AWS_Practical_Interview_801 1000

AWS Practical Interview Questions (801-1000)

Advanced AWS Scenarios

Q751: How do you implement multi-account AWS environment?

What it is: A multi-account environment splits an organisation into separate AWS accounts by purpose (security, shared services, workloads) inside Organizations OUs.

Why it is used: Provides blast-radius isolation, native IAM boundaries, per-account cost attribution and independent service quotas.

Structure:

• Root account (billing only)
• Shared Services account
• Security account
• Dev/Test accounts
• Production accounts

Implementation:

# Create organization
aws organizations create-organization

# Create OU
aws organizations create-organizational-unit \
  --parent-id r-root \
  --name Production

# Move accounts
aws organizations move-account \
  --account-id 123456789012 \
  --source-parent-id r-root \
  --destination-parent-id ou-production

Interview talking point: “Attach SCPs to an OU so every account in it inherits the policy, which a single account cannot do. Account creation is deliberately slow with a hard limit, so Terraform for_each over an account map is the standard approach.”

Q752: How do you implement centralized logging?

What it is: Centralised logging sends every account’s CloudTrail and flow logs to one S3 bucket in a log-archive account, with cross-account subscriptions.

Why it is used: Gives one auditable place to search that workload account administrators cannot read or delete.

1. Create S3 bucket in Security account
2. Enable CloudTrail in all accounts
3. Configure S3 cross-account access
4. Use Aggregator for CloudWatch Logs
5. Create Athena queries
6. Use QuickSight for visualization

Interview talking point: “An Organization CloudTrail in the archive account needs a per-account bucket policy, a customer-managed KMS key and object lock. Enable data events for S3, Lambda and DynamoDB, they are off by default and billed separately.”

Q753: How do you implement centralized security?

What it is: Centralised security aggregates GuardDuty, Security Hub, Config, IAM Access Analyzer and Macie findings into one security account.

Why it is used: Delivers one organisation-wide security posture and findings queue instead of unreconciled per-account consoles.

1. Use AWS Organizations
2. Create Security account
3. Use GuardDuty master
4. Use Security Hub aggregator
5. Use Config aggregator
6. Use IAM Access Analyzer

Interview talking point: “Each service uses delegated admin differently: guardduty enable-organization-admin, Security Hub create-findings-aggregator, Config put-aggregator with account-selection-mode ALL, Macie delegated admin. Findings then drive EventBridge to Lambda or SSM Automation for auto-remediation.”

Q754: How do you implement DNS management?

What it is: Centralised DNS runs private hosted zones and Route 53 Resolver endpoints in a shared-services VPC with conditional forwarding to on-premises.

Why it is used: Keeps internal naming consistent across accounts and hybrid environments without a private zone per VPC.

1. Create private hosted zone in shared services
2. Use Route 53 Resolver
3. Create conditional forwarders
4. Enable DNS query logging

Interview talking point: “Share hosted zones with RAM, add outbound Resolver endpoints in each workload VPC forwarding corp.example.com on-prem, plus inbound endpoints so on-prem resolves AWS names, and enable query logging, the only way to debug resolution. Keep internal TTLs near 300 seconds.”

Q755: How do you implement shared services?

What it is: Shared services are platform capabilities deployed once in a shared account: CI/CD, identity, artifact registry, monitoring, backup and DNS.

Why it is used: Avoids rebuilding the same tooling per team and gives platform teams one place to upgrade it.

Common shared services:

• Active Directory
• CI/CD pipelines
• Monitoring
• Backup
• DNS

Implementation:

• Deploy in shared services VPC
• Use PrivateLink for access
• Share via RAM

Interview talking point: “Delivery mechanisms differ: PrivateLink for cross-account service access, RAM for subnets and transit gateway, cross-account IAM roles for APIs, StackSets for deploying shared resources. Shared services need an owner and a documented SLA, not a dumping ground.”

---

AWS Cost Management Advanced

Q756: How do you implement showback/chargeback?

What it is: Showback and chargeback allocate AWS spend to teams using cost allocation tags plus the Cost and Usage Report.

Why it is used: Makes engineering teams accountable for consumption and justifies optimisation work with numbers.

1. Enable cost allocation tags
2. Create tag policies
3. Use CUR (Cost and Usage Report)
4. Create reports by tag
5. Use QuickSight for visualization
6. Create billing alerts

Interview talking point: “Showback only reports cost; chargeback moves money and needs finance agreement on transfer pricing, usually amortised cost. Tags are not applied retroactively and are missing on some services, so enforce a tagging policy with SCPs plus Config rules.”

Q757: How do you optimize reserved instance usage?

What it is: Optimising reserved instance and Savings Plan coverage means measuring usage, buying commitments for the steady baseline, then tracking coverage and waste.

Why it is used: Converts predictable on-demand spend into a lower committed rate without over-committing.

1. Analyze usage patterns
2. Purchase RIs for steady-state
3. Use convertible RIs
4. Set up coverage alerts
5. Use Savings Plans

Interview talking point: “Measure first, then buy for the baseline not the peak. Savings Plans span instance family, size, Region, Fargate and Lambda; RIs give a deeper discount for one family and can be convertible. Buying before right-sizing locks waste in for a year.”

Q758: How do you implement cost controls?

What it is: Cost controls combine budgets with alerts, service restrictions and automated actions that stop or throttle spend at thresholds.

Why it is used: Catches a runaway resource with an alarm rather than the next monthly invoice.

1. Create budgets with alerts
2. Use SCP to restrict services
3. Enable cost anomaly detection
4. Set up spend limits
5. Regular cost reviews

Interview talking point: “Use actual and forecast budget alerts, Cost Anomaly Detection for spikes a percentage threshold misses, and SCPs to deny services or regions. Budget actions can stop EC2, but they can also take down production, so keep them off it.”

Q759: How do you implement rightsizing?

What it is: Rightsizing matches resource size to observed demand using Compute Optimizer recommendations plus Trusted Advisor idle-resource reports.

Why it is used: Pays for capacity actually used, usually the largest zero-risk saving available.

1. Enable Compute Optimizer
2. Review recommendations
3. Right-size EC2
4. Right-size RDS
5. Right-size ElastiCache

Interview talking point: “Opt in per Region with update-enrollment-status, then act only where utilisation history is marked sufficient. Skip seasonal or bursty workloads, and remember RDS instance size also drives failover time and connection capacity, unlike a web server.”

Q760: How do you optimize data transfer costs?

What it is: Reducing data transfer cost is a placement problem: keep traffic inside the Region, inside the VPC and off the public internet.

Why it is used: Transfer is billed per GB on common paths and often invisible until you read the service breakdown.

1. Use VPC endpoints
2. Use PrivateLink
3. Use Direct Connect
4. Use CloudFront
5. Minimize cross-region traffic

Interview talking point: “VPC endpoints remove NAT per-GB charges, CloudFront stops S3 internet egress, same-AZ placement avoids cross-AZ fees. Direct Connect does not reduce data transfer charges, it is a latency and privacy decision. NAT also bills per GB processed on top of its hourly fee.”

---

AWS Security Advanced

Q761: How do you implement detective controls?

What it is: Detective controls establish that something bad happened: logging, monitoring, threat detection and configuration auditing rather than prevention.

Why it is used: Detects breaches, misconfigurations and misuse that preventive controls inevitably miss.

1. Enable CloudTrail (all regions)
2. Enable GuardDuty
3. Enable Config
4. Enable Security Hub
5. Enable Macie

Interview talking point: “CloudTrail says who did what, GuardDuty says something is wrong, Config shows resource state over time, Security Hub aggregates posture, Macie finds PII in S3. A finding nobody is routed to is not a control, so tune rules against alert fatigue.”

Q762: How do you implement preventive controls?

What it is: Preventive controls stop the bad action: IAM policies and SCPs, security groups and NACLs, and WAF rules blocking requests.

Why it is used: Reduces attack surface by making the insecure path unavailable rather than merely detectable.

1. Use SCPs
2. Use IAM policies
3. Use security groups
4. Use NACLs
5. Use WAF/Shield

Interview talking point: “They act in order: SCP ceiling including the root user, then IAM, then the network path, then WAF at layer 7. Deny-by-default needs an exception process, and an SCP blocking a region you depend on will break your recovery runbook, so test it.”

Q763: How do you implement responsive controls?

What it is: Responsive controls act once something is detected, triggering automated remediation instead of waiting for a human to investigate.

Why it is used: Contains incidents within minutes and makes the response identical every time.

1. Use EventBridge
2. Use Lambda for remediation
3. Create runbooks
4. Set up incident response
5. Use GuardDuty findings

Interview talking point: “Route alarm state changes and GuardDuty findings through EventBridge to SSM Automation for infrastructure fixes, or Lambda for everything else. Add a dead-letter queue and approvals for production, and make remediation idempotent with a circuit breaker so a loop cannot cause an outage.”

Q764: How do you implement IAM access analyzer?

What it is: IAM Access Analyzer finds resources shared beyond intent, including S3 buckets, roles, KMS keys, Lambda and secrets, plus access outside your organisation.

Why it is used: Continuously detects public exposure and cross-account sharing instead of periodic manual review.

# Create analyzer
aws access-analyzer create-analyzer \
  --analyzer-name organization-analyzer \
  --type ORGANIZATION

# Get findings
aws access-analyzer list-findings \
  --analyzer-name organization-analyzer

Interview talking point: “ACCOUNT analyzers flag sharing outside the account; ORGANIZATION analyzers know the org boundary. validate-policy checks policy grammar without evaluating permissions, and CloudTrail-based unused access analysis finds idle roles and keys. Feed findings to EventBridge to strip public policies automatically.”

Q765: How do you implement secrets rotation?

What it is: Secrets Manager rotation replaces a secret’s value on a schedule using a Lambda implementing createSecret, setSecret, testSecret and finishSecret.

Why it is used: Rotates database passwords, API keys and certificates without a deploy or anyone storing them in config.

# Create secret with rotation
aws secretsmanager create-secret \
  --name prod/db-creds \
  --secret-string '{"username":"admin","password":"pass"}' \
  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotate \
  --rotation-rules AutomaticallyAfterDays=30

Interview talking point: “Your Lambda must implement the four-step contract and manage the AWSCURRENT, AWSPENDING, AWSPREVIOUS and AWSCURRENTPENDING version stages. Rotation changes the secret only, so long-running tasks keep the old value until they re-read it or restart. rotate-secret triggers it on demand.”

---

AWS Network Advanced

Q766: How do you implement AWS Network Firewall?

What it is: AWS Network Firewall is a managed stateful firewall for a VPC, deployed per subnet with a policy of rule groups and IPS or IDS.

Why it is used: Adds centralised layer 3/4/7 inspection inside a VPC without running your own firewall fleet.

# Create firewall
aws network-firewall create-firewall \
  --firewall-name my-firewall \
  --vpc-id vpc-123 \
  --firewall-policy-arn policy-arn \
  --subnet-mapping '{"us-east-1a":"subnet-123"}'

Interview talking point: “create-firewall takes firewall-name, vpc-id, firewall-policy-arn and subnet-mapping, which must cover every AZ needing protection since ENIs are priced per AZ. Route traffic through it via route tables, and exclude AWS service traffic to avoid paying inspection cost for nothing.”

Q767: How do you implement PrivateLink for custom service?

What it is: PrivateLink publishes a custom service behind an NLB with a VPC endpoint service, reached by consumers through an interface endpoint.

Why it is used: Gives private cross-account access to your service without internet exposure or a full network connection.

1. Create NLB in service provider VPC
2. Create VPC endpoint service
3. Enable private DNS
4. Allow principals
5. Create VPC endpoint in consumer account

Interview talking point: “The allowed-principals whitelist on the endpoint service is the real access control. Private DNS only works if the NLB has a matching private-dns-name, otherwise consumers must use the vpce DNS name. PrivateLink is unidirectional with no data charges; Transit Gateway charges per GB.”

Q768: How do you implement Global Accelerator?

What it is: Global Accelerator is an anycast network giving two fixed IPs that route traffic to the nearest healthy regional endpoint.

Why it is used: Serves non-HTTP TCP and UDP protocols where Route 53 and CloudFront cannot help.

# Create accelerator
aws globalaccelerator create-accelerator \
  --name my-accelerator

# Add listener
aws globalaccelerator create-listener \
  --accelerator-arn accelerator-arn \
  --protocol TCP \
  --port-range FromPort=80,ToPort=80

Interview talking point: “It fails over in about a minute and routes by network distance, not measured latency. It is not a CDN, does no caching, and does not work with CloudFront or Route 53 health checks; for plain HTTP, CloudFront or Route 53 geolocation is cheaper.”

Q769: How do you implement Transit Gateway attachments?

What it is: Transit Gateway attachments connect VPCs, VPNs and Direct Connect links, with route tables controlling which attachments can reach which.

Why it is used: Replaces a full mesh of VPC peering with a scalable hub supporting transitive routing.

1. Create Transit Gateway
2. Create attachments (VPC, VPN, Direct Connect)
3. Create route tables
4. Associate attachments
5. Propagate routes

Interview talking point: “An attachment only propagates into a TGW route table whose propagation includes it, otherwise production routes reach every VPC. Propagation is eventually consistent, there is no route priority beyond longest-prefix match, and five attachments per route table per AZ is the limit.”

Q770: How do you implement DNS failover?

What it is: Route 53 failover routes users to a secondary resource only when a health check reports the primary unhealthy.

Why it is used: Moves users to a backup region or provider on failure without any client-side change.

1. Create primary record (A)
2. Create secondary record (A)
3. Set evaluate target health
4. Configure health check
5. Set routing policy

Interview talking point: “The most common failure is a health check not reporting Success: 1, which silently disables failover. PRIMARY and SECONDARY records need the same SetIdentifier with opposite Failover values, a 30 to 60 second TTL, and a genuinely warm secondary.”

---

AWS Storage Advanced

Q771: How do you implement S3 select?

What it is: S3 Select pushes a SQL query down to S3, returning only matching rows using the declared input and output serialisation.

Why it is used: Reads a subset of a large object in one request instead of downloading gigabytes.

import boto3

s3 = boto3.client('s3')

response = s3.select_object_content(
    Bucket='my-bucket',
    Key='data.csv',
    ExpressionType='SQL',
    Expression="SELECT * FROM s3object WHERE age > 25",
    InputSerialization={'CSV': {}},
    OutputSerialization={'CSV': {}}
)

Interview talking point: “An empty CSV serialization only works for unquoted headerless data, real files need FileHeaderInfo plus delimiter settings. select_object_content returns an event stream you must consume, or you get nothing and no error. For large scans, Athena over Parquet is faster and cheaper.”

Q772: How do you implement S3 batch operations?

What it is: S3 Batch Operations applies one operation, such as copy, delete, restore, tagging or replication, to millions of objects from an Inventory manifest.

Why it is used: Acts on buckets too large for CLI loops, with retries, concurrency control and a pausable job.

1. Create manifest
2. Create job
3. Choose operation (copy, tag, etc.)
4. Run and monitor job

Interview talking point: “The manifest must come from S3 Inventory, then create-job with an operation, report-scope All or OnlyFailed, and priority where 20 is highest. Monitor with describe-job. A Batch Operations DELETE cannot be undone and the job report is the only record, so test against a prefix first.”

Q773: How do you implement S3 inventory?

What it is: An S3 Inventory configuration periodically lists a bucket’s objects, including key, size, ETag, storage class, replication and encryption status.

Why it is used: Prerequisite for lifecycle cost optimisation, Batch Operations and any audit of bucket contents.

# Create inventory config
aws s3api put-bucket-inventory-configuration \
  --bucket my-bucket \
  --id daily-inventory \
  --inventory-configuration '{
    "Destination": {"S3BucketDestination":{"Bucket":"arn:aws:s3:::inventory-bucket","Format":"CSV","Prefix":"inventory/"}},
    "Schedule":{"Frequency":"Daily"},
    "IncludedObjectVersions": "All",
    "OptionalFields": ["Size","LastModifiedDate","StorageClass"]
  }'

Interview talking point: “Set IncludedObjectVersions to All or you only see current versions and miss the noncurrent ones silently inflating your bill. Put Format and Prefix inside S3BucketDestination, or inventory files land in the bucket root and collide with real objects. Output is daily with up to 48 hours lag.”

Q774: How do you implement EFS access points?

What it is: An EFS access point is a filesystem entry point enforcing a POSIX user and root directory, so a workload sees only a subtree.

Why it is used: Lets containerised or multi-tenant workloads share one filesystem without chown or escaping their directory.

# Create access point
aws efs create-access-point \
  --file-system-id fs-123 \
  --access-point-name app-access \
  --posix-user '{"Uid":1000,"Gid":1000}'

Interview talking point: “Always add a root-directory with CreationInfo so an arbitrary container UID gets a directory it owns. With transit encryption you must supply a security group on the mount target reachable from the caller, and on Fargate the task needs at least 30 GB ephemeral storage to mount EFS.”

Q775: How do you implement FSx for Windows?

What it is: FSx for Windows File Server is a managed, highly available SMB filesystem integrated with Active Directory for Windows workloads.

Why it is used: Serves SMB, DFS-R and SQL file shares that EFS cannot provide and S3 is not a filesystem.

# Create FSx
aws fsx create-file-system \
  --file-system-type WINDOWS \
  --storage-capacity 3000 \
  --subnet-ids subnet-123 \
  --windows-configuration '{
    "ActiveDirectoryId": "d-1234567890",
    "ThroughputCapacity": 8
  }'

Interview talking point: “Use at least two subnets in different AZs, one subnet gives no HA. The ActiveDirectoryId must be a Microsoft AD directory in the same VPC, SSD minimum storage is 3000 GB, and a backup consumes 20% of throughput while it runs.”

---

AWS Database Advanced

Q776: How do you implement DynamoDB on-demand backup?

What it is: A DynamoDB on-demand backup is a full point-in-time copy restorable to a new table, separate from the 35-day PITR window.

Why it is used: Provides a restorable copy independent of PITR, and supports compliance retention requirements.

# Create backup
aws dynamodb create-backup \
  --table-name my-table \
  --backup-name my-backup

# Restore (from the backup, not the PITR stream)
aws dynamodb restore-table-from-backup \
  --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/my-table/backup/0170000000000 \
  --target-table-name my-table-restore

Interview talking point: “restore-table-to-point-in-time reads the PITR stream and needs an explicit timestamp or use-latest-restoration-time, so it cannot restore your backup. To restore the backup you took, the API is restore-table-from-backup with a backup ARN. Both paths create a new table, nothing restores in place.”

Q777: How do you implement DynamoDB transactions?

What it is: A DynamoDB transaction is an all-or-nothing TransactWriteItems call grouping up to 100 items across up to 25 tables.

Why it is used: Makes multi-item changes like decrementing stock and creating an order happen fully or not at all.

import boto3

dynamodb = boto3.resource('dynamodb')

table = dynamodb.Table('orders')

try:
    with table.transactions_write() as tx:
        tx.put_item(Item={'order_id': '123', 'status': 'processing'})
        tx.update_item(
            Key={'product_id': '456'},
            UpdateExpression='SET stock = stock - :val',
            ExpressionAttributeValues={':val': 1}
        )
except Exception as e:
    print(f"Transaction failed: {e}")

Interview talking point: “Limits are 100 actions, 25 tables, a 1 MB total payload and 400 KB per item, and transactions cost 2x normal write capacity. They are not serialisable isolation across unrelated items, so you still need ConditionExpression for optimistic concurrency.”

Q778: How do you implement Aurora Serverless?

What it is: Aurora Serverless scales capacity automatically: v2 scales instances across an ACU range, while v1 paused the whole cluster when idle.

Why it is used: Fits intermittent or unpredictable load where paying for provisioned peak capacity would dominate the bill.

# Create Aurora Serverless
aws rds create-db-cluster \
  --db-cluster-identifier serverless-cluster \
  --engine aurora-postgresql \
  --engine-mode provisioned

# Then add a Serverless v2 DB instance with its own scaling config
aws rds create-db-instance \
  --db-cluster-identifier serverless-cluster \
  --db-instance-class db.serverless \
  --engine aurora-postgresql \
  --serverlessv2-scaling-configuration '{
    "MinCapacity": 2,
    "MaxCapacity": 64
  }'

Interview talking point: “The v1 form using engine-mode serverless is legacy and is rejected alongside v2 scaling configuration. Serverless v2 uses engine-mode provisioned with a per-instance serverlessv2-scaling-configuration of 0.5 to 128 ACU, and it scales on CPU and I/O limits, not query latency.”

Q779: How do you implement RDS proxy?

What it is: RDS Proxy is a managed connection pool multiplexing many client connections onto a smaller database pool using stored or IAM credentials.

Why it is used: Survives connection storms from Lambda scale-outs or deploys that would otherwise exhaust max_connections.

# Create proxy
aws rds create-db-proxy \
  --db-proxy-name my-proxy \
  --engine-family MYSQL \
  --auth '[{"SecretArn":"arn:secret","IAMAuth":"DISABLED"}]' \
  --role-arn arn:aws:iam::123456789012:role/rds-proxy-role \
  --vpc-subnet-ids subnet-123 subnet-456

Interview talking point: “role-arn is required, and auth must point at a secret RDS Proxy can rotate with the exact expected JSON fields. Engine family must match the database, idle-client-timeout requires require-tls, and a client is pinned to one backend connection, so session state like temporary tables breaks.”

Q780: How do you implement ElastiCache Serverless?

What it is: ElastiCache Serverless provisions, scales and patches cache nodes for you from just a cache name and an engine choice.

Why it is used: Suits unpredictable cache traffic where capacity planning and shard management cost more than the capacity itself.

# Create serverless cache
aws elasticache create-serverless-cache \
  --serverless-cache-name my-cache \
  --engine redis \
  --description "Serverless Redis"

Interview talking point: “It bills per data processed per hour, so it loses badly at sustained high throughput versus provisioned nodes. Limits: 320 GB per shard, 5 TB per cache, Redis or Valkey only, and moving between node-based and Serverless is not in place.”

---

AWS Serverless Advanced

Q781: How do you implement Lambda VPC endpoint?

What it is: A Lambda VPC endpoint is an interface endpoint letting a VPC-attached function be invoked privately without public addresses or NAT.

Why it is used: Lets private-subnet functions be reached and avoids internet egress for traffic originating inside a VPC.

# Create VPC endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --service-name com.amazonaws.us-east-1.lambda \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-123

Interview talking point: “Cover every AZ the function runs in with subnet-ids, pass security-group-ids or the default group drops traffic, and enable private-dns-endpoint DNS. You also need add-permission for the calling principal or invocations fail without mentioning the endpoint, and S3 or DynamoDB access needs their own endpoints.”

Q782: How do you implement Lambda layers?

What it is: A Lambda layer is a ZIP of libraries or runtimes published once and attached to many functions.

Why it is used: Shares and versions common code without duplicating a large dependency into every package.

# Create layer
aws lambda publish-layer-version \
  --layer-name my-layer \
  --zip-file fileb://layer.zip \
  --compatible-runtimes python3.12

# Use in function
aws lambda create-function \
  --function-name my-func \
  --layers arn:aws:lambda:us-east-1:123456789012:layer:my-layer:1

Interview talking point: “Layers extract to /opt on every cold start, so big layers cost init latency, and you get at most five per function. Versions are immutable with no latest reference, the zip must stay under 50 MB zipped and 250 MB unzipped, and a layer is not a security boundary.”

Q783: How do you implement Lambda cold start optimization?

What it is: Cold start optimisation shrinks execution-environment init time through smaller packages, fewer dependencies, arm64 and avoiding unnecessary VPC attachment.

Why it is used: Keeps latency predictable where warm invocation is short enough that init dominates it.

# Best practices:
# 1. Minimize package size
# 2. Avoid VPC if not needed
# 3. Use arm64
# 4. Use provisioned concurrency
# 5. Reduce dependencies

Interview talking point: “Move heavy imports and boto3 client construction inside the handler, and measure Init Duration against Duration first. Cold starts only matter when warm duration is short relative to init, so provisioned concurrency on a two-second function is an expensive non-fix.”

Q784: How do you implement Lambda error handling?

What it is: Lambda error handling decides per error whether to retry, dead-letter the event, or return a structured failure.

Why it is used: Makes failures visible and recoverable instead of letting an async exception vanish silently.

import boto3

def handler(event, context):
    try:
        process(event)
    except Exception as e:
        # Send to DLQ
        sqs = boto3.client('sqs')
        sqs.send_message(
            QueueUrl='https://sqs.../dlq',
            MessageBody=str(event)
        )
        raise

Interview talking point: “For async invocations Lambda itself retries twice then delivers to the function’s configured dead-letter queue, so a handler that publishes to SQS and re-raises creates two copies of the event. Catch expected errors and return, let unexpected ones propagate, and stay idempotent.”

Q785: How do you implement Lambda async invocation?

What it is: Async Lambda invocation is InvocationType Event, where Lambda acknowledges immediately, queues the event, and invokes it on its own schedule.

Why it is used: Fire-and-forget work without holding a connection open or handling a synchronous failure.

# Invoke async
aws lambda invoke \
  --function-name my-function \
  --invocation-type Event \
  --payload '{}' response.json

Interview talking point: “The output file argument is still required and you get a 202 with an empty body. Delivery is at-least-once with two retries before the DLQ, event age can reach six hours, and if you need to know it worked, use RequestResponse instead.”

---

AWS Container Advanced

Q786: How do you implement EKS managed node groups?

What it is: A managed node group is an AWS-managed Auto Scaling group that EKS patches, upgrades, drains and registers with the cluster.

Why it is used: Runs Kubernetes workloads without operating node lifecycle, AMI updates or scale-in draining yourself.

# Create node group
aws eks create-nodegroup \
  --cluster-name my-cluster \
  --nodegroup-name managed-nodes \
  --node-role arn:aws:iam::123456789012:role/eks-node-role \
  --subnets subnet-123 subnet-456 \
  --scaling-config minSize=2,maxSize=5,desiredSize=3 \
  --instance-types t3.medium

Interview talking point: “Subnets across at least two AZs and a node role are required. Managed means AMI and kubelet patching plus draining, not OS CVEs or your workloads, and node groups cannot scale to zero, so use Karpenter or Fargate when you need that.”

Q787: How do you implement EKS Fargate?

What it is: An EKS Fargate profile declares which pods run on Fargate by namespace and label, plus the subnets and pod execution role.

Why it is used: Runs Kubernetes workloads with no nodes to manage at all, paying only for running pods.

# Create Fargate profile
aws eks create-fargate-profile \
  --cluster-name my-cluster \
  --fargate-profile-name my-fargate \
  --selectors namespace=default

Interview talking point: “Without subnets and a pod-execution-role-arn the profile is useless. Pods need a matching ACTIVE profile, and Fargate has no DaemonSets, no privileged or host networking, no EBS or GPU, with persistent volumes only via EFS or FSx for Lustre.”

Q788: How do you implement ECS service discovery?

What it is: ECS service discovery registers tasks in AWS Cloud Map, a private DNS namespace, so tasks resolve by service name not task ID.

Why it is used: Addresses a service as my-service.local with traffic balanced across tasks and no load balancer.

# Create namespace
aws servicediscovery create-private-dns-namespace \
  --name local \
  --vpc vpc-123

# Create service
aws ecs create-service \
  --service-name my-service \
  --service-registries '[{"registryArn":"arn:service:srv-123","containerName":"nginx","containerPort":80}]'

Interview talking point: “create-service needs service-registries with containerName and containerPort, and the service must run in awsvpc mode so tasks have ENI addresses to register. Use MULTIVALUE routing to return all healthy IPs rather than WEIGHTED, and a 10-second record TTL so deregistered tasks stop resolving fast.”

Q789: How do you implement ECS capacity providers?

What it is: An ECS capacity provider is a named capacity source a service uses instead of launching directly onto an Auto Scaling group.

Why it is used: Lets a service prefer cheap Spot, fall back to on-demand, and gain managed instance draining on scale-in.

# Create capacity provider
aws ecs create-capacity-provider \
  --name my-provider \
  --auto-scaling-group-provider '{
    "autoScalingGroupArn": "arn:aws:autoscaling:asg"
  }'

# Update service
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --capacity-provider-strategy '[{"capacityProvider":"my-provider","weight":1}]'

Interview talking point: “The ASG must be ECS-managed so ECS installs the agent and drains instances. In the strategy, base guarantees a minimum task count from a provider and weight sets the share above it, so base 2 on on-demand keeps capacity when Spot disappears.”

Q790: How do you implement EKS security groups?

What it is: Security groups for pods give individual pods their own ENI and security group, applying AWS SG semantics to pod traffic.

Why it is used: Enables security group referencing for pods, which Kubernetes network policies cannot express.

security-group-policy.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: aws-node
  namespace: kube-system
---
apiVersion: networking.k8s.io/v1
kind: SecurityGroupPolicy
metadata:
  name: my-policy
spec:
  podSelector:
    matchLabels:
      role: db
  securityGroups:
    - id: sg-123

Interview talking point: “The SecurityGroupPolicy custom resource is deprecated and rejected outright by current EKS add-ons. The current mechanism is VPC CNI pod-ENI annotations with pod ENI enabled plus IRSA on the aws-node ServiceAccount. Network policies still default open, so you want both layers.”

---

AWS CI/CD Advanced

Q791: How do you implement CodePipeline with CloudFormation?

What it is: A CodePipeline using CloudFormation puts a change set in the deploy stage so template changes are reviewable before they are applied.

Why it is used: Sends infrastructure changes through the same approval, audit and rollback machinery as application changes.

pipeline.yaml

Resources:
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: arn:aws:iam::123456789012:role/pipeline-role
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              RoleArn: arn:aws:iam::123456789012:role/pipeline-source-role
              Configuration:
                BranchName: main
                RepositoryName: my-repo
        - Name: Deploy
          Actions:
            - Name: DeployAction
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1

Interview talking point: “The pipeline resource needs RoleArn, and the CodeCommit Source action needs a Configuration block with BranchName and RepositoryName or validation fails. Use ActionMode CHANGE_SET_REPLACE with WAIT_FOR_CHANGE_SET for a reviewable diff and an unapplied change set on failure, not a half-applied stack.”

Q792: How do you implement CodeBuild with testing?

What it is: A CodeBuild buildspec is YAML declaring build phases, the commands in each, and the artifacts to publish.

Why it is used: Keeps build environment and steps version-controlled instead of on a machine someone configured by hand.

buildspec.yml

version: 0.2

phases:
  install:
    commands:
      - npm install
  pre_build:
    commands:
      - npm run lint
  build:
    commands:
      - npm test
      - npm run build

artifacts:
  files:
    - '**/*'

Interview talking point: “Add a cache configuration or npm install reruns on every build, and list specific artifact files instead of everything in the workspace. CodeBuild does not apply set -e automatically, so prefix commands with it or a failure will not stop the phase, and Docker builds need privileged mode.”

Q793: How do you implement CodeDeploy rollback?

What it is: A CodeDeploy rollback is an AutoRollbackConfiguration returning traffic to the previous revision on failure, stop, timeout or alarm breach.

Why it is used: Reverts a failed release automatically instead of leaving a broken environment waiting for a human.

# Enable auto rollback
aws deploy create-deployment-group \
  --application-name my-app \
  --deployment-group-name my-group \
  --service-role-arn arn:aws:iam::123456789012:role/codedeploy-role \
  --auto-rollback-configuration '{
    "enabled": true,
    "events": ["DEPLOYMENT_FAILURE"]
  }'

Interview talking point: “The CLI verb is aws deploy, not codedeploy, and create-deployment-group also requires application-name and service-role-arn. The events are DEPLOYMENT_FAILURE, DEPLOYMENT_STOP_ON_REQUEST, DEPLOYMENT_STOP_ON_ALARM and DEPLOYMENT_LIMIT_BREACHED, and rollback only helps if the previous revision was actually good.”

Q794: How do you implement cross-account CI/CD?

What it is: Cross-account CI/CD runs one pipeline and assumes an IAM role in each target account to deploy into it.

Why it is used: Keeps one pipeline and one set of build artefacts while deploying into separately secured, separately billed accounts.

1. Create pipeline in tools account
2. Use IAM role for deployment
3. Assume role in target account
4. Use CloudFormation StackSets
5. Use deployment accounts

Interview talking point: “Trust policies should name the pipeline role and condition on aws:SourceArn or aws:SourceAccount. Use one role per environment with manual approval for prod; StackSet operations are asynchronous, so poll list-set-operations rather than assuming success, and authenticate builds with OIDC, not stored keys.”

Q795: How do you implement feature branch deployments?

What it is: Feature branch environments give each pull request its own deployable copy of the stack, created on branch push and destroyed on merge.

Why it is used: Enables real review of a change in a running environment rather than review of a plan.

1. Use CodePipeline webhooks
2. Create branch-specific deployments
3. Use parameter overrides
4. Use environment-specific configs

Interview talking point: “Ephemeral preview environments are only worth it if teardown is guaranteed, otherwise they accumulate cost and become a security problem. Give each branch its own isolated database, and consider restricting previews to labelled or path-matched PRs because every PR run costs money.”

---

AWS Monitoring Advanced

Q796: How do you implement custom CloudWatch metrics?

What it is: A custom CloudWatch metric is a data point you publish with put_metric_data: a namespace, metric name, value and unit.

Why it is used: Graphs and alarms on application behaviour AWS does not emit, using the same alarm machinery.

import boto3

cloudwatch = boto3.client('cloudwatch')

cloudwatch.put_metric_data(
    Namespace='MyApp',
    MetricData=[
        {
            'MetricName': 'OrderCount',
            'Value': 1,
            'Unit': 'Count'
        }
    ]
)

Interview talking point: “Each PutMetricData call takes at most 1,000 items, a custom metric cannot be older than two weeks, and Unit is immutable once published, so a wrong unit forks the metric. Publish aggregated StatisticValues, buffer and flush rather than calling per request, and back off on ThrottlingException.”

Q797: How do you implement CloudWatch Anomaly Detection?

What it is: CloudWatch Anomaly Detection models one metric’s own history and flags values outside the expected statistical band for use in an alarm.

Why it is used: Catches slow memory leaks and gradual latency drift that static thresholds miss without hand-tuning.

# Create anomaly detection alarm
aws cloudwatch put-anomaly-detection \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --statistic Average

Interview talking point: “The model accepts no dimensions, so add dimensions explicitly or you model a metric that has no data. It needs two weeks of history, works only on standard-resolution single metrics, and you act through a separate alarm on GreaterThanUpperThreshold referencing the detector id.”

Q798: How do you implement CloudWatch Contributor Insights?

What it is: Contributor Insights finds the top contributors to an anomaly in logs or metrics, such as the offending log group or API call.

Why it is used: Produces a root cause you never wrote a query for, in one step.

# Create insight rule
aws cloudwatch put-insight-rule \
  --rule-name my-rule \
  --rule-pattern '{"schema":{"root":"LogGroup","fields":[{"field":"@timestamp"},{"field":"@message"}]},"match":[{"equals":"ERROR","field":"@message"}]}'

Interview talking point: “The operations are put-insight-rule, describe-insight-rules, delete-insight-rules and list-contributors, with no put-contributor-rule. A rule needs a ContributionChart or EventList, rules enable asynchronously so read RuleStatus instead of assuming, and insights only appear once an anomaly actually exists.”

Q799: How do you implement CloudWatch Logs Insights?

What it is: CloudWatch Logs Insights runs SQL-like queries over log groups with no index to build, using fields, filter, sort, limit and stats.

Why it is used: Searches large log volumes in seconds from console or CLI without building a data warehouse pipeline.

# Query logs (async: start, then poll for results)
aws logs start-query \
  --log-group-name /aws/lambda/my-function \
  --start-time 1609459200 \
  --end-time 1609545600 \
  --query-string "fields @timestamp, @message | filter @message like 'ERROR' | stats count() by @message"
# -> returns a query-id; then:
aws logs get-query-results --query-id <query-id>

Interview talking point: “aws logs insights-query does not exist; the real flow is start-query, then get-query-results, then stop-query to cancel a runaway one. Operators run in pipeline order, bin on @timestamp gives a time series, cost is bytes scanned with a per-query timeout, and there is a concurrent-query quota.”

Q800: How do you implement X-Ray custom segments?

What it is: An X-Ray segment is a traced unit for a whole request; subsegments are nested units for downstream calls showing fan-out and timings.

Why it is used: Attributes latency to a specific cross-service call instead of guessing from averages.

from aws_xray_sdk.core import xray_recorder

@xray_recorder.capture('my_function')
def my_function():
    with xray_recorder.in_segment('subsegment') as subsegment:
        subsegment.put_annotation('key', 'value')
        # Do work

Interview talking point: “The APIs are the xray_recorder capture decorator and in_segment or in_subsegment context managers. Annotations are indexed and capped at 50 per segment and 5 KB, metadata is unindexed but retrievable. The X-Ray SDK is deprecated in favour of OpenTelemetry and ADOT with Application Signals.”

---

AWS Advanced Patterns 801-900

Q801: How do you implement dead letter queue pattern?

What it is: A dead letter queue preserves messages that cannot be processed so they can be inspected and replayed instead of being lost.

Why it is used: To make failures visible and recoverable once the root cause is fixed.

import boto3

sqs = boto3.client('sqs')

def process_with_dlq(message):
    try:
        process(message)
    except Exception as e:
        sqs.send_message(
            QueueUrl='https://sqs.../dlq',
            MessageBody=message['Body']
        )
        raise

Interview talking point: “SQS moves messages to a DLQ via a redrive policy on the queue, while Lambda and EventBridge use DLQs at the function or target level. Sending to a DLQ and re-raising causes duplicate retries.”

Q802: How do you implement retry with exponential backoff?

What it is: Exponential backoff retries failed operations by waiting base x 2^attempt, with jitter added to prevent synchronized retries.

Why it is used: To survive transient failures without amplifying load on a recovering dependency.

import random
import time

def retry_with_backoff(func, max_retries=3):
    for i in range(max_retries):
        try:
            return func()
        except Exception:
            if i == max_retries - 1:
                raise
            time.sleep(random.uniform(0, 2 ** i))

Interview talking point: “Full or decorrelated jitter prevents thundering herds, and delays must be capped. Managed services handle retries, so only retry idempotent operations with custom logic.”

Q803: How do you implement circuit breaker?

What it is: A circuit breaker stops calling a failing dependency after enough failures, failing fast until a trial request proves recovery.

Why it is used: To prevent thread, connection, and latency exhaustion from cascading into a full outage.

class CircuitBreaker:
    def __init__(self, failure_threshold=5):
        self.failures = 0
        self.failure_threshold = failure_threshold
        self.state = "closed"

    def call(self, func):
        if self.state == "open":
            raise Exception("Circuit open")
        try:
            result = func()
            self.failures = 0
            return result
        except Exception:
            self.failures += 1
            if self.failures >= self.failure_threshold:
                self.state = "open"
            raise

Interview talking point: “The three states are CLOSED, OPEN, and HALF_OPEN with a cool-down timer. Timeouts are essential, and only unhealthy errors should trip the circuit.”

Q804: How do you implement bulkhead pattern?

What it is: The bulkhead pattern partitions resources like threads, connections, or queues into isolated pools per dependency or feature.

Why it is used: To contain overload so one slow dependency does not starve the entire application.

import concurrent.futures

# Use thread pool executor as bulkhead
with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
    futures = [executor.submit(process, item) for item in items]
    results = [f.result() for f in futures]

Interview talking point: “Use per-dependency pools with bounded queues, explicit rejection policies, and timeouts on results. SDK connection pools and Lambda concurrency serve as real bulkheads.”

Q805: How do you implement saga pattern?

What it is: The saga pattern splits a distributed transaction into local transactions, each with a compensating action to undo it on failure.

Why it is used: To achieve eventual consistency across services without distributed two-phase commit.

def process_order(order):
    try:
        reserve_inventory(order)
        process_payment(order)
        confirm_order(order)
    except Exception as e:
        compensate(order)
        raise

Interview talking point: “Compensations can fail and must be idempotent, run in reverse order, and skip steps that never ran. Step Functions orchestrate sagas, while compensations are often new business actions, not rollbacks.”

Q806: How do you implement event sourcing?

What it is: Event sourcing stores all state changes as an immutable, append-only sequence of events that are replayed to derive current state.

Why it is used: To provide a full audit trail, time-travel, and rebuildable state for event-driven systems.

# Store events
def append_event(order_id, event):
    dynamodb.put_item(TableName='orders', Item={
        'order_id': order_id,
        'timestamp': now(),
        'event_type': event.type,
        'data': event.data
    })

# Replay events
def replay_events(order_id):
    events = dynamodb.query(
        TableName='orders',
        KeyConditionExpression='#oid = :id',
        ExpressionAttributeNames={'#oid': 'order_id'},
        ExpressionAttributeValues={':id': order_id}
    )['Items']
    return reduce(apply_event, events)

Interview talking point: “Use a composite sort key with a sequence number, enforce immutability with conditional writes, and version events for upcasting. Snapshots bound replay, and erasure is hard under immutability.”

Q807: How do you implement CQRS?

What it is: CQRS separates the write model from one or more denormalized read models, each optimized for its own access patterns.

Why it is used: To keep complex writes correct while making reads fast and scalable across different views.

# Command side
def create_order(order):
    dynamodb.put_item(TableName='orders', Item=order.to_dict())
    eventbridge.put_events(Entries=[{
        'Source': 'orders',
        'DetailType': 'OrderCreated',
        'Detail': order.created
    }])

# Query side
def get_order(order_id):
    return elasticache.get(f"order:{order_id}") or dynamodb.get_item(TableName='orders', Key={'order_id': order_id})

Interview talking point: “Writes publish events to projections that build read models, creating eventual consistency. The read model must be rebuildable from the event log, not just a cache of the command model.”

Q808: How do you implement cache-aside?

What it is: Cache-aside reads from cache and loads from the database on a miss, then writes the result back to the cache.

Why it is used: To reduce read latency without coupling the write path to cache consistency.

def get_product(product_id):
    # Check cache first
    cached = redis.get(f"product:{product_id}")
    if cached is not None:
        return cached

    # Fetch from DB
    product = dynamodb.get_item(Key={'product_id': product_id})

    # Store in cache
    redis.setex(f"product:{product_id}", 3600, product)

    return product

Interview talking point: “Check for None explicitly, not truthiness, to avoid treating cached empty values as misses. Use single-flight to prevent thundering herds and set jittered TTLs for stale data tolerance.”

Q809: How do you implement write-through cache?

What it is: Write-through writes to both the cache and the durable store as part of the same operation to keep them consistent.

Why it is used: To ensure subsequent reads hit the cache without the complexity of a read-miss path on writes.

def save_product(product):
    # Write to the DB first, then the cache (write-through)
    dynamodb.put_item(TableName='products', Item=product.to_dict())
    redis.set(f"product:{product.id}", product)

Interview talking point: “Always write to the database first, then the cache. Treat cache write failures as non-fatal and do not roll back a committed database write to avoid phantom records.”

Q810: How do you implement distributed lock?

What it is: A distributed lock provides mutual exclusion across processes using a shared store with a lease to auto-release on failure.

Why it is used: To serialize access when a local mutex cannot span multiple machines or tasks.

import boto3

def acquire_lock(key, ttl=30):
    return dynamodb.put_item(
        TableName='locks',
        Item={'lock_key': key, 'timestamp': now(), 'expires_at': now() + ttl},
        ConditionExpression='attribute_not_exists(lock_key) OR expires_at < :now',
        ExpressionAttributeValues={':now': now()}
    )

def release_lock(key, token):
    dynamodb.delete_item(
        TableName='locks',
        Key={'lock_key': key},
        ConditionExpression='token = :token',
        ExpressionAttributeValues={':token': token}
    )

Interview talking point: “Use conditional writes with a TTL and a fencing token to prevent stale holders from re-acquiring. Prefer optimistic concurrency or atomic operations when possible, as locks add complexity.”

---

AWS Architecture Scenarios 811-900

Q811: Design a photo sharing application

What it is: A serverless photo-sharing architecture accepts uploads, processes images, stores metadata, and delivers them securely at scale.

Why it is used: To serve large media to consumers while keeping costs low and content moderated.

Components:

• S3 for photo storage
• Lambda for processing (resize, thumbnail)
• DynamoDB for metadata
• CloudFront for delivery
• Cognito for auth
• Rekognition for moderation

Interview talking point: “Upload directly to S3 via presigned POST, trigger asynchronous processing, and serve via CloudFront with OAC. Keep buckets private and moderate content before public delivery.”

Q812: Design a real-time notification system

What it is: A real-time notification system pushes messages to clients over persistent connections with fan-out to multiple delivery channels.

Why it is used: To deliver low-latency alerts and messages to users, whether in-app or on mobile devices.

Components:

• API Gateway WebSocket
• DynamoDB for connections
• Lambda for processing
• SNS for fanout
• Pinpoint for mobile push

Interview talking point: “Store WebSocket connection state in DynamoDB and clean up on disconnect. Fan-out must be bounded, delivery is at-least-once, and clients must deduplicate by message ID.”

Q813: Design a streaming analytics platform

What it is: A streaming analytics platform ingests continuous events, computes windowed aggregations, archives raw data, and serves queries.

Why it is used: To gain sub-minute insights from high-volume streams without managing a self-hosted cluster.

Components:

• Kinesis Data Streams
• Kinesis Data Analytics
• Kinesis Firehose → S3
• Athena for queries
• QuickSight for visualization

Interview talking point: “Kinesis Data Streams feed Analytics for real-time aggregations, Firehose lands Parquet in S3, and Athena plus QuickSight serve queries. Use dynamic partitioning and columnar formats for cost efficiency.”

Q814: Design a serverless ETL pipeline

What it is: A serverless ETL pipeline extracts data on events or schedules, transforms it, and loads results into an analytics store.

Why it is used: To process spiky data volumes without maintaining a persistent compute cluster.

Components:

• S3 event triggers
• Lambda for extraction
• Glue for transformation
• Lambda for loading
• Redshift for analytics

Interview talking point: “Fan out S3 events to SQS before Lambda to avoid notification limits. Use Glue for large transforms, enforce idempotent loads, and orchestrate with Step Functions for retries and state tracking.”

Q815: Design a microservices architecture

What it is: A microservices architecture splits an application into independently deployable services, each owning its data and boundaries.

Why it is used: To let teams ship and scale independently while containing failures to specific capabilities.

Components:

• API Gateway
• Lambda/ECS services
• DynamoDB/RDS per service
• EventBridge for communication
• X-Ray for tracing
• App Mesh for service mesh

Interview talking point: “Each service needs its own data store, pipeline, and on-call. Use async events for decoupling, but synchronous calls for immediate responses. Avoid shared databases to prevent reintroducing coupling.”

Q816: Design a hybrid cloud architecture

What it is: A hybrid cloud architecture connects on-premises data centers to AWS for incremental migration or compliance requirements.

Why it is used: To extend existing investments while satisfying data residency, latency, or regulatory constraints.

Components:

• Direct Connect
• VPN backup
• Route 53 hybrid DNS
• Storage Gateway
• IAM federation

Interview talking point: “Use Direct Connect as primary with Site-to-Site VPN as backup, but test routing failover. Route 53 Resolver and Storage Gateway enable bidirectional access, and DNS must be planned carefully.”

Q817: Design a multi-region active-active

What it is: A multi-region active-active architecture runs full application copies in multiple Regions to serve traffic from both simultaneously.

Why it is used: To eliminate failover windows and reduce single-Region blast radius at higher cost.

Components:

• Global Accelerator
• Route 53 geolocation
• DynamoDB global tables
• Aurora global database
• S3 cross-region replication
• CloudFront

Interview talking point: “Writes typically go to one Region even with global tables or Aurora Global Database, creating read-active but write-limited semantics. Plan for data consistency, session sharing, and deploy parity.”

Q818: Design a data lake architecture

What it is: A data lake stores raw, unstructured data in object storage with a catalog and governance layer for direct querying.

Why it is used: To combine diverse data sources at scale without pre-loading everything into a warehouse.

Components:

• S3 as data lake
• Lake Formation
• Glue crawlers
• Athena for queries
• Redshift Spectrum
• QuickSight

Interview talking point: “Lake Formation governs access across engines, while partitioning and Parquet/ORC files prevent the swamp. Without strict bucket policies, users can bypass governance by accessing S3 directly.”

Q819: Design a machine learning pipeline

What it is: An ML pipeline moves data through preparation, labeling, training, evaluation, registry, deployment, and monitoring with feedback loops.

Why it is used: To make model development reproducible, auditable, and deployable like software.

Components:

• S3 for data storage
• SageMaker for training
• Ground Truth for labeling
• Model Registry
• Endpoint for inference
• Batch transform for batch

Interview talking point: “Track lineage for data, code, and hyperparameters for every run. Use SageMaker Feature Store to avoid train-serve skew, and monitor for data and concept drift with captured inference data.”

Q820: Design a IoT data pipeline

What it is: An IoT data pipeline ingests messages from constrained devices, filters at the edge, streams critical data, and archives the rest.

Why it is used: To handle millions of intermittent devices without overwhelming networks or storage costs.

Components:

• IoT Core for ingestion
• IoT Rules for processing
• Kinesis for streaming
• Lambda for real-time
• S3 for storage
• OpenSearch for search

Interview talking point: “IoT Core authenticates per-device with X.509 certificates. Use IoT Rules to filter early, Greengrass for offline buffering, and tune reporting frequency to control costs.”

---

AWS Interview Scenarios 821-900

Q821: How to secure S3 bucket with CloudFront?

What it is: To secure an S3 bucket behind CloudFront, keep the bucket private and allow access only through CloudFront’s signed identity.

Why it is used: To serve private content over HTTPS without exposing the bucket or proxying through servers.

1. Create an Origin Access Control (OAC) — OAI is legacy
2. Update the bucket policy to allow CloudFront (principal: cloudfront.amazonaws.com + SourceArn) only
3. Create CloudFront distribution
4. Point to S3 origin with OAC
5. Use signed URLs for private content

Interview talking point: “Use Origin Access Control (OAC), not the legacy OAI, with a bucket policy that restricts by SourceArn and SourceAccount. Block all public access and use signed URLs for private content.”

Q822: How to implement VPC peering?

What it is: VPC peering creates private IP connectivity between two VPCs without a NAT gateway or internet route.

Why it is used: To enable low-latency, private communication between VPCs under your control.

# Create peering connection
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-123 \
  --peer-vpc-id vpc-456

# Accept peering
aws ec2 accept-vpc-peering-connection \
  --vpc-peering-connection-id pcx-123

# Add routes on BOTH sides (accept first, then route both route tables)
aws ec2 create-route \
  --route-table-id rtb-123 \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id pcx-123
aws ec2 create-route \
  --route-table-id rtb-456 \
  --destination-cidr-block 10.0.0.0/16 \
  --vpc-peering-connection-id pcx-123

Interview talking point: “Routes and security group rules must be added on both sides, and peering must be accepted by the peer account. No transitive routing, and DNS support must be enabled if needed.”

Q823: How to set up IAM role for cross-account access?

What it is: A cross-account IAM role lets principals in one account assume a role in another to receive temporary permissions.

Why it is used: To grant controlled access across accounts without sharing long-lived access keys.

# Create role in target account
aws iam create-role \
  --role-name CrossAccountRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::source-account:root"},
      "Action": "sts:AssumeRole"
    }]
  }'

Interview talking point: “The trust policy must name the source principal, and the role needs a permissions policy. Use a specific principal or ExternalId to prevent confused deputy, and allow sts:AssumeRole in the source.”

Q824: How to configure Route 53 health checks?

What it is: Route 53 health checks actively probe endpoints and mark DNS records unhealthy when probes fail.

Why it is used: To automatically remove unhealthy targets from DNS rotation and restore them on recovery.

# Create health check
aws route53 create-health-check \
  --health-check-config '{
    "Type": "HTTPS",
    "FullyQualifiedDomainName": "example.com",
    "Port": 443,
    "ResourcePath": "/health"
  }'

Interview talking point: “Associate the health check with record sets, set appropriate failure thresholds and intervals, and test before attaching. For non-HTTP resources, use a CloudWatch alarm-based health check.”

Q825: How to set up WAF with CloudFront?

What it is: AWS WAF inspects incoming requests at CloudFront and blocks or challenges them based on defined rule sets.

Why it is used: To filter attacks like SQL injection, XSS, and bots at the edge before they reach the origin.

# Create web ACL
aws wafv2 create-web-acl \
  --name my-acl \
  --scope CLOUDFRONT \
  --default-action '{Allow={}}' \
  --visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"my-acl"}' \
  --region us-east-1

# Associate with distribution
aws cloudfront update-distribution \
  --id distribution-id \
  --web-acl-id acl-id

Interview talking point: “CloudFront-scoped WAF web ACLs must be created in us-east-1. Start with AWS managed rule groups, use Count action for testing, and leverage rate-based rules with CAPTCHA for suspicious traffic.”

Q826: How to implement S3 presigned URL?

What it is: S3 presigned URLs grant temporary, scoped access to a specific object using credentials without exposing them to clients.

Why it is used: To let users upload or download files without bucket public access or proxying through servers.

import boto3

s3 = boto3.client('s3')

url = s3.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
    ExpiresIn=3600
)

Interview talking point: “The URL is bound to the signing user’s permissions and key. Use generate_presigned_post for uploads with policy conditions, and keep expiry short since URLs are bearer credentials.”

Q827: How to implement Lambda URL auth?

What it is: Lambda function URLs provide dedicated HTTPS endpoints for invoking functions with configurable authentication.

Why it is used: To call Lambda directly without API Gateway when auth and caching needs are minimal.

def handler(event, context):
    auth = event['headers'].get('authorization')
    if not validate_token(auth):
        return {'statusCode': 401}
    return {'statusCode': 200}

Interview talking point: “Use AWS_IAM auth to have AWS validate signatures rather than implementing token validation in code. For public endpoints, configure CORS explicitly and avoid hand-rolled JWT checks.”

Q828: How to set up DynamoDB auto scaling?

What it is: DynamoDB auto scaling uses Application Auto Scaling to adjust provisioned read and write capacity based on utilization.

Why it is used: To avoid throttling during spikes while reducing costs during idle periods.

# Register scalable target
aws application-autoscaling register-scalable-target \
  --service-namespace dynamodb \
  --resource-id table/my-table \
  --scalable-dimension dynamodb:table:ReadCapacityUnits \
  --min-capacity 5 \
  --max-capacity 100

# Create policy
aws application-autoscaling put-scaling-policy \
  --policy-name my-policy \
  --service-namespace dynamodb \
  --resource-id table/my-table \
  --scalable-dimension dynamodb:table:ReadCapacityUnits \
  --policy-type TargetTrackingScaling \
  --target-tracking-scaling-policy-configuration '{
    "TargetValue": 70,
    "PredefinedMetricSpecification": {"PredefinedMetricType":"DynamoDBReadCapacityUtilization"}
  }'

Interview talking point: “Scale both read and write capacity units, and scale GSIs separately. Auto scaling only applies to provisioned tables, not on-demand. Target values around 70% help avoid oscillation.”

Q829: How to implement ECS task placement?

What it is: ECS placement strategies control how tasks are placed across instances, hosts, or AZs based on defined preferences.

Why it is used: To optimize for availability, density, or cost without relying on the default scheduler behavior.

{
  "placementStrategy": [
    {
      "type": "spread",
      "field": "attribute:ecs.availability-zone"
    },
    {
      "type": "binpack",
      "field": "memory"
    }
  ]
}

Interview talking point: “Only the first applicable strategy in the list is used, not all. Spread across AZs for resilience, and note that some strategies are not available on Fargate.”

Q830: How to implement EKS service mesh?

What it is: A service mesh adds networking features like retries, timeouts, mTLS, and observability between services via proxies.

Why it is used: To standardize cross-service communication and enforce policies without changing application code.

# Install App Mesh controller
helm install appmesh-controller eks/appmesh-controller \
  --namespace appmesh-system

# Add mesh resource
kubectl apply -f mesh.yaml

Interview talking point: “App Mesh is deprecated for new customers; Istio on EKS is the recommended alternative. Evaluate if ALB-based routing and client libraries meet needs before adopting a mesh.”

---

Additional Interview Questions 831-1000

Q831: How do you use AWS CLI with MFA?

What it is: AWS CLI MFA uses get-session-token with an MFA device ARN and one-time code to obtain temporary credentials.

Why it is used: To enforce multi-factor authentication for CLI access without long-lived keys.

# Get session token
aws sts get-session-token \
  --serial-number arn:aws:iam::123456789012:mfa/user \
  --token-code 123456

# Use credentials
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...

Interview talking point: “Use sts:assume-role with MFA when assuming roles; get-session-token works only with IAM user credentials. Prefer aws sso login or credential helpers over exporting tokens in shells.”

Q832: How do you configure AWS config for multiple accounts?

What it is: AWS Config aggregators collect resource configurations and compliance data from multiple accounts into a central view.

Why it is used: To assess compliance and inventory across an organization from one place.

1. Enable Config in each account
2. Create aggregator in Security account
3. Grant read permissions
4. Query aggregated data

Interview talking point: “Enable Config in each account, delegate admin rights, and grant aggregation authorizations. Scope recording to needed resource types to control evaluation costs.”

Q833: How do you use Systems Manager Parameter Store?

What it is: Systems Manager Parameter Store is a hierarchical key-value store for configuration and encrypted secrets.

Why it is used: To keep configuration out of code and share it across services with fine-grained access control.

# Create parameter
aws ssm put-parameter \
  --name /myapp/dbpass \
  --value "secret" \
  --type SecureString

# Get parameter
aws ssm get-parameter \
  --name /myapp/dbpass \
  --with-decryption

Interview talking point: “Use SecureString with a customer-managed KMS key for sensitive values. get-parameter requires —with-decryption, and overwrite is false by default to prevent accidental clobbering.”

Q834: How do you use AWS Secrets Manager?

What it is: AWS Secrets Manager stores secrets with automatic versioning and optional rotation via a Lambda function.

Why it is used: To manage credentials with audit trails and automated rotation without hardcoding secrets.

# Create secret
aws secretsmanager create-secret \
  --name prod/db-creds \
  --secret-string '{"user":"admin","pass":"secret"}'

# Get secret
aws secretsmanager get-secret-value \
  --secret-id prod/db-creds

Interview talking point: “Rotation requires a Lambda implementing the four-stage flow, and long-running consumers need restarts to pick up new versions. Parameter Store is cheaper for non-rotated config, while Secrets Manager excels at rotation.”

Q835: How do you use AWS Service Catalog?

What it is: AWS Service Catalog provides a governed catalog of approved IaC products for self-service provisioning.

Why it is used: To let teams deploy compliant infrastructure without tickets while enforcing platform controls.

1. Create portfolio
2. Add products
3. Create launch constraints
4. Grant access to users
5. Users launch products

Interview talking point: “Use portfolios, products, and launch constraints to restrict parameters and roles. Constraints like Rules, LaunchRole, and Account/Region limits are essential to prevent arbitrary provisioning.”

Q836: How do you use AWS AppConfig?

What it is: AWS AppConfig deploys configuration and feature flags to running applications with controlled rollout strategies and rollback.

Why it is used: To change behavior without redeploying code while minimizing risk with canary releases.

# Create application
aws appconfig create-application --name my-app

# Create environment
aws appconfig create-environment \
  --application-id app-id \
  --name production

# Deploy configuration
aws appconfig start-deployment \
  --application-id app-id \
  --environment-id env-id \
  --deployment-strategy-id strategy-id \
  --configuration-profile-id profile-id

Interview talking point: “Start-deployment requires a configuration version and a deployment strategy. Use alarms to trigger automatic rollback, and the AppConfig Agent to cache values and reduce API calls.”

Q837: How do you use AWS Proton?

What it is: AWS Proton lets platform teams define environment and service templates so developers can provision compliant services.

Why it is used: To standardize infrastructure and CI/CD while enabling self-service for development teams.

1. Register service template
2. Create environment template
3. Provision environments
4. Deploy services

Interview talking point: “Environment templates own shared resources, while service templates define the application stack. Proton availability is limited for new customers, so consider curated IaC modules as alternatives.”

Q838: How do you use AWS Amplify?

What it is: AWS Amplify is a toolchain for building and deploying full-stack applications with auth, APIs, data, and hosting.

Why it is used: To quickly prototype and deploy apps with managed build pipelines and backend provisioning.

# Initialize Amplify
amplify init

# Add API
amplify add api

# Deploy
amplify publish

Interview talking point: “Gen 2 is declarative with reviewable backend code, while Gen 1 is imperative. Amplify excels for prototypes, but explicit IaC is better for large, governed deployments.”

Q839: How do you use AWS App Runner?

What it is: AWS App Runner builds and runs containerized web applications from source or images with managed scaling and HTTPS.

Why it is used: To deploy HTTP services without managing Kubernetes, ECS clusters, or load balancers.

# Create service
aws apprunner create-service \
  --service-name my-service \
  --source-configuration '{
    "ImageRepository": {"RepositoryUrl": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image"}
  }'

Interview talking point: “For VPC access, use VPC networking mode with private subnets. Configure health checks and auto-scaling appropriately, as App Runner has limited sidecar and networking flexibility compared to ECS.”

Q840: How do you use AWS Batch?

What it is: AWS Batch runs container-based batch jobs on managed compute environments with per-second billing and Spot support.

Why it is used: To process parallel, compute-heavy workloads without operating a job scheduler or cluster.

# Create compute environment
aws batch create-compute-environment \
  --compute-environment-name my-env \
  --type MANAGED \
  --compute-resources '{"type":"FARGATE","maxvCpus":64}'

# Submit job
aws batch submit-job \
  --job-name my-job \
  --job-queue my-queue \
  --job-definition my-definition

Interview talking point: “Create separate Spot and on-demand compute environments with different queues for resilience. Job definitions are versioned, and retry strategies with timeouts are critical for reliability.”

Q841: How do you use AWS Lightsail?

What it is: AWS Lightsail provides simplified bundles for instances, databases, load balancers, and DNS with predictable pricing.

Why it is used: To run small workloads with minimal networking and IAM complexity.

# Create instance
aws lightsail create-instances \
  --instance-name my-instance \
  --blueprint-id ubuntu_20_04 \
  --bundle-id medium_2_0

# Create static IP
aws lightsail allocate-static-ip --static-ip-name my-ip

Interview talking point: “Validate blueprint and bundle IDs as they change over time. Lightsail networks are simplified with fixed firewalls, and load balancers only work with Lightsail instances, limiting flexibility.”

Q842: How do you use AWS WorkSpaces?

What it is: AWS WorkSpaces delivers managed Windows or Linux virtual desktops to users over a secure remote protocol.

Why it is used: To provide consistent, controlled desktops for contractors or task workers without managing physical hardware.

# Create directory
aws workspaces create-workspace-directory \
  --directory-service-arn arn:aws:ds:region:account:directory/directory-id

# Create workspace
aws workspaces create-workspaces \
  --workspaces '[{"DirectoryId":"directory-id","UserName":"user","BundleId":"value"}]'

Interview talking point: “Windows requires Microsoft AD, and desktops need two subnets in different AZs. Use RunningModeAutoStopTimeoutInMinutes to control costs, and plan network paths for PCoIP or RDP.”

Q843: How do you use AWS AppStream?

What it is: AppStream 2.0 streams Windows applications or full desktops from managed images to end users.

Why it is used: To give access to specific applications without installing software on user devices.

# Create fleet
aws appstream create-fleet \
  --name my-fleet \
  --instance-type stream.standard.small \
  --image-name AppStream-2.0-Latest

Interview talking point: “Availability is restricted in many Regions for new customers, so verify before proposing it. Use persistent home volumes on EFS for usability, and delete image builders when not in use.”

Q844: How do you use AWS Sumerian?

What it is: AWS Sumerian was a browser-based service for building and publishing 3D, AR, and VR experiences.

Why it is used: To create interactive 3D content without a full game engine.

Use Sumerian console to:

1. Create scene

2. Add assets

3. Add interactions

4. Publish

Interview talking point: “Sumerian has reached end of support and is no longer available. Modern alternatives include Three.js or Babylon.js hosted on S3 and CloudFront with Lambda for backend logic.”

Q845: How do you use AWS Personalize?

What it is: Amazon Personalize provides managed recommendations by training models on user-item interaction data with configurable recipes.

Why it is used: To deliver personalized rankings and item-to-item recommendations without building ML infrastructure.

# Create dataset group
aws personalize create-dataset-group --name my-group

# Import data
aws personalize create-dataset-import-job \
  --dataset-group-arn arn \
  --data-source location=s3://bucket/data

Interview talking point: “The schema must match imported data exactly, and a tracker is required to collect new interactions. Start with item-to-item recipes if user interaction data is sparse.”

Q846: How do you use AWS Forecast?

What it is: Amazon Forecast generates time-series forecasts using managed ML algorithms with prediction intervals and backtesting.

Why it is used: To predict demand, capacity, or staffing needs without selecting and tuning forecasting models manually.

# Create dataset
aws forecast create-dataset \
  --name my-dataset \
  --domain CUSTOM

# Create predictor
aws forecast create-predictor \
  --predictor-name my-predictor \
  --dataset-group-arn arn

Interview talking point: “Match frequency and timestamp formats to your data, and use imputation for gaps. Backtest metrics and quantiles are essential for evaluating forecast reliability.”

Q847: How do you use AWS Textract?

What it is: Amazon Textract extracts text, tables, forms, and signatures from scanned documents using ML.

Why it is used: To convert unstructured documents into structured data without building custom OCR pipelines.

import boto3

textract = boto3.client('textract')

response = textract.analyze_document(
    Document={'S3Object': {'Bucket': 'my-bucket', 'Name': 'doc.pdf'}},
    FeatureTypes=['TABLES', 'FORMS']
)

Interview talking point: “Synchronous mode supports small images and single-page PDFs only; use asynchronous jobs for multi-page documents. Reconstruct table relationships from cell graphs, as rows are not returned directly.”

Q848: How do you use AWS Rekognition?

What it is: Amazon Rekognition analyzes images and video to detect labels, faces, text, moderation issues, and celebrities.

Why it is used: To add computer vision capabilities like content moderation or face detection without training models.

import boto3

rekognition = boto3.client('rekognition')

response = rekognition.detect_labels(
    Image={'S3Object': {'Bucket': 'my-bucket', 'Name': 'image.jpg'}},
    MaxLabels=10
)

Interview talking point: “Set MinConfidence thresholds deliberately for moderation use cases. For face attributes, consider privacy and regulatory constraints, and use asynchronous jobs for video analysis.”

Q849: How do you use AWS Polly?

What it is: Amazon Polly converts text to lifelike speech with multiple voices, languages, and SSML control.

Why it is used: To generate audio narration, accessibility features, or voice responses programmatically.

import boto3

polly = boto3.client('polly')

response = polly.synthesize_speech(
    Text='Hello world',
    OutputFormat='mp3',
    VoiceId='Joanna'
)

Interview talking point: “Choose the appropriate engine and output format for quality and size. Use SSML and lexicons to correct pronunciation, and cache generated audio to reduce costs.”

Q850: How do you use AWS Transcribe?

What it is: Amazon Transcribe converts audio to text in batch or streaming modes with features like punctuation and diarization.

Why it is used: To transcribe calls, meetings, or media files without managing speech recognition infrastructure.

import boto3

transcribe = boto3.client('transcribe')

# Start transcription
transcribe.start_transcription_job(
    TranscriptionJobName='my-job',
    Media={'MediaFileUri': 's3://bucket/audio.mp4'},
    MediaFormat='mp4',
    LanguageCode='en-US'
)

Interview talking point: “Batch jobs require media in S3 in the same Region and correct format. Use domain-specific or custom language models for better accuracy, and prefer EventBridge notifications over polling.”

Q851: How do you use AWS Translate?

What it is: Amazon Translate is a neural machine translation service: submit text with source and target language codes and get the translation back, with custom terminology and parallel data support.

Why it is used: To translate content, tickets or documents at volume without training or operating a translation model.

import boto3

translate = boto3.client('translate')

response = translate.translate_text(
    Text='Hello',
    SourceLanguageCode='auto',
    TargetLanguageCode='es'
)

Interview talking point: “SourceLanguageCode auto is a real feature that detects the source language for you, and custom terminology keeps brand names untranslated. A single Text input is capped at a few thousand characters, so bulk work uses the asynchronous start-translation-job with S3 input and output.”

Q852: How do you use AWS Lex?

What it is: Amazon Lex builds conversational bots from intents, utterances and slot types; a runtime API turns each utterance into an intent plus slot values.

Why it is used: To handle voice or text interactions with structured intent and slot extraction instead of building NLU yourself.

import boto3

lex = boto3.client('lexv2-runtime')

response = lex.recognize_text(
    botId='<bot-id>',
    botAliasId='<bot-alias-id>',
    localeId='en_US',
    sessionId='user123',
    text='Hello'
)

Interview talking point: “The current runtime is Lex V2, whose recognize_utterance returns sessionState that must be echoed on the next turn, since it carries the slots already collected. For voice, pair Lex with Polly and telephony such as Amazon Connect.”

Q853: How do you use AWS Comprehend?

What it is: Amazon Comprehend extracts meaning from text with ML: entities, sentiment, key phrases, dominant language, toxicity, plus PII and custom classifiers.

Why it is used: To add text understanding for search, triage, routing or redaction without training a model.

import boto3

comprehend = boto3.client('comprehend')

response = comprehend.detect_entities(
    Text='Amazon is a company based in Seattle.',
    LanguageCode='en'
)

Interview talking point: “LanguageCode must be correct and Comprehend does not throw on a wrong one, so validate with detect_dominant_language first. Synchronous inputs cap at 5,000 bytes, and Comprehend Medical requires account approval; long-document reasoning belongs to a Bedrock model instead.”

Q854: How do you use AWS Kendra?

What it is: Amazon Kendra is managed enterprise search indexing documents from S3, SharePoint, websites and Salesforce, answering natural-language queries with attributed results.

Why it is used: To give users one search box across documents without knowing where they live, with source permissions respected.

# Create index
aws kendra create-index \
  --name my-index \
  --role-arn arn:aws:iam::123456789012:role/kendra-role

# Add documents
aws kendra batch-put-document \
  --index-id index-id \
  --documents '[{"Id":"1","Title":"Doc","Body":"Content"}]'

Interview talking point: “create-index fails without —role-arn, and bulk ingestion should be a data source rather than batch-put-document, because data sources give incremental crawling and ACL inheritance from the source. Without UserContextPolicy fed from your IdP, Kendra can return documents a user should not see.”

Q855: How do you use AWS Lookout for Vision?

What it is: Lookout for Vision is managed computer vision that detects defects and anomalies in industrial images by learning what normal product looks like.

Why it is used: To automate visual quality inspection without labelling every defect image or operating a CV pipeline.

# Create project
aws lookoutvision create-project --project-name my-project

# Create dataset
aws lookoutvision create-dataset \
  --project-name my-project \
  --dataset-type TRAIN

Interview talking point: “It takes images, not video, and needs no labelled anomalies since you train only on good product. Training and inference are asynchronous, so poll describe-project state or use EventBridge rather than expecting synchronous results; use SageMaker when you need bounding boxes.”

Q856: How do you use AWS DevOps Guru?

What it is: DevOps Guru collects operational data plus CloudTrail and produces anomaly insights and recommendations with suggested actions across common AWS resources.

Why it is used: To get anomaly detection and diagnosis you did not have to write, across EC2, RDS, Lambda and ASGs.

# Enable DevOps Guru
aws devops-guru enable-resource-collection \
  --account-ids '["123456789012"]'

# Get insights
aws devops-guru list-insights --status ACTIVE

Interview talking point: “enable-resource-collection requires —account-ids and silently does nothing without them. Coverage is a fixed resource list, findings overlap Compute Optimizer and Trusted Advisor and tend to be noisy, so use it for triage while alerting stays on CloudWatch Anomaly Detection; it bills per resource monitored.”

Q857: How do you use AWS Chatbot?

What it is: Chatbot, now part of Amazon Q Developer in chat apps, renders CloudWatch alarms and EventBridge events as actionable messages in Slack or Teams.

Why it is used: To put alarm and incident context into the chat channel the team already reads instead of only email.

# Create configuration
aws chatbot create-chatbot-configuration \
  --configuration-name my-config \
  --slack-workspace-id T00000000 \
  --slack-channel-id C123 \
  --iam-role-arn arn:aws:iam::123456789012:role/chatbot-role \
  --sns-topic-arns arn:aws:sns:us-east-1:123456789012:my-alerts

Interview talking point: “create-chatbot-configuration needs —sns-topic-arns, —iam-role-arn and the workspace and channel IDs, and chatbot.amazonaws.com must be allowed to publish to that topic or messages are dropped. Teams uses an SNS HTTPS subscription to a Chatbot webhook instead, and chat must never be the only paging path.”

Q858: How do you use AWS CodeGuru?

What it is: CodeGuru is an ML developer toolset: Reviewer comments on pull requests, and Profiler samples a running app for performance and cost problems.

Why it is used: To catch bugs, security issues and performance problems automatically as part of the normal review flow.

Use CodeGuru Reviewer

Connect repository

Get recommendations via CLI or console

Interview talking point: “Reviewer is associated with a repository through CodeStar Connections and comments on PRs; it excels at AWS API misuse, SQL injection and resource leaks but produces normal false positives, so tune with rules in .codegururc. Its edge over generic AI reviewers is AWS-specific and security knowledge.”

Q859: How do you use AWS CodeGuru Profiler?

What it is: CodeGuru Profiler runs an agent inside your application, sampling continuously to report where CPU time and memory go, including idle AWS resources.

Why it is used: To find performance and cost problems empirically from a real profile rather than by reading code.

from codeguru_profiler.profiler import Profiler

profiler = Profiler()
profiler.start()
# Your code
profiler.stop()

Interview talking point: “The Python package is published as codeguru-profiler and imported from codeguru_profiler.profiler, not aws_cg_profiler, which fails install with ModuleNotFoundError. Profiling has overhead, so treat it as a staged or canary activity, and compare profiles across deploys because a regression is a difference, not an absolute.”

Q860: How do you use AWS BugBust?

What it is: BugBust was a CodeGuru-family tool running bounty-style bug hunts in the IDE, importing a backlog and rewarding contributors who fixed challenges.

Why it is used: To clear known non-critical bugs with a gamified team event instead of a sprint commitment.

Use BugBust console to:

1. Import issues

2. Create challenges

3. Gamify bug fixes

Interview talking point: “BugBust was retired by AWS and is unavailable to new customers, so presenting it as current is a mistake. Frame clearing a bug backlog as a process question: triage by severity, Security Hub and Inspector for machine-detectable findings, dedicated capacity for the rest.”

---

Additional Scenarios 861-950

Q861: How do you implement AWS CDK Pipelines?

What it is: CDK Pipelines defines a CI/CD pipeline as a CDK construct inside the same app, with a synth step and one stage per environment.

Why it is used: So adding an environment or changing the pipeline is a reviewed code change that cannot drift from the app.

from aws_cdk import pipelines

pipeline = pipelines.CodePipeline(self, "Pipeline",
    synth=pipelines.ShellStep("Synth",
        commands=["npm ci", "cdk synth"]
    )
)

Interview talking point: “The minimal CodePipeline construct with a ShellStep is the correct CDK v2 form, but a pipeline with only a synth step deploys nothing until you call add_stage. Self-mutation and cross_account handle pipeline updates and multi-account stages, cdk bootstrap is required per account and Region, and cdk.context.json must be committed.”

Q862: How do you use AWS CDK Aspects?

What it is: A CDK Aspect visits every construct during synthesis to inspect it or apply a rule across the whole app at once.

Why it is used: To enforce an organisational rule once instead of relying on every stack to remember it.

from aws_cdk import Aspects, aws_iam as iam

class ValidateNoWildcardsAspect:
    def visit(self, node):
        if isinstance(node, iam.CfnManagedPolicy):
            # Check and warn
            pass

Interview talking point: “A plain class with a visit method never runs; the aspect must extend Aspects.Aspect and be registered with Aspects.of.add, then app.synth must actually be called. Raising fails the synth while Annotations addWarning only warns, and aspects cannot see deploy-time resources, so pair them with CloudFormation Guard and Config rules.”

Q863: How do you use AWS CDK Custom Resources?

What it is: A CDK custom resource is a CloudFormation resource backed by Lambda that runs an AWS API call CloudFormation does not support natively.

Why it is used: To bring an arbitrary SDK call into IaC as part of the stack lifecycle, permissions and rollback.

from aws_cdk import custom_resources as cr

custom = cr.AwsCustomResource(self, "Custom",
    on_create=cr.AwsSdkCall(
        service="SSM",
        action="putParameter",
        parameters={"Name": "param", "Value": "value", "Type": "String"}
    )
)

Interview talking point: “Set physical_resource_id explicitly, because a changing default id makes CloudFormation delete and recreate the resource on every update, and always define on_delete so the created thing is not leaked. Prefer a native construct when one exists, since each instance adds a Lambda and a role to every deployment.”

Q864: How do you use AWS SAM Deploy?

What it is: The SAM CLI translates a SAM template to CloudFormation, then builds, runs locally and deploys it via sam build, sam local and sam deploy.

Why it is used: For serverless development with a local feedback loop and one command to deploy.

sam deploy \
  --guided \
  --stack-name my-stack \
  --capabilities CAPABILITY_IAM

Interview talking point: “—guided is interactive and cannot be combined with —stack-name, —capabilities or explicit parameters; either run it once to create samconfig.toml or pass flags explicitly. CAPABILITY_IAM is required the first time IAM resources are created, and sam validate —lint is the real CI gate.”

Q865: How do you use AWS SAM Layers?

What it is: A SAM layer is a Lambda layer referenced from a serverless function by versioned ARN, letting several functions share one packaged dependency.

Why it is used: To share a common dependency or runtime across functions without duplicating it in every package.

template.yaml

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Layers:
        - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:my-layer:1

Interview talking point: “Hardcoding region and account with Fn::Sub assumes the layer already exists there and gives no dependency ordering; instead declare a Lambda LayerVersion in the same template and reference it with Ref. A layer is not a security boundary, and large layers add cold-start init time.”

Q866: How do you use Terraform remote state?

What it is: Terraform remote state is backend configuration placing the state file in a shared store, typically S3 with locking, so a team shares one authoritative state.

Why it is used: Because local state blocks collaboration and an unprotected state file exposes resource IDs and plaintext secrets.

backend.tf

terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

Interview talking point: “Add encrypt = true, bucket versioning and locking, either a DynamoDB table keyed on LockID or the newer use_lockfile for S3-native locking. The backend block cannot use variables or interpolation, so teams keep per-environment backend files, and OpenTofu adds state encryption at the source.”

Q867: How do you use Terraform modules?

What it is: A Terraform module is a reusable directory of .tf files with declared inputs and outputs, instantiated with a module block and versioned like code.

Why it is used: To build a VPC or service pattern once and reuse it across stacks without copy-paste drift.

main.tf

module "vpc" {
  source  = "./modules/vpc"
  cidr    = "10.0.0.0/16"
}

Interview talking point: “Every variable needs a type and, where it matters, a validation block, because validation is the only place a module refuses a bad input at plan time rather than halfway through apply. Pin the source to an exact ref, keep modules flat and single-purpose, and prefer for_each over boolean create flags.”

Q868: How do you use Terraform for_each?

What it is: for_each on a resource creates one instance per set or map element, giving each a stable key-based address in state.

Why it is used: To create many similar resources parameterised by key and addressable individually later.

resource "aws_instance" "server" {
  for_each = toset(["web1", "web2", "web3"])

  ami           = "ami-12345"
  instance_type = "t3.micro"
  tags = {
    Name = each.value
  }
}

Interview talking point: “Unlike count, for_each keys instances so inserting an element does not renumber the rest and destroy resources. It accepts a set, a map or toset of a list, keys must be known at plan time, and renaming a key destroys and recreates that instance.”

Q869: How do you use Ansible with AWS?

What it is: Ansible with AWS combines dynamic inventory from the EC2 API with AWS modules that converge configuration on discovered instances.

Why it is used: To apply configuration across a fleet selected by tags without SSH tooling or a static inventory.

playbook.yml

- name: Launch EC2
  hosts: localhost
  tasks:
    - amazon.aws.ec2_instance:
        image_id: ami-12345
        instance_type: t2.micro
        count: 1

Interview talking point: “The deprecated ec2 module is replaced by amazon.aws.ec2_instance, with amazon.aws.aws_ec2 for dynamic inventory. Playbooks must be idempotent, so guard command tasks with changed_when or creates, and pairing Ansible with SSM Session Manager removes SSH entirely; Terraform creates while Ansible configures.”

Q870: How do you use Packer with AWS?

What it is: Packer builds a machine image from a source configuration plus provisioners, outputting an AMI that EC2 launches already configured.

Why it is used: To bake packages and hardening into a golden image so instances boot fast and identical.

template.json

{
  "builders": [{
    "type": "amazon-ebs",
    "ami_name": "my-ami",
    "instance_type": "t2.micro",
    "source_ami": "ami-12345"
  }]
}

Interview talking point: “Put configuration in provisioners so the image is reproducible, set encrypt_boot with a KMS key, and pin the base AMI because Packer builds are not idempotent. Publishing the AMI version to an SSM parameter of type aws:ec2:image lets an ASG update by changing one parameter.”

Q871: How do you implement AWS Service Discovery?

What it is: AWS Cloud Map, CLI prefix servicediscovery, is service discovery for private VPC namespaces that registers instances and answers DNS queries for them.

Why it is used: To let services find each other by name inside a VPC without hardcoded IPs.

# Create private DNS namespace
aws servicediscovery create-private-dns-namespace \
  --name local \
  --vpc vpc-123

# Create service
aws servicediscovery create-service \
  --name my-service \
  --namespace-id ns-123

Interview talking point: “create-service requires —dns-config with DnsRecords and a routing policy, and for a DNS_HTTPS service the namespace goes in —dns-config NamespaceId rather than —namespace-id, which is the HTTP-type flag. Health checks are HTTP or NONE, so unhealthy cloud instances must be deregistered by the client.”

Q872: How do you implement AWS App Mesh?

What it is: App Mesh was a service mesh of virtual nodes, routes and services giving retries, mTLS and metrics across ECS, EKS or EC2.

Why it is used: To enforce and observe east-west traffic behaviour from configuration rather than from each codebase.

# Create mesh
aws appmesh create-mesh \
  --mesh-name my-mesh

# Create virtual node
aws appmesh create-virtual-node \
  --mesh-name my-mesh \
  --spec '{"listeners":[{"portMapping":{"port":80,"protocol":"http"}}]}'

Interview talking point: “App Mesh is closed to new customers, so new designs should use Istio or Linkerd on EKS. Beyond create-mesh and create-virtual-node you still need virtual services, routes and service discovery, and the sidecar adds a hop and a failure domain developers cannot see or debug.”

Q873: How do you implement AWS Cloud Map?

What it is: Cloud Map is the service discovery API registering instances in a private DNS namespace so clients resolve service.namespace to healthy IPs.

Why it is used: To replace hardcoded endpoints with dynamic discovery that updates as tasks come and go.

# Create namespace
aws servicediscovery create-private-dns-namespace \
  --name service.local \
  --vpc vpc-123

# Create service
aws servicediscovery create-service \
  --name my-service \
  --namespace-id ns-123

Interview talking point: “Cloud Map and Service Discovery are the same servicediscovery API, so naming them two services is the error to correct. The namespace must be a valid DNS domain like internal.example.com rather than plain local, and TTL controls how fast clients notice a deregistration.”

Q874: How do you implement AWS Step Functions Distributed Map?

What it is: Step Functions Distributed Map runs a Map state over up to a million items, each processed by a separate workflow execution.

Why it is used: To fan out very large collections where an Inline Map hits the 10,000-item and payload limits.

{
  "Comment": "Distributed Map",
  "StartAt": "Map",
  "States": {
    "Map": {
      "Type": "Map",
      "ItemProcessor": {
        "Processor": {
          "Type": "Task",
          "Resource": "arn:aws:states:::lambda:invoke"
        }
      },
      "End": true
    }
  }
}

Interview talking point: “The ASL needs Type DistributedMap plus an ItemReader, and ItemProcessor must set ProcessorConfig Mode DISTRIBUTED or the ItemReader is ignored. MaxConcurrency defaults to 10, ResultWriter moves aggregate results to S3 past the 256 KB state limit, and cost is per execution, so batching matters.”

Q875: How do you implement AWS EventBridge Scheduler?

What it is: EventBridge Scheduler invokes AWS targets on one-time, recurring or flexible schedules with standard retry and dead-letter delivery.

Why it is used: To run jobs on cron or rate expressions reliably at scale with one mechanism.

# Create schedule
aws scheduler create-schedule \
  --name my-schedule \
  --schedule-expression "rate(1 hour)" \
  --flexible-time-window 'Mode=OFF' \
  --target 'Arn=arn:aws:lambda:us-east-1:123:function:my-function,RoleArn=arn:aws:iam::123:role/scheduler-role'

Interview talking point: “The CLI prefix is scheduler, not eventsv2, which returns InvalidAction for createSchedule. Both —flexible-time-window and a target RoleArn trusting scheduler.amazonaws.com are required, and one-time schedules need ActionAfterCompletion DISABLE or they persist after firing.”

Q876: How do you implement AWS Control Tower guardrails?

What it is: Control Tower guardrails are preventive, detective or proactive controls applied to an organisational unit, managed by AWS or defined by you.

Why it is used: To enforce governance baselines across every account so resources cannot be configured outside policy.

Use AWS Control Tower console:

1. Select OU

2. Choose guardrail

3. Enable guardrail

Interview talking point: “Preventive controls deny the API call through SCPs, while detective controls evaluate with Config and post findings after the change. Control Tower only governs enrolled accounts, so a root-level SCP is what stops anything escaping, and deny-style controls need the AWSControlTowerExecution break-glass role.”

Q877: How do you implement AWS Audit Manager?

What it is: Audit Manager creates an assessment collecting evidence for a compliance framework automatically from AWS services and manually from uploads, producing a signed report.

Why it is used: To assemble compliance evidence continuously instead of answering auditor questions in a spreadsheet each year.

# Create assessment
aws auditmanager create-assessment \
  --name my-assessment \
  --framework-id framework-id

Interview talking point: “create-assessment requires —assessment-reports-configuration and control mappings or it fails ValidationException. Automated evidence comes from CloudTrail, Config and GuardDuty, but most requirements are process ones needing manual uploads, and the report tells you whether you have evidence, not whether you are compliant.”

Q878: How do you implement AWS Artifact?

What it is: Artifact is a portal for AWS compliance reports and agreements, including SOC reports, PCI attestations, ISO certifications and customer agreements.

Why it is used: To download audit evidence like the annual SOC 2 report without opening a support case.

Use Artifact console:

1. Download agreements

2. Access compliance reports

Interview talking point: “SOC 3 is the public report that often satisfies third-party questionnaires, while PCI coverage applies only to AWS infrastructure, not your application. Artifact proves AWS controls under shared responsibility, so your side still needs Config, Security Hub and Audit Manager, and the HIPAA BAA is requested here.”

Q879: How do you implement AWS Resource Access Manager?

What it is: Resource Access Manager shares named resources such as subnets, security groups, transit gateways and Route 53 zones with other accounts.

Why it is used: To let another account use a resource without copying it or giving up ownership.

# Create resource share
aws ram create-resource-share \
  --name my-share \
  --resource-arns arn:aws:ec2:us-east-1:123:subnet/subnet-123 \
  --principals 111111111111

Interview talking point: “create-resource-share is rejected without —principals, and sharing outside the organization needs —allow-external-principals. Shares do not require the consumer to accept them, a shared subnet lets another account place ENIs in your VPC, and enable-sharing-with-aws-organization must be on for organisation-wide shares.”

Q880: How do you implement AWS Tag Editor?

What it is: Tag Editor is a bulk search-and-edit tool that finds resources by tag and adds, edits or removes tags across them in one action.

Why it is used: To standardise or clean up tagging across hundreds of resources at once.

Use Tag Editor console:

1. Find resources

2. Add/remove tags

3. Apply changes

Interview talking point: “Tag Editor does not cover every resource type or operation, so search per service rather than expecting one query to span all of them. An empty tag value means remove the key, and renaming a tag value silently breaks IAM conditions and cost allocation reports, so treat it as a change with blast radius.”

---

Final Interview Questions 881-1000

Q881: How do you implement AWS Cost Explorer API?

What it is: The Cost Explorer API returns cost and usage aggregated by time, granularity, dimension groups and metrics for dashboards and allocation reports.

Why it is used: To automate cost reporting and showback or chargeback views without a third-party tool.

aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity DAILY \
  --metrics UnblendedCost

Interview talking point: “The CLI prefix is ce, since cost-explorer returns Unknown options. End dates are exclusive, so a Jan 1 to Jan 31 range skips a day, granularity is only DAILY or MONTHLY, tag grouping needs the tag activated first, and data lags up to 24 hours.”

Q882: How do you implement AWS Budgets Actions?

What it is: Budgets Actions attach an IAM policy, SCP or notification to a budget and apply it automatically when a threshold is crossed.

Why it is used: To make cost control automatic rather than waiting for a human to read an email.

# Create budget action
aws budgets create-budget-action \
  --account-id 123456789012 \
  --budget-name my-budget \
  --action-type STOP_EC2_INSTANCES \
  --action-threshold '{"Type":"PERCENTAGE","Value":100}'

Interview talking point: “create-budget-action needs —definition, —execution-role-arn and —notification-type, not —action-type or —action-threshold. Native action types are APPLY_IAM_POLICY and APPLY_SCP, so STOP_EC2_INSTANCES must be your own Lambda or Instance Scheduler, and budgets are per account.”

Q883: How do you implement AWS Compute Optimizer?

What it is: Compute Optimizer analyses EC2, ASG, EBS and Lambda utilisation and recommends right-sized configurations and instance types.

Why it is used: To cut compute cost using the account’s own observed utilisation instead of estimates.

# Opt-in
aws compute-optimizer update-enrollment-status \
  --status Active

# Get recommendations
aws compute-optimizer get-ec2-instance-recommendations

Interview talking point: “Opt-in is per account, and ASG-launched instances are reported through get-auto-scaling-group-recommendations rather than the EC2 list. Memory data must be enabled on the instance or launch template, otherwise recommendations ignore memory and will happily halve your size, and results reflect observed utilisation, not your SLA.”

Q884: How do you implement AWS License Manager?

What it is: License Manager tracks software licenses on EC2 and Marketplace subscriptions via self-inventory, manual entry or discovery rules.

Why it is used: To know whether software is licensed correctly across an account’s compute.

# Create license configuration
aws license-manager create-license-configuration \
  --name my-license \
  --license-counting-type vCPU

Interview talking point: “Counting type is the design decision: vCPU, core or instance, with a configurable core multiplier for per-core licensing. Self-inventory depends on the SSM AWS:SoftwareInventory plugin being enabled, and Marketplace licences are per account even when bought centrally.”

Q885: How do you implement AWS Marketplace subscriptions?

What it is: Marketplace lets you buy and deploy third-party AMIs, containers and SaaS products through your AWS account with billing consolidated on the invoice.

Why it is used: To deploy commercial products with AWS billing and, for SaaS, identity-aware access without a second login.

Use Marketplace console:

1. Browse products

2. Subscribe

3. Configure

4. Deploy

Interview talking point: “AMIs deploy into your account like any artefact, while SaaS provisioning uses CreateTenant and marketplace token entitlements validated against AWS’s public key. RegisterApplication with an IAM role grants the vendor scoped access, and Marketplace charges a transaction fee.”

Q886: How do you implement AWS Managed Services?

What it is: AWS Managed Services is an AWS-operated team taking on monitoring, incident response, patching, security and database operations under an SLA.

Why it is used: To get 24/7 operations without building a follow-the-sun NOC for an enterprise estate.

Use Managed Services:

1. Request engagement

2. Define operating model

3. Transition to production

Interview talking point: “AMS itself runs a shared responsibility model where they own the infrastructure and platform layer and you own application code and data. It is sold as an add-on gated by your support plan level, is Region-limited, and only pays off for a large or regulated estate.”

Q887: How do you use AWS Professional Services?

What it is: AWS Professional Services is AWS’s own consultancy delivering assessments, target architecture, migration and hands-on implementation.

Why it is used: To get expert help on a specific AWS problem without hiring a systems integrator.

Contact AWS Professional Services:

1. Assessment

2. Solution design

3. Implementation

Interview talking point: “A Well-Architected Review against its six pillars is the canonical assessment entry point, and MAP with its 7 Rs frames a large migration. Be explicit whether you want PS writing code or enabling your team, since a build-it-all engagement leaves you unable to maintain it.”

Q888: How do you implement AWS QuickSight embed?

What it is: QuickSight embedding embeds a dashboard or analysis in your own application so users see AWS analytics without an AWS account.

Why it is used: To put dashboards into a product without each user signing up for QuickSight.

# Generate embed URL
quicksight = boto3.client('quicksight')
url = quicksight.generate_embed_url_for_registered_user(
    AwsAccountId='123456789012',
    UserArn='arn:aws:quicksight:us-east-1:123456789012:user/default/embed-user',
    ExperienceConfiguration={
        'Dashboard': {'InitialDashboardId': 'dashboard-id'}
    }
)

Interview talking point: “The Python API is generate_embed_url_for_registered_user; get-dashboard-embed-url exists in neither Python nor CLI, where the command is generate-embed-url-for-dashboard returning a base64 payload for the Embedding SDK. Registered users must exist via register-user, anonymous embedding needs a dashboard configured for it, and generate a fresh URL per session.”

Q889: How do you implement AWS Data Exchange?

What it is: AWS Data Exchange is a managed marketplace for publishing, finding and subscribing to datasets with entitlements and revision tracking.

Why it is used: To share data with partners or buy third-party data through a governed, auditable exchange.

# Create data set
aws dataexchange create-data-set \
  --name my-dataset \
  --asset-type S3_SNAPSHOT

Interview talking point: “The modern API is two-step, create the dataset then create-asset inside a revision, so the classic one-shot asset-type call is rejected. Revisions are immutable, publishing is a job rather than a call, and imported data becomes yours, so run normal validation; Lake Formation is often simpler.”

Q890: How do you implement AWS Clean Rooms?

What it is: Clean Rooms lets two accounts analyse data jointly through SQL whose permitted joins are enforced by AWS, without seeing each other’s raw data.

Why it is used: To enable analytics or research partnerships where the parties will not exchange underlying data.

# Create collaboration
aws cleanrooms create-collaboration \
  --name my-collab \
  --creator-member-role-arn arn:aws:iam::123:role/CleanRoomRole \
  --members '[{"accountId":"111111111111","capabilities":["CAN_QUERY"]}]' \
  --auto-approval-enabled

Interview talking point: “create-collaboration needs —creator-member-role-arn, and the auto-approval flag differs between collaboration and clean room. Query rules restrict join types and DescribeTable hides ungranted columns, so the restriction is technical rather than contractual, and query logging to CloudWatch is how every query is audited.”

Q891: How do you implement AWS HealthLake?

What it is: HealthLake stores FHIR healthcare data in a purpose-built datastore with bulk import and export in FHIR, HL7 v2 and SMART on FHIR.

Why it is used: To hold PHI in a store built around the FHIR resource model with gated analytics.

# Create data store
aws healthlake create-fhir-datastore \
  --datastore-name my-datastore \
  --datastore-type-version R4

Interview talking point: “Datastore version takes R4 or R4B with no FHIR prefix, and the schema configuration controls what PHI can ever land in the store. A customer-managed KMS key is required for BAA-grade control, all access is IAM-authenticated and audited, and analytics use de-identified exports to S3.”

Q892: How do you implement AWS IoT Greengrass?

What it is: IoT Greengrass runs a local runtime on a gateway so rules, data processing and app logic execute at the edge with cloud-managed deployment.

Why it is used: To keep devices working offline, cut bandwidth by processing locally, and ship updates to a fleet of gateways.

# Create thing group
aws iot create-thing-group --thing-group-name my-group

Interview talking point: “aws iot create-thing-group creates an IoT Core group and deploys nothing; the Greengrass flow is create-core-device, create-group with a group version, then greengrassv2 create-deployment. A Lambda uploaded but not referenced in a group version never runs, and fleet rollouts need staging and canary with rollback.”

Q893: How do you implement AWS IoT Core for edge?

What it is: IoT Core at the edge means local rules, local storage and a device gateway that keeps working when the WAN link is down.

Why it is used: For remote sites, vehicles or industrial cells where connectivity is intermittent or per-message cloud round trips are impractical.

# Create edge configuration
aws iotthingsgraph create-flow-template \
  --definition '{"nodes":[]}'

Interview talking point: “aws iotthingsgraph create-flow-template does not exist, since Things Graph was closed to new customers; Greengrass is the replacement. Use a Greengrass core device per site, filter a subset of messages upstream because IoT bills per message, and treat certificate onboarding and staged jobs as the real work.”

Q894: How do you implement AWS FreeRTOS?

What it is: FreeRTOS is a small real-time OS that AWS maintains a port of for microcontrollers, with an AWS IoT connectivity layer on top.

Why it is used: For microcontrollers with kilobytes of RAM that must talk to IoT Core.

Use FreeRTOS console:

1. Create project

2. Configure device

3. Deploy

Interview talking point: “There is no FreeRTOS console; register devices with aws iot create-thing and create-keys-and-certificate, then build on FreeRTOS+TCP and the core_mqtt module. TLS needs roughly 20 KB RAM so devices under about 64 KB are out, and unsecured socket flags must never ship.”

Q895: How do you implement AWS Snow Family?

What it is: The Snow Family is AWS physical data transfer: Snowball Edge devices shipped to you, Snowcone, and storage appliances for data centres.

Why it is used: To move petabytes offline when a network link would take weeks or data must not cross the internet.

# Create job
aws snowball create-job \
  --job-type EXPORT \
  --address-id address-id \
  --s3-resources '[{"BucketName":"my-bucket"}]'

Interview talking point: “aws snowball create-job covers device jobs, but importing data is aws s3 sync after transfer, and export jobs target buckets owned by another party. Jobs need an address label and an UnlockCode before transfer starts, and you must delete-job when finished.”

Q896: How do you implement AWS Outposts?

What it is: Outposts is a rack-scale on-premises extension of a Region running EC2, EBS and a subset of RDS inside your data centre.

Why it is used: For workloads needing sub-millisecond latency or data locality next to equipment that cannot leave the building.

Use Outposts console:

1. Order Outpost

2. Install

3. Register

4. Deploy workloads

Interview talking point: “An Outpost is one Availability Zone of its parent Region, not a whole region, and only a fixed service list runs there, with no Lambda, S3 or DynamoDB. Subnets have no NAT gateway, connectivity rides Direct Connect, and Local Zones usually solve the same problem with far less commitment.”

Q897: How do you implement AWS Local Zones?

What it is: A Local Zone is an AWS-managed AZ-like location in a metro area letting you run EC2, EBS and RDS near users.

Why it is used: To get low single-digit millisecond latency without deploying a full Region.

# Enable Local Zone
aws ec2 describe-availability-zones \
  --filters "Name=zone-type,Values=local-zone"

# Create subnet in Local Zone
aws ec2 create-subnet \
  --vpc-id vpc-123 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1-wl1-bos-wl-1

Interview talking point: “You must opt in per account per zone, confirmed with describe-availability-zones filtering on zone-type. RDS there is a standalone instance that cannot join a Multi-AZ or Aurora cluster, there is no NAT gateway, and the parent Region remains the control plane.”

Q898: How do you implement AWS Wavelength?

What it is: Wavelength Zones place 5G compute inside a telecom carrier’s data centre, giving sub-10-millisecond round trips to mobile devices on that carrier.

Why it is used: For mobile apps where latency to a 5G handset dominates, such as AR, gaming and IoT.

# Create subnet in Wavelength Zone
aws ec2 create-subnet \
  --vpc-id vpc-123 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1-wl1-nyc-wl-1

Interview talking point: “A Wavelength subnet has no internet gateway and no NAT gateway, so egress goes over Direct Connect or Transit Gateway. Service coverage is EC2 and EBS only, and carrier 5G data transfer is billed per GB on top of instance cost.”

Q899: How do you implement AWS Gaming?

What it is: Gaming on AWS is GameLift fleets of dedicated or serverless game servers plus the storage, CDN, identity and analytics around them.

Why it is used: To run low-latency game servers with elastic capacity and matchmaking instead of maintaining plain EC2.

Use GameLift:

1. Upload game build

2. Create fleet

3. Scale automatically

Interview talking point: “CreateBuild then CreateFleet, with GameLift Anywhere for your own hardware, are the models to know. A DynamoDB ConditionExpression on a player-in-match record is the concurrency control preventing two servers accepting one player, and anti-cheat has no AWS service; it is server-authoritative logic.”

Q900: How do you implement AWS Thinkbox?

What it is: Thinkbox Deadline was AWS’s render-queue manager, scheduling frames across a farm of Deadline Workers submitted from a client.

Why it is used: To manage distributed rendering for VFX and animation where naive job submission wastes capacity.

Use Thinkbox Deadline:

1. Install Deadline

2. Configure render farms

3. Submit jobs

Interview talking point: “Deadline reached end of support and Frost, Krakatoa and Color were retired, so it is not a current AWS service. The modern replacement is AWS Batch with Spot and automatic requeue plus S3 for frames, keeping a dependency-aware queue rather than flat job arrays.”

---

Final Practical Questions 901-1000

Q901: Design a serverless data processing pipeline

What it is: A serverless data pipeline chains event-triggered, managed steps with no servers to provision or patch.

Why it is used: For spiky data volumes where paying for idle capacity is unacceptable.

S3 Events → Lambda → Kinesis → Firehose → S3 → Athena

Interview talking point: “S3 events cannot target Kinesis directly—use SQS, Lambda, EventBridge, or S3→Lambda→Firehose→S3. Since events are at-least-once and unordered, use idempotent, stateless steps and consider partitioning for Athena cost.”

Q902: Design a multi-tenant SaaS architecture

What it is: A multi-tenant SaaS architecture serves many customers from one codebase while isolating their data, config, and performance.

Why it is used: To run efficiently for many customers without data or noisy-neighbor interference.

Account isolation + Cognito + Per-tenant data + WAF

Interview talking point: “Choose isolation model: DB-per-tenant (max isolation, fleet mgmt), shared schema with tenant_id (cheapest but risky without RLS), or pooled. Always derive tenant from verified claims, never request params.”

Q903: Design a disaster recovery system

What it is: A DR system combines replicated/backed-up state, a failover procedure, and a tested way to redirect traffic.

Why it is used: To meet RTO/RPO objectives during Region, AZ, or site failures.

Multi-region with automated failover + backups + tested RTO/RPO

Interview talking point: “RTO/time and RPO/data trade off by tier: Backup/Restore (hours/days), Pilot Light (min-hrs/min), Warm Standby (min/min), Active-Active (~0/~0). Aurora Global DB, DynamoDB global tables, and tested failback reduce risk.”

Q904: Design a secure CI/CD pipeline

What it is: A secure CI/CD pipeline builds, tests, and deploys with no long-lived creds and auditable, policy-gated approvals.

Why it is used: To ensure consistent, reviewable, tamper-evident deployments without production SSH access.

CodeCommit + CodeBuild + CodeDeploy + IAM + VPC + WAF

Interview talking point: “Use OIDC for short-lived creds (no AWS keys), disable privileged builds, store secrets in Secrets Manager/SSM, and prefer WAF for apps—not pipelines. Alarm-triggered rollbacks and cross-account roles improve safety.”

Q905: Design a real-time analytics dashboard

What it is: A real-time analytics dashboard shows operational metrics updating on seconds-to-minutes timescale from streaming ingest.

Why it is used: To see current state (latency, errors, throughput) and alert in near-real time.

Kinesis + Firehose + OpenSearch + Kibana

Interview talking point: “Kinesis shards give ordered, replayable ingest; Firehose→S3 is durable but buffered (60s min), while OpenSearch is sub-second but pricier. Use Kinesis Analytics for aggregation and emit counts/histograms, not raw events.”

Q906: Design a mobile backend

What it is: A mobile backend provides auth, API, app data, binary assets, and push for global mobile clients.

Why it is used: To support mobile-specific needs (tokens, offline sync, uploads, push) without managing infra.

API Gateway + Lambda + DynamoDB + Cognito + S3

Interview talking point: “Never ship secrets/API keys in mobile apps—use Cognito with PKCE/JWT (not SigV4 from device). Prefer AppSync for offline sync/conflict resolution, presigned S3 uploads, and per-user throttling.”

Q907: Design a machine learning inference API

What it is: An ML inference API serves model predictions behind an HTTP endpoint with scaling, batching, and concurrency control.

Why it is used: To serve predictions to apps synchronously with managed scaling.

API Gateway + Lambda + SageMaker endpoint

Interview talking point: “Use serverless SageMaker endpoints for sporadic traffic (scale-to-zero) or provisioned for p99-sensitive paths (cold starts). Tune MaxConcurrentInvocationsPerInstance and use multi-model endpoints only when models share container/runtime.”

Q908: Design a content delivery network

What it is: A CDN caches content at globally distributed edge locations, terminating client connections and shielding the origin.

Why it is used: To cut latency and offload origin while enforcing policy before traffic reaches it.

CloudFront + S3 + WAF + Route 53

Interview talking point: “Use Origin Access Control (not OAI) for private S3. Forwarding cookies/query strings disables caching—prefer cache policies and versioned paths over frequent invalidations. WAF runs at edge (CloudFront WAF in us-east-1).”

Q909: Design a hybrid cloud architecture

What it is: A hybrid cloud architecture connects on-prem to AWS with defined authority and a single operating model.

Why it is used: To extend existing systems, meet latency/residency needs, or migrate incrementally.

Direct Connect + VPN + Storage Gateway + IAM federation

Interview talking point: “Make DX primary, VPN backup (test failover/BGP prefs). Use Route 53 Resolver for hybrid DNS, DataSync/Snowball for transfers, and IAM Identity Center/IRSA/IRSA-like (Roles Anywhere) for unified identity.”

Q910: Design a data archival system

What it is: A data archival system moves rarely-read data to low-cost durable storage on a schedule, keeping it retrievable.

Why it is used: To cut storage costs while meeting retention/legal obligations.

S3 Lifecycle → Glacier + S3 Object Lock + Cross-region replication

Interview talking point: “Use S3 lifecycle to Glacier Flexible/Instant/Deep Archive—note Deep Archive has 12h retrieval and 40GB min. S3 Object Lock (WORM) is the feature (not “Vault Lock”); COMPLIANCE is immutable even by root.”

Q911: How do you optimize Lambda cold starts?

What it is: A Lambda cold start is the latency to create a new execution env (microVM, runtime, code init).

Why it is used: To keep API latency predictable under spiky/bursty traffic.

Use provisioned concurrency, minimize package, avoid VPC

Interview talking point: “Provisioned concurrency reduces cold starts but costs when idle (must set on alias/version). VPC ENIs can throttle scale-out—prefer VPC endpoints/RDS Proxy. SnapStart (Java), larger memory (more CPU), and smaller packages help.”

Q912: How do you secure DynamoDB?

What it is: Securing DynamoDB means IAM access control, network restriction, encryption, auditing, and backups.

Why it is used: To protect sensitive key-value data where misconfig can cause a full breach.

IAM policies, VPC endpoints, encryption, fine-grained access

Interview talking point: “DynamoDB has no per-item auth—enforce row-level in app or proxy. Use gateway VPC endpoint (free), CloudTrail data events (scope due to payload), encryption at rest with KMS, and least-privilege IAM.”

Q913: How do you optimize S3 performance?

What it is: S3 performance tuning optimizes request distribution, object layout, and reads via cache.

Why it is used: To keep S3 fast/cheap at scale as request patterns and sizes vary.

Multipart upload, CloudFront, prefix partitioning

Interview talking point: “S3 scales per prefix (5000 req/s)—use hashed/random prefixes to avoid hotspots. Multipart upload required >5GB and recommended for large files. CloudFront is best read optimization; consider S3 Select for columnar reads.”

Q914: How do you implement RDS high availability?

What it is: RDS HA uses a synchronously replicated standby in another AZ with automatic promotion on primary failure.

Why it is used: To survive AZ/instance failures without manual intervention.

Multi-AZ deployment, read replicas, automated backups

Interview talking point: “Multi-AZ is synchronous failover (not cross-Region) and needs app reconnect/backoff. Read replicas are async (for scaling) and manual promote—not automatic HA. Use deletion protection, PITR backups, and Performance Insights.”

Q915: How do you secure EKS clusters?

What it is: EKS cluster security is layered: API server access, node network, pod permissions, and secrets encryption.

Why it is used: To prevent lateral movement if a pod/node/cred is compromised.

RBAC, network policies, pod security, secrets encryption

Interview talking point: “Use EKS access entries (not legacy aws-auth in many cases), disable public endpoint/private access, encrypt etcd with KMS. Enforce RBAC, Pod Security Admission (restricted), network policies (CNI must support), and IRSA.”

Q916: How do you implement auto-scaling?

What it is: Auto Scaling adjusts capacity via target tracking, step scaling, scheduled scaling, or predictive scaling.

Why it is used: To match capacity to demand—cost down at low load, scale up for spikes.

Target tracking, step scaling, scheduled scaling

Interview talking point: “Target tracking reacts after load; step scaling for non-linear metrics; scheduled for known peaks; predictive scales before. Scaling can’t create capacity—ensure quotas/AZs/subnets. ASG can’t scale from zero without min>0.”

Q917: How do you implement caching strategy?

What it is: A caching strategy chooses what/where/how long to cache and how to invalidate across layers.

Why it is used: To cut latency, origin load, and DB load.

CloudFront, ElastiCache, DAX, proper TTL

Interview talking point: “CloudFront for public/immutable global content (forwarding cookies disables caching). ElastiCache for general KV (set maxmemory-policy). DAX is DynamoDB-specific (eventually-consistent cache only). Use TTL + jitter to avoid stampedes.”

Q918: How do you implement disaster recovery testing?

What it is: DR testing deliberately exercises failover/restore under controlled conditions on a schedule.

Why it is used: To verify RTO/RPO claims before a real incident.

Regular DR drills, document procedures, automated testing

Interview talking point: “Test backup restore (usable), failover (measured time), RPO verification, and regional failover. Use AWS Fault Injection Simulator (test account) and AWS Resilience Hub; track achieved RTO/RPO vs targets each time.”

Q919: How do you implement cost allocation?

What it is: Cost allocation attributes every charge to a team/project/env via metadata attached at creation.

Why it is used: To know what costs and who pays—prerequisite for optimization.

Tags, Cost Explorer, budgets, reports

Interview talking point: “Activate cost allocation tags (limit 30) before using in Cost Explorer/CUR/budgets. Enforce via AWS Organizations tag policies/IaC; use Cost Categories for business buckets. CUR to S3+Athena gives resource-level detail.”

Q920: How do you implement security monitoring?

What it is: Security monitoring continuously collects logs/threats/misconfigs/vulns and alerts with account posture view.

Why it is used: To detect compromises or dangerous misconfigs quickly and automatically.

GuardDuty, Security Hub, CloudTrail, Config

Interview talking point: “CloudTrail gives audit (mgmt free; data events charged, include payload). GuardDuty detects threats across logs/DNS/VPC/EKS. Security Hub aggregates posture/standards. Config detects drift. Centralize to log archive account.”

Q921: How do you implement incident response?

What it is: Incident response is a defined process for detect/triage/mitigate/learn with severity, roles, escalation, comms.

Why it is used: To respond faster/consistently under pressure with fewer errors.

Runbooks, automation, escalation, communication

Interview talking point: “Runbooks must have explicit commands/expected outputs/branches. Use time-boxed escalation, paging with ack tracking, and a single incident commander. Blameless post-mortems with tracked actions; test via game days/FIS.”

Q922: How do you implement change management?

What it is: Change management controls what may deploy, by whom, how reviewed, rolled back, and recorded.

Why it is used: To make changes safe/auditable and prevent unreviewed changes causing outages.

Code review, testing, deployment automation, rollback

Interview talking point: “Require PR reviews (non-author), automated checks (cfn-lint/Checkov), immutable artifacts via pipeline (no console). Every deploy needs automated rollback on alarm (CodeDeploy). Emergency changes need post-hoc review within 24h.”

Q923: How do you implement compliance monitoring?

What it is: Compliance monitoring continuously evaluates against a standard, collects evidence, and alerts on drift.

Why it is used: To stay compliant continuously rather than scrambling for annual audits.

Config rules, Security Hub, Audit Manager

Interview talking point: “Config evaluates rules/conformance packs (evals cost). Security Hub aggregates findings and compliance scores. Audit Manager assembles evidence. Centralize via delegated admin/aggregators across accounts; scope recording to cut costs.”

Q924: How do you implement performance monitoring?

What it is: Performance monitoring measures latency, throughput, utilization, errors and attributes request cost to code/service.

Why it is used: To find bottlenecks (slow downstream, cold starts, bad queries) rather than guessing from averages.

CloudWatch, X-Ray, Performance Insights

Interview talking point: “Watch p99/p95 (not averages), error rates, queue depths. Performance Insights answers “why slow DB” (wait events/SQL). X-Ray is legacy—use ADOT/OpenTelemetry or CloudWatch Application Signals for tracing.”

Q925: How do you implement operational monitoring?

What it is: Operational monitoring observes availability/latency/errors/saturation/business signals with dashboards and alarms.

Why it is used: To detect degradation before users report and give shared view.

CloudWatch dashboards, alarms, escalation

Interview talking point: “Dashboards for investigation; alarms for action—alert on user symptoms, not causes. Use TreatMissingData, N-of-M (datapointsToAlarm), composite alarms, and anomaly detection. Link every alarm to a runbook.”

Q926: How do you implement backup automation?

What it is: Backup automation captures workloads on schedule/policy, retains, and copies to separate account/Region.

Why it is used: To ensure backups run reliably without relying on ad-hoc scripts.

AWS Backup, lifecycle policies, cross-region replication

Interview talking point: “AWS Backup centralizes policies (tag-based selection), lifecycle, and vaults with AWS Backup Vault Lock (immutable). RDS automated backups give PITR only (35d). Test restores regularly—they’re the only way to verify backups work.”

Q927: How do you implement secrets management?

What it is: Secrets management stores creds encrypted, with per-secret access, versioning, rotation, and audit logs.

Why it is used: To eliminate long-lived secrets in code/images/config.

Secrets Manager, rotation, IAM policies

Interview talking point: “Secrets Manager supports automatic rotation (Lambda + AWSCURRENT/AWSPREVIOUS). SSM Parameter Store is cheaper but rotation less turnkey. No manager prevents exfiltration if app can GetSecretValue—enforce IAM; cache secrets per env carefully.”

Q928: How do you implement access management?

What it is: Access management controls who/what can act, using roles (not long-lived keys), least privilege, MFA, and analysis.

Why it is used: To minimize blast radius with temporary, reviewable credentials.

IAM roles, policies, MFA, access analyzer

Interview talking point: “Prefer roles/temporary creds; use resource-based policies + SCPs + permissions boundaries. Deny always wins. IAM Access Analyzer finds over-permissive/external access/unused perms. Never trust account root broadly; use ExternalId with cross-account.”

Q929: How do you implement network security?

What it is: Network security layers containment: VPC, SGs/NACLs (L3–4), and WAF/Shield (L7), plus egress control.

Why it is used: To limit blast radius, prevent lateral movement, and block L7 attacks SGs can’t see.

VPC, security groups, NACLs, WAF, Shield

Interview talking point: “SGs are stateful/allow-only; NACLs stateless with deny rules. SG referencing is useful but not transitive. WAF runs at edge (CloudFront us-east-1); Shield Standard free, Advanced paid. Use VPC endpoints to avoid NAT.”

Q930: How do you implement data encryption?

What it is: Data encryption protects data at rest, in transit, and in use with keys managed separately from data.

Why it is used: To ensure compromised storage/network alone doesn’t expose plaintext.

KMS, client-side encryption, SSL/TLS

Interview talking point: “Enforce TLS everywhere (aws:SecureTransport deny). SSE-S3 free; SSE-KMS gives CMK control (costly at high freq); SSE-C means you must keep key. KMS separation of duties critical—both key policy and IAM must allow.”

Q931: How do you implement logging strategy?

What it is: A logging strategy defines what/where/retention/access, with structured/correlated/centralized logs.

Why it is used: To reconstruct incidents/audits and debug without deploys.

CloudTrail, CloudWatch, centralized S3, retention policies

Interview talking point: “CloudTrail mgmt free; data events charged (payload). CloudWatch Logs needs structured JSON + correlation IDs (traceId/requestId). Set explicit retention per group (avoid “never”). Centralize to log archive account with Object Lock.”

Q932: How do you implement alerting strategy?

What it is: An alerting strategy maps symptoms to notifications with severity, routing, responder, and runbook.

Why it is used: To alert those who can act quickly, without drowning them in noise.

CloudWatch alarms, SNS, escalation, runbooks

Interview talking point: “Alert on user symptoms (errors/latency), not causes. Use TreatMissingData, N-of-M, composite alarms, anomaly detection. Every alarm links to runbook; require ack tracking on paging. One alert→one action.”

Q933: How do you implement automation strategy?

What it is: An automation strategy decides which ops to codify via triggers (event/schedule/pipeline) with human approval where needed.

Why it is used: To make routine ops reliable, repeatable, auditable, and reduce toil.

Systems Manager, Lambda, EventBridge, pipelines

Interview talking point: “SSM for infra ops (Automation/Run/Patch/State/Session). EventBridge + Lambda for event-driven logic. CodePipeline for deploys. Automate deterministic frequent tasks; don’t automate ambiguous judgement-heavy ones.”

Q934: How do you implement infrastructure testing?

What it is: Infrastructure testing validates IaC templates are syntactically valid, deployable, and correct in ephemeral envs.

Why it is used: To catch template/config errors before production deploys.

CloudFormation validation, cfn-lint, taskcat

Interview talking point: “validate-template (basic) → cfn-lint (policy/typos) → CloudFormation Guard (property rules) → taskcat (real deploy test). Add Checkov/tfsec in CI. Use change-set review for Terraform/CFN to catch unintended changes.”

Q935: How do you implement blue-green deployment?

What it is: Blue-green deployment runs two identical envs; deploy to idle, verify, switch traffic all-at-once.

Why it is used: To get instant, fully reversible rollback via single switch.

Two environments, weighted routing, automated rollback

Interview talking point: “DNS/ALB target-group swap or CodeDeploy blue/green. “Weighted” is canary, not blue-green. Data is hard—schema changes need expand/contract (rollback can break if non-backward compatible). Green costs double while active.”

Q936: How do you implement canary deployment?

What it is: Canary deployment releases to small traffic %, measures, and progressively increases until full or auto-rollback.

Why it is used: To limit blast radius of bad deploys by catching issues early.

Gradual rollout, monitoring, automated rollback

Interview talking point: “Measure symptoms (error rate, p95/p99 latency, business metrics) with sufficient sample size/bake time. Use CodeDeploy canary configs, ECS CodeDeploy, ALB weighted TGs, or Lambda aliases with weighted routing. Auto-rollback on alarms.”

Q937: How do you implement feature flags?

What it is: Feature flags are runtime switches with owner/scope/expiry to separate deploy from release.

Why it is used: To enable controlled rollout/kill switches without redeploying.

AppConfig, code integration, monitoring

Interview talking point: “AppConfig caches flags locally (avoid per-request flag service calls). Default to safe value; enable separately. Govern flags—track inventory and remove dead flags; kill switches must be instant/reversible.”

Q938: How do you implement A/B testing?

What it is: A/B testing splits traffic between variants, measures primary metric against baseline with statistical rigor.

Why it is used: To make data-driven product decisions with confidence, not opinion.

CloudFront, Lambda@Edge, user segmentation

Interview talking point: “Pre-register hypothesis, sample size, fixed duration (avoid peeking). Keep allocation sticky per user. Include variant in cache key at edge (CloudFront). CloudWatch Evidently or CloudFront Functions/Lambda@Edge can implement.”

Q939: How do you implement chaos engineering?

What it is: Chaos engineering deliberately injects scoped faults to verify resilience and response readiness.

Why it is used: To find gaps before real incidents and build response muscle memory.

AWS Fault Injection Simulator, controlled experiments

Interview talking point: “Use AWS FIS with narrowly scoped targets/role, start conditions requiring approval, stop conditions tied to alarms. Test detection + mitigation (not just infra). Run in test env first; notify on-call; document hypothesis/abort criteria.”

Q940: How do you implement observability?

What it is: Observability lets you infer internal state from metrics, logs, traces, and events without new code.

Why it is used: To debug unknown production issues that monitoring alone can’t answer.

CloudWatch, X-Ray, distributed tracing, logging

Interview talking point: “Metrics show “is it normal”; logs “what happened”; traces “why slow across services” (causal); events “what system decided”. X-Ray is legacy—use ADOT/OpenTelemetry or CloudWatch Application Signals. Include traceId in logs.”

Q941: How do you implement cost optimization?

What it is: Cost optimization systematically reduces spend without losing capability via right-sizing, pricing, waste elimination, architecture.

Why it is used: To make cost an engineering outcome, not a monthly surprise.

Rightsizing, reservations, spot, automation

Interview talking point: “Eliminate waste first (unused resources) via Cost Explorer/Cost Optimization Hub/Trusted Advisor/Compute Optimizer. Then use Savings Plans for steady compute, Spot for interruptible/stateless (diversify), RIs selectively. Attribute via tags first.”

Q942: How do you implement sustainability?

What it is: Sustainability reduces environmental impact (carbon) through efficient utilization, right-sizing, managed services, and region choice.

Why it is used: To meet carbon goals with measurable reductions.

Serverless, right-sizing, managed services, regions

Interview talking point: “Focus on utilization/right-sizing and scaling to zero (biggest lever). Use Graviton where efficient. Schedule non-urgent batch in low-carbon regions/hours when possible. Use Customer Carbon Footprint Tool to measure impact.”

Q943: How do you implement multi-cloud?

What it is: Multi-cloud uses services from >1 provider to avoid single-provider lock-in/failure, at cost of complexity.

Why it is used: To meet contractual/regulatory needs or protect against provider outage.

Consistent tooling, abstraction, portability

Interview talking point: “Abstraction tax is real—lowest common denominator hides provider advantages. Prioritize data portability/open formats (Parquet) and exit planning. Kubernetes/OCI images port well; managed services least portable. Skills/ops cost often largest.”

Q944: How do you implement hybrid cloud?

What it is: Hybrid cloud coexists on-prem + AWS with unified identity/network/monitoring/cost model.

Why it is used: To extend DC, meet latency/residency, or migrate incrementally without big-bang cutover.

Direct Connect, VPN, consistent networking

Interview talking point: “DX primary, VPN backup (test BGP failover). Route 53 Resolver for hybrid DNS. DataSync/Snowball for transfers. IAM Identity Center + Roles Anywhere for unified identity. Use SSM+CW agents on-prem for single ops plane.”

Q945: How do you implement edge computing?

What it is: Edge computing runs compute close to users/data (CDN, metro, carrier, on-prem) to cut latency.

Why it is used: To meet last-ms latency needs or handle data that can’t leave local area.

Lambda@Edge, Outposts, Wavelength, Local Zones

Interview talking point: “CloudFront Functions for simple (<1µs), Lambda@Edge for richer (viewer/request events, us-east-1). Wavelength is 5G-co-located (sub-10ms) but limited services. Local Zones are metro AWS. Outposts is on-prem racks (own DC).”

Q946: How do you implement IoT at scale?

What it is: IoT at scale ingests from large device fleets, routes/filters, and keeps per-device cost low.

Why it is used: To support 10^5–10^9 devices affordably with constrained bandwidth/power.

IoT Core, rules, stream processing, analytics

Interview talking point: “Devices use IoT Core with per-device X.509 certs/MQTT (QoS 1 at-least-once; consumers must be idempotent). Filter/drop at IoT Rules (cost lever). Use Kinesis/Firehose→S3/Timestream for scale. 128KB msg limit shapes design.”

Q947: How do you implement ML operations?

What it is: MLOps runs models in production reliably/responsibly with packaging, deploy, monitoring, retraining on data drift.

Why it is used: To make models maintained production artifacts with rollback/owner, not one-off notebooks.

SageMaker, MLOps, model registry, monitoring

Interview talking point: “Train → register in Model Registry (approval gate) → deploy via SageMaker Pipelines. Use shadow/canary for model promotion. Capture inputs/outputs for retraining/debug. Monitor data/concept/drift; block on metric regression.”

Q948: How do you implement data governance?

What it is: Data governance defines what data exists, meaning, access, location, and regulations—enforced technically.

Why it is used: To share data safely across org and answer audits/residency without long investigations.

Lake Formation, Glue, access control, catalog

Interview talking point: “Glue Data Catalog for metadata/schema. Lake Formation enforces column/row-level access across engines (single permission model). Use LF-tags to propagate access. DataZone adds business glossary/owners/lineage. Audit with Access Analyzer.”

Q949: How do you implement API management?

What it is: API management adds auth, throttling, versioning, docs, usage metering around APIs.

Why it is used: To expose/evolve APIs safely for untrusted consumers without breaking clients.

API Gateway, throttling, auth, versioning

Interview talking point: “Throttle at account/stage/method + per-API-key via usage plans. Auth: Cognito (users), IAM (services), Lambda/JWT authorizers (3rd-party). Version via stages, not path. Enable access logs + metrics; use Lambda authorizer caching.”

Q950: How do you implement message patterns?

What it is: Message patterns: SQS (point-to-point queue), SNS (pub-sub fan-out), EventBridge (rule-based routing), Kinesis (ordered replay log).

Why it is used: To decouple producers/consumers, absorb bursts, and match semantics (ordering/replay/fan-out).

SQS, SNS, EventBridge, Kinesis

Interview talking point: “SQS standard at-least-once unordered (idempotent consumers); SQS FIFO ordered per group with lower throughput. SNS→SQS for durable fan-out with DLQ. Kinesis for replay/multi-consumer ordering by shard. EventBridge for content-based routing.”

Q951: How do you implement event sourcing?

What it is: Event sourcing stores immutable state changes as an append-only stream, with current state derived by replaying those events.

Why it is used: Provides full history, new views from past events, and an immutable audit trail.

Store events, replay, CQRS pattern

Interview talking point: “The event stream is the source of truth, so event schemas are permanent contracts. AWS options include Kinesis for streaming and EventBridge Archive/S3 for long-term replayable storage.”

Q952: How do you implement CQRS?

What it is: CQRS separates the write model (for invariants) from read models (optimized for specific query patterns).

Why it is used: Allows both write integrity and flexible reads when a single model cannot serve both well.

Separate read/write models, eventual consistency

Interview talking point: “Event-driven projections build read models from the write-stream. The main trade-off is eventual consistency, so clients may need read-after-write strategies or watermarks.”

Q953: How do you implement saga pattern?

What it is: A saga breaks a distributed transaction into local transactions, with compensating actions to undo failures.

Why it is used: Maintains consistency across services that own separate databases when 2PC is unavailable.

Orchestrated compensation, event-driven

Interview talking point: “Orchestrated sagas (Step Functions) make workflows explicit and queryable, while choreographed ones (EventBridge/SNS) are decoupled but harder to track and compensate.”

Q954: How do you implement circuit breaker?

What it is: A circuit breaker stops calling a failing dependency after repeated failures, fails fast, then probes for recovery.

Why it is used: Prevents a slow or failing dependency from exhausting threads, connections, and resources.

State machine, fallback, recovery

Interview talking point: “It moves between Closed, Open, and Half-Open states. Count only dependency-failing errors (5xx/timeouts), not client errors (4xx), and cap the probe count before reopening.”

Q955: How do you implement bulkhead?

What it is: A bulkhead partitions resources (threads, connections, queues) so one component cannot exhaust all capacity.

Why it is used: Isolates failures to prevent one overloaded dependency or tenant from taking down the entire service.

Thread pools, isolation, resource limits

Interview talking point: “Partition by dependency, operation, or tenant. In AWS, use Lambda reserved concurrency, separate ECS services, per-queue SQS consumers, or RDS Proxy to cap DB connections.”

Q956: How do you implement retry strategy?

What it is: A retry strategy re-attempts transient failures using exponential backoff, jitter, and capped attempts/time.

Why it is used: Absorbs temporary issues like throttling, network drops, or failover without creating retry storms.

Exponential backoff, jitter, limits

Interview talking point: “Use decorrelated or full jitter to avoid synchronized retries. Only retry idempotent or retry-safe operations, cap total elapsed time, and respect caller deadlines.”

Q957: How do you implement idempotency?

What it is: Idempotency ensures that performing an operation multiple times has the same effect as once.

Why it is used: Makes retries, redeliveries, and timeouts safe where at-least-once delivery is the only guarantee.

Deduplication, conditional writes

Interview talking point: “Prefer natural idempotency (PUT with full state), use idempotency keys with DynamoDB conditional writes, or use optimistic concurrency/version checks to prevent duplicates.”

Q958: How do you implement caching?

What it is: Caching stores data closer to readers with a defined key, lifetime, and invalidation strategy.

Why it is used: Reduces latency, origin load, and database load for frequently accessed, expensive-to-compute data.

Cache-aside, write-through, invalidation

Interview talking point: “Cache-aside survives outages but can cause stampedes; write-through avoids staleness but adds latency. CloudFront, ElastiCache, and DAX cover edge/app/DB layers.”

Q959: How do you implement rate limiting?

What it is: Rate limiting caps how many requests a caller can make over a period using an algorithm like token bucket.

Why it is used: Protects against abuse and overload at the caller granularity, not just system-wide.

Token bucket, throttling, quotas

Interview talking point: “Token bucket allows controlled bursts via burst capacity. API Gateway throttling, WAF rate-based rules, and per-user limits in Redis/DynamoDB enforce it.”

Q960: How do you implement throttling?

What it is: Throttling rejects requests above a limit, signaling callers to slow down via 429 responses.

Why it is used: Shedds load predictably so the system degrades gracefully instead of collapsing under overload.

API Gateway throttling, WAF rate rules

Interview talking point: “Distinguish layers: API Gateway (token bucket, per-key), WAF (5-minute rolling window), and service limits (Lambda concurrency, DynamoDB/Kinesis throttles) as different failure modes.”

Q961: How do you implement queue depth monitoring?

What it is: Queue depth monitoring tracks pending messages, oldest-message age, and in-flight counts to detect backlogs.

Why it is used: Identifies slow or failed consumers before message retention expires or data loss occurs.

CloudWatch metrics, alarms, scaling

Interview talking point: “Alarm on ApproximateAgeOfOldestMessage (not just count) to catch stagnation. Pair with composite alarms and scale consumers via target tracking on queue depth.”

Q962: How do you implement connection pooling?

What it is: Connection pooling reuses database connections across requests instead of opening new ones per request.

Why it is used: Prevents exhausting the database’s max_connections and reduces connection setup latency.

RDS Proxy, ElastiCache, proper configuration

Interview talking point: “RDS Proxy multiplexes connections but can cause session pinning for long transactions, cursors, or session state. Size app pools below DB limits and avoid pooling bloat.”

Q963: How do you implement connection draining?

What it is: Connection draining stops sending new traffic to a target while letting in-flight requests complete before termination.

Why it is used: Prevents dropping active requests during deployments, scale-in, or instance replacements.

ALB draining, instance replacement delays

Interview talking point: “ALB/NLB use deregistration delay on target groups. Combine with ASG lifecycle hooks and InstanceRefresh to ensure graceful termination without losing in-flight work.”

Q964: How do you implement graceful shutdown?

What it is: Graceful shutdown lets a process finish in-flight work, ack messages, and flush state before termination.

Why it is used: Avoids data loss when deployments, scale-in, or platform signals (SIGTERM) terminate instances/tasks.

Lifecycle hooks, signal handling, cleanup

Interview talking point: “Handle SIGTERM, stop accepting new work, process in-flight batches, checkpoint Kinesis/DynamoDB Streams, and ack SQS. Use ECS stopTimeout/ASG hooks to allow time.”

Q965: How do you implement health checks?

What it is: Health checks probe targets periodically to determine liveness/readiness for routing and replacement decisions.

Why it is used: Automatically removes unhealthy instances from rotation and triggers replacement to prevent outages.

ELB health checks, auto-scaling, replacement

Interview talking point: “Test dependency-aware readiness, not just ”/”. ELB checks feed ASG replacement; Route 53 checks enable DNS failover. Distinguish liveness (/healthz) from readiness (/readyz).”

Q966: How do you implement circuit isolation?

What it is: Circuit isolation segments systems by network, account, or service to contain failures and limit blast radius.

Why it is used: Prevents a compromised or overloaded segment from affecting others, including critical data stores.

Security groups, network isolation, VPC

Interview talking point: “Use VPC/subnets/SGs with SG-referencing, per-account boundaries via Organizations, and per-service IAM roles/SGs. Bulkheads at capacity layer complement network isolation.”

Q967: How do you implement data partitioning?

What it is: Data partitioning splits data across storage units by a key to spread reads and writes.

Why it is used: Scales beyond a single node’s throughput and storage while aligning access patterns to partitions.

Shard keys, partition strategy, distribution

Interview talking point: “Choose the partition key from access patterns, not data. Hot keys/thundering prefixes are common in DynamoDB, Kinesis, and S3; shard keys or hashed prefixes mitigate them.”

Q968: How do you implement sharding?

What it is: Sharding splits a logical dataset across physical instances/tables with a router by shard key.

Why it is used: Enables horizontal scale for large datasets where vertical scaling is insufficient.

Application-level, DynamoDB partition keys

Interview talking point: “AWS often handles sharding (DynamoDB partitions, ElastiCache Cluster, Aurora Limitless). Self-managed sharding requires a router and trades cross-shard joins/transactions for scale.”

Q969: How do you implement replication?

What it is: Replication keeps copies of data in another node/AZ/Region for durability, availability, read scaling, or locality.

Why it is used: Improves resilience and read capacity, with sync/async trade-offs determining potential data loss on failover.

Cross-region, read replicas, multi-master

Interview talking point: “Sync (RDS Multi-AZ, Aurora writer) prevents loss but adds latency. Async (read replicas, Global DB, global tables, CRR) scales reads but risks lag/window loss.”

Q970: How do you implement consensus?

What it is: Consensus is how distributed replicas agree on a single order/value to avoid divergence.

Why it is used: Ensures replicated state remains coherent when nodes can fail or lag behind each other.

Aurora, DynamoDB global tables, consensus protocols

Interview talking point: “AWS hides most consensus (Aurora storage quorum, partition replication). True cross-Region consensus is rare; global tables reconcile via policy (LWW), not a global consensus protocol.”

Q971: How do you implement locking?

What it is: Locking prevents concurrent operations from corrupting shared state by coordinating access to critical sections.

Why it is used: Enforces mutual exclusion for jobs, updates, or resources in distributed systems without races.

DynamoDB conditional writes, database locks

Interview talking point: “Prefer conditional writes/leases (DynamoDB conditional Put with TTL + owner checks) over cache-only locks. RDS row locks (SELECT FOR UPDATE) are relational but pin sessions.”

Q972: How do you implement transactions?

What it is: Transactions ensure a set of operations all succeed or all fail atomically with defined isolation.

Why it is used: Preserves data integrity for multi-step changes like transfers where partial success is unacceptable.

Database transactions, distributed transactions

Interview talking point: “RDS/Aurora provide ACID SQL transactions. DynamoDB TransactWriteItems is atomic/multi-item conditional, not a general distributed 2PC — it uses conditions, not global locking.”

Q973: How do you implement two-phase commit?

What it is: Two-phase commit (2PC) coordinates prepare then commit/rollback across independent participants for atomicity.

Why it is used: Provides ACID across separate databases when one DB cannot contain all changes.

Prepare phase, commit phase, rollback

Interview talking point: “AWS does not expose a managed 2PC coordinator; use sagas instead. 2PC is blocking on coordinator failure and complex to recover, so it’s rarely the right AWS choice.”

Q974: How do you implement optimistic locking?

What it is: Optimistic locking detects conflicts at write time using a version; updates fail if the version changed.

Why it is used: Prevents lost updates with minimal contention cost and no blocking on reads.

Version fields, conditional updates

Interview talking point: “Use version+ConditionExpression in DynamoDB (return conflict details) or WHERE version=v in SQL. Conflicts are expected and must be retried with re-read/new version.”

Q975: How do you implement pessimistic locking?

What it is: Pessimistic locking acquires and holds a lock for the operation duration to serialize writers up front.

Why it is used: Protects highly contended or long-running writes where optimistic retries would thrash.

Locks, SELECT FOR UPDATE

Interview talking point: “RDS/Aurora support SELECT FOR UPDATE (transaction-scoped). DynamoDB has no global SELECT FOR UPDATE; use conditional leases/TTL locks. Cache locks (SET NX) are eviction-prone.”

Q976: How do you implement eventually consistent reads?

What it is: Eventually consistent reads may return stale data because replication is asynchronous.

Why it is used: Improves read latency and scale when temporary staleness is acceptable for the use case.

Read replicas, consistency models

Interview talking point: “S3 is strongly consistent now. DynamoDB defaults to eventual; ConsistentRead is table-only (not on GSIs). Global tables, read replicas, and caches are eventually consistent.”

Q977: How do you implement strong consistency?

What it is: Strong consistency guarantees a read returns the most recent acknowledged write.

Why it is used: Required for cases where stale reads are unacceptable, like balances, order state, or idempotency guards.

Primary writes, read-after-write

Interview talking point: “Costs more: DynamoDB ConsistentRead doubles RCU and isn’t available on GSIs. Aurora/RDS leader reads are strongly consistent; cross-Region/global writes trade consistency for availability.”

Q978: How do you implement time-to-live?

What it is: TTL automatically deletes or expires items/objects after a set time without running app code.

Why it is used: Bounds lifetime of transient data (sessions, tokens, caches) to control cost and staleness.

DynamoDB TTL, S3 lifecycle, cleanup

Interview talking point: “DynamoDB TTL deletes can take up to 48 hours after expiry and TTL deletions don’t emit stream events. S3 lifecycle expiration is destructive with different timing semantics.”

Q979: How do you implement data archival?

What it is: Data archival moves rarely-read data to low-cost storage tiers on a defined schedule.

Why it is used: Cuts storage costs while preserving data that must be kept, accepting longer retrieval times.

Lifecycle policies, Glacier, cold storage

Interview talking point: “S3 tiers: Glacier Flexible (minutes–hours), Deep Archive (up to 12h, 180-day minimum). Lifecycle rules automate transitions; restores incur time/cost constraints on RTO.”

Q980: How do you implement data retention?

What it is: Data retention defines how long data is kept, when it’s deleted, and how to prove both actions.

Why it is used: Meets legal/financial retention requirements and privacy deletion obligations with defensible enforcement.

Policies, versioning, cleanup

Interview talking point: “Combine Object Lock (immutability), versioning/lifecycle for noncurrent versions, backup retention, and CloudWatch Logs retention. Deletion must be provable with audit evidence.”

Q981: How do you implement data compliance?

What it is: Data compliance ensures continuous adherence to regulatory/contractual obligations with documented evidence.

Why it is used: Survives audits and reduces breach impact by proving controls are enforced, not just stated.

Encryption, access control, audit

Interview talking point: “Core pillars: encryption (SSE-KMS, required), access control (least privilege, SCPs, Access Analyzer), and audit (CloudTrail, Config, tamper-evident logs with Object Lock).”

Q982: How do you implement data residency?

What it is: Data residency requires data to be stored and processed only within specified geographic boundaries.

Why it is used: Satisfies laws/contracts (GDPR, sector rules) and controls where data physically resides.

Region selection, controls, compliance

Interview talking point: “Region is the unit on AWS. Prevent cross-Region features (CRR, Global DB, global tables) via SCPs denying those actions. Edge services need scrutiny for sensitive payloads.”

Q983: How do you implement GDPR compliance?

What it is: GDPR compliance addresses EU data rights with technical controls plus process/documentation evidence.

Why it is used: Enables lawful processing of EU personal data and reduces penalty risk under GDPR.

Data encryption, access control, deletion

Interview talking point: “Encryption, least privilege, and deletion pipelines satisfy key articles. AWS DPA covers processor terms; Art 17 erasure needs provable deletion jobs, not just TTL.”

Q984: How do you implement HIPAA compliance?

What it is: HIPAA compliance requires meeting Security/Privacy Rules for ePHI with BAA, encryption, audit, and controls.

Why it is used: Allows lawful handling of ePHI for covered entities/business associates under strict penalty risk.

Encryption, audit logging, BAA

Interview talking point: “Only HIPAA-eligible AWS services may touch ePHI under BAA. BAA doesn’t make you compliant — you own correct use (encryption, audit, least privilege, “minimum necessary”).”

Q985: How do you implement PCI compliance?

What it is: PCI compliance meets DSS requirements for systems that store/process/transmit cardholder data.

Why it is used: Required by card schemes/acquirers; segmentation and controls reduce scope and avoid fines/exclusion.

Encryption, segmentation, monitoring

Interview talking point: “Scope reduction via segmentation is critical — prove no path between CDE and non-CDE. Tokenization/field encryption keeps PAN out of systems; audit/log retention satisfy R10.”

Q986: How do you implement SOC compliance?

What it is: SOC compliance (SOC 1/SOC 2) proves controls operate as designed via auditor-tested evidence over a period.

Why it is used: Required for enterprise deals; customers demand SOC 2 Type II as standard security evidence.

Logging, access control, monitoring

Interview talking point: “Focus on evidence trail: access reviews, change logs, incident handling, monitoring alerts with tickets. CloudTrail/Config/Access Analyzer feed automated evidence for audits.”

Q987: How do you implement ISO compliance?

What it is: ISO 27001 compliance certifies an ISMS with risk assessment, Annex A controls, and audit cycles.

Why it is used: Provides internationally recognized proof of a governed security program for procurement requirements.

Documentation, controls, audits

Interview talking point: “Process-driven: define scope, SoA, risk register. Map AWS controls (IAM, Config, GuardDuty, Backup) to Annex A; internal/external audits require documented evidence.”

Q988: How do you implement FedRAMP compliance?

What it is: FedRAMP compliance meets NIST 800-53 baselines for US federal cloud workloads with ATO/continuous monitoring.

Why it is used: Required to sell to federal agencies; authorization covers a specific system boundary with inherited AWS controls.

High security controls, region selection

Interview talking point: “Work in FedRAMP-authorized Regions (including GovCloud). System boundary + SSP + POA&M drive scope; Inspector/GuardDuty/CloudTrail support continuous monitoring requirements.”

Q989: How do you implement CJIS compliance?

What it is: CJIS compliance meets FBI Security Policy for criminal justice information with strict encryption/audit/access controls.

Why it is used: Required by law enforcement agencies contracting for CJI; includes personnel/background and audit requirements.

Criminal justice data controls

Interview talking point: “FIPS 140-2 validated encryption, RBAC/individual IDs/MFA, audit log retention (1–5 years), and agency approval. CloudTrail immutable logs help satisfy audit requirements.”

Q990: How do you implement ITAR compliance?

What it is: ITAR compliance meets export-control rules for defense articles/technical data under strict US-person/residency rules.

Why it is used: Required for ITAR-controlled data; violations are criminal, with mandatory US-only processing/residency.

Export controls, data residency

Interview talking point: “Enforce US-only Regions and deny cross-Region via SCPs. Restrict to US persons via IAM tags/conditions; Nitro Enclaves/FIPS crypto help, but legal process (license) is separate.”

Q991: How do you implement data masking?

What it is: Data masking transforms sensitive fields into non-sensitive representations without exposing originals.

Why it is used: Lets dev/test/analytics work with realistic data while shrinking compliance scope for PHI/PII/card data.

Lambda transformation, column-level security

Interview talking point: “S3 Object Lambda masks on read; Lake Formation/Redshift provide column/row masking. Choose deterministic vs irreversible/reversible masking based on join/unmask needs.”

Q992: How do you implement tokenization?

What it is: Tokenization replaces sensitive values with surrogate tokens stored in a vault, not the original.

Why it is used: Shrinks compliance scope (tokens vs PANs) and limits breach impact since tokens are meaningless without vault.

Secrets Manager, KMS, token vaults

Interview talking point: “Vault holds token↔original with strict access. Prefer PCI-certified tokenization providers when handling PANs; self-managed vault needs encrypted mapping + tight de-tokenization controls.”

Q993: How do you implement field-level encryption?

What it is: Field-level encryption encrypts individual fields so plaintext never exists in middle systems (DB/logs/queues).

Why it is used: Protects data from storage/log compromise when intermediaries shouldn’t see plaintext.

KMS, client-side encryption, application logic

Interview talking point: “Use AWS Encryption SDK with envelope encryption (per-field data keys) and split KMS decrypt permissions from storage roles. KMS calls per field need batching to avoid rate limits.”

Q994: How do you implement key rotation?

What it is: Key rotation replaces cryptographic keys regularly to limit damage from key compromise.

Why it is used: Bounds exposure window and satisfies compliance rotation expectations for encryption keys.

KMS automatic rotation, manual rotation

Interview talking point: “KMS auto-rotates symmetric CMKs annually without re-encrypting data or changing ARNs (old material remains decryptable). Asymmetric/imported keys need manual rotation/re-encryption.”

Q995: How do you implement key management?

What it is: Key management controls the full lifecycle of keys (create, store, policy, usage, rotation, revocation).

Why it is used: Ensures you own and can audit key access; separates keys from data for stronger security/compliance.

KMS, HSM, key policies, access control

Interview talking point: “KMS is default (FIPS 140-2 L3); CloudHSM/XKS for customer-held material. Key policies + IAM policies both required; use grants for scoped service access.”

Q996: How do you implement certificate management?

What it is: Certificate management handles TLS cert lifecycle: issuance, validation, storage, renewal, and revocation.

Why it is used: Prevents expired cert outages and enforces TLS everywhere with verifiable, trackable certificates.

ACM, rotation, import, validation

Interview talking point: “ACM auto-renews public certs if DNS validation records persist. Imported certs aren’t auto-renewed. CloudFront needs certs in us-east-1; regional certs for ALB/NLB in region.”

Q997: How do you implement mutual TLS?

What it is: Mutual TLS (mTLS) requires clients to present certificates validated by the server for cryptographic authentication.

Why it is used: Authenticates service-to-service/partner calls without shared secrets; enables zero-trust API access.

ACM client certificates on ALB/NLB/CloudFront (API Gateway does not support mTLS)

Interview talking point: “API Gateway doesn’t support mTLS — use ALB/NLB/CloudFront instead. Issue client certs via ACM PCA, maintain trust store/CRL for revocation, and extract identity from cert.”

Q998: How do you implement SAML?

What it is: SAML federates identity via signed assertions from an IdP to AWS for SSO access.

Why it is used: Lets users sign in with corporate credentials and get AWS access without creating IAM users.

IAM Identity Center, third-party IdP

Interview talking point: “IAM Identity Center is modern path; legacy uses IAM SAML provider. Success depends on IdP metadata, signing cert rotation, and correct role/permission-set attribute mappings.”

Q999: How do you implement OIDC?

What it is: OIDC is an identity layer on OAuth2 issuing signed JWTs (ID tokens) for verified user identity.

Why it is used: Delegates authentication to trusted issuers (Cognito/external IdP) instead of managing passwords.

Cognito, external IdP integration

Interview talking point: “Cognito issues tokens (jwks for verification). Verify signatures/iss/aud/exp at boundaries/apps. API Gateway JWT authorizers validate access tokens; apps validate ID tokens.”

Q1000: How do you implement OAuth2?

What it is: OAuth2 is an authorization framework granting scoped, expiring access tokens without sharing user passwords.

Why it is used: Enables third-party/app access to resources with least-privilege, revocable, auditable permissions.

Cognito, API Gateway authorizer, scopes

Interview talking point: “Cognito is authorization server; API Gateway enforces tokens/scopes per route. OAuth2 authorizes, not authenticates — use OIDC for identity; enforce least-privilege scopes per client.”