, it carries higher operational overhead than CodePipeline with CodeDeploy or Argo Rollouts for AWS-only use cases.”

Questions 751-800 continue with more scenarios and advanced topics…