AWS_Practical_Interview_1501 2000

AWS Practical Interview Questions (1501-2000)

Advanced AWS Security Scenarios

Q1501: How do you implement AWS Security Hub Integration?

What it is: AWS Security Hub integration aggregates findings from GuardDuty, Inspector, Macie, Config, and partner tools into one store.

Why it is used: One pane for security alerts across sources instead of checking each console separately.

# Enable Security Hub
aws securityhub enable-security-hub \
  --enable-default-standards

# Create custom action
aws securityhub create-action-target \
  --name "Send to remediation" \
  --description "Trigger Lambda remediation"

Interview talking point: “Security Hub is per-region; enable with enable-security-hub —enable-default-standards and AWS sources auto-forward once both services are enabled, since GuardDuty has no manual connect button. Partners push via batch-import-findings, where a valid ProductArn is required or findings are rejected; cross-region needs a FindingAggregator.”

Q1502: How do you use AWS GuardDuty Malware Protection?

What it is: GuardDuty Malware Protection snapshots EBS volumes, scans them agentless in an isolated VPC, and reports file-level findings.

Why it is used: Detect malware on disk without installing agents or touching the running instance.

# Enable Malware Protection
aws guardduty create-member \
  --detector-id detector-id \
  --account-id member-id

# Enable for EC2
aws guardduty enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “Malware Protection is a feature flag on the detector: update-detector —features ’[{“Name”:“EBS_MALWARE_PROTECTION”,“Status”:“ENABLED”}]’, because there is no separate enable-malware-protection verb. Scans skip detached volumes, cover Linux and Windows but not macOS, and finding ProductFields carry the file path and hash.”

Q1503: How do you implement AWS Config Conformance Packs?

What it is: Conformance packs bundle Config rules plus remediation actions into one parameterized compliance template across accounts and regions.

Why it is used: Roll out a whole rule set and auto-remediation fleet-wide instead of building rules one by one.

Resources:
  - ConfigRule:
      Type: AWS::Config::ConfigRule
      Properties:
        ConfigRuleName: required-tags
        Source:
          Owner: AWS
          SourceIdentifier: REQUIRED_TAGS

Interview talking point: “Deploy with put-conformance-pack —template-body file://pack.yml, where rules and remediation both live in the YAML and remediation runs SSM runbooks. Organization packs need organization-wide Config set up first or members never see them, and a schema error like a missing Source fails the whole pack.”

Q1504: How do you use AWS Network Firewall Suricata Rules?

What it is: Network Firewall stateful rule groups accept Suricata signature text for open-format IPS-style custom detection.

Why it is used: Bring community signatures and drop traffic matching custom rules, not just AWS-provided sets.

# Create rule group with Suricata rules
aws network-firewall create-rule-group \
  --rule-group-name my-rules \
  --type STATEFUL \
  --capacity 1000 \
  --rule-group '{"RuleDefinitions":[{"SuricataRuleAction":"pass","Signature":{"Definition":{"Action":"pass"}}}]}'

Interview talking point: “Suricata text goes into a STATEFUL rule group via create-rule-group —type STATEFUL with RulesSource RulesString; there is no —suricata-options flag. Domain allowlists use RulesSourceList with TargetTypes HTTP_HOST and TLS_SNI, and stateless rules run first, so a stateless drop beats a stateful pass.”

Q1505: How do you implement AWS WAF Rule Groups?

What it is: WAF rule groups are reusable rule sets attached to a WebACL with a priority and override action.

Why it is used: Package blocking logic once and reuse it across many WebACLs instead of duplicating rules.

# Create rule group
aws wafv2 create-rule-group \
  --name my-group \
  --scope REGIONAL \
  --capacity 50 \
  --rules '[{"Name":"rule1","Priority":1,"Statement":{"ByteMatchStatement":{"SearchString":"test","FieldToMatch":{"Body":{}}}},"Action":{"Block":{}}}]'

Interview talking point: “Rule groups go INTO a WebACL via create-web-acl with RuleGroupReferenceStatement, the group ARN, priority, and an override action; there is no associate-web-acl for them. A group whose —capacity is below the summed rule WCUs fails to create, and REGIONAL versus CLOUDFRONT scopes cannot mix in one call.”

Advanced AWS Networking Scenarios

Q1506: How do you implement AWS Gateway Load Balancer?

What it is: Gateway Load Balancer flows IP traffic through third-party appliance fleets using GENEVE encapsulation on port 6081.

Why it is used: Inline transparent inspection of VPC traffic with automatic appliance scale-in and scale-out.

# Create Gateway Load Balancer endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --vpc-endpoint-type GatewayLoadBalancer \
  --service-name com.amazonaws.us-east-1.gwlb \
  --route-table-ids rtb-123

Interview talking point: “Create it with create-load-balancer —type gateway and target groups of appliance ENI IPs on protocol GENEVE, so appliances see the original 5-tuple. Traffic reaches it through a GatewayLoadBalancer VPC endpoint plus a route, and the return path must go back through the GWLB or asymmetric routing breaks it; GWLB inspects nothing itself.”

Q1507: How do you use AWS Direct Connect Location?

What it is: Direct Connect locations are the physical colocation facilities where you order connections that terminate on AWS DX routers.

Why it is used: Pick the metro and port where your dedicated link lands; locations are not regions.

# Create connection at DX location
aws directconnect create-connection \
  --location EqDC2 \
  --bandwidth 1Gbps \
  --connection-name my-connection

Interview talking point: “Flow is describe-locations, then create-connection with locationCode and bandwidth, then confirm-connection after handing the LOA-CFA to your provider. A private VIF reaches only DXGW-attached VPCs, never the internet, and DX gives you no failover, so HA means two connections in diverse locations.”

Q1508: How do you implement AWS VPN CloudHub?

What it is: VPN CloudHub is a hub-and-spoke topology linking multiple on-prem sites to AWS over IPsec tunnels.

Why it is used: Connect remote offices to each other cheaply instead of buying a private WAN.

# Create VPN with CloudHub
aws ec2 create-vpn-connection \
  --customer-gateway-id cgw-123 \
  --type ipsec.1 \
  --vpn-gateway-id vpg-123 \
  --options '{"CloudHub":{"Enabled":true,"RemoteIps":["10.0.0.0/16"]}}'

Interview talking point: “Spokes only learn each other’s routes if BGP is used, since static routes never propagate between tunnels and that is why branch A cannot see branch B. Classic CloudHub on one VPN gateway is legacy; the modern form is create-vpn-connection —transit-gateway-id —type ipsec.1.”

Q1509: How do you use AWS Transit Gateway Route Tables?

What it is: Transit Gateway route tables control traffic between attachments using association, propagation, and static routes.

Why it is used: Segment spokes so prod reaches the backbone while dev reaches only shared services.

# Create route table
aws ec2 create-transit-gateway-route-table \
  --transit-gateway-id tgw-123

# Associate attachment
aws ec2 associate-transit-gateway-route-table \
  --transit-gateway-attachment-id tgw-attach \
  --transit-gateway-route-table-id rtb-123

# Create route
aws ec2 create-transit-gateway-route \
  --destination-cidr-block 10.0.0.0/8 \
  --transit-gateway-route-table-id rtb-123 \
  --transit-gateway-attachment-id tgw-attach

Interview talking point: “An attachment associates with exactly one route table, which is where its traffic looks up routes, but it can propagate its routes into many tables. Static routes preempt propagated ones and —blackhole drops explicitly, so a route added to a table the attachment is not associated with does nothing.”

Q1510: How do you implement AWS PrivateLink Interface Endpoints?

What it is: PrivateLink interface endpoints place ENIs in your subnets so service traffic stays inside the AWS network.

Why it is used: Reach AWS or your own services privately without NAT, internet gateways, or peering.

# Create Interface endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.secretsmanager \
  --subnet-ids subnet-123 subnet-456

Interview talking point: “Interface endpoints need a subnet per AZ, and their security groups are the source of traffic into the service. With —private-dns-enabled the normal hostname resolves to the endpoint ENI, so no code changes, but both the endpoint policy and the service policy must allow the call. For S3 pick Gateway (free, regional, no SGs) or Interface (cross-region and on-prem).”

Advanced AWS Database Scenarios

Q1511: How do you implement RDS Custom SQL Server?

What it is: RDS Custom runs SQL Server on an isolated managed EC2 instance where you get OS and admin access.

Why it is used: Support legacy apps needing custom patches or agents while keeping managed backups and HA.

# Create RDS Custom instance
aws rds create-db-instance \
  --db-instance-identifier custom-sql \
  --engine custom-sqlserver-ex \
  --engine-version 15.00.4245.2.v1 \
  --db-instance-class db.r5.large

Interview talking point: “Create it with —engine custom-sqlserver-ee or se, then shell into the Windows OS via ssm start-session; RDS Custom is the only managed engine exposing the OS. AWS still owns the reserved volumes, patching, and Multi-AZ, but any OS change outside the maintained baseline is your problem and pricing is above standard managed RDS.”

Q1512: How do you use RDS Optimized Reads?

What it is: RDS Optimized Reads uses local NVMe on d-class instances to hold temporary and sort files.

Why it is used: Speed up temp-heavy queries like big GROUP BYs without scaling the whole instance.

# Enable RDS Optimized Reads (automatic with r6id/r5b)
# Use r6id instances for 2x read throughput

Interview talking point: “There is nothing to configure: you move to a d-class instance like db.m5d or db.r6id and RDS automatically puts temp and sort files on local NVMe. That NVMe is ephemeral and lost on failover, which RDS handles for you, and it is a different feature from Optimized Writes, a PostgreSQL skip-ahead WAL option.”

Q1513: How do you implement Aurora Serverless V2?

What it is: Aurora Serverless v2 scales a cluster in 0.5 ACU steps per second between configured min and max.

Why it is used: Give spiky or intermittent workloads elastic database capacity with no cold starts.

# Create Aurora Serverless V2
aws rds create-db-cluster \
  --db-cluster-identifier my-cluster \
  --engine aurora-postgresql \
  --serverlessv2-scaling-configuration '{
    "MinCapacity": 1,
    "MaxCapacity": 64,
    "AutoPause": false
  }'

Interview talking point: “It is set on the cluster with —serverless-v2-scaling-configuration between 0.5 and 128 ACUs, scaling in about a second; unlike v1 it never pauses to zero, but the 0.5 ACU minimum is your cost floor. A cluster is either serverless or provisioned, never both, and leaving means snapshot plus restore as provisioned.”

Q1514: How do you use Aurora ML Integration?

What it is: Aurora ML exposes SQL functions that call Comprehend, SageMaker, or Bedrock inference directly from queries.

Why it is used: Run ML inference inside SQL instead of app-level HTTP calls or ETL.

-- Use Aurora ML with SageMaker
SELECT * FROM athena_query('SELECT * FROM my_table');

Interview talking point: “You need the aurora_ml cluster parameter plus an associated IAM role with Comprehend or SageMaker permissions, otherwise you get permission denied for function aws_comprehend_detect_sentiment. Calls are synchronous and per-row with no batching, results come back as JSON, and the invoking identity is the cluster role, not your user.”

Q1515: How do you implement DynamoDB Accelerator (DAX) Cluster?

What it is: DAX is an in-memory cache cluster in front of DynamoDB serving hot items at microsecond latency.

Why it is used: Cut read latency for hot read-heavy items without scaling DynamoDB capacity.

# Create DAX cluster
aws dax create-cluster \
  --cluster-name my-dax \
  --node-type dax.r5.large \
  --replication-factor 3 \
  --iam-role-arn role-arn

Interview talking point: “Create it with aws dax create-cluster —node-type —replication-factor 3 —iam-role-arn; DAX runs inside your VPC, so reachability is a subnet and security-group problem. Your app just swaps to the DAX client on port 8111, reads are cached with a TTL and writes invalidate keys, and consistency is eventually consistent by default.”

Advanced AWS Container Scenarios

Q1516: How do you implement ECS Exec with Session Manager?

What it is: ECS Exec shells into running ECS or Fargate containers over an SSM Session Manager tunnel, not SSH.

Why it is used: Debug live containers with no inbound ports, no bastion, and IAM-based access control.

# Enable ECS Exec
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --enable-execute-command

# Connect to container
aws ecs execute-command \
  --cluster my-cluster \
  --task task-id \
  --container web \
  --interactive \
  --command "/bin/sh"

Interview talking point: “The top failure is forgetting —enable-execute-command on the service or task, which surfaces as TargetNotConnectedException. The task role also needs the ssmmessages Create/Open control and data channel permissions, then ecs execute-command —interactive opens a session executed as the container’s configured user.”

Q1517: How do you use ECS Service Discovery with Cloud Map?

What it is: ECS service discovery registers tasks in AWS Cloud Map so peers resolve them through private DNS.

Why it is used: Let services find each other by name without hardcoded IPs or an ALB hop.

# Create private DNS namespace
aws servicediscovery create-private-dns-namespace \
  --name production.local \
  --vpc vpc-123

# Create service with health checks
aws servicediscovery create-service \
  --name my-service \
  --namespace-id ns-123 \
  --health-check-config '{"Type":"HEALTHY","ResourcePath":"/health"}'

Interview talking point: “Set up a private DNS namespace and Cloud Map service, then attach it with —service-registries so each task registers itself. Use SRV records when ports are dynamic, since only SRV carries the port, and DNS returns records in random order, so this is discovery, not real load balancing.”

Q1518: How do you implement EKS Secrets Encryption?

What it is: EKS Secrets Encryption envelope-encrypts Kubernetes secrets at rest in etcd with a KMS symmetric CMK.

Why it is used: Protect secrets beyond base64, which is only encoding and trivially decoded.

# Enable secrets encryption
aws eks create-cluster \
  --name my-cluster \
  --encryption-config '[{"Provider":{"KeyArn":"arn:aws:kms:key/123"},"Resources":["secrets"]}'

Interview talking point: “You can add it to an existing cluster with aws eks associate-encryption-config; the key must be symmetric and only the secrets resource is supported. Rotating the CMK does not re-encrypt existing ciphertext, only new writes, and the KMS key policy must allow the EKS service principal or the cluster fails to start.”

Q1519: How do you use EKS Pod Security Standards?

What it is: Pod Security Standards enforce privileged, baseline, or restricted pod rules at admission via namespace labels.

Why it is used: Bake in baseline container hardening without installing OPA or Gatekeeper for simple policies.

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  seLinuxOptions:
    level: "s0:c123,c456"

Interview talking point: “Label namespaces with pod-security.kubernetes.io/enforce=restricted and violators are rejected with the failing control named; roll out warn, then audit, then enforce. PodSecurityPolicy was removed in Kubernetes 1.25 so this is the built-in replacement, there are no per-pod exceptions once a namespace enforce level is set, and enforce-version should be pinned.”

Q1520: How do you implement EKS Fargate Spot?

What it is: EKS Fargate Spot runs pods on interruptible Fargate capacity at a discount via a Fargate profile.

Why it is used: Cut compute cost for batch and dev pods that tolerate interruption.

# Create Fargate profile with spot capacity
aws eks create-fargate-profile \
  --cluster-name my-cluster \
  --fargate-profile-name my-spot-profile \
  --selectors '[
    {"namespace": "batch", "labels": {"type": "batch"}}
  ]'

Interview talking point: “Spot selection happens through the Fargate profile’s —selectors label match, since there is no built-in spot nodeSelector. Spot pods get about two minutes of interruption warning, so make them restartable, and they can sit Pending forever when capacity is tight, so keep an on-demand profile as fallback.”

Advanced AWS Serverless Scenarios

Q1521: How do you implement Lambda Function URLs with Auth?

What it is: Lambda Function URLs give each function a dedicated HTTPS endpoint with optional AWS_IAM auth, no API Gateway.

Why it is used: Expose a function over HTTP quickly for simple webhooks or internal endpoints.

# Create function URL with IAM auth
aws lambda put-function-url-config \
  --function-name my-function \
  --auth-type AWS_IAM

# Invoke with auth
aws lambda invoke \
  --function-name my-function \
  --cli-binary-format raw-in-base64-out \
  --payload '{"authorization":"Bearer token"}' response.json

Interview talking point: “With —auth-type AWS_IAM, callers must SigV4-sign and hold lambda:InvokeFunctionUrl, and cross-account callers need a resource-based policy on the function, since a missing policy is the classic 403. NONE means anyone on the internet can invoke it, and Function URLs have no custom domain, so put CloudFront in front.”

Q1522: How do you use Lambda Response Streaming?

What it is: Lambda response streaming returns an HTTP response in chunks so clients get first bytes before completion.

Why it is used: Serve large files or SSE without buffering the whole response in memory.

# Enable response streaming
import json

def handler(event, context):
    def generate():
        for i in range(10):
            yield f"chunk {i}\n"

    return streaming_response(generate())

Interview talking point: “Set —invoke-mode RESPONSE_STREAM on the function URL configuration, because InvokeMode lives on the URL config, not the function itself. Streaming works only over Function URLs since API Gateway stays buffered, and the stream is still bounded by the function’s 15-minute timeout.”

Q1523: How do you implement Lambda VPC ENI Management?

What it is: Lambda VPC ENI management attaches functions to shared hyperplane ENIs pooled per subnet and security group.

Why it is used: Explains VPC Lambda cold starts and why ENI attach or subnet-IP failures happen.

# Configure VPC for Lambda
aws lambda create-function \
  --function-name my-function \
  --vpc-config '{
    "SubnetIds":["subnet-123"],
    "SecurityGroupIds":["sg-123"]
  }' \
  --runtime python3.9 \
  --handler index.handler

Interview talking point: “The classic Unable to create ENI failure is either an execution role missing the ec2 network-interface permissions, which AWSLambdaVPCAccessExecutionRole covers, or a subnet with no spare IPs. Since 2021 Lambda shares ENIs per subnet and security group rather than one per function, so Provisioned Concurrency skips the attach delay.”

Q1524: How do you use Lambda Event Source Mapping Filters?

What it is: Event source mapping filters drop events before the Lambda function is ever invoked.

Why it is used: Cut noisy invocations, concurrency, and cost by matching only the events you want.

# Create event source with filters
aws lambda create-event-source-mapping \
  --function-name my-function \
  --event-source-arn arn:aws:sqs:us-east-1:123456789012:my-queue \
  --filter-criteria '{"Filters":[{"Pattern":"{\"body\":{\"type\":[\"order\"]}}"}]}'

Interview talking point: “Filter patterns match a JSON subset, and for SQS they apply to the decoded message body. Unmatched messages are silently consumed, never delivered and never sent to a DLQ, and filtering happens before batching, so decide up front where filtered events should go if you still need them.”

Q1525: How do you implement Lambda Custom Runtimes?

What it is: Lambda custom runtimes ship a bootstrap executable that polls the Runtime API for events and posts results.

Why it is used: Run languages AWS does not provide by implementing the Runtime API protocol yourself.

# Create layer with custom runtime
# In Dockerfile:
FROM amazonlinux
RUN yum install -y php74

# Create function using custom runtime
aws lambda create-function \
  --function-name my-function \
  --runtime provided.al2023 \
  --layers layer-arn

Interview talking point: “With —runtime provided.al2023 you ship a bootstrap that polls GET /2018-06-01/runtime/invocation/next and posts to the response or error endpoint, and that protocol is the whole contract. Container images implement the same contract, while SnapStart applies only to Java and is not available for custom runtimes.”

Advanced AWS Storage Scenarios

Q1526: How do you implement S3 Access Grants?

What it is: S3 Access Grants map IAM Identity Center or AD directory identities to prefix-level S3 data permissions.

Why it is used: Give thousands of employees least-privilege S3 prefix access without per-user bucket policies.

# Create access grant
aws s3control create-access-grant \
  --account-id 123456789012 \
  --access-grant-id grant-123 \
  --permission READ \
  --access-grant-scope Bucket=my-bucket

Interview talking point: “Setup order matters: create-access-grants-instance, then register-access-grants-identity-provider with IAM Identity Center or Directory Service, then a location and a grant. Grantee types are directory user, directory group, or IAM, and grants complement rather than replace IAM and bucket policies, since the caller still needs base s3 permissions.”

Q1527: How do you use S3 Intelligent-Tiering?

What it is: S3 Intelligent-Tiering auto-moves objects between access tiers based on usage with no retrieval fees.

Why it is used: Cut cost when access patterns are unpredictable and lifecycle rules would be guesswork.

# Configure Intelligent-Tiering
aws s3api put-bucket-intelligent-tiering-configuration \
  --bucket my-bucket \
  --id my-config \
  --intelligent-tiering-configuration '{
    "Status": "Enabled",
    "Tierings": [
      {"Days": 30, "AccessTier": "STANDARD_IA"},
      {"Days": 90, "AccessTier": "GLACIER"}
    ]
  }'

Interview talking point: “Intelligent-Tiering charges a monitoring fee per object every month, so tiny objects under about 128KB can cost more than they save. There are no retrieval fees, the optional Archive tiers must be explicitly enabled, and objects only shift tiers after a full 30-day observation window.”

Q1528: How do you implement S3 Dual-Stack Endpoints?

What it is: S3 dual-stack endpoints at s3.dualstack..amazonaws.com serve requests over both IPv4 and IPv6.

Why it is used: Let IPv6-only networks reach S3 without NAT or IPv4 plumbing.

# Use dual-stack endpoint
aws s3api list-buckets --endpoint-url https://s3.dualstack.us-east-1.amazonaws.com

Interview talking point: “The dualstack hostname is just a different endpoint for the same S3 API, resolving to both A and AAAA records. Bucket policies using aws:SourceIp must include IPv6 CIDRs or IPv6 clients will not match, dotted bucket names still need path-style addressing, and this is unrelated to Transfer Acceleration.”

Q1529: How do you use S3 Access Points Multi-Region?

What it is: Multi-Region Access Points give one global S3 endpoint spanning buckets in several regions with automatic failover.

Why it is used: Serve multi-region S3 data from one URL without app-side regional logic.

# Create multi-region access point
aws s3control create-multi-region-access-point \
  --account-id 123456789012 \
  --region us-east-1 \
  --bucket my-bucket

Interview talking point: “Create it with s3control create-multi-region-access-point listing a bucket per region, then call the global endpoint. MRAP only routes and fails over, so replication is separate S3 CRR and without it writes exist in just one region, while TrafficDialPercentage per region shifts traffic gradually.”

Q1530: How do you implement EFS Replication?

What it is: EFS Replication continuously copies a file system to another region or AZ at file level.

Why it is used: Give shared file data a disaster-recovery copy that survives regional loss.

# Create replication configuration
aws efs create-replication-configuration \
  --source-file-system-id fs-123 \
  --destinations '[{"Region":"us-west-2","AvailabilityZoneName":"us-west-2a"}]'

Interview talking point: “You create the replication, not the destination: create-replication-configuration —source-file-system-id —destinations provisions a destination filesystem that stays read-only until you break replication and promote it. Replication is asynchronous with roughly minutes-level RPO, and you pay for destination storage plus transfer, so pair it with AWS Backup for retention.”

Advanced AWS Analytics Scenarios

Q1531: How do you implement Kinesis Data Firehose Transformation?

What it is: Firehose transformation is a Lambda enrichment step that rewrites records in flight before delivery.

Why it is used: Reshape or enrich streaming data en route without a separate streaming job.

# Create delivery stream with Lambda transformation
aws firehose create-delivery-stream \
  --delivery-stream-name my-stream \
  --delivery-stream-type DirectPut \
  --lambda-arn arn:aws:lambda:region:account:function:my-function \
  --s3-destination-configuration '{
    "RoleARN":"role-arn",
    "BucketARN":"arn:aws:s3:::bucket"
  }'

Interview talking point: “The Lambda contract is strict: return exactly one result per input record, same recordId, base64 data, and a status of Ok, Dropped, or ProcessingFailed, since a count or recordId mismatch fails the batch. Configured under ProcessingConfiguration, bad records retry up to NumberOfRetries and then land in the S3 error-output-prefix.”

Q1532: How do you use OpenSearch Ingestion?

What it is: OpenSearch Ingestion runs managed Data Prepper pipelines with source, processor, and sink stages in YAML.

Why it is used: Get data into OpenSearch reliably without running ingestion nodes or Logstash.

# Create pipeline
aws osis create-pipeline \
  --pipeline-name my-pipeline \
  --min-units 2 \
  --max-units 10

Interview talking point: “Pipelines use standard Data Prepper syntax, created with aws osis create-pipeline and scaled by min and max Ingestion Compute Units. The pipeline service role needs es:ESHttp* actions plus iam:PassRole and domain access-policy approval or you get 403s, and validate-pipeline checks the config before you deploy.”

Q1533: How do you implement Redshift Concurrency Scaling?

What it is: Redshift Concurrency Scaling spins up transient clusters to absorb bursts when main cluster query slots are full.

Why it is used: Handle reporting spikes without over-provisioning or manually scaling the main cluster.

# Enable concurrency scaling
aws redshift modify-cluster \
  --cluster-identifier my-cluster \
  --enable-concurrency-scaling

Interview talking point: “It only engages when the main cluster runs out of query slots, so it is a backstop, not load balancing, and it never splits one query. Eligible work is short reads and light writes while long ETL and DDL do not qualify, you get roughly one free hour per day, and unlike Redshift Serverless it keeps your provisioned cluster.”

Q1534: How do you use Glue Data Quality?

What it is: Glue Data Quality runs declarative DQDL rulesets inside Glue jobs or as standalone evaluation runs.

Why it is used: Fail or flag pipelines when data has duplicates, missing keys, or stale rows.

# Create data quality ruleset
glue.create_data_quality_ruleset(
    Name='my-ruleset',
    Ruleset='rules'
)

Interview talking point: “Rules are written in DQDL such as IsComplete, IsUnique, ColumnValues, and Freshness, and created with create-data-quality-ruleset. A recommendation run can scan a sample and propose rules for you, and the job either stops the pipeline on failure or logs and continues; the engine underneath is AWS Deequ.”

Q1535: How do you implement Athena Query Federation?

What it is: Athena Query Federation registers connector Lambdas as catalogs so one query reads live non-S3 sources.

Why it is used: Join live DynamoDB or RDS data with S3 logs without loading it first.

# Use Athena federated query
athena.start_query_execution(
    QueryString='SELECT * FROM lambda_db.my_function()',
    ResultConfiguration={'OutputLocation': 's3://bucket/results/'}
)

Interview talking point: “Register connectors with create-data-catalog —type LAMBDA and query them using quoted three-part names. Predicates are pushed down only as far as each connector supports, and each connector Lambda runs with its own execution role, so an AccessDenied inside the connector means that role, not Athena, lacks source permissions.”

Advanced AWS DevOps Scenarios

Q1536: How do you implement CodePipeline Artifact Store Encryption?

What it is: CodePipeline artifact store encryption applies SSE-KMS to artifacts passed between pipeline stages.

Why it is used: Meet audit requirements by encrypting interim artifacts with your own customer-managed key.

# Create pipeline with encryption
aws codepipeline create-pipeline \
  --pipeline '{
    "name": "my-pipeline",
    "artifactStore": {
      "type": "S3",
      "location": "my-bucket",
      "encryptionKey": {"id":"key-arn","type":"KMS"}
    }
  }'

Interview talking point: “Set encryptionKey to your KMS ARN inside the pipeline artifactStore block. The CodePipeline service role then needs kms Encrypt, Decrypt, GenerateDataKey, and DescribeKey on that key or the pipeline fails with KMSAccessDeniedException, and the key must live in the same region as the artifact bucket.”

Q1537: How do you use CodeBuild Multiple Sources?

What it is: CodeBuild multiple sources check out up to five repositories into separate directories in one build.

Why it is used: Build a service and its shared library from two repos without chained builds.

# buildspec.yml with multiple sources
version: 0.2

env:
  variables:
    CODEBUILD_RESOLVED_SOURCE_VERSION: "source_version"

sources:
  - type: CODECOMMIT
    identifier: source
  - type: S3
    identifier: assets
    location: s3://bucket/assets

Interview talking point: “Secondary sources land at $CODEBUILD_SRC_DIR_, while the buildspec runs relative to the primary source, so cross-repo steps start with an explicit cd. A push to a secondary repo will not fire the build unless the webhook filter explicitly includes that source.”

Q1538: How do you implement CodeDeploy Rollback Triggers?

What it is: CodeDeploy rollback triggers auto-redeploy the last successful revision on deployment failure or a CloudWatch alarm.

Why it is used: Undo bad rollouts automatically instead of watching dashboards and reverting by hand.

# Create deployment with rollback
aws codedeploy create-deployment \
  --application-name my-app \
  --deployment-group-name my-group \
  --rollback-trigger '{
    "arn": "arn:aws:cloudwatch:region:account:alarm:alarm-name",
    "type": "ALARM"
  }'

Interview talking point: “Use —rollback-configuration, since the older auto-rollback-configuration name still appears, with DEPLOYMENT_FAILURE and DEPLOYMENT_STOP_ON_ALARM triggers, and create the CloudWatch alarm first. Rollback only fires while the deployment is in progress, so an alarm after completion does nothing, and it restores the last successful revision.”

Q1539: How do you use CDK Pipelines Self-Mutation?

What it is: CDK Pipelines self-mutation redeploys the pipeline’s own CloudFormation stack when a run changes it.

Why it is used: Commit pipeline changes and let the pipeline upgrade itself instead of redeploying by hand.

from aws_cdk import pipelines

pipeline = pipelines.CodePipeline(
    self, "Pipeline",
    synth=pipelines.ShellStep("Synth",
        commands=["npm ci", "cdk synth"]
    ),
    self_mutation=True
)

Interview talking point: “Self-mutation is on by default, so a run whose synth changes the pipeline stack redeploys that stack itself, which is why the first run after a pipeline edit often only mutates and your app deploys on the next run. It depends on cdk bootstrap roles holding CloudFormation permissions and can be disabled with selfMutation false.”

Q1540: How do you implement Terraform Import Existing Resources?

What it is: Terraform import adopts an already-existing live resource into state so configuration can manage it.

Why it is used: Bring manually created infrastructure under IaC control without recreating it or causing downtime.

# Import S3 bucket
terraform import aws_s3_bucket.example my-bucket

# Import EC2 instance
terraform import aws_instance.example i-12345

Interview talking point: “terraform import only writes to state and never touches the live resource, but a partial config makes the next plan propose destructive replacements, so match config to reality before applying. The modern path is an import block with terraform plan -generate-config-out, and re-importing something already in state fails with resource already managed.”

Advanced AWS Cost Management

Q1541: How do you implement AWS Budgets Anomaly Detection?

What it is: Budgets anomaly monitors learn a spend baseline and alert on unexpected deviations, with optional subscriptions.

Why it is used: Catch runaway or surprising spend quickly instead of waiting for static thresholds.

# Create budget with anomaly detection
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "monthly-budget",
    "BudgetLimit": {"Amount": "1000", "Unit": "USD"},
    "CostFilters": {"Service": ["Amazon EC2"]},
    "CostTypes": {"IncludeTax": true}
  }'

Interview talking point: “Anomaly detection is two calls: create-anomaly-monitor for the scope, then create-anomaly-subscription to route alerts to subscribers over SNS. It needs enough history to build a baseline, so brand-new accounts never alert, and auto-remediation is on you since budget actions attach to budgets, not anomalies.”

Q1542: How do you use AWS Cost Categories?

What it is: Cost Categories are rules grouping cost line items into your own business dimensions like product or environment.

Why it is used: Slice spend by business labels in Cost Explorer and use them in budgets.

# Create cost category
aws ce create-cost-category-definition \
  --name "Environment" \
  --rules '[{
    "Rule": {
      "CostCategoryValue": "Production",
      "DimensionValue": "prod-*"
    }
  }]'

Interview talking point: “Cost category rules are evaluated in order with the first match winning, so put catch-alls last, since anything unmatched lands in Unassigned. Rule types are REGULAR, INHERITED_VALUE, and SPLIT, grouping in Cost Explorer uses group-by with Key COST_CATEGORY, and changes lag because CE data trails the CUR.”

Q1543: How do you implement Reserved Instance Planning?

What it is: Reserved Instance planning sizes 1- or 3-year commitments to match your steady-state baseline usage.

Why it is used: Cut predictable on-demand spend by committing to capacity you run around the clock.

# Get Reserved Instance recommendations
aws ce get-reservation-purchase-recommendation \
  --service "Amazon EC2" \
  --account-id 123456789012

Interview talking point: “Plan from data: get-reservation-coverage shows coverage, get-reservation-utilization shows waste, and CE recommendations size the purchase. Zonal RIs guarantee capacity in one AZ while regional RIs do not but offer size flexibility, org RI sharing must be enabled for members, and Savings Plans are now the default answer over RIs.”

Q1544: How do you use AWS Compute Optimizer Recommendations?

What it is: Compute Optimizer analyzes CloudWatch utilization with ML to flag over- or under-provisioned EC2, ASG, Lambda, EBS.

Why it is used: Find rightsizing opportunities with evidence instead of eyeballing dashboards for 800 instances.

# Get EC2 recommendations
aws compute-optimizer get-ec2-instance-recommendations

# Export to S3
aws compute-optimizer export-recommendations \
  --destination s3://bucket/

Interview talking point: “It is a suggestion engine only and never resizes anything. Findings are UNDER_PROVISIONED, OVER_PROVISIONED, OPTIMIZED, NOT_OPTIMIZED, or INSUFFICIENT_DATA when history is too short, and Enhanced infrastructure metrics needs an agent on the instance plus an extra-cost enrollment.”

Q1545: How do you implement Savings Plans Recommendations?

What it is: Savings Plans recommendations compute hourly commitment suggestions across Compute, EC2 Instance, and SageMaker plan types.

Why it is used: Buy the right-size commitment by asking AWS to model your historical usage.

# Get Savings Plans recommendations
aws ce get-savings-plans-purchase-recommendation \
  --savings-plan-type COMPUTE_SP \
  --term-in-years THREE_YEAR

Interview talking point: “get-savings-plans-purchase-recommendation takes four knobs, type, term, payment option, and lookback window, and the lookback you choose changes the number. Commit to roughly your floor since it should cover only stable usage, Compute SP is the flexible default covering EC2, Fargate, and Lambda, and afterward watch utilization and coverage.”

Advanced AWS Integration Patterns

Q1546: How do you implement SQS Batch with Lambda?

What it is: SQS batching with Lambda packs up to 10,000 messages per invocation using a batching window.

Why it is used: Process queues in fewer invocations to cut GB-seconds and raise throughput.

# Lambda handler with batch processing
def handler(event, context):
    records = event['Records']
    batch_item_failures = []

    for record in records:
        try:
            process_message(record)
        except Exception:
            batch_item_failures.append({'itemIdentifier': record['messageId']})

    return {'batchItemFailures': batch_item_failures}

Interview talking point: “Batch size goes to 10,000 for standard queues but only 10 for FIFO, with a batching window up to 300 seconds. Without —function-response-types ReportBatchItemFailures one failure retries the entire batch, and MaximumConcurrency in scaling-config caps how fast the mapping drains your queue.”

What it is: SNS FIFO to SQS FIFO delivers ordered, deduplicated messages to FIFO queue subscriptions with group semantics.

Why it is used: Fan out ordered, non-duplicated events when standard SNS and SQS are unordered and at-least-once.

# SNS FIFO to SQS FIFO
sns.publish(
    TopicArn=topic_arn,
    Message='{"orderId": "123"}',
    MessageGroupId='order-123',
    MessageDeduplicationId='unique-id'
)

Interview talking point: “FIFO topics and queues must have names ending in .fifo, and a FIFO topic can only subscribe to FIFO queues. Deduplication only covers a five-minute window, ordering holds per MessageGroupId with one consumer per group, and throughput is 300 messages per second unless you enable high-throughput mode for up to 3,000.”

Q1548: How do you implement EventBridge Pipe Transformation?

What it is: EventBridge Pipes connect one source to one target with inline filter, enrichment, and input transformation.

Why it is used: Move, filter, and reshape events between services without writing a plumbing Lambda.

# Create pipe
aws eventsv2 create-pipe \
  --name with transformation my-pipe \
  --source kinesis \
  --target lambda \
  --input-template '{"data": $.data, "meta": $.meta}'

Interview talking point: “create-pipe takes a source and a single target with —filter, —enrichment, and —input-transformer in between. Filtering happens before enrichment so it saves calls, enrichment is synchronous, and unlike EventBridge rules there is only one target, so use rules when you need fan-out to many subscribers.”

Q1549: How do you use Step Functions Distributed Map?

What it is: Distributed Map runs a child execution per item or batch read from S3 at high concurrency.

Why it is used: Parallelize millions of items with concurrency control and per-batch failure isolation.

{
  "Map": {
    "Type": "Map",
    "ItemProcessor": {
      "Processor": {"Type": "Task", "Resource": "arn:aws:states:::lambda:invoke"}
    },
    "MaxConcurrency": 100,
    "ItemsPath": "$.records"
  }
}

Interview talking point: “An ItemReader pulls CSV, JSON, JSONL, or Parquet from S3, ItemBatcher groups them, and each batch runs as its own child execution with MaxConcurrency up to 10,000, so one failure never poisons the rest. ToleratedFailurePercentage allows partial success, ResultWriter writes outputs to S3, and every child is billed separately.”

Q1550: How do you implement Kinesis Consumer Enhanced Fan-Out?

What it is: Kinesis Enhanced Fan-Out gives each consumer a dedicated 2 MB per shard channel via SubscribeToShard over HTTP/2.

Why it is used: Let multiple consumers read at low latency without polling contention starving each other.

# Register consumer
kinesis.register_stream_consumer(
    StreamARN='arn:aws:kinesis:stream/my-stream',
    ConsumerName='enhanced-consumer'
)

# Subscribe with enhanced fan-out
shard_iterator = kinesis.get_shard_iterator(
    StreamName='my-stream',
    ShardIteratorType='AT_TIMESTAMP',
    ConsumerName='enhanced-consumer'
)

Interview talking point: “Register a consumer with register-stream-consumer, then subscribe with SubscribeToShard for a dedicated channel and sub-200ms latency, billed per consumer-hour with a soft quota of five. Lambda’s Kinesis mapping cannot use EFO since it polls instead, and delivery remains at-least-once, so deduplication is your job.”

Advanced AWS Architecture Patterns

Q1551: How do you implement Strangler Fig Pattern?

What it is: Incrementally replaces a legacy monolith: a facade routes requests feature-by-feature to new services until the old system is retired.

Why it is used: Modernizes without a big-bang rewrite — cut over one feature at a time to limit risk.

# Use API Gateway to route between old and new
# Old: https://api.example.com/v1/*
# New: https://api.example.com/v2/*
aws apigateway create-route \
  --api-id api-id \
  --route-key 'GET /v1/{proxy+}' \
  --target 'integrations/v1'

Interview talking point: “The facade is API Gateway or ALB listener rules; cut over one path at a time with per-route integrations — REST API changes need create-deployment to go live, and create-route with route keys is apigatewayv2 syntax, not apigateway. Keep the DB shared via dual-write or DMS CDC, and retire legacy when CloudWatch shows zero traffic.”

Q1552: How do you use Sidecar Pattern in ECS?

What it is: Places a helper container — log agent, proxy, metrics exporter — as a second container in the same ECS task, sharing network and volumes.

Why it is used: Adds cross-cutting capability like logging or metrics without rebuilding the application.

{
  "containerDefinitions": [
    {
      "name": "app",
      "image": "my-app"
    },
    {
      "name": "sidecar",
      "image": "sidecar-agent",
      "essential": false
    }
  ]
}

Interview talking point: “There is no —sidecars flag: you just add a second containerDefinition in the same task definition. Both containers share the awsvpc task IP so the app reaches the sidecar on localhost, dependsOn controls startup order, and ECS containers are co-terminus unlike Kubernetes sidecars.”

Q1553: How do implement Ambassador Pattern in Kubernetes?

What it is: A single edge proxy — Ingress or gateway controller on EKS — in front of services, handling routing, TLS, and authentication.

Why it is used: Centralizes entry-point concerns so clients hit one door for TLS, auth, and routing.

apiVersion: v1
kind: Service
metadata:
  name: redis-ambassador
spec:
  selector:
    app: redis
  ports:
  - port: 6379
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
      - name: ambassador
        image: envoyproxy/envoy:latest

Interview talking point: “An Ingress object does nothing until a controller like the AWS Load Balancer Controller is installed — that is why your Ingress 404s. Attach certificates via the ALB ingress ACM annotation, not a —ssl-certificate-arn flag, and use the ambassador for client traffic while internal calls bypass it.”

Q1554: How do you use Anti-Entropy in Distributed Systems?

What it is: Background reconciliation that compares replica state via digests or Merkle trees and repairs drift missed by operation logs.

Why it is used: Guarantees replicas converge after partitions or dropped writes — self-healing replication instead of log replay alone.

# Implement anti-entropy repair
def repair(node_data, peer_data):
    merged = merge_versions(node_data, peer_data)
    if merged != node_data:
        store(merged)
        return True
    return False

Interview talking point: “Anti-entropy compares full state instead of replaying logs: nodes exchange Merkle-tree digests and repair drift — the mechanism behind Dynamo and S3’s integrity repair. You don’t operate it yourself, so design for convergence with versioned items and conditional writes; the base64 angle is a red herring.”

Q1555: How do you implement Bulkhead Pattern with Lambda?

What it is: Partitions resources so one consumer or dependency can’t starve others; on Lambda it’s per-function reserved concurrency caps.

Why it is used: Bounds blast radius so a noisy tenant or slow dependency fails alone while others keep serving.

# Use reserved concurrency for bulkhead
lambda_client.put_function_concurrency(
    FunctionName='critical-function',
    ReservedConcurrentExecutions=10
)

Interview talking point: “put-function-concurrency per function is the bulkhead, but reserved units are deducted from the account’s shared pool (default 1000 unreserved) — over-reserving throttles your other functions. Buffer intake with SQS and pair with circuit breakers; watch for ThrottlingException when a partition is sized too small.”

Advanced AWS ML Services

Q1556: How do you implement SageMaker Feature Store?

What it is: SageMaker’s central feature store: feature groups with an online store for low-latency serving and an offline S3 store for training.

Why it is used: Keeps training and inference on identical features, killing train/serve skew and enabling feature reuse.

# Create feature group
featurestore_runtime.put_record(
    FeatureGroupName='my-feature-group',
    Record=[{'FeatureName': 'feature1', 'ValueAsString': 'value1'}]
)

Interview talking point: “Feature groups need a record identifier and event time: the online store gives millisecond get_record for serving, the offline S3/Athena store gives full history for training, and eventTime powers point-in-time joins so training never sees the future. The online TTL field is OnlineStoreTtlDuration.”

Q1557: How do you use SageMaker Model Registry?

What it is: Versioned catalog for models: package groups hold versions with approval statuses, and approved versions deploy through aliases.

Why it is used: Gates which model goes live — deploy only approved versions and track lineage automatically.

# Create model package
aws sagemaker create-model-package \
  --model-package-name my-model \
  --inference-specification '{
    "Containers": [{"Image": "image-uri"}],
    "SupportedTransformInstanceTypes": ["ml.m5.xlarge"],
    "SupportedRealtimeInferenceInstanceTypes": ["ml.m5.xlarge"]
  }'

Interview talking point: “Package groups are the repo and each create-model-package bumps ModelPackageVersion; deploy through an alias updated with update-model-package so endpoints always track the latest Approved version. A package stuck InProgress means the inference-spec validation is still running — and remember registry versions, Model Monitor detects drift.”

Q1558: How do you implement SageMaker Edge Manager?

What it is: Packages trained models for edge devices, with an on-device agent doing inference and a fleet service managing updates.

Why it is used: Runs ML offline on cameras and gateways while managing metrics and over-the-air updates centrally.

# Create edge deployment plan
aws sagemaker create-edge-deployment-plan \
  --edge-deployment-plan-name my-plan \
  --model-name my-model

Interview talking point: “There is no single edge command: Neo’s create-compilation-job targets the chip, then create-edge-packaging-job bundles model plus agent, and devices register to a fleet. The on-device agent queues metrics and syncs to S3 only when online, pulling OTA model updates from the fleet — Neo compiles, Edge Manager manages.”

Q1559: How do you use SageMaker Canvas?

What it is: No-code ML app in the SageMaker console where analysts import data, prep it, auto-build, evaluate, and deploy models.

Why it is used: Lets non-engineers build working ML models without writing training code.

# Use SageMaker Canvas console:
# 1. Import data
# 2. Prepare data (visual)
# 3. Build model (no-code)
# 4. Evaluate results
# 5. Deploy

Interview talking point: “Canvas isn’t switched on by a console toggle — it lives in a SageMaker domain’s CanvasAppSettings, and users need a domain profile plus sagemaker:CreateApp on the canvas AppType. Don’t confuse it with SecurityGroupIdForRStudio, which is the RStudio setting; Autopilot trains the models underneath.”

Q1560: How do you implement SageMaker Clarify?

What it is: Processing jobs that compute bias metrics (like DPPL and AD) and SHAP feature attributions before and after deployment.

Why it is used: Audits models for fairness and explains individual predictions for responsible AI.

# Configure SageMaker Clarify
sagemaker.create_model(
    ModelName='my-model',
    PrimaryContainer={'Image': 'image-uri'},
    ClarifyContainerConfig={
        'ModelName': 'my-model',
        'ModelPackageVersion': '1.0'
    }
)

Interview talking point: “Clarify runs as a processing job driven by analysis_config with dataset, label, and facet, reporting bias metrics like DPPL and AD plus SHAP attributions to S3 and Studio. A clean no-bias result can just mean the wrong facet, and Clarify also monitors bias drift and evaluates LLMs.”

Advanced AWS IoT Scenarios

Q1561: How do you implement IoT Device Provisioning?

What it is: AWS IoT Core mechanisms to register fleets of devices — fleet provisioning with claim certs, JITP, JITR, and bulk registration.

Why it is used: Onboards thousands of devices securely with zero-touch registration of things, certs, and policies.

# Provision with fleet provisioning template
iot.create_provisioning_claim(
    templateName='my-template',
    certificateId='cert-id'
)

Interview talking point: “Fleet provisioning is the modern path: flash a claim certificate that can only call register-thing against a provisioning template attaching the thing plus a policy with ${thingName} substitution, then revoke claim certs after rollout. JITP and JITR need the root CA uploaded — not any —enable-no-catalog flag.”

Q1562: How do you use IoT Fleet Indexing?

What it is: Searchable index over things, shadows, and connectivity status, plus fleet metrics that aggregate counts across the fleet.

Why it is used: Finds devices across a huge fleet by query instead of scanning things one by one.

# Enable fleet indexing
aws iot update-fleet-metrics \
  --thing-name my-thing \
  --metric '{\"cpu\": 80, \"memory\": 60}'

Interview talking point: “Search returns nothing until you enable indexing: run update-indexing-configuration with REGISTRY_AND_SHADOW plus connectivity STATUS. The sample command update-fleet-metrics doesn’t exist (it’s update-fleet-metric, for fleet metrics not search). Queries use search-index with fields like shadow.reported.*, sync lags seconds to minutes, and connectivity indexing bills extra.”

Q1563: How do you implement IoT Greengrass V2 Components?

What it is: Deployable software units for edge devices: a recipe (lifecycle steps plus S3 artifacts) that the Greengrass nucleus runs and updates.

Why it is used: Manages and rolls out edge software to fleets from the cloud instead of SSH.

Recipe:
  ComponentVersion: '1.0.0'
  Publisher: AWS
  Function: Lambda
  Configuration:
    Handler: index.handler

Interview talking point: “Components are a recipe plus S3 artifacts: create-component-version —inline-recipe, then create-deployment against thing groups — rollout rate and ROLLBACK failure policy live under —deployment-config, not a standalone —rollout flag. The nucleus runs components on each core device, greengrass-cli component list debugs them, and IoT Jobs cover one-shot commands.”

Q1564: How do you use IoT Events Detectors?

What it is: Stateful detector models — states, conditions, variables, timers — where each detector instance tracks one device through a state machine.

Why it is used: Detects conditions needing memory, like running hot for five minutes, which stateless alarms can’t.

# Create detector with simple rules
detector = iotevents.create_detector_model(
    detectorModelName='temperature-monitor',
    detectorModelDefinition={
        'states': [{
            'stateName': 'Normal',
            'onInput': {
                'events': [{
                    'eventName': 'CheckTemperature',
                    'condition': 'input.temperature > 80',
                    'actions': [{'setVariable': {'variableName': 'alert', 'value': 'true'}}]
                }]
            }
        }]
    }
)

Interview talking point: “Detector models are state machines: states with onInput events whose conditions fire actions and nextState, with a key creating one instance per device — 1000 sensors means 1000 instances. Use variables as counters and timers via timeout() for duration rules, unlike stateless CloudWatch alarms; changing the key restarts the instance.”

Q1565: How do you implement IoT SiteWise Edge Gateway?

What it is: Runs SiteWise on-premises on a Greengrass core device, collecting OPC-UA and Modbus data locally with buffering and cloud sync.

Why it is used: Collects industrial telemetry at poorly connected plants, buffering locally and syncing when online.

# Deploy edge gateway
aws iotsitewise create-gateway \
  --gateway-name my-gateway \
  --gateway-platform '{"Greengrass":{"GroupId":"group-id"}}'

Interview talking point: “Create the gateway with —gateway-platform GreengrassV2 and a core device thing name; the older Greengrass GroupId platform shown in some samples is wrong. OPC-UA and Modbus collectors ingest and buffer locally for days before syncing, but the SiteWise portal and dashboards still need cloud connectivity.”

Advanced AWS Media Services

Q1566: How do you implement MediaLive Encoding Profiles?

What it is: MediaLive channels that transcode a live input into multiple encoded outputs using encoder settings for video, audio, and output groups.

Why it is used: Turns one live feed into a multi-bitrate ladder of HLS or DASH renditions.

# Create channel
aws medialive create-channel \
  --channel-class SINGLE_PIPELINE \
  --name my-channel \
  --input-specification '{
    "Codec": "AVC",
    "Resolution": "HD",
    "MaximumBitrate": "MAX_10_MBPS"
  }'

Interview talking point: “A channel is input plus an —encoder-settings JSON of VideoDescriptions, AudioDescriptions and OutputGroups; STANDARD gives dual-pipeline HA while SINGLE_PIPELINE is cheaper. MediaLive only encodes — packaging belongs to MediaPackage — and console profiles are just curated presets; troubleshoot with describe-channel and —log-level ERROR.”

Q1567: How do you use MediaPackage Packaging?

What it is: Turns a single high-bitrate encode into packaged HLS, DASH, CMAF, or MSS endpoints with DRM, DVR windows, and ad markers.

Why it is used: Serves one encode to every device format just-in-time instead of storing multiple copies.

# Create packaging configuration
aws mediapackage create-origin-endpoint \
  --channel-id my-channel \
  --id my-endpoint \
  --hls-package '{
    "SegmentDuration": 6,
    "PlaylistWindowSize": 60
  }'

Interview talking point: “Create a channel for the ingest URL, then one origin endpoint per format using —hls-package-configuration, —dash-package-configuration, —cmaf or —mss — not a bare —hls-package flag. PlaylistWindowSeconds is your DVR window, SPEKE delivers DRM keys, and small events can skip MediaPackage for MediaLive’s direct HLS output.”

Q1568: How do you implement MediaTailor Ad Insertion?

What it is: Server-side ad insertion: MediaTailor rewrites manifests to stitch personalized ads into live and VOD streams at playback time.

Why it is used: Monetizes streams with per-viewer ads that players can’t block and all players handle identically.

# Create ad insertion configuration
aws mediatailor create-playback-configuration \
  --name my-config \
  --ad-decision-server-url http://ads.example.com \
  --hls-configuration '{
    "ManifestWindowSeconds": 60
  }'

Interview talking point: “A configuration pairs your content source with an ad-decision-server URL serving VAST or VMAP; playback endpoints return manifests where MediaTailor stitches ad segments matched against SCTE-35 markers — missing markers hurt matching. The modern flow is create-channel plus create-program, and SSAI beats client-side because it’s ad-block-proof.”

Q1569: How do you use Elemental Server?

What it is: AWS’s on-premises media encoding line — the standalone Elemental Server offer is retired in favor of Elemental Live and MediaLive.

Why it is used: Runs broadcast-grade encoding on your own hardware when cloud ingest isn’t an option.

# Use Elemental Server for on-premise encoding
# Deploy software on hardware
# Configure via web interface

Interview talking point: “Elemental Server as a standalone product is retired — map the question to Elemental Live for on-prem encoding and MediaLive for the cloud, with MediaConvert for files. On-prem gear uses its own web interface and API rather than the medialive CLI, and hybrid setups feed the cloud via MediaConnect.”

Q1570: How do you implement MediaConvert Queue-Based Encoding?

What it is: MediaConvert routes transcoding jobs through on-demand or reserved queues, controlling concurrency, priority, and pricing per queue.

Why it is used: Prioritizes transcoding work — ad renders jump ahead of bulk archive jobs.

# Create queue
aws mediaconvert create-queue \
  --name my-queue \
  --description "High priority queue"

# Submit job to queue
aws mediaconvert create-job \
  --queue arn:aws:mediaconvert:us-east-1:account:queues/my-queue

Interview talking point: “Queues control priority: an on-demand default plus custom queues, or RESERVED with reservation-plan-settings for committed discount, and jobs carry a Priority within each queue. create-job requires —role plus iam:PassRole — that’s the usual AccessDenied cause; MediaConvert does files, Elastic Transcoder is deprecated.”

Advanced AWS Gaming Services

Q1571: How do you implement GameLift Fleets?

What it is: Groups of instances running your game server build, hosting game sessions with scaling, queues, and player-session APIs.

Why it is used: Hosts multiplayer game servers at scale without managing EC2 game servers yourself.

# Create build
aws gamelift upload-build \
  --operating-system AMAZON_LINUX \
  --build-version "v1.0" \
  --storage-location bucket=my-bucket,key=game-build

# Create fleet
aws gamelift create-fleet \
  --name my-fleet \
  --build-id build-123 \
  --ec2-instance-type c5.large

Interview talking point: “There is no upload-build command — builds come from create-build with a storage location. create-fleet takes runtime-configuration with a launch path and concurrent executions, sessions are placed by game-session queues, and a fleet stuck in BUILDING almost always means a bad LaunchPath.”

Q1572: How do you use GameLift Aliases for Deployments?

What it is: Stable names pointing at a GameLift fleet so clients never know the fleet ID behind them.

Why it is used: Swaps fleets during deploys or maintenance without touching game clients.

# Create alias with routing
aws gamelift create-alias \
  --name production \
  --routing-strategy '{
    "Type": "TERMINAL",
    "FleetId": "fleet-123"
  }'

Interview talking point: “Aliases are free indirection: SIMPLE points to one fleet, TERMINAL always rejects placement with a maintenance message. Clients pass an alias ID, so blue/green and rollback are just update-alias with no client change — but game-session queues and FlexMatch target fleets through destinations, not aliases.”

Q1573: How do you implement GameLift Player Sessions?

What it is: Represents a player inside a game session, handing back the server address, port, and a session the server validates.

Why it is used: Lets players join securely — the server authenticates the session instead of opening a raw port.

# Create player session
aws gamelift create-player-session \
  --player-id player-123 \
  --player-session-id session-123

Interview talking point: “You don’t supply a —player-session-id — create-player-session takes only game-session-id and player-id and returns the session, IP and port. Status moves RESERVED to ACTIVE when the player connects, the server validates via describe-player-sessions, and MaximumPlayerSessionCount caps occupancy.”

Q1574: How do you use GameLift FlexMatch?

What it is: Managed matchmaking: rule sets balance players into teams by latency and skill, then place the match via tickets and queues.

Why it is used: Forms balanced matches on rules and timing rather than first-come placement.

# Create matchmaking configuration
aws gamelift create-matchmaking-configuration \
  --name my-match \
  --game-session-queue arn:aws:gamelift:gamesessionqueue \
  --rule-set-arn rule-set-arn

Interview talking point: “Rule sets are strict JSON — a typo makes create-matchmaking-ruleset reject with an invalid rule set error, so validate early. Teams plus distance and comparison rules feed a configuration with a queue and timeout; start-matchmaking tickets come back PLACED with team assignments, and automatic backfill refills live games.”

Q1575: How do you implement Gamelift Serverless?

What it is: There is no GameLift Serverless product; the real answer covers GameLift’s managed model, container fleets, and why Lambda can’t host game servers.

Why it is used: Clarifies that game sessions are stateful, so the serverless-like value comes from GameLift’s managed layer.

# Create game session queue
aws gamelift create-game-session-queue \
  --name my-queue \
  --destinations '[{"DestinationArn":"fleet-arn"}]'

Interview talking point: “There is no GameLift Serverless SKU — say so first. The serverless-like story is GameLift’s managed layer of fleets, session APIs, queues, FlexMatch and auto-scaling; stateful low-latency UDP sessions rule out Lambda and Fargate, while container fleets and GameLift Anywhere offer bring-your-own compute.”

Additional Interview Questions 1576-1700

Q1576: How do you implement AWS AppSync Subscriptions?

What it is: GraphQL subscriptions over WebSocket where @aws_subscribe ties subscription fields to mutation payloads for real-time push.

Why it is used: Streams live updates like chat and scores to web and mobile clients instantly.

# GraphQL subscription
type Subscription {
  onCreatePost(id: ID!): Post
    @aws_subscribe(mutations: ["createPost"])
}

Interview talking point: “Subscriptions fire from mutations: the @aws_subscribe directive lists the triggering mutation names, and clients open the wss:// endpoint using the API’s auth mode, filtered by the subscription’s arguments. Offline writes and conflict resolution are a separate AppSync Sync feature — realtime is billed per connection-minute.”

Q1577: How do you use AWS Amplify Admin UI?

What it is: Visual console — now Amplify Studio — for managing an Amplify backend: auth, data models, storage, functions, and UI components.

Why it is used: Lets non-engineers manage app backend visually while CLI-driven code stays in sync.

# Use Amplify Admin UI:
# 1. amplify add auth
# 2. amplify add api
# 3. amplify push
# 4. Access Admin UI at /admin

Interview talking point: “Admin UI is now Amplify Studio: a visual layer over the same amplify/backend JSON, so run amplify pull after UI edits to sync your repo. Simple auth, models and storage live here; complex resolvers and CI stay with the CLI’s amplify push.”

Q1578: How do you implement AWS Device Farm?

What it is: Service that runs your tests and remote sessions against real physical phones and tablets in AWS labs.

Why it is used: Validates releases on real devices instead of emulators only.

# Create device pool
aws devicefarm create-device-pool \
  --name "Android Devices" \
  --rules '[{"attribute":"PLATFORM","operator":"EQUALS","value":"ANDROID"}]'

Interview talking point: “The flow is create-project, create-upload for the app and test package, then schedule-run against a device pool — test types include APPIUM, XCUITest and BUILTIN_FUZZ. For hands-on debugging use create-remote-access-session; runs can sit QUEUED waiting for devices and billing is per device-minute.”

Q1579: How do you use AWS Mobile Hub?

What it is: AWS’s 2016-2018 all-in-one mobile backend console, retired and folded into AWS Amplify.

Why it is used: We don’t — it’s deprecated; answer by mapping its features to Amplify equivalents.

# Use Mobile Hub console:
# 1. Create project
# 2. Select features
# 3. Download sample app

Interview talking point: “Mobile Hub was retired around 2018 and folded into Amplify, so any question about it is testing whether you know that. Map the features: auth to amplify add auth, analytics to Pinpoint, logic to amplify add api, storage to DynamoDB, hosting to amplify hosting.”

Q1580: How do you implement AWS Sumerian Scenes?

What it is: AWS’s browser-based no-code 3D/VR/AR scene builder with animated hosts, discontinued in July 2023.

Why it is used: We don’t — recognize it’s dead and name modern Three.js or Unity WebGL alternatives.

# Use Sumerian console:
# 1. Create scene
# 2. Add 3D objects
# 3. Add interactions
# 4. Publish

Interview talking point: “Sumerian was discontinued in July 2023, so don’t pitch it — describe it as the old no-code 3D/VR editor with Polly-lipsynced hosts, then pivot to Three.js or Babylon.js or Unity WebGL hosted on S3 and CloudFront with normal AWS backends.”

Q1581: How do you use AWS Polly Neural Voices?

What it is: Higher-quality neural TTS voices selected with —engine neural, with generative prosody, SSML, and batch synthesis to S3.

Why it is used: Makes voice interactions sound natural instead of robotic for IVR and voiceovers.

# Use neural voice
polly = boto3.client('polly')
response = polly.synthesize_speech(
    Text='Hello world',
    OutputFormat='mp3',
    VoiceId='Matthew',
    Engine='neural'
)

Interview talking point: “The gotcha is the engine flag: requesting Joanna without —engine neural gives you the standard voice, so check describe-voices —engine neural first. Neural costs roughly 4x per character; use synthesize-speech for realtime and start-speech-synthesis-task for long text pushed to S3.”

Q1582: How do you implement AWS Transcribe Medical?

What it is: Domain-tuned speech-to-text for clinical audio, now part of Amazon Transcribe via specialty and type flags.

Why it is used: Transcribes dictation and conversations accurately with medical vocabulary instead of mangled drug names.

# Medical transcription
transcribe.start_medical_transcription_job(
    MedicalTranscriptionJobName='my-job',
    LanguageCode='en-US',
    Specialty='PRIMARYCARE',
    OutputBucketName='bucket'
)

Interview talking point: “Transcribe Medical was merged into Amazon Transcribe in 2023: use the standard start-transcription-job with —specialty MEDICAL and —type DICTATION or CONVERSATION instead of the standalone medical job API. Add vocabulary and PII redaction for HIPAA, then Comprehend Medical extracts the conditions and medications.”

Q1583: How do you use AWS Kendra Enterprise Edition?

What it is: Kendra’s enterprise tier for org-wide natural-language search across connectors like SharePoint, Salesforce, and S3 with document ACLs.

Why it is used: Gives employees one search box over wikis, tickets, and docs with source-level permissions.

# Create index with enterprise features
kendra.create_index(
    Name='my-index',
    Edition='ENTERPRISE_EDITION',
    RoleArn='role-arn'
)

Interview talking point: “Don’t fixate on editions: Kendra’s edition structure was restructured in 2023-24 and the Developer Edition is gone for new customers, so name capabilities instead — data-source connectors with sync jobs, natural-language kendra query, Experience UI and source ACLs. Q Business is now AWS’s AI search answer.”

Q1584: How do you implement AWS Personalize Recipes?

What it is: Prebuilt recommendation algorithms you select by recipe ARN — user-personalization, sims, trending-now, popularity, ranked ranking.

Why it is used: Picks the right recommender model for your use case instead of building ML yourself.

# Use user-personalization recipe
personalize.create_solution(
    SolutionName='my-solution',
    DatasetGroupArn='group-arn',
    RecipeArn='arn:aws:personalize:::recipe/user-personalization'
)

Interview talking point: “There is no create-recipe command — recipes are AWS-provided, listed with list-recipes and selected through create-solution —recipe-arn. Choose user-personalization for per-user picks, sims for similar items, trending or popularity as baselines, or omit the recipe so AutoML chooses; then solution-version, then a campaign.”

Q1585: How do you use AWS Lookout for Metrics?

What it is: Managed anomaly detection for business metrics with per-dimension root-cause scoring, fed from S3, CloudWatch, RDS, or Redshift.

Why it is used: Catches metric anomalies and tells you which product or region caused them.

# Create detector
aws lookoutmetrics create-anomaly-detector \
  --anomaly-detector-name my-detector \
  --metric-set-name my-metric-set

Interview talking point: “Build an anomaly detector plus metric sets with dimensions and a source like S3, CloudWatch, RDS or Redshift, then create alerts to SNS. The differentiator is root cause: anomaly groups report per-dimension ImpactScore. Sparse metrics give weak baselines, and CloudWatch anomaly detection covers infrastructure metrics instead.”

Q1586: How do you implement AWS DevOps Guru Insights?

What it is: ML analysis over CloudWatch telemetry and CloudFormation stacks that emits proactive and reactive operational insights with root causes.

Why it is used: Finds operational anomalies automatically instead of digging through dashboards by hand.

# Get insights
aws devops-guru list-insights \
  --region us-east-1 \
  --start-time 2024-01-01

Interview talking point: “There is no create-insight command — you enable DevOps Guru over your CloudFormation stacks and it emits insights you read with ListInsights and DescribeInsight. Proactive insights predict problems like a throttling table, reactive ones flag current anomalies, each with a root-cause hypothesis; hook EventBridge for alerting.”

Q1587: How do you use AWS CodeGuru Security?

What it is: Static application security scanning that finds injection, crypto weaknesses, secret leaks, and AWS misconfigurations with severity and fixes.

Why it is used: Finds security bugs in code early and gates CI before release.

# Enable CodeGuru Security in console
# Connect repository
# Review findings

Interview talking point: “The flow is create-upload-url then create-scan, with findings from list-findings carrying RuleId, severity, code snippet and remediation. Baseline diffs surface only new findings so CI can gate on them via the CodePipeline action. Don’t confuse it with CodeGuru Reviewer, which does PR-time code review.”

Q1588: How do you implement AWS Inspector V2?

What it is: Continuous, mostly agentless CVE scanning of EC2, ECR images, and Lambda functions plus network reachability.

Why it is used: Continuously finds known vulnerabilities and exposure across your compute estate.

# Enable Inspector
aws inspector2 enable \
  --account-ids 123456789012

# List findings
aws inspector2 list-findings

Interview talking point: “Enable with inspector2 enable —resource-types for EC2, ECR and Lambda. EC2 CVE scanning is agentless from snapshots now — the agent is only for network reachability, unlike Inspector Classic; findings carry CVSS, InspectorScore and FixAvailable, and ECR basic scanning is just the free manual tier.”

Q1589: How do you use AWS Audit Manager Evidence?

What it is: Collects audit evidence automatically against frameworks like SOC 2 and PCI, mapping controls to Config and CloudTrail sources.

Why it is used: Gathers compliance evidence continuously instead of assembling audit spreadsheets by hand.

# Create assessment
aws auditmanager create-assessment \
  --name "SOC 2 Assessment" \
  --scope-compliance-framework "SOC2"

Interview talking point: “Create an assessment from a built-in framework like SOC 2 or PCI; controls map to sources — AWS Config rules, CloudTrail events or manual uploads — and evidence accrues per control. Empty folders mean a manual mapping needs a human, and start-assessment-report-generation exports the auditor package. Audit Manager is GA and active.”

Q1590: How do you implement AWS Control Tower Audit?

What it is: Multi-account landing zone with Audit and Log Archive accounts, an account factory, and controls enforcing governance via SCPs and Config.

Why it is used: Governs a whole organization so every new account inherits the baseline automatically.

# Use Control Tower Audit account:
# 1. Review logs in CloudTrail
# 2. Check AWS Config rules
# 3. Use Service Catalog for compliance

Interview talking point: “Guardrails were rebranded to controls: preventive controls are SCP-based, detective controls are Config rules, enabled via enable-control with an arn control identifier. The Audit account holds the cross-account Config aggregator while the org CloudTrail lands in Log Archive, and a failed enable usually means a stackset failure.”

Q1591: How do you use AWS Secrets Manager Multi-Region?

What it is: Replicates a secret to other regions as read-only replicas that sync from a primary region.

Why it is used: Makes the same credentials available in multiple regions with failover by promotion.

# Create secret in primary region
aws secretsmanager create-secret \
  --name prod/db-creds \
  --secret-string '{"password":"secret"}'

# Replicate to secondary region
aws secretsmanager replicate-secret-to-regions \
  --secret-id prod/db-creds \
  --add-replica-regions Region=us-west-2

Interview talking point: “replicate-secret-to-regions creates read-only replicas — writes against a replica are rejected until you promote it with update-primary-region, which also changes the secret’s ARN region so app config must follow. Each replica needs its own KMS key in its region, and rotation stays with the primary.”

Q1592: How do you implement AWS Systems Manager Documents?

What it is: Reusable YAML or JSON runbooks defining steps executed by Run Command, State Manager, or Automation.

Why it is used: Standardizes operational actions as versioned, parameterized, permission-aware documents everyone reuses.

# Create custom document
aws ssm create-document \
  --content '{
    "schemaVersion": "2.2",
    "description": "My custom command",
    "mainSteps": [{
      "action": "aws:runCommand",
      "name": "runCommand",
      "inputs": {"commands":["echo hello"]}
    }]
  }' \
  --name MyDocument \
  --document-type Command

Interview talking point: “Documents are versioned runbooks created with create-document and a type — Command, Automation, Session or Policy — with schemaVersion and mainSteps using actions like aws:runShellScript or aws:executeAwsApi. Run them with send-command, create-association or start-automation-execution; steps use the instance role’s permissions, so missing API perms fail the step.”

Q1593: How do you use AWS Config Advanced Queries?

What it is: SQL queries over your recorded resource configurations using select-resource-config, plus aggregate queries across accounts.

Why it is used: Answers inventory questions like which volumes are unattached without paging through describe APIs.

# Query resources
aws configservice select-aggregate-resource-config \
  --configuration-aggregator-name my-aggregator \
  --expression "SELECT resourceId, resourceType WHERE resourceType = 'AWS::EC2::Instance'"

Interview talking point: “Advanced queries are SQL over recorded configuration items, not live describes — the recorder must be running or the resource never appears. Use select-resource-config, or select-aggregate-resource-config with an aggregator for cross-account results; responses page with NextToken, and Resource Explorer is the newer search tool.”

Q1594: How do you implement AWS CloudFormation Change Sets?

What it is: Previews the resource changes a stack update would apply — adds, modifications, replacements — before executing.

Why it is used: Reviews blast radius before updating, catching replacements that would destroy data.

# Create change set
aws cloudformation create-change-set \
  --stack-name my-stack \
  --change-set-type UPDATE \
  --template-body file://template.yaml

Interview talking point: “Change sets are dry-run previews: describe-change-set shows Action Add, Modify or Remove plus the Replacement flag, where Replacement True means delete-and-create — the data-loss warning for RDS. Creating one without CAPABILITY_IAM fails at execute, and a change set is stale after one execution.”

Q1595: How do you use AWS CDK Assets?

What it is: Local files and container images that CDK hashes, publishes to the bootstrap assets bucket or ECR, and wires into templates.

Why it is used: Ships local artifacts like Lambda code with deploys, handling upload and references automatically.

# Add asset
asset = aws_s3_assets.Asset(
    self, "Asset",
    path="./assets"
)

# Use in Lambda
function = aws_lambda.Function(
    self, "Function",
    code=aws_lambda.Code.from_asset("./lambda")
)

Interview talking point: “cdk bootstrap creates the CDKToolkit stack with the assets bucket and publishing roles; cdk synth hashes assets by content and deploy publishes them to S3 or ECR for CloudFormation to reference. Same hash skips the upload, and a “Failed to publish asset” error means re-bootstrap.”

Q1596: How do you implement AWS SAM Local Testing?

What it is: Runs SAM functions locally in Docker via sam local invoke, start-api, or start-lambda with a sample event.

Why it is used: Tests serverless apps quickly before deploying instead of iterating in the cloud.

# Start local API
sam local start-api

# Invoke function
sam local invoke MyFunction

# Generate sample event
sam local generate-event s3 put > event.json

Interview talking point: “sam local invoke and start-api run functions in Docker from the template’s CodeUri and Handler, so Docker is required and sam build comes first. Crucially, local runs use your own AWS credentials, not the template’s execution role — IAM gaps won’t show up locally.”

Q1597: How do you use AWS Amplify Console Webhooks?

What it is: HTTP URLs created per app and branch that trigger a build when posted to.

Why it is used: Starts Amplify builds from external CI systems that Amplify doesn’t integrate with natively.

# Configure webhooks:
# 1. Go to Amplify Console
# 2. App settings > Webhooks
# 3. Add webhook URL

Interview talking point: “create-webhook with an app ID and branch returns a unique URL whose id and token are the auth — treat it like a deploy key since POSTing it triggers a full branch build. Revoke with delete-webhook; start-deployment is the other API path, and Git providers get webhooks auto-created.”

Q1598: How do you implement CodePipeline Custom Actions?

What it is: Registers your own action types so custom tools plug into pipeline stages, executed by a polling job worker.

Why it is used: Integrates homegrown or third-party steps into CI/CD when AWS has no built-in action.

# Create custom action type
aws codepipeline create-custom-action-type \
  --category Build \
  --provider-name MyProvider \
  --input-artifact-details '{"MaximumCount":1,"MinimumCount":1}'

Interview talking point: “Register a type with create-custom-action-type — one of five categories plus provider and version — reference it in the pipeline as owner Custom, then run a worker doing poll-for-jobs, acknowledge-job and put-job-result. Jobs expire if unclaimed, and Lambda or Step Functions Invoke actions cover most cases now.”

Q1599: How do you use CodeBuild Report Groups?

What it is: Aggregates test and coverage reports from builds, showing pass/fail trends with optional S3 export.

Why it is used: Tracks test health over time and fails builds when reports are missing.

# Create report group
aws codebuild create-report-group \
  --name my-reports \
  --type TEST_EXPORT

# Create report
aws codebuild create-report \
  --name my-report \
  --report-group-arn arn

Interview talking point: “Report groups are typed TEST or CODE_COVERAGE — not TEST_EXPORT — and are fed by the buildspec reports section with a file-format like JUNITXML, optionally exported to S3. Missing report files fail the build, but a coverage percentage gate you implement yourself in the buildspec with exit 1.”

Q1600: How do you implement CloudWatch Metric Math?

What it is: Combines metrics inline in alarm and dashboard expressions — arithmetic, IF, FILL — without publishing derived metrics.

Why it is used: Alerts on computed values like error percentage without custom metric publishing.

# Create math expression
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --expression "AVG(m1) + AVG(m2)"

Interview talking point: “Alarms take a —metrics array of MetricStat ids plus Expression ids, and each expression needs an explicit Period or you get an expression-requires-period error. Division by zero returns missing data so guard with IF; Sum and Average are stats, while IF, FILL, ABS, CEIL and FLOOR are math functions.”

Additional Interview Questions 1601-1800

Q1601: How do you implement Route 53 Resolver DNS Queries?

What it is: Route 53 Resolver endpoints and forwarding rules bridge DNS between VPCs and on-premises networks, with query logging for visibility.

Why it is used: Extends hybrid DNS so VPCs resolve on-prem names and vice versa without running DNS servers.

# There is no `route53resolver resolve` command -- DNS resolution happens
# through the resolver endpoints themselves; the CLI surface is
# create-resolver-endpoint / create-resolver-rule / log associations:
aws route53resolver create-resolver-endpoint \
  --direction INBOUND \
  --ip-addresses '[{"SubnetId":"subnet-a","Ip":"10.0.1.53"}]' \
  --name corp-dns

Interview talking point: “There is no route53resolver resolve command; resolution happens via the endpoints, using create-resolver-endpoint and create-resolver-rule. Inbound serves on-prem to VPC, outbound forwards specific domains to on-prem; endpoints need 2+ IPs across 2 AZs.”

Q1602: How do you use CloudFront Key Groups?

What it is: CloudFront key groups are named sets of public keys attached to cache behaviors to validate signed URLs and cookies.

Why it is used: Restricts premium content so only users with a backend-signed URL or cookie can access protected files.

# Create key group
aws cloudfront create-key-group \
  --key-group-config '{
    "Name": "my-keys",
    "Items": ["public-key-1"]
  }'

Interview talking point: “Key groups replaced the deprecated trusted signers and attach via TrustedKeyGroups on the behavior. The Key-Pair-Id in the URL is the public key’s ID, not the private key, which must stay server-side in your backend.”

Q1603: How do you implement S3 Object Lambda Access Points?

What it is: S3 Object Lambda Access Points run your Lambda on GetObject, transforming the original object as it is read.

Why it is used: Anonymizes PII or resizes images on the fly without storing pre-computed variants.

# Create Object Lambda access point
aws s3control create-access-point \
  --name my-object-lambda \
  --type ObjectLambda \
  --configuration '{
    "ObjectLambdaSupportedOperations": [{"GetObject": {}}]
  }'

Interview talking point: “The Lambda fetches the object from a presigned supporting access point URL and returns bytes via WriteGetObjectResponse; the function role needs s3-object-lambda:WriteGetObjectResponse or you get AccessDenied. Every GetObject is a Lambda invocation, so weigh cost and latency.”

Q1604: How do you use Lambda Function Aliases with Weighted Routing?

What it is: Lambda aliases with weighted routing split invokes between a main version and a canary version using AdditionalVersionWeights.

Why it is used: Rolls out new code gradually so you can watch errors, then dial traffic up or roll back.

# Create alias with weighted routing
aws lambda create-alias \
  --function-name my-function \
  --name prod \
  --function-version '$LATEST' \
  --routing-config '{"AdditionalVersionWeights":{"2":0.1}}'

Interview talking point: “Only published versions can be weighted — $LATEST is not allowed — and an alias holds at most two versions. Event source mappings like SQS point at a fixed version, so they never canary with the alias.”

Q1605: How do you implement DynamoDB On-Demand Capacity?

What it is: DynamoDB on-demand capacity mode bills per request with PAY_PER_REQUEST instead of provisioned read and write capacity units.

Why it is used: Removes capacity guessing for unpredictable traffic — pay per request, no waste, no underestimation throttling.

# Create on-demand table
aws dynamodb create-table \
  --table-name my-table \
  --billing-mode PAY_PER_REQUEST \
  --attribute-definitions AttributeName=PK,AttributeType=S \
  --key-schema AttributeName=PK,KeyType=HASH

Interview talking point: “On-demand still has per-table soft limits, so enormous sudden spikes can see brief throttles, and it costs roughly 7x provisioned at steady state. Provisioned plus autoscaling wins for known, steady baselines.”

Q1606: How do you use ElastiCache Global Datastore?

What it is: ElastiCache Global Datastore replicates a Redis cluster across regions, with a primary writer region and read-only secondaries.

Why it is used: Serves reads near users and enables cross-region disaster recovery with sub-second RPO and manual promotion.

# Create global datastore
aws elasticache create-global-replication-group \
  --global-replication-group-id my-global \
  --replication-group-id primary-cluster \
  --at-rest-encryption-enabled

Interview talking point: “Create it with create-global-replication-group —global-replication-group-id-suffix and —primary-replication-group-id, not the flags shown elsewhere. Secondaries stay read-only until failover-global-replication-group promotes them, and only Redis is supported — Memcached has no Global Datastore.”

Q1607: How do you implement RDS Kerberos Authentication?

What it is: RDS Kerberos authentication lets database users log in with Active Directory identities instead of local DB passwords.

Why it is used: Centralizes DB access on corporate AD accounts that can be disabled the moment an employee leaves.

# Enable Kerberos
aws rds create-db-instance \
  --db-instance-identifier my-db \
  --domain-arn domain-arn \
  --domain-iam-role-name role-name

Interview talking point: “Create or modify with —domain plus —domain-iam-role-name, and that role must have the AmazonRDSDirectoryServiceAccess managed policy. Engine support is mainly SQL Server, so verify per engine before promising it.”

Q1608: How do you use OpenSearch Fine-Grained Access?

What it is: OpenSearch fine-grained access control maps users and roles to index, document, and field-level permissions inside the domain.

Why it is used: Restricts who reads which indexes and masks PII fields, going beyond network-only access control.

# Configure fine-grained access
aws opensearch create-domain \
  --domain-name my-domain \
  --cluster-config '{
    "InstanceType": "r6g.large.search",
    "InstanceCount": 2
  }' \
  --advanced-security-options '{
    "Enabled": true,
    "InternalUserDatabaseEnabled": false
  }'

Interview talking point: “You cannot enable FGAC without HTTPS — the domain must run TLS. Enabling also requires a master user, internal database or SAML, and FGAC sits alongside the resource access policy rather than replacing it.”

What it is: Redshift data sharing grants live, zero-copy access to tables and schemas on a producer cluster from consumer clusters.

Why it is used: Gives other teams read access to data without ETL, snapshots, or duplicate storage copies.

-- Create datashare
CREATE DATASHARE myshare;

-- Add table to datashare
ALTER DATASHARE myshare ADD TABLE myschema.mytable;

-- Grant access
GRANT USAGE ON DATASHARE myshare TO ACCOUNT '123456789012';

Interview talking point: “It is DDL — CREATE DATASHARE, then ALTER … ADD, then GRANT USAGE — and the consumer runs CREATE DATABASE FROM DATASHARE. Consumers are read-only, and cross-account shares stay pending until the consumer account accepts the association.”

Q1610: How do you use Glue Data Catalog Encryption?

What it is: Glue Data Catalog encryption settings encrypt catalog metadata and stored connection passwords with SSE-KMS via put-data-catalog-encryption-settings.

Why it is used: Protects table and partition definitions at rest and hides saved connection credentials.

# Enable encryption
aws glue put-data-catalog-encryption-settings \
  --encryption-at-rest '{
    "CatalogEncryptionMode": "DISABLED",
    "SecurityConfigurationName": "my-config"
  }'

Interview talking point: “Catalog SSE-KMS encrypts the metadata store, not your S3 data, which stays the bucket’s KMS concern. Job output, CloudWatch, and bookmark encryption come from a separate Glue Security Configuration attached to the job with —security-configuration.”

Q1611: How do you implement EMR Studio?

What it is: EMR Studio is a browser-based multi-user IDE with Jupyter workspaces backed by EMR clusters or EMR Serverless.

Why it is used: Gives analysts a managed notebook environment instead of self-hosted Jupyter over SSH.

# Create EMR Studio
aws emr createStudio \
  --name my-studio \
  --auth-mode SSO

Interview talking point: “Use create-studio with —auth-mode SSO — CLI verbs are kebab-case, not createStudio — plus workspace and engine security groups that reference each other, the classic cause of notebooks that cannot reach the cluster.”

Q1612: How do you use Kinesis Analytics Application Inputs?

What it is: Kinesis Data Analytics inputs define the streaming source — Kinesis stream, Firehose, or Kafka — and its record schema.

Why it is used: Wires a stream into the SQL or Flink app so it can query incoming records.

-- Create application with Kinesis input
CREATE OR REPLACE STREAM "DEST_SQL_STREAM" AS
SELECT Ticker, COUNT(*) AS Count
FROM SOURCE_SQL_STREAM_001
GROUP BY Ticker

Interview talking point: “Each input needs an InputSchema matching the stream, or records are dropped or the app fails. The execution role must include kinesis:GetShardRecords, or the app sits RUNNING with no data.”

Q1613: How do you implement EventBridge Event Buses?

What it is: EventBridge event buses are named routing buses where rules match event patterns and fan out to targets.

Why it is used: Decouples services so one published event triggers several independent consumers.

# Create custom event bus
aws events create-event-bus \
  --name my-bus

# Put custom event
aws events put-events \
  --entries '[{
    "Source": "myapp.events",
    "DetailType": "OrderCreated",
    "Detail": "{\"orderId\":\"123\"}"
  }]'

Interview talking point: “Rules take up to five targets each, and a Lambda target needs a resource-based policy granting the bus permission to invoke it — the usual cause of silent Lambda targets. Cross-account senders need put-permission on the bus.”

Q1614: How do you use Step Functions Workflow Studio?

What it is: Workflow Studio is Step Functions’ drag-and-drop console editor that generates and validates ASL JSON state machine definitions.

Why it is used: Builds workflows visually without hand-writing error-prone ASL syntax yourself.

# Use Step Functions Workflow Studio:
# 1. Open in console
# 2. Drag and drop states
# 3. Configure inputs/outputs
# 4. Save and run

Interview talking point: “Studio is only the authoring layer; deploy the exported definition with sfn create-state-machine —definition or an S3 location. Edge-case ASL like OutputPath still needs the code view, and CDK or CloudFormation is the versioned IaC alternative.”

Q1615: How do you implement Systems Manager Quick Setup?

What it is: SSM Quick Setup is a console wizard that creates the associations, roles, and schedules for common instance baselines.

Why it is used: Makes instances SSM-managed, inventoried, and patched in one step instead of twenty.

# Create Quick Setup
aws ssm create-association \
  --name "AWS-ConfigureAWSManagedRules" \
  --targets '[{"Key":"instanceids","Values":["*"]}]'

Interview talking point: “Quick Setup is only an orchestration layer over existing SSM features like State Manager associations and patch policies. Deleting a configuration removes the associations it made but leaves shared roles behind.”

Q1616: How do you use AWS Config Organization Conformance Packs?

What it is: Organization conformance packs deploy one Config rules-and-remediation template to every account or selected OUs automatically.

Why it is used: Enforces a single compliance baseline org-wide with no per-account configuration drift.

# Create org conformance pack
aws configservice put-organization-conformance-pack \
  --organization-conformance-pack-name "security-baseline" \
  --template-s3-uri s3://bucket/template.yaml

Interview talking point: “The top failure is org Config support or delegated admin not being enabled. Config must also be recording in each member account and region, and you still need an aggregator to view org-wide compliance in one place.”

Q1617: How do you implement GuardDuty Organization?

What it is: GuardDuty organization management lets a delegated admin enable and auto-enable threat detection across all member accounts.

Why it is used: Turns on GuardDuty for the whole organization from one dedicated security account.

# Enable GuardDuty for organization
aws guardduty enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “The flow is register-delegated-administrator, then enable-organization-admin-account and update-organization-configuration —auto-enable. There is only one GuardDuty admin per region, and org enablement is regional, so repeat it in each region you care about.”

Q1618: How do you use Security Hub Automation Rules?

What it is: Security Hub automation rules automatically update or notify on new findings that match criteria you define.

Why it is used: Auto-triages findings by setting severity, workflow status, or notes without Lambda or EventBridge glue.

# Create automation rule
aws securityhub create-automation-rule \
  --name "Auto-remediate" \
  --criteria '{"Severity":{"Value":["CRITICAL","HIGH"]}}' \
  --actions '[{"Type":"FINDING_FIELDS_UPDATE"}]'

Interview talking point: “The criteria JSON needs Comparison-bearing objects such as Severity with Comparison EQUALS and a Value list — the console-style form with only Value is rejected. Rules evaluate in rule-order and act only on new findings, leaving existing ones untouched.”

Q1619: How do you implement Detective Organization?

What it is: Detective organization management lets a delegated admin run behavior graphs spanning all member accounts for cross-account investigation.

Why it is used: Gives the security team one graph to investigate activity across every account.

# Enable Detective for org
aws detective enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “Register a delegated admin, enable org config with auto-enable, and members onboard automatically. Detective is regional and ingests GuardDuty findings, CloudTrail, VPC Flow Logs, and EKS audit data — members need those sources actually flowing.”

Q1620: How do you use Macie Organization?

What it is: Macie organization management lets a delegated admin auto-enable sensitive-data discovery and classification jobs across member accounts.

Why it is used: Applies organization-wide S3 data-loss prevention without setting up each account separately.

# Enable Macie for org
aws macie2 enable-organization

Interview talking point: “Use macie2 enable-organization-admin-account then update-organization-configuration with auto-enable true; discovery jobs and allow lists are managed centrally. Scope is S3 only, and findings flow into Security Hub automatically when both are enabled.”

Q1621: How do you implement Inspector Organization?

What it is: Inspector organization management auto-enables CVE scanning for EC2, ECR, and Lambda across all member accounts.

Why it is used: Scans every new account’s compute for vulnerabilities without per-account setup.

# Enable for organization
aws inspector2 enable-organization

Interview talking point: “Enable with inspector2 enable plus update-org-configuration auto-enable flags per resource type; a missing auto-enable flag is why a new account is unscanned. Coverage checks use batch-get-account-status, not list-account-permissions, and enablement is per region.”

Q1622: How do you use AWS Network Firewall with Gateway Load Balancer?

What it is: AWS Network Firewall endpoints can attach behind a Gateway Load Balancer so many VPCs share one inspection fleet.

Why it is used: Centralizes traffic inspection for hub-and-spoke VPCs with a single policy to update.

# Deploy Network Firewall with GWLB
aws network-firewall create-firewall \
  --firewall-name my-firewall \
  --vpc-id vpc-123 \
  --firewall-policy-arn policy-arn \
  --subnet-mapping '{
    "us-east-1a": "subnet-gwlb"
  }'

Interview talking point: “Spokes route through a Gateway Load Balancer endpoint into the inspection VPC using GENEVE encapsulation, with symmetric return through the same LB. The alternative is inline per-VPC firewall endpoints referenced from route tables, the standard single-VPC path.”

Q1623: How do you implement VPC Flow Logs Analysis?

What it is: VPC Flow Logs analysis queries accepted and rejected traffic metadata using Athena on S3 or CloudWatch Logs Insights.

Why it is used: Answers who talked to whom, on which ports, and what was rejected.

# Create flow logs
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-123 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flow-logs

Interview talking point: “Flow logs are metadata only — no payloads — so use Traffic Mirroring for content. The canonical cheap setup is logs to S3 plus Athena SQL, and a 10-minute aggregation interval samples rather than counts exactly, unlike 60 seconds.”

Q1624: How do you use Transit Gateway Network Manager?

What it is: Transit Gateway Network Manager builds a global topology view of TGWs, Direct Connect, and VPNs across regions and accounts.

Why it is used: Visualizes and troubleshoots the entire hybrid network from a single pane of glass.

# Create global network
aws networkmanager create-global-network \
  --description "Global network"

# Register transit gateway
aws networkmanager register-transit-gateway \
  --global-network-id network-id \
  --transit-gateway-arn tgw-arn

Interview talking point: “Network Manager is a view and management plane only — it never carries traffic, which stays on TGW, DX, and VPN. Its core-network APIs evolved into Cloud WAN, the managed global network construct.”

Q1625: How do you implement PrivateLink for SaaS?

What it is: PrivateLink for SaaS exposes your service to customer VPCs through an endpoint service backed by your own NLB.

Why it is used: Lets customers reach your SaaS privately over the AWS backbone without public IPs or VPNs.

# Create endpoint service
aws ec2 create-vpc-endpoint-service-configuration \
  --service-name com.amazonaws.us-east-1.my-saas \
  --network-load-balancer-arns [nlb-arn] \
  --acceptance-required

Interview talking point: “You create the endpoint service with —network-load-balancer-arns, gate it with AllowedPrincipals and acceptance, and register a private DNS name so customers use your normal hostname. Expect per-endpoint hours plus NLB data processing charges.”

Q1626: How do you use AWS Network Access Analyzer?

What it is: Network Access Analyzer finds unintended reachability by analyzing configured paths against a defined access scope.

Why it is used: Audits whether anything is publicly reachable without manually reading security groups and routes.

# Analyze network access
aws network-insights-analyzer start-network-insights-access-scope-analysis \
  --network-insights-access-scope-id scope-id

Interview talking point: “The flow is create-network-insights-access-scope, then start the analysis, then get the findings. Analysis is static and config-based — it sends no packets. It differs from Reachability Analyzer, which verifies one specific path, and Traffic Mirroring, which captures real packets.”

Q1627: How do you implement Internet Monitor?

What it is: CloudWatch Internet Monitor measures internet path performance between your AWS resources and end users by city and ISP.

Why it is used: Tells you whether slowness is your app or the ISP in a specific city.

# Create monitor
aws internetmonitor create-monitor \
  --monitor-name my-monitor \
  --internet-measurements-log-delivery '{
    "s3Config": {"bucketName": "my-bucket"}
  }'

Interview talking point: “It only scopes traffic to your AWS resources, not general internet speed. Metrics export to CloudWatch for alarms, and list-health-events reports city-plus-ASN outages; traffic-percentage-to-monitor is the accuracy-versus-cost knob.”

Q1628: How do you use Verified Access Endpoint Policies?

What it is: Verified Access endpoint policies are Cedar policies authorizing access per request using identity and device trust data.

Why it is used: Gates each application by user and device posture instead of granting network-level VPN access.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "igw:CreateTags",
    "Resource": "*"
  }]
}

Interview talking point: “Policies evaluate at instance, then group, then endpoint level, and all must allow. Conditions reference trust-provider attributes like device_status from your IdP, making Verified Access the zero-trust replacement for Client VPN’s network-level model.”

Q1629: How do you implement VPC Lattice Service Network?

What it is: VPC Lattice service networks connect consumer VPCs to services across accounts with listeners, rules, target groups, and auth policies.

Why it is used: Lets teams call each other’s services by name with IAM auth and no VPC peering.

# Create service network
aws vpc-lattice create-service-network \
  --name my-network

# Add VPC to service network
aws vpc-lattice create-vpc-association \
  --vpc-identifier vpc-123 \
  --service-network-identifier sn-123

Interview talking point: “Build blocks are service networks, services, and VPC associations; auth is AWS_IAM using SigV4, or NONE, per service. Share networks cross-account via RAM. Lattice is a VPC-scale L7 mesh, unlike App Mesh sidecars or PrivateLink’s point-to-point endpoints.”

Q1630: How do you use IPAM Scopes?

What it is: IPAM scopes are top-level partitions inside an IPAM, each holding an independent tree of pools and CIDR allocations.

Why it is used: Separates IP planning per environment so dev and prod CIDR ranges never collide.

# Create IPAM scope
aws ec2 create-ipam-scope \
  --ipam-id ipam-123 \
  --name public-scope

# Allocate IP pool
aws ec2 allocate-ipam-pool-cidr \
  --ipam-pool-id pool-123 \
  --netmask-length 24

Interview talking point: “A scope does nothing itself — pools hold the CIDR logic and the scope is just the tree boundary. create-ipam auto-creates default public and private scopes that cannot be deleted, and pools are shared to accounts via RAM.”

Q1631: How do you implement AWS AppConfig Feature Flags?

What it is: AppConfig feature flags store versioned configuration JSON deployed to apps at runtime through staged deployment strategies.

Why it is used: Switches features on or off instantly without redeploys, with rollout ramps and fast rollback.

# Create configuration
aws appconfig create-configuration-profile \
  --application-id app-123 \
  --name my-feature \
  --type AWS.AppConfig.FreeFormConfiguration

# Deploy
aws appconfig start-deployment \
  --application-id app-123 \
  --environment-id env-123 \
  --configuration-profile-id profile-123

Interview talking point: “Flags are just config values — the if-branch logic lives in your code; AppConfig only delivers the value. Hosted versions are immutable, validators check content, and deployment strategies control rollout rate and bake time.”

Q1632: How do you use AWS Proton Environments?

What it is: AWS Proton environment templates define shared infrastructure while service templates define apps and their deployment pipelines.

Why it is used: Standardizes deployment so developers self-serve from platform-team-owned templates.

# Create environment template
aws proton create-environment-template \
  --name "vpc-environment"

# Create environment
aws proton create-environment \
  --name production \
  --template-major-version 1

Interview talking point: “Environments are created from an environment template with a spec, and services deploy into them via service instances. Account connections let Proton deploy cross-account; Proton packages and provisions IaC rather than replacing CloudFormation.”

Q1633: How do you implement Amplify Branches?

What it is: Amplify branches map Git branches to separate deploys, each with its own URL, build settings, and backend environment.

Why it is used: Gives every branch its own preview deployment and isolated backend resources.

# Add branch
aws amplify create-branch \
  --app-id app-id \
  --branch-name develop

Interview talking point: “Each branch serves at branch-dot-appid.amplifyapp.com with auto-build on push, toggleable via update-branch. Backend environments give per-branch stacks, and the local amplify env checkout maps to that branch’s backend.”

Q1634: How do you use CodeCatalyst Workflows?

What it is: CodeCatalyst workflows are YAML pipeline definitions in workflows files, triggered by pushes and pull requests.

Why it is used: Provides CI/CD bundled with repository, issues, and dev environments in one AWS product.

Name: deploy
SchemaVersion: "1.0"
Triggers:
  - Type: PUSH
    Branches: [main]
Actions:
  - Name: build
    Action: BUILD
    Timeout: 10

Interview talking point: “There is no codecatalyst create-workflow command — the CLI surface is thin; workflows are YAML files committed to the project. Deploy actions target an Environment, the connected AWS account and role, and CodeCatalyst is AWS’s GitHub Actions equivalent.”

Q1635: How do you implement IoT Core Fleet Hub?

What it is: IoT Core Fleet Hub is a managed SSO-secured web dashboard showing device registry and shadow state as widgets.

Why it is used: Gives ops teams a device fleet view without building a frontend themselves.

# Create fleet index
aws iot create-fleet-index \
  --fleet-name my-fleet

# Query fleet
aws iot get-fleet-meta-data \
  --fleet-name my-fleet

Interview talking point: “create-application needs a role ARN with IoT read permissions — a weak role yields an empty dashboard. Access is via IAM Identity Center, and widgets show registry and shadow values, not raw telemetry streams.”

Q1636: How do you use IoT SiteWise Data Streams?

What it is: SiteWise data streams ingest time-series values into asset properties using property aliases and batch-put-asset-property-value.

Why it is used: Routes machine readings from IoT Core or gateways into modeled asset properties.

# Create data stream
aws iotsitewise create-time-series \
  --asset-id asset-123 \
  --property-id property-123

Interview talking point: “Model first, then ingest — values need an existing asset property, and each alias must be unique or you get AliasAlreadyExists. Feed it via an IoT rule action, edge gateways, or direct batch-put; data up to 7 days late is accepted.”

Q1637: How do you implement IoT Events Input Transformations?

What it is: IoT Events inputs declare the JSONPath attributes detectors read and can attach a Lambda to transform payloads first.

Why it is used: Normalizes or filters messages before detector logic runs so conditions see clean fields.

# Define input transformation
transformation = {
    "action": "lambda",
    "payload": {
        "sensorId": "{{input.sensorId}}",
        "value": "{{input.value}}",
        "timestamp": "{{input.timestamp}}"
    }
}

Interview talking point: “A detector referencing a field missing from the input definition simply never fires. The transform is a Lambda, not SQL — cheaper still is transforming in the IoT rule’s SELECT before the input ever sees the data.”

Q1638: How do you use Greengrass V2 Components Recipes?

What it is: Greengrass V2 component recipes are YAML or JSON files declaring lifecycle hooks, artifacts, platforms, and dependencies.

Why it is used: Packages edge software reproducibly, like a Dockerfile for Greengrass components.

RecipeFormatVersion: 2020-01-01
ComponentName: my-component
ComponentVersion: 1.0.0
Manifests:
  - Platform:
      os: linux
    Artifacts:
      - URI: s3://bucket/artifact.tar.gz

Interview talking point: “Publish with iot create-component-version using —inline-recipe; manifests split per OS and architecture, so arm64 and x86 ship separately. The recipe is only metadata — the artifacts downloaded to the device cache do the actual work.”

Q1639: How do you implement IoT Device Simulator?

What it is: The AWS IoT Device Simulator is a self-deployed CloudFormation solution with a web UI generating fake MQTT device fleets.

Why it is used: Produces realistic test traffic for dashboards and rules without physical hardware.

# Use IoT Device SDK
from awsiot import mqtt

mqtt_connection = mqtt.connect()
mqtt_connection.publish(topic, payload, qos=1)

Interview talking point: “It is a solution, not a managed service. Don’t confuse it with Device Tester, the Greengrass and FreeRTOS qualification harness, or Device Advisor, AWS’s managed MQTT conformance-testing service.”

Q1640: How do you use Amazon Chime SDK Meetings?

What it is: Chime SDK meetings provide create-meeting and create-attendee APIs to embed real-time video and audio in your own app.

Why it is used: Builds click-to-join video calls while you own the entire user interface.

# Create meeting
chime = boto3.client('chime')
meeting = chime.create_meeting(
    ClientRequestToken='token',
    MediaRegion='us-east-1'
)

Interview talking point: “create-meeting takes a media-region for latency; create-attendee returns a JoinToken that is that attendee’s credential — never broadcast it. This is the SDK, not the Amazon Chime application, and pricing is per attendee-minute.”

Q1641: How do you implement Connect Contact Flow Modules?

What it is: Connect contact flow modules are reusable sub-flows with entry and exit points, invoked from a parent contact flow.

Why it is used: Avoids copy-pasting common flow logic like queue checks across many contact flows.

{
  "modules": [{
    "id": "module-1",
    "type": "ContactFlowModule",
    "branches": []
  }]
}

Interview talking point: “A module needs an EntryPoint and exit blocks, and the parent calls it through an Invoke Contact Flow block, running synchronously within the same contact trace. Heavier logic still belongs in Lambda, not the flow.”

Q1642: How do you use Pinpoint Segments?

What it is: Pinpoint segments select campaign recipients, either dynamically by criteria at send time or from an imported static list.

Why it is used: Targets the right audience, like users who opened the app in the last 30 days.

# Create segment
pinpoint.create_segment(
    ApplicationId='app-id',
    SegmentRequest={
        'Name': 'active-users',
        'SourceSegments': [{'SegmentId': 'source-id'}]
    }
)

Interview talking point: “Dynamic segments re-evaluate endpoint profiles on every campaign run, so churned users drop automatically; imported segments are a frozen CSV or JSON list. SegmentGroups ALL, ANY, NONE gives AND and OR logic across filter groups.”

Q1643: How do you implement SES Configuration Set?

What it is: SES configuration sets attach event destinations so bounce, complaint, delivery, open, and click events stream out.

Why it is used: Tracks and reacts to email outcomes for deliverability monitoring and alerting.

# Create configuration set
aws ses create-configuration-set \
  --name my-config

# Add tracking domain
aws ses create-configuration-set-tracking-options \
  --configuration-set-name my-config \
  --custom-tracking-domain domain.com

Interview talking point: “Sends must reference the config set, via —configuration-set-name or the X-SES-CONFIGURATION-SET header over SMTP. Destinations are SNS, Firehose, CloudWatch, or EventBridge, but open and click tracking must be enabled at the identity level.”

Q1644: How do you useboxes WorkMail Mail?

What it is: Amazon WorkMail is managed business email and calendaring backed by AWS Managed Microsoft AD or AD Connector.

Why it is used: Provides company mailboxes with Outlook support without operating your own Exchange servers.

# Create user
aws workmail create-user \
  --organization-id org-id \
  --display-name "John Doe" \
  --user-name john

Interview talking point: “WorkMail requires an AD — create-organization takes —directory-id and users come from the directory. Adding your domain means setting the MX, DKIM, and SPF records it gives you, and mailboxes include 50 GB of storage.”

Q1645: How do you implement Amazon Honeycode?

What it is: Amazon Honeycode was AWS’s no-code app builder over spreadsheets, retired in February 2024 with no new users after 2023.

Why it is used: Nothing today — the interview answer is to name its retirement accurately and pivot.

# Use Honeycode console:
# 1. Create workbook
# 2. Add tables
# 3. Build screens
# 4. Share with team

Interview talking point: “Honeycode is discontinued, so export any workbook data and move on. Today’s replacements are Amazon Q Apps for generative no-code and Amplify or AppSync for real applications.”

Q1646: How do you use AWS Wickr?

What it is: AWS Wickr was end-to-end-encrypted messaging with channels, calls, and retention controls, retired around 2025.

Why it is used: Nothing new — the answer recognizes its wind-down and shifts to alternatives.

# Use Wickr Admin console:
# 1. Create organization
# 2. Add users
# 3. Configure security policies

Interview talking point: “The docs-era aws wickr CLI largely never existed; admin was console and portal based. Commercial customers were wound down in 2024-2025 while Gov and Defense continued, and AWS has no managed E2EE successor.”

Q1647: How do you implement AppFlow Integrations?

What it is: AppFlow flows move data between SaaS apps and AWS using connector profiles, scheduled triggers, and transform tasks.

Why it is used: Syncs Salesforce or other SaaS data into S3 or Redshift without writing OAuth glue code.

# Create flow
aws appflow create-flow \
  --flow-name my-flow \
  --source-flow-config '{"ConnectorType":"Salesforce"}' \
  --destination-flow-config '{"ConnectorType":"S3"}'

Interview talking point: “The connector profile stores the OAuth credentials, and incremental syncs track a watermark for only new or changed records. AppFlow is batch ETL-lite — for true streaming, use Kinesis or Kafka.”

Q1648: How do you use Managed Workflows for Apache Airflow?

What it is: MWAA provisions managed Airflow schedulers, workers, and webserver in your VPC while you upload DAGs to S3.

Why it is used: Runs Airflow without managing the infrastructure; you keep the DAGs and plugins.

# Create environment
aws mwaa create-environment \
  --name my-environment \
  --execution-role-arn role-arn

Interview talking point: “The number one failure is an execution role missing S3 read access, which leaves the environment stuck in CREATE_FAILED. DAGs take a few minutes to sync from S3, and worker-to-scheduler traffic needs the right security group ports open.”

Q1649: How do you implement Glue Studio Visual ETL?

What it is: Glue Studio Visual ETL is a drag-and-drop job builder compiling a graph of sources, transforms, and targets into PySpark.

Why it is used: Writes ETL without hand-coding Spark while still producing real, editable code.

# Use Glue Studio console:
# 1. Create job. Visual editor
# 2
# 3. Add transforms
# 4. Run

Interview talking point: “The visual job generates a DynamicFrame script you can view and export, so it is not lock-in. Drop to code for custom UDFs, and run with start-job-run on Glue workers or interactive sessions.”

Q1650: How do you use Redshift Query Editor V2?

What it is: Redshift Query Editor V2 is a browser SQL IDE backed by the Redshift Data API’s execute-statement and get-statement-result calls.

Why it is used: Runs ad-hoc SQL without a SQL client, VPC access, or a database driver.

# Use Redshift console Query Editor V2:
# 1. Connect to cluster
# 2. Write SQL
# 3. Save queries
# 4. Share

Interview talking point: “The Data API is plain HTTPS, so Lambda can query without a DB client; auth via —db-user, —secret-arn, or —workgroup-name for Serverless. Results are capped and paginated, so heavy BI should use JDBC or ODBC instead.”

Additional Interview Questions 1651-1800

Q1651: How do you implement OpenSearch Serverless Collections?

What it is: OpenSearch Serverless collections are managed search endpoints created with opensearchserverless create-collection --type SEARCH|TIME_SERIES.

Why it is used: To run OpenSearch without capacity planning or domain maintenance.

# Create collection
aws opensearchserverless create-collection \
  --name my-collection \
  --type SEARCH \
  --description "Search collection"

Interview talking point: “Collections need a data access policy, encryption policy, and network policy; they scale by OCUs. Serverless means per-OCU pricing (idle still costs) and cold bursts may lag versus provisioned domains.”

Q1652: How do you use EMR on EKS?

What it is: EMR on EKS runs Spark/Trino/Flink on Amazon EKS via virtual clusters mapped to a namespace.

Why it is used: To consolidate data processing and microservices on one EKS cluster.

# Register EKS cluster
aws emr-containers register-cluster \
  --eks-cluster-name my-cluster \
  --type "EMR_ON_EKS"

Interview talking point: “Create a virtual cluster (create-virtual-cluster with EKS provider) then start jobs with start-job-run using --execution-role-arn and a release label. Executors run as pods (EKS autoscaling); compare to EMR on EC2.”

Q1653: How do you implement MSK Connect Connectors?

What it is: MSK Connect runs managed Kafka Connect workers that use connector plugins (zipped on S3) to ingest/egress data.

Why it is used: To stream data into/out of Kafka without operating worker fleets.

# Create connector
aws kafkaconnect create-connector \
  --connector-name my-connector \
  --connector-configuration '{
    "connector.class": "S3Sink"
  }' \
  --capacity '{
    "workerCount": 2
  }'

Interview talking point: “Flow: create-custom-plugin (S3 zip), then create-connector with plugin ARN, cluster config (MSK ARN, IAM auth, TLS), and --capacity (provisioned/autoscaling). Workers run in your VPC.”

Q1654: How do you use Managed Kafka Topics?

What it is: MSK topic access is controlled via IAM policies (with IAM auth) or Kafka ACLs (with SASL/SCRAM) on the brokers.

Why it is used: To enforce per-topic read/write permissions for services.

# Create topic
aws kafka create-topic \
  --topic-name my-topic \
  --partitions 6 \
  --replication-factor 3

Interview talking point: “Note: MSK has no aws kafka create-topic CLI for topics — topic ops use kafka-topics.sh. With IAM auth, grant kafka-cluster:*Topic actions on the topic ARN; use Replicator for cross-cluster mirroring.”

Q1655: How do you implement Lake Formation Data Filtering?

What it is: Lake Formation data filters provide row/column/cell-level security by named filters applied to catalog tables.

Why it is used: To expose restricted views across engines without duplicating tables.

# Grant column-level access
aws lakeformation grant-permissions \
  --principal user@example.com \
  --permissions SELECT \
  --resource '{"Table":{"DatabaseName":"mydb","TableName":"table1","ColumnNames":["col1","col2"]}}'

Interview talking point: “Create a data cells filter (create-data-cells-filter with column list + RowFilter.FilterExpression) and grant SELECT on that filter resource to principals. Filters apply only via LF-integrated engines (Athena/EMR/Spectrum); direct S3 access bypasses them.”

Q1656: How do you use Glue Interactive Sessions?

What it is: Glue Interactive Sessions are ephemeral serverless Spark runtimes for notebook-based ETL prototyping (Glue Studio notebooks).

Why it is used: To develop and preview DataFrame transforms interactively before jobs.

# Use Glue Interactive Sessions
%glueContext

# Read data
df = glueContext.create_dynamic_frame.from_catalog(
    database='mydb',
    table_name='mytable'
)

Interview talking point: “Sessions are started by the notebook (expose glueContext/%magics). You can also use the Glue API (create-session + run-statement/get-statement). Sessions auto-stop on idle to control cost; you can export notebook cells to a Glue job.”

Q1657: How do you implement Data Exchange for S3?

What it is: Data Exchange for S3 lets publishers share S3 datasets as data products with automated delivery to subscribers’ buckets.

Why it is used: To syndicate datasets (marketplace/private offers) with automatic export.

# Create data set
aws dataexchange create-data-set \
  --name "Public Dataset" \
  --description "My dataset" \
  --asset-type S3_SNAPSHOT

# Export data set
aws dataexchange create-revision \
  --data-set-id dataset-id

Interview talking point: “Publisher: create-data-set, create-revision, import assets via create-job --type IMPORT_ASSETS_FROM_S3, publish revision. Subscriber: create-job --type EXPORT_ASSETS_TO_S3 (or auto-export) delivers assets to their S3 bucket.”

Q1658: How do you use Clean Rooms SQL Queries?

What it is: AWS Clean Rooms runs governed SQL queries across collaborators with privacy controls (row/column restrictions and output constraints).

Why it is used: To analyze joint data without revealing raw rows between parties.

-- Run query in clean room
SELECT *
FROM my_table
WHERE user_id IN (
  SELECT user_id
  FROM other_table
)

Interview talking point: “Setup: collaboration → configured tables (with analysis methods/allowed columns) → analysis templates/queries. Output controls enforce aggregate-only and minimum row counts to prevent re-identification; raw data never leaves member accounts.”

Q1659: How do you implement HealthLake FHIR Export?

What it is: HealthLake FHIR export runs bulk $export jobs to write FHIR resources as NDJSON to S3 for analytics.

Why it is used: To extract FHIR data in bulk from a datastore for downstream processing.

# Create export job
aws healthlake create-fhir-export-job \
  --datastore-id datastore-id \
  --output-data-config S3OutputUri=s3://bucket/export

Interview talking point: “Use start-fhir-export-job --datastore-id --output-data-config '{"S3Uri":"s3://..."}' --data-access-role-arn (role must write to S3). Jobs run async; output is per-resource NDJSON files. Import/export form a round trip with start-fhir-import-job.”

Q1660: How do you use IoT TwinMaker Workspaces?

What it is: IoT TwinMaker workspaces are containers for digital twins (entities, component types, scenes, data bindings to sources like SiteWise).

Why it is used: To model physical systems with live sensor data in a 3D scene.

# Create workspace
aws iottwinmaker create-workspace \
  --workspace-id my-workspace \
  --s3-bucket my-bucket

Interview talking point: “create-workspace --workspace-id --s3-location --role stores assets. Entities have components with properties bound to sources (e.g. SiteWise time series); scenes are JSON in S3 viewed via TwinMaker console/GraphQL APIs.”

Q1661: How do you implement IoT FleetWise Campaigns?

What it is: IoT FleetWise campaigns define what telemetry to collect from which vehicles and where to send it (S3/Timestream).

Why it is used: To declaratively collect vehicle signals (time/condition-based) without coding in-vehicle logic.

# Create campaign
aws iotfleetwise create-campaign \
  --name my-campaign \
  --target-arn "arn:aws:iotfleetwise:region:account:vehicle/group-id"

Interview talking point: “Build signal catalog → decoder/model manifests → vehicles → campaign with collection-scheme (TimeBased or ConditionBased via ConditionExpression) and data-destination-configs. Activate campaign (update-campaign --action ACTIVATE). Requires FleetWise agent on vehicles.”

Q1662: How do you use Panorama Data Processing Jobs?

What it is: Panorama is edge CV (appliances + camera streams) — deployment uses application instance deployment jobs to push models/apps to appliances.

Why it is used: To run computer vision inference at the edge with offline capability.

# Create job
aws panorama create-job \
  --name my-job \
  --input-config '{"uri":"s3://bucket/input"}'

Interview talking point: “Define application (node graph: camera→models) and application instance; create create-application-instance-deployment-job --job-type OTA to deploy to the Panorama appliance. On-device inference runs locally (results can upload to S3).”

Q1663: How do you implement SageMaker Edge Manager Packaging?

What it is: SageMaker Edge Manager packaging bundles a compiled (Neo) model plus Edge Manager runtime into a deployable artifact for devices.

Why it is used: To produce the installable package for edge inference with fleet management.

# Package model
aws sagemaker create-edge-packaging-job \
  --job-name my-job \
  --model-name my-model

Interview talking point: “Prereq: compile model (create-compilation-job) → register model → create-edge-packaging-job --model-name --model-version --output-config (optionally --preset-deployment-type greengrass-v2-component). Output is deployed to devices running the Edge Manager agent.”

Q1664: How do you use Lookout for Vision Inference?

What it is: Lookout for Vision detects image anomalies (classification + pixel anomaly segmentation) via hosted endpoints or Greengrass edge.

Why it is used: To flag visual defects on production lines in real time.

# Detect anomalies
lookoutvision.detect_anomalies(
    ProjectName='my-project',
    ContentType='image/jpeg',
    Body=image_bytes
)

Interview talking point: “Train model from normal/anomalous images, start hosted with start-model --min-inference-units, call detect-anomalies (returns IsAnomalous, Confidence, anomaly details). For edge, export model and deploy as Greengrass component to run on-device.”

Q1665: How do you implement Fraud Detector Predictions?

What it is: Fraud Detector predicts fraud risk by evaluating events against ML models and rules to return scores and outcomes.

Why it is used: To score transactions in real time and decide whether to block/allow.

# Get prediction
frauddetector.get_event_prediction(
    detectorId='my-detector',
    eventTypeName='transaction',
    entities=[{'entityType':'customer','entityId':'123'}]
)

Interview talking point: “Define event types/entities, add models/rules, create detector and activate its version (update-detector-version-status --status ACTIVE). Call get-event-prediction with event variables/entities to receive model scores and rule results (apply your own threshold/decision).”

Q1666: How do you use CodeWhisperer Professional?

What it is: CodeWhisperer Professional is the org-governed tier (SSO, org-wide controls) of the AWS AI code assistant.

Why it is used: To roll out governed AI code completions/security scanning across an organization.

# Enable in VS Code:
# 1. Install CodeWhisperer extension
# 2. Sign in with AWS Builder ID
# 3. Start coding

Interview talking point: “Org features: IAM Identity Center (SSO), admin controls, usage visibility. Note: CodeWhisperer completions are now folded into Amazon Q Developer (Q Developer Professional is the current org tier).”

Q1667: How do you implement Bedrock Model Invocation?

What it is: Bedrock model invocation calls foundation models via invoke-model (raw per-model formats) or the unified converse/converse-stream API.

Why it is used: To integrate LLMs (Claude, Titan, Llama, Cohere, Mistral, AI21) without self-hosting.

# Invoke Claude
bedrock = boto3.client('bedrock-runtime')

response = bedrock.invoke_model(
    modelId='anthropic.claude-v2',
    contentType='application/json',
    accept='application/json',
    body=json.dumps({
        'prompt': 'Hello',
        'max_tokens_to_sample': 100
    })
)

Interview talking point: “Enable model access in Bedrock console first (common AccessDenied cause). Prefer converse for chat (unified messages + inferenceConfig). Use invoke-model-with-response-stream/converse-stream for token streaming; for embeddings use the appropriate embedding model ID.”

Q1668: How do you use Q Business Conversations?

What it is: Amazon Q Business is an enterprise assistant over indexed company data with conversations grounded in sources and identity-aware permissions.

Why it is used: To give employees answers from internal knowledge with citations.

# Use Q Business console:
# 1. Connect data sources
# 2. Configure security
# 3. Create web experience

Interview talking point: “Components: application + index + data sources (S3/SharePoint/Confluence/ServiceNow) + retriever (native/Kendra). Responses respect document ACLs (identity-aware retrieval). Access via hosted web experience or embed/API; org governance via IAM Identity Center.”

Q1669: How do you implement Supply Chain Traceability?

What it is: AWS Supply Chain traceability provides lot/item genealogy (upstream/downstream) across the supply chain from ingested data.

Why it is used: To track lots end-to-end for recalls/quality investigations.

# Create supply chain
aws supplychain create-instance \
  --instance-name my-supply-chain

Interview talking point: “Model items/lots/transactions from your data (landed in S3 schema) in AWS Supply Chain; use traceability views to query genealogy by lot/item. The product is console-heavy; CLI surface is minimal compared to pipeline building.”

Q1670: How do you use AWS Clean Rooms ML Training?

What it is: AWS Clean Rooms ML trains models across collaborators without sharing raw data, producing a model artifact for the designated owner.

Why it is used: To do collaborative ML (e.g. fraud models) while preserving data privacy.

# Train model in clean room
cleanrooms.train(
    algorithm='logistic_regression',
    data={'table': 'mytable'},
    target='label'
)

Interview talking point: “Define training datasets with schema and allowed column operations, configure privacy settings, run training via Clean Rooms ML. Raw data stays put; the trained model goes to the configured owner. Limited algorithm set vs fully custom federated approaches.”

Q1671: How do you implement Inspector SBOM Export?

What it is: Inspector V2 SBOM export generates CycloneDX/SPDX software bills of materials for a scanned resource and writes to S3.

Why it is used: To produce audit-ready dependency inventories (with CVE correlations) for shipped artifacts.

# `inspector2 get-findings` doesn't exist -- Inspector2's read verb is
# list-findings (same --filter-criteria shape):
aws inspector2 list-findings \
  --filter-criteria '{"severity":[{"comparison":"EQUALS","value":"CRITICAL"}]}'

Interview talking point: “Run inspector2 export-sbom --report-format CYCLONEDX_1_5|SPDX_2_3 --resource-arn <resource> --s3-destination. Prereq: resource already scanned. Note: inspector2 get-findings is not the read verb — use inspector2 list-findings. Export is per-resource.”

Q1672: How do you use Detective Investigation Graphs?

What it is: Amazon Detective creates a behavior graph from GuardDuty/CloudTrail/VPC Flow/EKS logs to investigate entities across accounts.

Why it is used: To trace security incidents (who did what, when) with cross-account visibility.

# Create investigation
aws detective create-investigation \
  --graph-arn graph-arn \
  --title "Security incident"

Interview talking point: “create-graph → invite members (create-members) or use org mode. Data ingested continuously (latency ~15 min). Use entity pages/timeline or create-investigation API. Graph needs sources configured; pricing is per-ingested data volume.”

Q1673: How do you implement Audit Manager Evidence Collection?

What it is: Audit Manager evidence collection automatically gathers evidence for controls into evidence folders per control/period from mapped sources.

Why it is used: To continuously prove compliance (Config/CloudTrail/manual evidence) without last-minute scrambling.

# Create evidence folder
aws auditmanager create-evidence-folder \
  --assessment-id assessment-id \
  --name "Evidence folder"

Interview talking point: “Assessment uses framework controls mapped to sources (AWS Config rules, CloudTrail events, MANUAL). Evidence collected continuously into folders; export via start-assessment-report-generation. Gaps appear if sources not configured or MANUAL controls have no uploads.”

Q1674: How do you use Control Tower Guardrail Scoping?

What it is: Control Tower guardrail (control) scoping determines where controls apply (OU/account level) and governed regions.

Why it is used: To apply governance selectively (e.g. sandbox OU less strict than prod).

# Get guardrail status
aws controltower list-guardrails \
  --region us-east-1

Interview talking point: “Enable control with enable-control --target-identifier <OU-arn|account-arn> (OU scope applies to descendants). Region scope is the landing zone’s governed regions. Mandatory controls can’t be scoped off; finer per-resource scope comes from underlying Config/SCP parameters.”

Q1675: How do you implement Security Hub Standards Subscription?

What it is: Security Hub standards subscriptions enable compliance frameworks (AFSBP, CIS, PCI, NIST) whose controls evaluate resources and emit findings.

Why it is used: To run a compliance baseline with centralized findings.

# `enable-standards` is not a real verb -- standards subscribe via
# batch-enable-standards (the hub itself opens with enable-security-hub):
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}]'

Interview talking point: “Subscribe via batch-enable-standards --standards-subscription-requests (note: enable-standards is not a real verb). Tune by disabling individual controls with update-standards-control --control-status DISABLED (document reason). Standards findings depend on Security Hub being enabled in the regions/resources.”

Q1676: How do you use GuardDuty Findings Export?

What it is: GuardDuty findings export routes findings to EventBridge (real-time) and/or S3/Kinesis Firehose (bulk) for SIEM/ticketing.

Why it is used: To automate response and centralize findings outside GuardDuty.

# Export findings
aws guardduty list-findings \
  --detector-id detector-id \
  --finding-criteria '{"severity":{"Eq":["4","5"]}}'

Interview talking point: “Real-time: EventBridge rule on GuardDuty Finding events. Bulk: create-publishing-destination --destination-type S3 --destination-properties (requires bucket/KMS permissions). On-demand query: list-findings + get-findings. Use create-sample-findings to test pipeline.”

Q1677: How do you implement Macie Sensitive Data Discovery?

What it is: Macie sensitive data discovery scans S3 objects with managed/custom data identifiers to produce findings on sensitive content.

Why it is used: To detect exposed PII/keys across buckets for remediation.

# Create discovery job
aws macie2 create-discovery-job \
  --name "Sensitive data scan" \
  --sensitivity-job-config '{"jobType":"ONE_TIME"}'

Interview talking point: “create-classification-job --job-type ONE_TIME|SCHEDULED --s3-job-definition (bucket scope) with sampling. Findings list objects containing matches (identifier + counts). Findings flow to EventBridge/Security Hub; job cost varies with sampling and volume.”

Q1678: How do you use Config Aggregation Authorization?

What it is: Config aggregation authorization allows a central aggregator account to collect Config data from source accounts after authorization.

Why it is used: To view org-wide compliance/resources from a single aggregator account.

# Authorize aggregator
aws configservice put-aggregation-authorization \
  --authorized-account-id 123456789012 \
  --authorized-region us-east-1

Interview talking point: “Source: put-aggregation-authorization --authorized-account-id <aggregator> --authorized-aws-region <region>. Aggregator: put-configuration-aggregator (account list or org source with role). Aggregated views use Aggregate* APIs; source must have Config recorder enabled.”

Q1679: How do you implement CloudFormation StackSets Updates?

What it is: CloudFormation StackSets update propagates template/parameter changes to all stack instances across accounts/regions.

Why it is used: To roll infrastructure changes org-wide with controlled rollout.

# Update stack set
aws cloudformation update-stack-set \
  --stack-set-name my-stackset \
  --template-body file://new-template.yaml

Interview talking point: “update-stack-set --stack-set-name --template-body updates all instances; update-stack-instances targets subsets. Use --operation-preferences (FailureTolerancePercentage, MaxConcurrentPercentage, RegionConcurrencyType) to control rollout. Check list-stack-set-operations/describe-stack-set-operation for per-instance status.”

Q1680: How do you use CDK Import Resources?

What it is: CDK import brings existing resources under management (cdk import) or references them (fromXxxArn/fromXxxAttributes) without recreation.

Why it is used: To adopt existing infrastructure into CDK IaC safely.

# Import existing resource
imported_vpc = ec2.Vpc.from_lookup(
    self, "ExistingVPC",
    is_default=True
)

Interview talking point: “Reference-only: use static from* methods (no management change). True import: write matching CDK code and run cdk import (CloudFormation imports the physical resource). Code must match live resource properties; logical IDs must align for existing CF stacks.”

Additional Interview Questions 1681-1900

Q1681: How do you implement SAM Accelerate?

What it is: SAM Accelerate (sam sync) and local emulation (sam local invoke/start-api/start-lambda) speed serverless development loops.

Why it is used: To iterate on Lambda/API code quickly without full redeploys or in offline mode.

# Sync and watch
sam sync --stack-name my-stack --watch

Interview talking point: “sam sync --stack-name syncs stack+code; sam sync --code --watch does fast code-only push on file changes. Local: sam local start-api emulates API Gateway locally (Docker); --use-container improves runtime parity. Sync requires existing stack.”

Q1682: How do you use Amplify Branch Auto-Build?

What it is: Amplify branch auto-build automatically triggers builds on push for specific branches connected to the repo.

Why it is used: To control which branches deploy automatically (e.g. main auto-deploy, feature branches manual).

# Configure in Amplify Console:
# 1. App settings > Branch connections
# 2. Enable auto-build

Interview talking point: “Configure per branch: create-branch/update-branch --enable-auto-build true|false. Auto-build ON fires webhook to start build job; preview deployments are separate from long-lived branch auto-build. Build logic comes from branch/buildspec settings.”

Q1683: How do you implement CodePipeline Artifact Encryption?

What it is: CodePipeline artifact encryption uses a KMS CMK (or AWS-managed key) to encrypt artifacts in the pipeline’s S3 artifact store.

Why it is used: To enforce BYO-KMS for pipeline artifacts with audit/revocation control.

# Configure encryption
aws codepipeline create-pipeline \
  --pipeline '{
    "artifactStore": {
      "encryptionKey": {"id":"key-arn","type":"KMS"}
    }
  }'

Interview talking point: “Set artifactStore.encryptionKey with {"id":"<cmk-arn>","type":"KMS"} in create/update pipeline. Pipeline role needs kms:GenerateDataKey/kms:Decrypt on the CMK (key policy must allow). CMK and artifact bucket must be in same region/account.”

Q1684: How do you use CodeBuild VPC Configuration?

What it is: CodeBuild VPC configuration runs builds in your VPC with ENIs in specified subnets/security groups for private resource access.

Why it is used: To let builds reach private resources (RDS, internal endpoints) without public internet exposure.

version: 0.2

config:
  vpc:
    vpc_id: vpc-123
    subnets:
      - subnet-123
    security_groups:
      - sg-123

Interview talking point: “update-project --vpc-config {"vpcId","subnets","securityGroupIds"}. Builds in private subnets need NAT for internet egress (npm/pip); alternatively use VPC endpoints. VPC config is like Lambda VPC (ENI model) and adds ENI attach time.”

Q1685: How do you implement CodeDeploy Blue-Green Validation?

What it is: CodeDeploy blue-green validation uses traffic control, AppSpec hooks (ValidateService), deployment-ready wait, and CloudWatch alarms/auto-rollback.

Why it is used: To verify the green fleet before committing traffic cutover with automatic rollback on failure.

# Configure validation
aws codedeploy create-deployment \
  --deployment-config-name CodeDeployDefault.AllAtOnce

Interview talking point: “Deployment style BLUE_GREEN with WITH_TRAFFIC_CONTROL. Configure blue-green-deployment-configuration: deploymentReadyOption.waitTimeInMinutes (smoke test window), greenFleetProvisioningOption, and terminateBlueInstancesOnDeploymentSuccess. Auto-rollback on DEPLOYMENT_FAILURE/DEPLOYMENT_STOP_ON_ALARM using alarm-configuration.”

Q1686: How do you use CloudWatch Unified Agent?

What it is: CloudWatch unified agent collects OS-level metrics (mem/disk/net/cpu/procstat) and custom logs from EC2/on-prem into CWAgent namespace.

Why it is used: To monitor hosts beyond EC2 hypervisor metrics (get memory/disk/process/logs).

# Install agent
yum install -y amazon-cloudwatch-agent

# Configure
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s

Interview talking point: “Install amazon-cloudwatch-agent, configure via JSON or SSM parameter (-c ssm:<param>), start with amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s. Replaces legacy monitoring scripts; logs go to specified log groups/streams with instance_id substitution.”

Q1687: How do you implement X-Ray Custom Sampling Rules?

What it is: X-Ray custom sampling rules control trace recording via reservoir (guaranteed count/sec) and fixed rate (% of rest) matched by request attributes.

Why it is used: To focus trace budget on critical paths and reduce noise from high-volume calls.

{
  "Rules": [{
    "RuleName": "priority",
    "FixedRate": 0.5,
    "ReservoirSize": 10,
    "Host": "*",
    "HTTPMethod": "*",
    "URLPath": "/api/*"
  }]
}

Interview talking point: “Create rules with create-sampling-rule (priority order; first match wins). Criteria include ServiceName, HTTPMethod, URLPath, Host. Agents poll for rules/targets (propagation ~5 min). Default rule gives ~1/sec + 5%; tune per endpoint to record what matters.”

Q1688: How do you use CloudWatch Anomaly Detection Alarms?

What it is: CloudWatch anomaly detection alarms trigger when a metric deviates from its learned normal band (adaptive thresholds) rather than fixed values.

Why it is used: To alarm on unusual/seasonal behavior without manual threshold tuning.

# Create anomaly detection alarm
aws cloudwatch put-anomaly-detection \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --statistic Average

Interview talking point: “put-anomaly-detector learns band from history (up to 2 weeks; exclude known incidents). Create alarm with metric math using ANOMALY_DETECTION_BAND(m1, N) (sigma width) and compare metric to band. Works for metrics with cycles; same alarm actions as static alarms.”

Q1689: How do you implement CloudWatch Contributor Insights?

What it is: CloudWatch Contributor Insights analyzes logs to produce top-N contributors grouped by extracted keys (user/IP/statusCode).

Why it is used: To quickly find who/what dominates traffic/errors without running full SQL queries.

# Create rule
aws cloudwatch put-insight-rule \
  --rule-name "top-users" \
  --rule '{"schema":{"root":"LogGroup","fields":[{"field":"@timestamp"}]}}'

Interview talking point: “put-insight-rule --rule-definition with AggregateOn (Count/Sum), Contribution.Keys (group-by fields), LogGroupNames, and field extraction. Produces top contributors over time windows (console metrics). Different from metric filters (breakdown by key vs time-series counts).”

Q1690: How do you use CloudWatch Evidently Experiments?

What it is: CloudWatch Evidently manages feature flags, launches (gradual rollouts), and experiments (A/B tests) with built-in metrics/analytics.

Why it is used: To safely roll features and measure impact (conversion) before full deployment.

# Create launch
aws evidently create-launch \
  --project my-project \
  --name "Feature launch"

Interview talking point: “Create project → feature with variations → evaluate via evaluate-feature --project --feature --entity-id (stable bucketing by entity). Launches do staged % ramps; experiments split traffic and monitor CloudWatch metrics. entity-overrides force variations for testing.”

Q1691: How do you implement CloudWatch RUM Metrics?

What it is: CloudWatch RUM collects real browser telemetry (page loads, web vitals, XHR/fetch, JS errors) from users via a JS snippet.

Why it is used: To measure actual user experience (performance/errors) segmented by browser/device/country/page.

# Create app monitor
aws rum create-app-monitor \
  --name my-monitor \
  --domain-allow-list '["example.com"]'

Interview talking point: “create-app-monitor --domain-allow-list generates client snippet (or aws-rum-web). Telemetry sent to RUM endpoint, aggregated to AWS/RUM namespace metrics. CSP must allow RUM endpoint. Different from Synthetics (real users vs scripted canaries).”

Q1692: How do you use Systems Manager Session Manager Proxy?

What it is: Systems Manager Session Manager proxy provides shell access and TCP port forwarding (including to remote hosts) over SSM control channel with no inbound ports.

Why it is used: To securely access private instances/databases without public bastions.

# Configure tunnel
aws ssm start-session \
  --target i-12345 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["80"],"localPortNumber":["8080"]}'

Interview talking point: “Interactive shell: ssm start-session --target i-xxx. Local port forward: AWS-StartPortForwardingSession with portNumber/localPortNumber. Remote host proxy: AWS-StartPortForwardingSessionToRemoteHost to tunnel through instance to private DB. SSH-over-SSM via ProxyCommand also works.”

Q1693: How do you implement Parameter Store Public Parameters?

What it is: Parameter Store public parameters are AWS-owned read-only parameters under /aws/service/ (latest AMIs, ECS/EKS/Glue/EMR metadata, regions).

Why it is used: To resolve dynamic AWS values (e.g. latest AMI IDs) without hardcoding.

# Use public parameters
aws ssm get-parameters \
  --names /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Interview talking point: “Read with ssm get-parameter --name /aws/service/.... Use {{resolve:ssm:/aws/service/...}} in CloudFormation. Public params require authenticated calls but no account ownership; pin specific versions for reproducibility in prod.”

Q1694: How do you use Secrets Manager Resource Policy?

What it is: Secrets Manager resource policy grants cross-account access to a secret (external principals); identity policies govern same-account access.

Why it is used: To share secrets securely with other accounts without copying credentials.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::123456789012:root"},
    "Action": "secretsmanager:GetSecretValue",
    "Resource": "*"
  }]
}

Interview talking point: “put-resource-policy --secret-id --resource-policy allowing secretsmanager:GetSecretValue to external principal (e.g. arn:aws:iam::<acct>:root). Effective access: identity OR resource policy. Cross-account also needs KMS key policy to allow kms:Decrypt on the secret’s CMK. Use --block-public-policy to prevent public grants.”

Q1695: How do you implement IAM Access Analyzer External Access?

What it is: IAM Access Analyzer external access analyzer scans resource policies to find grants to principals outside your account/org (public/external access).

Why it is used: To detect unintended external access to resources (buckets, roles, keys, etc.) continuously.

# Analyze external access
aws access-analyzer create-analyzer \
  --analyzer-name my-analyzer \
  --type ACCOUNT

Interview talking point: “create-analyzer --analyzer-name --type ACCOUNT (or ORGANIZATION). list-findings returns external grants with resource/principal/actions (isPublic flag). validate-policy lints policies; check-access-not-granted tests hypothetical access. Analyzer does static policy analysis, not live access.”

Q1696: How do you use IAM Policy Simulator for Roles?

What it is: IAM Policy Simulator evaluates what a principal/role can do against identity+resource policies without making live API calls.

Why it is used: To test “what-if” permission changes safely before deployment.

# Test policy
aws iam simulate-principal-policy \
  --policy-source-arn role-arn \
  --action-names "s3:GetObject"

Interview talking point: “simulate-principal-policy --policy-source-arn <role-arn> --action-names ... --resource-arns ... returns EvalDecision (allowed/explicitDeny/implicitDeny) with matched statements. Use --policy-input-list to simulate adding a new policy. Supply context (caller ARN, source IP) to resolve condition-based decisions.”

Q1697: How do you implement KMS Custom Key Store?

What it is: KMS custom key store (CloudHSM-backed) stores key material exclusively in your CloudHSM cluster; KMS provides the API surface.

Why it is used: To meet compliance mandates requiring keys on hardware you control (custody of key material).

# Create CloudHSM key store
aws kms create-custom-key-store \
  --custom-key-store-name my-cks \
  --cloud-hsm-cluster-id cluster-123

Interview talking point: “Create CloudHSM cluster → create-custom-key-store --cloud-hsm-cluster-id --trust-anchor-certificate --key-store-password → connect-custom-key-store → create-key --custom-key-store-id. Cryptographic ops run in your HSMs; if store disconnects (HSM unavailable), keys become unusable — availability trade-off vs custody.”

Q1698: How do you use KMS Asymmetric Keys?

What it is: KMS asymmetric keys generate a public/private pair; private key never leaves KMS (use sign/verify or encrypt/decrypt via public key).

Why it is used: To do public-key crypto (JWT signing, client encryption to you) without exporting private keys.

# Create asymmetric key
aws kms create-key \
  --key-usage SIGN_VERIFY \
  --key-spec RSA_4096

Interview talking point: “create-key --key-usage SIGN_VERIFY|ENCRYPT_DECRYPT --key-spec <RSA|ECC|SM2>. get-public-key returns public key for distribution. sign --message-type RAW|DIGEST --signing-algorithm and verify; asymmetric encrypt/decrypt use the corresponding algorithm. Key usage is fixed at creation.”

Q1699: How do you implement KMS Key Policy Conditions?

What it is: KMS key policy conditions scope key usage by caller context (org ID, via service, encryption context, source account/ARN, etc.).

Why it is used: To tightly restrict which principals/services/contexts can use a CMK.

{
  "Condition": {
    "StringEquals": {
      "aws:PrincipalTag/Department": "Finance"
    }
  }
}

Interview talking point: “Add Condition blocks in key policy (e.g. aws:PrincipalOrgID, kms:ViaService, kms:EncryptionContext, aws:SourceArn, kms:GrantIsForAWSResource). Update with put-key-policy --policy-name default (full policy replace). Conditions are metadata-based (not on plaintext content).”

Q1700: How do you use CloudTrail Event Selectors?

What it is: CloudTrail event selectors control which events are recorded (management events by default; data events like S3 object-level/Lambda require selectors).

Why it is used: To capture only relevant events and manage volume/cost (data events incur charges).

# Create trail with selectors
aws cloudtrail create-trail \
  --name my-trail \
  --s3-bucket-name my-bucket \
  --event-selectors '[{"ReadWriteType":"WriteOnly","IncludeManagementEvents":true}]'

Interview talking point: “Legacy: event-selectors with DataResources (S3 objects, Lambda functions), ReadWriteType, ExcludeManagementEventSources. Advanced: advanced-event-selectors with field selectors (eventCategory, resources.type/ARN, eventName, readOnly) for finer filtering. Without selectors, only management events recorded.”

Q1701: How do you implement CloudTrail Lake Queries?

What it is: CloudTrail Lake stores events in an event data store you query with SQL via start-query, retained up to 2557 days (7 years) without Athena setup.

Why it is used: Answer audit questions in SQL without shipping logs to S3 and running Athena yourself.

# Run query
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=ec2.amazonaws.com

Interview talking point: “The SQL FROM clause is the event data store ID, not a trail, and the lake is separate from standard S3 trails. start-import backfills historical events into the store.”

Q1702: How do you use AWS Config Advanced Query?

What it is: SQL queries over Config’s recorded resource inventory, one account or aggregated across accounts through an aggregator.

Why it is used: Answer inventory questions like finding unencrypted buckets without writing inventory scripts.

# Query resources
aws configservice select-resource-config \
  --expression "SELECT * WHERE resourceType = 'AWS::EC2::Instance'"

Interview talking point: “select-resource-config returns 100 rows per page with NextToken, and select-aggregate-resource-config needs an existing aggregator for cross-account. Results reflect the last recorded configuration, so the recorder must be running.”

Q1703: How do you implement Security Hub Finding Aggregation?

What it is: Centralizes findings from member accounts and regions into one administrator account view using a finding aggregator.

Why it is used: Gives the security team one console showing every account’s findings across regions.

# Enable aggregator
aws securityhub enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “Setup is enable-organization-admin-account plus update-organization-configuration —auto-enable, then create-finding-aggregator with an aggregation region and region-linking-mode of ALL_REGIONS, SPECIFIED_REGIONS, or ALL_REGIONS_EXCEPT_SPECIFIED. Aggregation copies findings at ingestion; each account still runs its own Security Hub.”

Q1704: How do you use GuardDuty Finding Publishing?

What it is: Publishing destinations stream GuardDuty findings to S3 or Kinesis Firehose as they are generated.

Why it is used: Pushes a durable copy of findings to a SIEM bucket for archival.

# Enable publishing
aws guardduty update-organization-configuration \
  --detector-id detector-id \
  --auto-enable ORG

Interview talking point: “The documented destination types are S3 and Firehose, not CloudWatch Logs, and KmsKeyArn is mandatory. The bucket policy must allow guardduty.amazonaws.com s3:PutObject and the key policy kms:GenerateDataKey/Decrypt or describe-publishing-destination shows ERROR.”

Q1705: How do you implement Macie Organization Configuration?

What it is: Org-wide Macie runs through a delegated admin account plus auto-enable, so new accounts get Macie automatically.

Why it is used: Rolls PII discovery out org-wide with central findings instead of per-account enablement.

# Enable for org
aws macie2 enable-organization

Interview talking point: “Run macie2 enable-organization-admin-account after enable-macie in the admin account, then update-organization-configuration —auto-enable true. There is no macie2 enable-organization command; the admin’s classification jobs can target member buckets with AccountId in the s3-job-definition.”

Q1706: How do you use Detective Organization Admin?

What it is: A delegated admin plus auto-enable makes new accounts join one shared organization behavior graph.

Why it is used: One cross-account investigation graph instead of manual per-account graph invitations.

# Set admin
aws detective enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “detective enable-organization-admin-account then update-organization-configuration —auto-enable true replaces the manual create-members invite dance; members feed GuardDuty, CloudTrail, VPC Flow, and EKS audit data into the admin’s graph, and each member still pays its own ingestion.”

Q1707: How do you implement Inspector Organization Setup?

What it is: Three-call org onboarding: delegate the admin, enable resource types, then set per-resource auto-enable.

Why it is used: Ensures every org account’s EC2, ECR, and Lambda workloads get scanned automatically.

# Enable organization
aws inspector2 enable-organization

Interview talking point: “Order matters: inspector2 enable-delegated-admin-account, then inspector2 enable —resource-types with EC2, ECR, LAMBDA, LAMBDA_CODE, then update-org-configuration —auto-enable. There is no enable-organization command; the enable call is per-region and auto-enable toggles resource types, not accounts.”

Q1708: How do you use Control Tower Custom Guardrails?

What it is: Register your own SCP or Config rule as a Control Tower custom control with enablement and drift tracking.

Why it is used: Enforce org-specific rules through Control Tower like the AWS-managed guardrails.

# Create custom guardrail
aws controltower create-guardrail \
  --region us-east-1

Interview talking point: “There is no controltower create-guardrail API; you author the policy with organizations create-policy —type SERVICE_CONTROL_POLICY, then enable-control —target-identifier and —control-identifier using arn:aws:controltower:…:control/ while managed ones are AWS-GR_*. A current landing-zone version is required.”

Q1709: How do you implement Audit Manager Custom Framework?

What it is: Build custom controls from Config rules, CloudTrail events, or manual evidence, grouped into your own assessment framework.

Why it is used: Codifies an internal baseline when SOC 2 or PCI frameworks do not fit.

# Create custom framework
aws auditmanager create-framework \
  --name "Custom Framework"

Interview talking point: “The API is create-assessment-framework, not create-framework; each create-control declares mapping sources with sourceType AWS_CONFIG plus sourceKeyword, AWS_CLOUDTRAIL, or MANUAL. The framework packages controls but the evidence still comes from those mapped sources.”

Q1710: How do you use Systems Manager Patch Policies?

What it is: Patch Manager bundles a baseline, schedule, and instance patch groups so fleets patch on a cadence with compliance reporting.

Why it is used: Installs security patches on a schedule and proves compliance across the fleet.

# Create patch policy
aws ssm create-patch-baseline \
  --name "Critical Patches" \
  --operating-system AMAZON_LINUX2

Interview talking point: “Note the operating-system enum is AMAZON_LINUX_2, not AMAZON_LINUX2. Flow: create-patch-baseline, register-patch-baseline-for-patch-group, then a maintenance window running AWS-RunPatchBaseline with Operation Install or Scan; the SSM agent and AmazonSSMManagedInstanceCore role are required.”

Q1711: How do you implement GuardDuty Severity Thresholds?

What it is: GuardDuty scores findings 1.0-10.0 in Low, Medium, High, and Critical bands, with no detector threshold setting.

Why it is used: Consumers decide which severity levels alert, since GuardDuty emits every finding.

# Update severity
aws guardduty update-detector \
  --detector-id detector-id \
  --finding-publishing-frequency SIX_HOURS

Interview talking point: “The detector has no suppress-below-N knob; thresholds are applied downstream via list-findings —finding-criteria severity Gte, EventBridge numeric patterns on detail.severity, or create-filter —action ARCHIVE. Bands: Low 1.0-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0+.”

Q1712: How do you use Security Hub Severity Filters?

What it is: Security Hub normalizes provider severities into a label plus a 0-100 score you can filter and route on.

Why it is used: Triages HIGH and CRITICAL findings across GuardDuty, Inspector, WAF, and third parties.

# Severity filters use SeverityLabel (StringFilter) / SeverityNormalized
# (NumberFilter) keys -- there is no bare `Severity` attribute:
aws securityhub get-findings \
  --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}'

Interview talking point: “There is no bare Severity filter attribute: use SeverityLabel as a StringFilter or SeverityNormalized as a NumberFilter. Labels map to 0/20/40/70/90, and normalization is scale transfer, not equal risk between products.”

Q1713: How do you implement CloudTrail Integration with CloudWatch?

What it is: The trail streams events into a CloudWatch Logs group where metric filters and alarms trigger on risky API calls.

Why it is used: Wakes the team when root signs in or an IAM policy is deleted.

# Configure CloudWatch
aws cloudtrail update-trail \
  --name my-trail \
  --cloud-watch-logs-log-group-arn arn:logs

Interview talking point: “You need both —cloud-watch-logs-log-group-arn ending in :* and —cloud-watch-logs-role-arn for the CloudTrail_CW_Logs role. The chain is put-metric-filter on the JSON text then put-metric-alarm; EventBridge rules are the structured alternative to string matching.”

Q1714: How do you use Config Remediation Actions?

What it is: Remediation configurations run an SSM document or Lambda against noncompliant resources, with retries, until the rule passes.

Why it is used: Auto-fixes drift like unencrypted volumes instead of just flagging them.

# Configure remediation
aws configservice put-remediation-configurations \
  --remediation-configurations '[{
    "TargetType":"AWS::SSM::Document",
    "TargetId":"AWS-ConfigureS3BucketPublicReadProhibited"
  }]'

Interview talking point: “TargetType is SSM or LAMBDA with TargetId as the document name, not AWS::SSM::Document as the sample shows. Parameters use ResourceValue for the offending resource ID or StaticValue, and you should start with Automatic false before enabling auto-remediation.”

Q1715: How do you implement Detective Behavioral Graph Analysis?

What it is: Entity profile pages correlate CloudTrail, flow log, and GuardDuty activity into timelines with linked related entities.

Why it is used: Answers whether a principal’s behavior looks normal by walking linked entity timelines.

# Query behavior
aws detective list-graph-members \
  --graph-arn graph-arn

Interview talking point: “Detective visualizes and links the data but the anomaly judgment is still the analyst’s. Start from a finding’s Investigate view, follow related entities for lateral movement, and remember analysis depends on which data sources are enabled.”

Q1716: How do you use Macie Classification Scope?

What it is: A classification job’s Scoping block includes or excludes objects by key, extension, size, date, or tags.

Why it is used: Focuses expensive per-GB scanning on objects that could contain PII.

# Define scope
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --s3-job-definition '{
    "bucketDefinitions": [{"accountId":"123","buckets":["my-bucket"]}]
  }'

Interview talking point: “Scoping has Includes.And and Excludes.And arrays of SimpleScopeTerm or TagScopeTerm, and excludes win over includes. BucketDefinitions scope accounts and buckets first, sampling-percentage is a separate knob, and scope skips objects while an allow list suppresses matches.”

Q1717: How do you implement Inspector Coverage Queries?

What it is: Coverage asks Inspector what is actually being scanned per account, region, and resource type.

Why it is used: Finds scanning gaps before trusting a quiet findings list.

# Get coverage
aws inspector2 list-coverage \
  --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_EC2_INSTANCE"}]}'

Interview talking point: “Inspector2 has no list-coverage API despite the sample; use batch-get-account-status for per-resource-type states and describe-organization-configuration for auto-enable intent. Coverage is per region, so an account can be enabled in one region and disabled in another.”

Q1718: How do you use GuardDuty Export Findings to S3?

What it is: The S3 publishing destination writes findings as jsonl files under detector, year, month, and day paths.

Why it is used: Keeps a durable KMS-encrypted findings archive for a SIEM and long retention.

# Configure export
aws guardduty create-publishing-destination \
  --detector-id detector-id \
  --destination-type S3 \
  --s3-destination '{
    "BucketName": "my-bucket"
  }'

Interview talking point: “Pass DestinationArn and a mandatory KmsKeyArn via —destination-properties, not the —s3-destination BucketName shape in the sample. Both the bucket policy for PutObject and the KMS key policy for GenerateDataKey and Decrypt must allow GuardDuty or the status shows ERROR.”

Q1719: How do you implement Security Hub Automation Rules Actions?

What it is: Automation rules match incoming findings with filters and apply actions like suppress, archive, or change severity.

Why it is used: Auto-triages noise at ingestion instead of wiring EventBridge and Lambda glue.

# Create automation
aws securityhub create-automation-rule \
  --actions '[{"Type":"FINDING_FIELDS_UPDATE"}]'

Interview talking point: “Action types are SUPPRESS, ARCHIVE, CHANGE_SEVERITY, NOTIFY, and LABEL, set with —rule-actions, —rule-order, and —rule-status. Rules only run on new findings at ingestion, so existing findings need a manual update-findings pass.”

Q1720: How do you use AWS Config Conformance Pack Templates?

What it is: A conformance pack is a YAML bundle of Config rules, remediation, and parameters deployed to one or many accounts.

Why it is used: Ships the same multi-rule baseline everywhere instead of clicking rules per account.

# Template
Resources:
  ConfigRule:
    Type: AWS::Config::ConfigRule

Interview talking point: “put-conformance-pack —template-body takes YAML with AWS::Config::ConfigRule and AWS::Config::RemediationConfiguration; put-organization-conformance-pack —template-s3-uri deploys org-wide and new accounts auto-deploy. It is a packaging and distribution layer, not a new evaluation engine.”

Additional Interview Questions 1721-2000

Q1721: How do you implement AWS Network Firewall Rule Priorities?

What it is: Stateless rule groups carry explicit priorities with first-match wins; stateful groups evaluate in listed policy order.

Why it is used: Controls which rule wins so allow-lists run before the drop-all default.

# Create with priority
aws network-firewall create-rule-group \
  --rule-group-name high-priority \
  --priority 1

Interview talking point: “Only stateless groups take —priority, lower first; stateful groups run in the order listed in the policy, closed by —stateful-default-action PASSTHROUGH, DROP, or REJECT. A stateless pass bypasses the stateful engine entirely.”

Q1722: How do you use VPC Flow Logs to S3 with Kinesis?

What it is: Flow logs can write directly to S3, to Firehose, or through CloudWatch Logs with a subscription filter.

Why it is used: Streams flow records into analytics within minutes instead of batch Athena queries.

# Configure Kinesis
aws ec2 create-flow-logs \
  --resource-type VPC \
  --traffic-type ALL \
  --destination-type kinesis-data-firehose \
  --deliver-to-kinesis-data-firehose-arn firehose-arn

Interview talking point: “create-flow-logs accepts —log-destination-type s3, kinesis-data-firehose, or cloud-watch-logs; for the CW path add logs put-subscription-filter pointing at the Firehose stream. Firehose buffers around 60 seconds, while Athena over direct S3 stays the cheaper batch option.”

Q1723: How do you implement Transit Gateway Performance Mode?

What it is: Transit Gateway has no performance mode option; throughput comes from attachment scale, ECMP, and appliance mode.

Why it is used: Corrects the premise and explains how TGW capacity is actually increased.

# Enable performance
aws ec2 create-transit-gateway \
  --options '{"AmazonAsn":64512}'

Interview talking point: “create-transit-gateway options are AmazonSideAsn, VpnEcmpSupport, and DnsSupport, not a PerformanceMode key. Scale by attaching subnets in more AZs for roughly 50 Gbps per attachment, enable VpnEcmpSupport for VPN ECMP, and set ApplianceModeSupport on the attachment for stateful appliances.”

Q1724: How do you use Direct Connect LAG?

What it is: A LAG bonds up to four same-bandwidth, same-location Direct Connect links into one logical connection.

Why it is used: Adds bandwidth and link redundancy with a single VIF stack on top.

# Create LAG
aws directconnect create-lag \
  --lag-name my-lag \
  --number-of-connections 4 \
  --location EqDC2

Interview talking point: “create-lag —connections-count provisions new links, or associate-connection-with-lag bundles existing ones, provided they share bandwidth and location. Losing one link degrades rather than drops the LAG, and a LAG cannot span DX locations, so cross-location HA needs two LAGs with BGP.”

Q1725: How do you implement VPN Accelerator?

What it is: Accelerated Site-to-Site VPN routes tunnels through Global Accelerator edge POPs onto the AWS backbone.

Why it is used: Cuts latency and jitter on long-haul internet VPN paths without Direct Connect.

# Create accelerated VPN
aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-123 \
  --vpn-gateway-id vpg-123 \
  --accelerate

Interview talking point: “There is no —accelerate flag on create-vpn-connection as the sample suggests; acceleration is enabled on the customer gateway or connection option. Do not confuse this with standalone Global Accelerator for app endpoints, and expect Global Accelerator charges plus TGW VPN attachment support.”

Q1726: How do you use PrivateLink Gateway Services?

What it is: Endpoint services backed by a GWLB give consumers a gateway endpoint used as a route table target.

Why it is used: Transparently inserts an appliance fleet into customer traffic for inspection.

# Create gateway service
aws ec2 create-vpc-endpoint-service-configuration \
  --service-name com.amazonaws.us-east-1.gwlb

Interview talking point: “Pass —gateway-load-balancer-arns to create-vpc-endpoint-service-configuration, not a service-name like the sample shows. Consumers create a vpc-endpoint-type GatewayLoadBalancer endpoint and route traffic to it; the gateway pattern is inspection while the NLB-backed interface endpoint is application access.”

Q1727: How do you implement IPAM Pool Allocation Strategies?

What it is: IPAM pools hand out CIDRs under default, minimum, and maximum netmask bounds with tiered child pools.

Why it is used: Governs VPC address space centrally so ranges never overlap.

# Configure allocation
aws ec2 create-ipam-pool \
  --ipam-scope-id scope-123 \
  --allocation-default-netmask-length 24

Interview talking point: “provision-ipam-pool-cidr gives the pool its space; allocate-ipam-pool-cidr —preferred-cidr picks a specific block while the automatic path is first-fit within the netmask bounds. Child pools use —source-ipam-pool-id to partition the root, and get-ipam-pool-allocations shows usage.”

Q1728: How do you use Verified Access Trust Providers?

What it is: Trust providers supply user identity from SAML or OIDC and device posture from Jamf, CrowdStrike, or IdC.

Why it is used: Feeds identity and device health claims into each zero-trust access decision.

# Create trust provider
aws ec2 create-verified-access-trust-provider \
  --policy-reference-name my-provider \
  --device-trust-provider-type IOT

Interview talking point: “Create them with —trust-provider-type user using SAML metadata or OIDC config, or device with jamf, crowdstrike, or aws-iam-identity-center, then attach to the Verified Access instance. Endpoint policies then condition on claims like saml:sub and device_status.”

Q1729: How do you implement VPC Lattice Auth Policies?

What it is: An IAM-style auth policy plus an auth-type toggle controls who may invoke each Lattice service.

Why it is used: Adds per-request IAM authorization at the service mesh edge.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "vpc-lattice-svcs:Invoke",
    "Resource": "service-arn"
  }]
}

Interview talking point: “Set —auth-type AWS_IAM on the service for SigV4 per request, then put-auth-policy on the service or service network ARN. The invoke action is vpc-lattice-svcs:Invoke as in the sample, not vpc-lattice:Invoke, and with AWS_IAM and no policy everything is denied.”

Q1730: How do you use Internet Monitor City-level Metrics?

What it is: Internet Monitor reports availability and RTT per city and ISP for traffic reaching your monitored VPCs.

Why it is used: Shows whether a slow experience comes from a city’s ISP or your app.

# Get city data
aws internetmonitor get-monitor \
  --monitor-name my-monitor

Interview talking point: “Metrics are keyed by CityNetwork, meaning city plus ASN, and only appear where you actually have traffic. list-health-events names the impacted city and ISP pairs with ACTIVE or RESOLVED status, and metrics export to CloudWatch for per-city alarms.”

Q1731: How do you implement Route 53 Latency-Based Routing?

What it is: Latency routing answers with the region whose measured round trip from the user’s resolver is lowest.

Why it is used: Sends users to the fastest region by measurement instead of a fixed map.

# Create latency record
aws route53 change-resource-record-sets \
  --hosted-zone-id Z123 \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "example.com",
        "Type": "A",
        "SetIdentifier": "us-east-1",
        "Latency": {"Region": "us-east-1"},
        "TTL": 60,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

Interview talking point: “Each record needs SetIdentifier plus LatencyRoutingPolicy with a Region field; the sample’s bare Latency key and missing SetIdentifier would be rejected. EvaluateTargetHealth or a health check drops the sick region and Route 53 returns the next fastest healthy one.”

Q1732: How do you use CloudFront Origin Shield?

What it is: Origin Shield is a per-origin regional cache that consolidates edge cache misses before touching the origin.

Why it is used: Cuts origin load and thundering-herd fetches on volatile or costly origins.

# Enable origin shield
aws cloudfront update-origin-shield-origin-shield-configuration \
  --origin-shield-origin-shield-configuration '{
    "Enabled": true,
    "OriginShieldRegion": "us-east-1"
  }'

Interview talking point: “There is no update-origin-shield command as the sample implies; you set OriginShield with Enabled and OriginShieldRegion inside the distribution config via update-distribution. It adds a hop and per-origin cost on misses while saving origin fetches on later regional hits.”

Q1733: How do you implement S3 Replication Time Control?

What it is: Replication Time Control adds a 99.99 percent within-15-minutes SLA plus CloudWatch replication metrics on the destination.

Why it is used: Guarantees and proves DR copy speed where standard replication promises nothing.

# Enable RTC
aws s3api put-bucket-replication \
  --bucket my-bucket \
  --replication-configuration '{
    "Role": "role-arn",
    "Rules": [{
      "ID": "rule",
      "Status": "Enabled",
      "Destination": {"Bucket": "arn:aws:s3:::dest-bucket"},
      "ReplicationTime": {"Status": "Enabled", "Time": {"Minutes": 15}}
    }]
  }'

Interview talking point: “Enable ReplicationTime with Time Minutes 15 and Metrics on the rule destination; RTC requires the metrics block. Alarm on ReplicationLatency over 15 minutes, remember RTC bills per object and covers only new objects, with batch replication handling backfill.”

Q1734: How do you use S3 Object Lambda Transformations?

What it is: An Object Lambda access point runs a Lambda on each read to transform the stored object per consumer.

Why it is used: Delivers redacted or resized views of one canonical object without ETL copies.

# Lambda for transformation
def handler(event, context):
    return {"statusCode": 200}

Interview talking point: “It needs a standard access point as backing, and the handler must fetch via inputS3Url then answer with WriteGetObjectResponse using outputRoute and outputToken, not a normal Lambda return. Every read costs a Lambda invocation, so skip it for hot paths.”

Q1735: How do you implement Lambda Concurrency Limits?

What it is: Reserved concurrency caps and guarantees a function’s slice of the account’s 1000 per-region concurrent executions.

Why it is used: Stops one runaway function from starving every other Lambda in the region.

# Set reserved concurrency
aws lambda put-function-concurrency \
  --function-name my-function \
  --reserved-concurrent-executions 100

Interview talking point: “put-function-concurrency both caps and isolates the function, deducted from the shared pool you see via UnreservedConcurrentExecutions. Hitting the cap returns 429 TooManyRequestsException, async traffic retries to a DLQ, and throughput equals concurrency divided by average latency.”

Q1736: How do you use DynamoDB Adaptive Capacity?

What it is: Adaptive capacity automatically lends idle partitions’ unused throughput to hot partitions, with no setting to toggle.

Why it is used: Absorbs hot-key skew without over-provisioning the whole table.

# Adaptive capacity is automatic
# Monitor with CloudWatch

Interview talking point: “A hot partition can burst up to the table’s total provisioned throughput but never beyond it; exceeding that still throws ProvisionedThroughputExceededException, so raise capacity or redesign the key. Watch ThrottledEvents, or use PAY_PER_REQUEST to skip capacity planning entirely.”

Q1737: How do you implement Aurora Backtrack?

What it is: Backtrack rewinds an Aurora MySQL cluster in place to an earlier timestamp without restoring a new cluster.

Why it is used: Undoes a bad deploy in minutes on the same endpoint.

# Enable backtrack
aws rds modify-db-cluster \
  --db-cluster-identifier my-cluster \
  --backtrack-hours 24

Interview talking point: “Set —backtrack-window at cluster creation in seconds up to 259200, not —backtrack-hours as the sample shows; then backtrack-db-cluster —backtrack-to or —use-earliest-time. It is Aurora MySQL only, writes after the target are lost, and it is not a backup.”

Q1738: How do you use RDS Performance Insights Retention?

What it is: Performance Insights keeps DB load, wait events, and top SQL for a configurable retention period.

Why it is used: Longer paid retention reveals slow regressions the free 7-day window erases.

# Set retention
aws pi put-performance-insights-retention-period \
  --db-instance-identifier my-db \
  --retention-period 7

Interview talking point: “Retention is 7 days free, then 31 through 731 paid, set with modify-db-instance —performance-insights-retention-period. It is per instance and encrypted with a KMS key, and distinct from backup retention of 0 to 35 days and Enhanced Monitoring OS metrics.”

Q1739: How do you implement ElastiCache Redis AUTH?

What it is: The legacy AUTH token is a shared 16 to 128 character password clients send before any Redis command.

Why it is used: Keeps unauthenticated callers out of a network-reachable cache.

# Enable AUTH
aws elasticache create-replication-group \
  --replication-group-id my-group \
  --auth-token-enabled

Interview talking point: “There is no —auth-token-enabled flag as the sample shows; set —auth-token at create or modify-cache-cluster, and clients get NOAUTH Authentication required without it. One shared token is legacy, so prefer user groups with ACLs, IAM auth, and —transit-encryption-enabled TLS.”

Q1740: How do you use OpenSearch Dashboards SAML?

What it is: Domain-level SAML options single-sign-on Dashboards users through an IdP, mapping roles to backend roles.

Why it is used: Gives analysts SSO with automatic role assignment instead of local passwords.

# Configure SAML
aws opensearch update-domain-config \
  --domain-name my-domain \
  --saml-options '{"Enabled":true}'

Interview talking point: “SAMLOptions lives inside —domain-config-options on update-domain-config, not in a separate —saml-options flag as the sample shows. The IdP metadata XML supplies EntityId and the certificate; SAML covers only the UI, while API access still uses IAM or the master user.”

Q1741: How do you implement Redshift WLM Queues?

What it is: WLM partitions query concurrency and memory into manual queues or auto WLM in the cluster parameter group.

Why it is used: Keeps daily ETL floods from starving interactive dashboards.

# Configure WLM
aws rds create-db-cluster-parameter-group \
  --parameter-group-family redshift-1.0 \
  --description "Custom WLM"

Interview talking point: “Set wlm_json_configuration with aws redshift modify-cluster-parameter-group, not the rds create-db-cluster-parameter-group call in the sample. Manual queues use query_concurrency, memory_percent_to_use, and user or query group routing while auto_wlm self-tunes, and changes require a cluster reboot.”

Q1742: How do you use Glue Job Bookmarks Encryption?

What it is: JobBookmarksEncryption encrypts the incremental-run bookmark state with client-side KMS, disabled by default.

Why it is used: Protects the stored incremental-processing offsets per security policy.

# Enable encryption
aws glue create-security-configuration \
  --encryption-configuration '{
    "JobBookmarksEncryption": {"Mode":"CSE-KMS","KmsKeyArn":"key-arn"}
  }'

Interview talking point: “Set JobBookmarksEncryption with mode CSE-KMS and kmsKeyArn on the job via create-job or update-job, or bundle it in a SecurityConfiguration; the same block also covers S3 and CloudWatch encryption. The job role needs kms:Encrypt and kms:Decrypt.”

Q1743: How do you implement Kinesis Enhanced Monitoring?

What it is: Enhanced monitoring emits per-shard CloudWatch metrics beyond the free stream-level aggregates for hot-shard diagnosis.

Why it is used: Identifies which shard is hot or lagging instead of just the stream.

# Enable enhanced metrics
aws kinesis enhance-metrics \
  --stream-name my-stream \
  --shard-level-metrics IncomingBytes,OutgoingBytes

Interview talking point: “The command is enable-enhanced-monitoring —shard-level-metrics, not enhance-metrics as the sample shows, and it is charged per shard. Track IteratorAgeMilliseconds and Read or WriteProvisionedThroughputExceeded per shard to spot hot shards; disable-enhanced-monitoring reverts it.”

Q1744: How do you use EventBridge Retry Policies?

What it is: Per-target retry policies bound delivery attempts and event age, then park failures in an SQS or SNS DLQ.

Why it is used: Turns fire-and-forget delivery into bounded retries with a replayable dead-letter path.

{
  "RetryPolicy": {
    "MaximumRetryAttempts": 3,
    "MaximumEventAgeInSeconds": 86400
  }
}

Interview talking point: “RetryPolicy and DeadLetterConfig attach to each target in put-targets, not to the rule; defaults are 185 attempts and 86400 second event age with no DLQ. The queue policy must allow EventBridge SendMessage, retries can duplicate, and archives with start-replay are the parallel recovery path.”

Q1745: How do you implement Step Functions Callback Pattern?

What it is: A task using the waitForTaskToken resource suffix pauses until an external worker reports back with the token.

Why it is used: Pauses workflows for human approval or slow external systems.

{
  "WaitForCallback": {
    "Type": "WaitForTaskToken",
    "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken"
  }
}

Interview talking point: “It is a Task state whose Resource ends in .waitForTaskToken with $$.Task.Token in the payload, not a WaitForCallback state type as the sample JSON implies. The worker calls send-task-success, send-task-failure, or send-task-heartbeat; tokens are single-use, so set TimeoutSeconds.”

Q1746: How do you use SQS Message Deduplication?

What it is: FIFO queues drop duplicate sends within a 5-minute window using a dedup ID or content hash.

Why it is used: Prevents retried messages from creating double payments or orders.

# Enable FIFO
sqs.create_queue(
    QueueName='orders.fifo',
    Attributes={
        'FifoQueue': 'true',
        'ContentBasedDeduplication': 'false'
    }
)

# Use deduplication ID
sqs.send_message(
    QueueUrl=queue_url,
    MessageBody='order',
    MessageDeduplicationId='unique-id'
)

Interview talking point: “Dedup is FIFO only, so the queue name ends in .fifo with FifoQueue true; standard queues have no dedup. Use MessageDeduplicationId or ContentBasedDeduplication hashing the body, remembering the window is 5 minutes and message-group-id handles ordering separately.”

What it is: Filter policies on each subscription deliver only matching messages by attribute or message body JSON.

Why it is used: Fans out selectively so only the fraud checker sees high-value orders.

# Create with filter
sns.create_topic(
    Name='my-topic',
    Tags=[{'Key': 'filter', 'Value': 'enabled'}]
)

Interview talking point: “The policy is set on the subscription via subscribe —attributes or set-subscription-attributes, not on the topic like the sample implies. Top-level keys AND together while value lists OR, numeric ranges chain in one array, and FilterPolicyScope MessageBody filters the body instead of attributes.”

Q1748: How do you use Kinesis Data Stream Encryption?

What it is: Server-side KMS encryption protects stream records at rest with the aws/kinesis key or your CMK.

Why it is used: Meets at-rest encryption rules without changing producers or consumers.

# Enable encryption
aws kinesis enable-stream-encryption \
  --stream-name my-stream \
  --encryption-type KMS \
  --kms-key-id key-id

Interview talking point: “The API is start-stream-encryption —encryption-type KMS —key-id, not enable-stream-encryption —kms-key-id as the sample shows, and stop-stream-encryption reverts it. Producer and consumer roles need kms:GenerateDataKey and kms:Decrypt, while TLS covers data in transit.”

Q1749: How do you implement Lambda VPC DNS Support?

What it is: A VPC-attached Lambda uses the VPC resolver, so private hosted zones and RDS endpoints resolve like on EC2.

Why it is used: Lets functions reach private endpoints by name instead of hardcoded IPs.

# Enable DNS
aws lambda update-function-configuration \
  --function-name my-function \
  --vpc-config '{
    "SubnetIds":["subnet-123"],
    "SecurityGroupIds":["sg-123"],
    "VpcConfig": {"VpcId":"vpc-123"}
  }'

Interview talking point: “vpc-config takes only SubnetIds and SecurityGroupIds; the VpcId field in the sample is output, not an input you pass. There is no Lambda-side DNS setting to configure, but without the VPC config the function gets public DNS only and private names fail.”

Q1750: How do you use ECS Task Metadata Endpoint?

What it is: Magic environment variables expose task and container metadata plus CPU, memory, and network stats from inside a task.

Why it is used: Lets a container self-identify and collect its own metrics without ECS API calls.

{
  "containerDefinitions": [{
    "name": "web",
    "image": "nginx",
    "disableNetworking": false
  }]
}

Interview talking point: “ECS_CONTAINER_METADATA_URI_V4 gives /task and /task/stats while ECS_CONTAINER_METADATA_URI is the container view, and no IAM is needed. Do not confuse it with the separate 169.254.170.2 credentials endpoint for AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, and it needs awsvpc or bridge networking.”

Q1751: How do you implement EKS Cluster Endpoint Access?

What it is: EKS cluster endpoint access controls how the Kubernetes API server is reachable, via resourcesVpcConfig: endpointPublicAccess, endpointPrivateAccess, and publicAccessCidrs.

Why it is used: Locks down kube-apiserver exposure: office-IP-only public access, or private-only inside the VPC.

# Configure endpoint access
aws eks update-cluster-config \
  --name my-cluster \
  --resources-vpc-config '{
    "endpointPublicAccess": true,
    "endpointPrivateAccess": true
  }'

Interview talking point: “Three toggles: public on/off, private ENI endpoint on/off, and the CIDR allowlist, which defaults to 0.0.0.0/0. Private-only means kubectl must come from inside the VPC via VPN or peering, and network reachability is separate from IAM auth.”

Q1752: How do you use CloudFormation Drift Detection Settings?

What it is: Drift detection compares a stack’s live resources to its template; detect-stack-drift runs it and describe-stack-resource-drifts reports per-resource diffs.

Why it is used: Catches manual console or CLI changes to stack-owned resources before the next deploy.

# Configure detection
aws cloudformation update-stack \
  --stack-name my-stack \
  --drift-detection true

Interview talking point: “There is no drift setting on update-stack, since detection is on-demand, so —drift-detection true is not a real flag. Statuses are IN_SYNC, DRIFTED, MODIFIED, DELETED, NOT_CHECKED; fix drift via update-stack or by editing the template.”

Q1753: How do you implement CDK Context Lookup?

What it is: CDK context is synth-time configuration from cdk.json, —context flags, and lookups such as Vpc.fromLookup that query the deployed environment.

Why it is used: Lets stacks read environment-specific values without hardcoding account IDs.

# Look up existing VPC
vpc = ec2.Vpc.from_lookup(
    self, "VPC",
    vpc_id="vpc-123"
)

Interview talking point: “Lookup results are cached in cdk.context.json for reproducible synths; reset with cdk context —reset or —clear. Zero-match or ambiguous lookups fail synth, and context is build-time while SSM and env vars are runtime.”

Q1754: How do you use SAM Package Command?

What it is: sam package uploads local artifacts like CodeUri and DefinitionUri to S3 and rewrites the template references as s3:// URLs.

Why it is used: Makes templates with local paths deployable, since CloudFormation cannot reference local artifacts.

# Package application
sam package \
  --template-file template.yaml \
  --s3-bucket my-bucket \
  --output-template packaged.yaml

Interview talking point: “Use —template-file and —output-template-file; the older —template alias is drift. Package only uploads, so build, package, and deploy are three separate steps, while sam deploy —s3-bucket gives a one-step auto-package.”

Q1755: How do you implement CodePipeline Artifact Retention?

What it is: CodePipeline artifacts live in an S3 bucket with no pipeline retention setting, so lifetime is governed by bucket lifecycle rules.

Why it is used: Keeps the artifact bucket from growing forever by expiring old build outputs.

# Configure retention
aws codepipeline put-attribute \
  --pipeline-name my-pipeline \
  --attribute Key=ArtifactRetentionCount,Value=5

Interview talking point: “There is no ArtifactRetentionCount attribute, so the put-attribute example is not a real command. Retention is put-bucket-lifecycle-configuration on the artifact prefix with headroom for in-flight executions, and execution history is separate from artifact files.”

Q1756: How do you use CodeBuild Environment Variables?

What it is: CodeBuild environment variables are PLAINTEXT, PARAMETER_STORE, or SECRETS_MANAGER values defined on the project or in the buildspec env block.

Why it is used: Injects configuration and secrets at build time without committing them to the repository.

version: 0.2

env:
  variables:
    ENV: production
  parameter-store:
    API_KEY: /myapp/api/key

Interview talking point: “Parameter and secret values are fetched at build start through the project role and snapshotted, so changed values need a rebuild. Buildspec variables override same-name project variables, and start-build —environment-variables-override passes runtime values.”

Q1757: How do you implement CodeDeploy AppSpec Hooks?

What it is: AppSpec hooks map deployment lifecycle events to scripts, each with a location, a timeout in seconds, and a runas user.

Why it is used: Runs ordered deploy scripts such as migrations, starts, and health checks, rolling back on failure.

hooks:
  AfterInstall:
    - location: scripts/after_install.sh
      timeout: 300

Interview talking point: “In-place order is ApplicationStop, DownloadBundle, BeforeInstall, AfterInstall, ApplicationStart, ValidateService; blue/green adds the BlockTraffic and AllowTraffic hooks. A hook exiting non-zero fails the deployment and triggers rollback on DEPLOYMENT_FAILURE.”

Q1758: How do you use CloudWatch Logs Subscriptions?

What it is: A subscription filter streams new matching log events to Lambda, Kinesis, or Firehose in near real time.

Why it is used: Feeds log events into analytics or SIEM pipelines without polling or manual exports.

# Create subscription
aws logs put-subscription-filter \
  --log-group-name /aws/lambda/my-function \
  --filter-name my-filter \
  --destination-arn lambda-arn

Interview talking point: “Only new events stream and nothing is back-filled, so use create-export-task for history. Received payloads are base64 and GZIP compressed so consumers must decode them, and cross-account delivery needs a destination plus put-destination-policy.”

Q1759: How do you implement X-Ray Sampling with Agent?

What it is: X-Ray sampling pairs a fixed per-second reservoir with a rate percentage, enforced by the SDK and the X-Ray daemon.

Why it is used: Traces an affordable, representative slice of traffic instead of every request.

{
  "SamplingRule": {
    "RuleName": "default",
    "FixedRate": 0.01
  }
}

Interview talking point: “The default is one request per second plus 5% of the rest, and the daemon polls central sampling rules so updates are not instant. The Sampled flag in X-Amzn-Trace-Id carries the decision downstream.”

Q1760: How do you use Systems Manager Parameter Policies?

What it is: Parameter policies are lifecycle JSON attached through put-parameter —policies: Expiration, ExpirationNotification, and NoChangeNotification.

Why it is used: Makes temporary parameters delete themselves and warns operators before or after expiry.

# Set expiration
aws ssm put-parameter \
  --name /myapp/config \
  --value "value" \
  --type String \
  --policies '[{"Type":"Expiration","Version":"1.0","Attributes":{"Date":"2024-12-31T00:00:00Z"}}]'

Interview talking point: “There is no —notification-arn field on put-parameter; notifications flow through EventBridge’s Systems Manager source to your rules. Expiration deletes the parameter at its timestamp, while ExpirationNotification fires the given days before and after.”

Q1761: How do you implement Secrets Manager Resource Policy?

What it is: A resource policy attached to one secret gates Secrets Manager API calls and unions with the caller’s identity policy.

Why it is used: Grants conditioned per-secret access, including cross-account, organization, and VPC endpoint restrictions.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::123:root"},
    "Action": "secretsmanager:*",
    "Resource": "*"
  }]
}

Interview talking point: “Either policy allowing is enough, but a Deny in either wins. Wildcard principals get AccessDeniedException when BlockPublicPolicy is set, and the KMS key policy remains a separate third layer.”

Q1762: How do you use IAM Roles Anywhere Profiles?

What it is: IAM Roles Anywhere pairs a trust anchor, a CA bundle or Private CA, with a profile mapping certificate attributes to an IAM role.

Why it is used: Gives on-premises X.509 workloads temporary STS credentials instead of long-lived access keys.

# Create profile
aws rolesanywhere create-profile \
  --name my-profile \
  --role-arns role-arn

Interview talking point: “There is no CLI verb for the session exchange, since aws_signing_helper or credential_process signs the request. Attribute mappings expose certificate fields as IAM condition keys, import-crl and enable-crl handle revocation, and profile session duration caps the credentials.”

Q1763: How do you implement KMS Grants?

What it is: A KMS grant is a delegable, revocable permission record on a key authorizing specific operations without editing the key policy.

Why it is used: Lets AWS services use a key per job instead of widening the key policy.

# Create grant
aws kms create-grant \
  --key-id key-id \
  --grantee-principal role-arn \
  --operations Encrypt Decrypt

Interview talking point: “Operations are fixed at creation because there is no update-grant, only revoke and recreate. Pass —grant-tokens on follow-up calls to avoid the eventual-consistency AccessDenied race; retire-grant is the grantee’s verb, revoke-grant the owner’s.”

Q1764: How do you use GuardDuty Export to CloudWatch?

What it is: GuardDuty has no native CloudWatch Logs destination; findings publish to EventBridge automatically, and a rule bridges them into CloudWatch.

Why it is used: Routes high-severity findings into the standard SNS and CloudWatch alarm flow.

# Enable
aws guardduty update-detector \
  --detector-id detector-id \
  --features '[{"Name":"S3_LOG_EVENTS","Status":"ENABLED"}]'

Interview talking point: “EventBridge severity patterns must enumerate values like 7, 7.1, 7.2 because there is no range operator. A Lambda then calls put-metric-data under your own namespace for alarms, while S3 or Firehose publishing is the archive path.”

Q1765: How do you implement Security Hub Auto-enable?

What it is: Security Hub auto-enable turns the service on for all current and future org member accounts through two admin commands.

Why it is used: Removes per-account enablement as accounts join the organization.

# Enable org
aws securityhub enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “Run enable-organization-admin-account then update-organization-configuration —auto-enable. Org-managed members cannot disable Security Hub themselves, no past findings are backfilled, and the invite flow remains only for non-org setups; —no-auto-enable reverts.”

Q1766: How do you use Macie Discovery Jobs?

What it is: Macie discovery is implemented as classification jobs, ONE_TIME or SCHEDULED, scanning chosen S3 buckets for sensitive data.

Why it is used: Discovers PII continuously with run history that auditors can reference.

# Create job
aws macie2 create-discovery-job \
  --name my-job \
  --job-type ONE_TIME

Interview talking point: “The verb is create-classification-job, not create-discovery-job as the example shows. Statuses run WAITING_FOR_RUN_SCHEDULE, RUNNING, COMPLETE plus USER_PAUSED, CANCELLED, ERROR; —initial-run forces the first run and update-classification-job pauses or resumes.”

Q1767: How do you implement Detective Graph Queries?

What it is: Detective offers no query language; analysis happens through console entity search and the investigations APIs on its behavior graph.

Why it is used: Pivots from a GuardDuty finding to an entity’s behavior without writing your own log joins.

# Query graph
aws detective search-graph \
  --graph-arn graph-arn \
  --criteria '{"entity": {"value": "user@example.com"}}'

Interview talking point: “There is no search-graph command; the programmatic surface is start-investigation with a scope of entity type and identifier, plus get-investigation, list-indicators, and update-investigation-state. The graph holds pre-joined CloudTrail, Flow Logs, and GuardDuty data with no bulk export.”

Q1768: How do you use Audit Manager Assessments Scope?

What it is: An Audit Manager assessment scope lists the accounts and AWS service names its controls collect evidence from.

Why it is used: Bounds an audit to chosen accounts and services so only their evidence is collected.

# Set scope
aws auditmanager create-assessment \
  --name my-assessment \
  --scope '{\"awsAccounts\":[{\"id\":\"123456789012\"}]}'

Interview talking point: “Valid service names come from get-services-in-scope, so do not invent them. Scope is the where and whom, the framework is the what, and scope edits affect future collection only while old evidence stays.”

Q1769: How do you implement Control Tower Service Control Policies?

What it is: Control Tower preventive guardrails are Organizations SCPs attached to OUs; detective guardrails are Config and CloudTrail checks.

Why it is used: Explains what actually enforces a guardrail and whether you can add your own SCPs.

# Create SCP
aws organizations create-policy \
  --type SERVICE_CONTROL_POLICY \
  --content '{"Version":"2012-10-17"}'

Interview talking point: “The modern verb is enable-control with a control identifier and an OU ARN, while the older enable-guardrail and list-enabled-guardrails are retired in favor of the controls API. You may attach your own SCPs to CT OUs but never detach CT’s.”

Q1770: How do you use AWS Config Aggregation Sources?

What it is: A Config aggregator’s source is either the whole organization or an explicit account list with chosen regions.

Why it is used: Gives the security team one multi-account, multi-region compliance view.

# Authorize
aws configservice put-aggregation-authorization \
  --authorized-account-id 123456789012

Interview talking point: “The org source needs Config delegated admin and the recorder running in each member account, after which new accounts auto-join. The RoleArn must trust config.amazonaws.com, and select-aggregate-resource-config runs SQL across the aggregator.”

Q1771: How do you implement CloudTrail Management Events?

What it is: Management events are control-plane API calls captured by every trail by default, with selectors tuning read, write, and scope.

Why it is used: Provides the baseline audit trail of who called what, when, and from where.

# Configure
aws cloudtrail update-trail \
  --name my-trail \
  --include-global-service-events

Interview talking point: “Keep IncludeManagementEvents true in every selector, because adding DataResources without it silently stops management-event delivery. Data events are opt-in and separately priced, and lookup-events gives 90-day history against the trail’s long-term S3 store.”

Q1772: How do you use CloudWatch Metric Filter Alarms?

What it is: A metric filter converts matching log text into a custom CloudWatch metric, which a metric alarm then watches.

Why it is used: Alerts on security signals like AccessDenied or root sign-ins without deploying a SIEM.

# Create filter
aws logs put-metric-filter \
  --log-group-name /aws/lambda/my-function \
  --filter-name error-filter \
  --metric-transformations '[
    {"metricNamespace":"MyApp","metricName":"Errors","metricValue":"1"}
  ]' \
  --pattern "[ERROR]"

Interview talking point: “Create the filter first, since an alarm on a nonexistent metric sits in InsufficientData forever and filters never backfill old events. Patterns support JSON like { $.errorCode = “AccessDenied” }, and treat-missing-data notBreaching suits quiet log groups.”

Q1773: How do you implement VPC Peering DNS Support?

What it is: Peered VPC DNS has three layers: per-VPC DNS attributes, a private hosted zone associated with both VPCs, and the peering DNS option.

Why it is used: Gives instances cross-VPC name resolution, since peering alone only routes packets.

# Enable DNS
aws ec2 modify-vpc-peering-connection-options \
  --vpc-peering-connection-id pcx-123 \
  --accepter-peering-options '{"AllowDnsResolutionFromRemoteVpc":true}'

Interview talking point: “Peering gives no DNS by itself. Verify enableDnsSupport and enableDnsHostnames on both VPCs, associate a private hosted zone, where cross-account needs associate-vpc-association-authorization first, and remember overlapping CIDRs block the peering entirely.”

Q1774: How do you use Transit Gateway Policy Table?

What it is: A Transit Gateway policy table holds ordered rules matching source and destination CIDR, port, and protocol, dispatching to a target route table.

Why it is used: Supports service insertion by steering selected flows through a firewall VPC.

# Create policy table
aws ec2 create-transit-gateway-policy-table \
  --transit-gateway-id tgw-123

Interview talking point: “Rules evaluate in policy-rule-number order and first match wins, unlike route tables’ longest-prefix match. An attachment can associate with a policy table or a route table but not both, and unassociated attachments keep default routing.”

Q1775: How do you implement Direct Connect Virtual Interface Tags?

What it is: Direct Connect virtual interfaces are tagged through the directconnect endpoint’s tag-resource, describe-tags, and untag-resource calls using resource ARNs.

Why it is used: Categorizes VIFs by purpose or location for search and IAM conditions.

# Tag VIF
aws directconnect tag-resource \
  --resource-id vif-123 \
  --tags Key=Environment,Value=Production

Interview talking point: “Use —resource-arn, since the example’s tag-resource —resource-id form is wrong; ARN prefixes are dxcon, dxlag, dxvif, and dxgw. Virtual interfaces and DX gateways do not support cost-allocation tags, and tags never affect BGP or routing.”

Q1776: How do you use Route 53 DNSSEC Validation?

What it is: DNSSEC validation is the resolver’s check of the DS, DNSKEY, and RRSIG chain, with zone health read from get-dnssec.

Why it is used: Catches broken signing such as a deleted KMS key before users hit SERVFAIL.

# Enable DNSSEC
aws route53 enable hosted-zone-dnssec \
  --hosted-zone-id Z123

Interview talking point: “get-dnssec showing ACTION_NEEDED usually means the KMS key was deleted or its key policy changed. The key must be ECC_NIST_P256 with Sign and Verify and dnssec-route53.amazonaws.com allowed, and a broken chain gives validating resolvers SERVFAIL, worse than unsigned.”

Q1777: How do you implement CloudFront Field-Level Encryption?

What it is: CloudFront field-level encryption encrypts named form fields at the edge through a public key, profile, and config bound to a cache behavior.

Why it is used: Keeps card numbers and SSNs encrypted all the way to the origin.

# Configure
aws cloudfront create-field-level-encryption-config \
  --field-level-encryption-config '{
    "CallerReference": "ref",
    "ContentTypeProfileConfig": {"ForwardWhenContentTypeIsUnknown": true}
  }'

Interview talking point: “Setting ForwardWhenContentTypeIsUnknown to false is fail-closed, so unmatched requests are not forwarded to the origin. You keep the private key outside AWS, and edge logs show field names with ciphertext values only.”

Q1778: How do you use S3 Object Lock Retention?

What it is: Object Lock retention applies per object version in GOVERNANCE or COMPLIANCE mode, set explicitly or through bucket DefaultRetention.

Why it is used: Enforces regulatory retention so objects cannot be deleted before their RetainUntilDate.

# Set retention
aws s3api put-object-retention \
  --bucket my-bucket \
  --key file.txt \
  --retention '{
    "Mode": "GOVERNANCE",
    "RetainUntilDate": "2025-01-01"
  }'

Interview talking point: “Extending RetainUntilDate is always allowed; shortening needs GOVERNANCE mode with —bypass-governance-retention and s3:BypassGovernanceRetention, while COMPLIANCE cannot be shortened by anyone including root. Retention attaches to a version rather than a key, and legal hold is separate.”

Q1779: How do you implement Lambda Container Image Support?

What it is: Lambda container image functions use —package-type Image with an ECR ImageUri instead of a zip, handler, or runtime argument.

Why it is used: Allows 10GB deployments for heavy dependencies beyond the 250MB zip ceiling.

# Create function with image
aws lambda create-function \
  --function-name my-function \
  --package-type Image \
  --code ImageUri=123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest

Interview talking point: “With images there is no —handler or —runtime because the base image owns them, and the digest resolves at deploy time, so use immutable tags like v2 rather than latest. Dependencies live in the Dockerfile instead of layers.”

Q1780: How do you use ECS Task Placement Constraints?

What it is: ECS placement constraints are hard filters, distinctInstance or memberOf attribute expressions, applied before placement strategies run.

Why it is used: Guarantees rules like one task per instance when soft strategies are not enough.

{
  "placementConstraints": [
    {
      "type": "memberOf",
      "expression": "attribute:ecs.instance-type == t3.medium"
    }
  ]
}

Interview talking point: “Constraints filter hard while spread, binpack, and random order softly afterward. They are EC2 and capacity provider concepts that Fargate ignores, and an unsatisfiable constraint parks the task in PENDING rather than raising an error.”

Q1781: How do you implement EKS Node Group Scaling?

What it is: update-nodegroup-config —scaling-config sets a managed node group’s ASG minSize, maxSize, and desiredSize, applied asynchronously.

Why it is used: Resizes the worker pool without recreating the node group or changing AMIs.

# Update scaling config
aws eks update-nodegroup-scaling \
  --cluster-name my-cluster \
  --nodegroup-name my-nodes \
  --scaling-config minSize=2,maxSize=10,desiredSize=5

Interview talking point: “The verb is update-nodegroup-config, not update-nodegroup-scaling as the example shows. A min of zero is legal but schedules nothing and nothing recreates it, so set bounds and let the autoscaler own desiredSize because manual edits race it.”

Q1782: How do you use CloudFormation Custom Resource Backward Compatibility?

What it is: Custom resource backward compatibility rests on a fixed contract: a PUT to the pre-signed ResponseURL with Status, PhysicalResourceId, and Data.

Why it is used: Keeps 2016-era custom resources working across stack updates and Lambda runtime changes.

# Use with DependsOn
Resources:
  CustomResource:
    Type: Custom::MyResource
    DependsOn: LambdaFunction

Interview talking point: “cfnresponse ships only for ZipFile inline code, while S3-stored code must send the response itself, and forgetting it hangs the stack until timeout. Keep PhysicalResourceId stable across updates because changing it forces replacement, and keep Data keys additive.”

Q1783: How do you implement CDK Cross-Stack References?

What it is: CDK cross-stack references auto-generate a CfnOutput with Export on the producer and Fn::ImportValue on the consumer stack.

Why it is used: Shares resources across stacks without hardcoding names or manually ordering deployments.

# Export
class NetworkStack(core.Stack):
    def __init__(self, scope, id):
        super().__init__(scope, id)
        self.vpc = ec2.Vpc(self, "VPC")
        core.CfnOutput(self, "VPCId", value=self.vpc.vpc_id)

Interview talking point: “Exports work only within one account and region, and the exporting stack cannot be deleted while imported. Circular references fail synthesis; for cross-account or cross-region sharing, bypass exports with Parameter Store or GetStackOutput.”

Q1784: How do you use SAM Layers with Python?

What it is: SAM Python layers are AWS::Serverless::LayerVersion resources whose ZIP must contain a top-level python/ folder, built with BuildMethod.

Why it is used: Shares Python dependencies across functions without rebundling them into every deployment package.

Layers:
  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:requests:1

Interview talking point: “The layout is the contract: python/ at the ZIP root becomes /opt/python, and a wrong folder name silently breaks imports. Each deploy publishes a new layer version that functions must re-reference; limits are five layers and 250MB unzipped.”

Q1785: How do you implement CodePipeline Webhook Filters?

What it is: CodePipeline webhook filters are JSONPath and matchEquals conditions on the incoming payload that decide whether the pipeline runs.

Why it is used: Keeps feature-branch pushes from triggering the production pipeline.

# Create webhook
aws codepipeline create-webhook \
  --name my-webhook \
  --filters '[{"jsonPath":"$.ref","matchEquals":"refs/heads/main"}]'

Interview talking point: “The CLI verb is put-webhook while create-webhook is the API name shown in the example. Up to five filters apply and all must pass rather than any one, the GITHUB_HMAC token must match GitHub’s secret, and re-creating the webhook changes its URL.”

Q1786: How do you use CodeBuild Source Credentials?

What it is: import-source-credentials stores one Git credential per account and region so CodeBuild projects can clone private repositories.

Why it is used: Avoids embedding clone tokens in buildspecs or project configurations.

# Add credential
aws codebuild import-source-credentials \
  --token my-token \
  --type GITHUB

Interview talking point: “The flags are —server-type plus a required —auth-type, so the example’s —type GITHUB is wrong. OAUTH cannot be created through the API and is console-only, BASIC_AUTH needs —username, and re-importing requires —should-overwrite.”

Q1787: How do you implement CodeDeploy Environment Variables?

What it is: CodeDeploy exports APPLICATION_NAME, DEPLOYMENT_ID, DEPLOYMENT_GROUP_NAME, DEPLOYMENT_GROUP_ID, and LIFECYCLE_EVENT into each hook script’s environment.

Why it is used: Lets one hook script adapt to environment and deployment without baking in configuration.

env:
  variables:
    ENV: production

Interview talking point: “The variables are per lifecycle event, so a value set during BeforeInstall is not visible to AfterInstall. Bundle variables depend on the source, with BUNDLE_VERSION only on versioned buckets and BUNDLE_COMMIT for GitHub, and DownloadBundle, Install, BlockTraffic, AllowTraffic are agent-reserved.”

Q1788: How do you use CloudWatch Dashboard Variables?

What it is: CloudWatch dashboard variables are a top-level variables array in the dashboard body, referenced as ${varId} inside widget JSON.

Why it is used: Turns one dashboard into many views as operators pick a function or region.

# Use widget API
dashboard = cloudwatch.Dashboard(
    self, "Dashboard",
    widgets=[cloudwatch.GraphWidget(
        title="Metrics",
        left=[metric]
    )]
)

Interview talking point: “property substitutes literal values while pattern substitutes a search pattern, and an invalid pattern value silently yields an empty widget. The inputType picker is filled by search and populateFrom, and dashboard limits like 500 widgets still apply.”

Q1789: How do you implement X-Ray Context Missing Strategy?

What it is: The X-Ray context missing strategy decides what happens when code records with no open segment: RUNTIME_ERROR, LOG_ERROR, or IGNORE_ERROR.

Why it is used: Keeps startup code and spawned threads from crashing the application over tracing gaps.

from aws_xray_sdk.core import xray_recorder

xray_recorder.configure(context_missing='LOG_ERROR')

Interview talking point: “RUNTIME_ERROR is the strict default and LOG_ERROR suits background workers. The AWS_XRAY_CONTEXT_MISSING environment variable overrides in-code configuration, while wrapping calls in try/catch hides the real fix, which is opening an explicit segment.”

Q1790: How do you use Systems Manager Maintenance Window Tasks?

What it is: Maintenance window tasks bind an SSM document, runbook, Lambda, or state machine to a window’s schedule with priority and throttles.

Why it is used: Runs recurring admin jobs such as patch scans and cleanups with bounded fan-out.

# Register task
aws ssm register-task-with-maintenance-window \
  --window-id mw-123 \
  --task-arn role-arn \
  --task-type AUTOMATION

Interview talking point: “—task-arn is the document or runbook ARN, not a role ARN as the example shows, and —service-role-arn is optional since a service-linked role is used instead. Lower —priority runs first, while max-concurrency and max-errors throttle the fan-out.”

Q1791: How do you implement Secrets Manager Random Passwords?

What it is: generate-secret-string lets Secrets Manager create a random password at create-secret, while get-random-password generates one without storing it.

Why it is used: Avoids homebrew password generators for database and service credentials.

# Generate
secret = secretsmanager.create_secret(
    Name='db-pass',
    GenerateSecretString={
        'PasswordLength': 32,
        'ExcludeCharacters': '@%'
    }
)

Interview talking point: “Defaults are 32 characters, punctuation included and space excluded, with RequireEachIncludedType enforcing every category. The create response does not echo the value, so read it with get-secret-value, and the secret is redacted in CloudTrail.”

Q1792: How do you use IAM Policy Versioning?

What it is: IAM managed policies keep up to five versions, with one marked default through create-policy-version —set-as-default.

Why it is used: Enables instant rollback of a bad policy edit without rewriting the document.

# Create version
aws iam create-policy-version \
  --policy-arn policy-arn \
  --policy-document file://v2.json \
  --set-as-default

Interview talking point: “A sixth version fails with LimitExceeded, so delete a non-default first. Without —set-as-default the version stays inactive until set-default-policy-version flips it, and inline policies are not versioned at all.”

Q1793: How do you implement KMS Import Key Material?

What it is: Imported key material lets you supply the key bytes for an EXTERNAL-origin KMS key using a wrapping handshake.

Why it is used: Meets BYOK requirements where keys must originate in your own systems.

# Get import parameters
aws kms get-parameters-for-import \
  --key-id key-id \
  --wrapping-key-spec RSA_4096 \
  --import-mechanism KEY_MATERIAL

Interview talking point: “Import only works on keys created with —origin EXTERNAL, and the ImportToken expires after 24 hours with ExpiredImportTokenException. Expired material makes every operation fail with KMSInvalidStateException until re-import, and rotating imported keys is simply re-importing.”

Q1794: How do you use GuardDuty Finding Severity Mapping?

What it is: GuardDuty severity is a 1.0 to 10.0 number on each finding, mapped into EventBridge patterns, Security Hub labels, and filters.

Why it is used: Turns the mere existence of a finding into consistent triage across alerting systems.

# Update
aws guardduty update-organization-configuration \
  --detector-id detector-id

Interview talking point: “The bands are 1 to 3.9 Low, 4 to 6.9 Medium, 7 to 8.9 High, and 9 to 10 Critical. Severity is finding data, since update-organization-configuration configures data sources rather than severity, so there is no per-detector severity knob.”

Q1795: How do you implement Security Hub Finding History?

What it is: get-finding-history returns up to 90 days of per-finding ASFF change events, capped at 100 per page.

Why it is used: Shows when and how a finding’s fields changed, for incident timelines.

# Get history
aws securityhub list-finding-aggregators

Interview talking point: “The example’s list-finding-aggregators snippet is a different feature, cross-region aggregation rather than history, so the correct verb is get-finding-history with Id and ProductArn. Timestamps are excluded from change detection, and history stops at 90 days.”

Q1796: How do you use Macie Allow Lists?

What it is: Macie allow lists suppress findings for matching content, with criteria holding either a single regex or an S3 words list.

Why it is used: Stops Macie flagging known-good test data as sensitive.

# Create allow list
aws macie2 create-allow-list \
  --name "Trusted patterns" \
  --pattern "*.example.com"

Interview talking point: “The flag is —criteria, not —pattern as the example shows, and criteria accepts one regex up to 512 characters or one s3WordsList, never both. Suppression applies at detection time so re-run jobs after edits, and the words-list bucket must be same account and region.”

Q1797: How do you implement Detective Retention Period?

What it is: Detective retention is a fixed rolling window of about one year with no API to change it.

Why it is used: Sets the expectation that longer retention must come from your own exports.

# Set retention
aws detective update-graph \
  --graph-arn graph-arn \
  --data-encryption-key-encryption-options '{"kmsKeyArn":"key-arn"}'

Interview talking point: “There is no set-retention API; update-graph with data-encryption-key-encryption-options switches the graph to a customer-managed KMS key and nothing else. If compliance needs longer retention, archive through Detective API pulls.”

Q1798: How do you use Audit Manager Delegations?

What it is: Audit Manager delegations hand an assessment to another account or role, tracked by list-assessment-delegations, with an optional dry-run.

Why it is used: Lets auditors collect and review evidence without receiving broad account access.

# `delegate-assessment` doesn't exist -- custom FRAMEWORKS (not assessments)
# are shared via start-assessment-framework-sharing:
aws auditmanager start-assessment-framework-sharing \
  --framework-id <fid> \
  --assessment-framework-sharing-request '{"comment":"shared for Q3 audit","destinationAccount":"123456789012","destinationRegion":"us-east-1","sourceAccount":"123456789012","sourceRegion":"us-east-1"}'

Interview talking point: “Per the source notes, delegate-assessment does not exist, since frameworks rather than assessments are shared via start-assessment-framework-sharing. Delegation covers only work inside the assessment instead of IAM access, and it is unrelated to Organizations delegated admin.”

Q1799: How do you implement Control Tower OU Management?

What it is: Control Tower OU management uses Organizations commands to create OUs and move accounts so guardrails attach per OU.

Why it is used: Scales which accounts receive which preventive and detective controls.

# Move account
aws organizations move-account \
  --account-id 123456789012 \
  --source-parent-id old-ou \
  --destination-parent-id new-ou

Interview talking point: “The CLI verb is organizations move-account, not a controltower command, since Control Tower just observes the re-parent. An account lives in exactly one OU, and applying the destination OU’s controls is asynchronous after the move.”

Q1800: How do you use AWS Config Advanced Query Filters?

What it is: Config advanced queries are SQL expressions over recorded resources, run by select-resource-config or select-aggregate-resource-config.

Why it is used: Finds misconfigurations like unencrypted buckets across the whole inventory in one query.

# Query with filters
aws configservice select-aggregate-resource-config \
  --configuration-aggregator-name my-aggregator \
  --expression "SELECT * WHERE resourceType = 'AWS::EC2::Instance'"

Interview talking point: “The SQL belongs in —expression, not the CLI’s —query JMESPath, since two query concepts sit side by side. Queries read current recorded state rather than history, rows return as strings, and —pagination-token walks large results.”

Final Interview Questions 1801-2000

Q1801: How do you implement CloudTrail Event Store?

What it is: CloudTrail Lake event data store: a queryable store for events with configurable retention, separate from S3 trails. Created with create-event-data-store, queried via start-query SQL.

Why it is used: Runs SQL analytics over events in place without exporting to S3 first; retention is a store property.

# Create event data store
aws cloudtrail create-event-data-store \
  --name my-eds \
  --retention-period 90

Interview talking point: “The CLI verb is create-event-data-store, not create-trail — trails write to S3 while event data stores are the queryable lake. Retention is a —retention-period property, and mirroring the same events to both doubles cost for no benefit.”

Q1802: How do you use CloudWatch Logs Insights Query Syntax?

What it is: CloudWatch Logs Insights query syntax is a pipe chain of fields, filter, stats, sort, limit, and parse stages run with start-query and read with get-query-results.

Why it is used: Turns a firehose of log lines into an answer over a time window without exporting logs anywhere.

# Query
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by @message

Interview talking point: “Queries need start and end epochs, regex uses /slashes/ while quoted strings are literal, and get-query-results pages automatically with its token. Aggregating unstructured messages returns noise, so parse the message into fields before running stats.”

Q1803: How do you implement VPC CIDR Reservation?

What it is: Subnet CIDR reservation marks an IP range inside a subnet as unavailable for auto-assignment, with reservation types prefix and explicit, managed by create-subnet-cidr-reservation.

Why it is used: Guarantees addresses for NLBs, Direct Connect endpoints, or prefix delegation without AWS handing them to random instances.

# Reserve CIDR
aws ec2 associate-vpc-cidr-block \
  --vpc-id vpc-123 \
  --amazon-provided-ipv6-cidr-block

Interview talking point: “associate-vpc-cidr-block adds address space to a VPC — it is not the reservation; the reservation verb is create-subnet-cidr-reservation. The range must sit inside the subnet CIDR, and a reservation blocks auto-assignment only, not routing.”

Q1804: How do you use Direct Connect Gateway Associations?

What it is: Direct Connect gateway associations wire a Direct Connect gateway to virtual gateways, transit gateways, and virtual interfaces using create-direct-connect-gateway-association.

Why it is used: One DXGW bridges multiple VIFs into VPCs across regions and accounts without extra BGP sessions per VPC.

# Associate
aws directconnect associate-connection-with-lag \
  --connection-id conn-123 \
  --lag-id lag-123

Interview talking point: “The doc’s associate-connection-with-lag bundles a connection into a LAG — that is not the gateway association; the verb is create-direct-connect-gateway-association. Cross-account, the DXGW owner proposes and the gateway owner accepts, and update-direct-connect-gateway-association tunes the propagated prefixes.”

Q1805: How do you implement Route 53 Record Set Groups?

What it is: Route 53 change batches group CREATE, DELETE, and UPSERT record changes into one change-resource-record-sets call applied as a single unit.

Why it is used: Lets several DNS records that must change together flip in one call, like failover swaps or blue-green cutovers.

# Create record group
aws route53 create-reusable-delegation-set \
  --caller-reference "my-set"

Interview talking point: “The batch is validate-first, not transactional: an invalid entry fails everything, but applied entries are never rolled back. The doc’s create-reusable-delegation-set is a different feature, and get-change INSYNC means authoritative servers updated, not TTL-cached resolvers.”

Q1806: How do you use CloudFront Response Headers Policies?

What it is: CloudFront response headers policies declaratively add, override, or remove headers on viewer responses at the distribution or cache-behavior level.

Why it is used: Standardizes HSTS, CSP, CORS, and custom headers edge-wide without Lambda@Edge or per-origin application code.

# Create policy
aws cloudfront create-response-headers-policy \
  --response-headers-policy-config '{
    "Name": "security-headers",
    "SecurityHeadersConfig": {"StrictTransportSecurity":{"AccessControlMaxAgeSec":31536000,"IncludeSubdomains":true,"Override":true}}'

Interview talking point: “Override true always replaces the origin’s header while Override false only applies when the origin sent nothing, and a partial CorsConfig fails validation. Updates take the full config with the current —if-match ETag from get, not a patch-style flag.”

Q1807: How do you implement S3 Batch Operations Manifest?

What it is: An S3 Batch Operations manifest is a CSV or inventory report listing exactly which objects a job acts on, referenced by ObjectArn plus ETag.

Why it is used: Runs one operation — tagging, copy, restore, ACL, retention, Lambda — over a precise object list with retries and a completion report.

{
  "Bucket": "my-bucket",
  "Key": "objects.csv",
  "Format": "S3BatchOperations_CSV_20180820"
}

Interview talking point: “The manifest Location needs the CSV’s ETag, the job’s —report is required, and only one operation type is allowed per job. The manifest is read once, so mid-run drift just shows up as failed tasks in the report.”

Q1808: How do you use Lambda Function URLs Custom Domains?

What it is: Lambda function URLs have a fixed https://url-id.lambda-url.region.on.aws address with no native custom-domain parameter on create-function-url-config.

Why it is used: Serves a function under your own TLS domain by fronting it with API Gateway or CloudFront.

# Create mapping
aws apigatewayv2 create-domain-name \
  --domain-name api.example.com \
  --domain-name-configurations '[{"CertificateArn":"cert-arn"}]'

Interview talking point: “There is no custom-domain option on create-function-url-config — the domain is always indirection through API Gateway’s create-domain-name plus create-api-mapping, or a CloudFront alias. ACM certificates must match the API’s region, or be us-east-1 for CloudFront.”

Q1809: How do you implement ECS Task EFS Volume Mount?

What it is: ECS task EFS volumes attach an EFS filesystem through efsVolumeConfiguration in the task definition, linked to container mountPoints by name.

Why it is used: Provides tasks with shared, durable multi-AZ storage that outlives containers, unlike single-instance EBS volumes.

{
  "volumes": [{
    "name": "efs-volume",
    "efsVolumeConfiguration": {
      "fileSystemId": "fs-123"
    }
  }],
  "mountPoints": [{
    "sourceVolume": "efs-volume",
    "containerPath": "/data"
  }]
}

Interview talking point: “The volume’s name and the container’s sourceVolume must match exactly or the task fails to start, and the task security group must allow NFS 2049 to the EFS security group — the top EFS-on-ECS failure. EFS works on both Fargate and EC2.”

Q1810: How do you use EKS Cluster Security Groups?

What it is: EKS cluster security groups cover the control-plane ENIs and cross-account load-balancer ENIs; EKS creates and manages the cluster security group itself.

Why it is used: Controls which traffic reaches the cluster API and nodes without editing the AWS-managed rules directly.

# Add security group
aws eks update-cluster-config \
  --name my-cluster \
  --resources-vpc-config '{
    "securityGroupIds":["sg-123"]
  }'

Interview talking point: “Add extra groups with update-cluster-config —resources-vpc-config securityGroupIds, while clusterSecurityGroupId is set only at create-cluster. Never hand-edit or delete the EKS-managed cluster SG, and remember node group security groups are separate — both sets must allow traffic.”

Q1811: How do you implement CloudFormation Stack Policy?

What it is: A CloudFormation stack policy is update-time JSON denying actions like Update:Delete or Update:Replace on protected resource types during stack operations.

Why it is used: Prevents accidental destructive changes to critical resources such as RDS instances while a stack is being updated.

{
  "Statement": [{
    "Effect": "Allow",
    "Action": "Update:*",
    "Principal": "*",
    "Resource": "*"
  }]
}

Interview talking point: “Default is Allow — the policy exists to Deny. It only guards updates: delete-stack still wipes everything, so pair it with update-termination-protection, and relax the policy for a single run with —stack-policy-during-update-body.”

Q1812: How do you use CDK Fn::GetAtt?

What it is: Fn.getAtt in CDK reads a CloudFormation resource attribute at deploy time, usually exposed automatically as construct properties like vpc.vpcId.

Why it is used: References values that only exist after a resource is created, adding an implicit dependency on that resource.

vpc = ec2.Vpc(self, "VPC")
subnet = ec2.Subnet(self, "Subnet", vpc_id=vpc.vpc_id)

Interview talking point: “Most attributes are already exposed as CDK properties; the escape hatch Fn.getAtt needs the synthesized logical ID, which breaks if a refactor renames the construct. GetAtt resolves at deploy time, never as a runtime value.”

Q1813: How do you implement SAM Environment Variables?

What it is: SAM environment variables are literal, Ref, or Sub values declared under Environment.Variables on a Serverless::Function in the template.

Why it is used: Keeps configuration out of code so the same artifact deploys unchanged across dev, stage, and prod.

Environment:
  Variables:
    TABLE_NAME: my-table

Interview talking point: “Values are always strings — booleans and integers get coerced — with a 4KB total limit and reserved AWS_ prefixes. Env vars are visible in the console, so secrets belong in Secrets Manager or SSM dynamic references instead.”

Q1814: How do you use CodePipeline Custom Job Worker?

What it is: A custom job worker polls CodePipeline for jobs of your registered custom action type, acknowledges each, then reports success or failure.

Why it is used: Runs proprietary or self-hosted steps — on-prem builds, custom approvals, licensed scanners — inside a managed pipeline.

# Create action
aws codepipeline create-custom-action-type \
  --category Build \
  --provider-name MyProvider

Interview talking point: “create-custom-action-type must run before the pipeline references it, and the worker must poll with the exact category, owner, provider, and version — a mismatch means it polls forever. Report within the job timeout or the job is marked Failed.”

Q1815: How do you implement CodeBuild Buildspec Artifacts?

What it is: The buildspec artifacts section declares what a build publishes: a required files glob plus name, base-directory, and discard-paths options.

Why it is used: Packages only the built output — dist or target files — for CodePipeline or S3 instead of shipping the whole repo.

artifacts:
  files:
    - '**/*'
  name: my-artifact

Interview talking point: “files is required — a missing or empty list silently publishes no artifact. The S3 destination lives on the project via create-project —artifacts, while discard-paths and base-directory shape what ends up in the zip.”

Q1816: How do you use CodeDeploy Hooks Timeout?

What it is: Each CodeDeploy AppSpec hook takes a timeout in seconds, defaulting to 3600, and a runas user for the script.

Why it is used: Bounds how long a stuck script may hold a deployment so it fails fast instead of hanging the window.

hooks:
  ApplicationStop:
    - location: scripts/stop.sh
      timeout: 600

Interview talking point: “Omitting timeout gives a script a full hour, so set explicit values. Exceeding it kills the process and marks the lifecycle event Failed, and a blue/green BeforeAllowTraffic timeout blocks the cutover — keep hooks aligned with real drain times.”

Q1817: How do you implement CloudWatch Metrics Composite Alarm?

What it is: A CloudWatch composite alarm derives its state from boolean logic over other alarms’ states, defined in put-composite-alarm —alarm-rule.

Why it is used: Pages only when the right combination of signals holds, cutting false positives across the fleet.

# Create composite
aws cloudwatch put-composite-alarm \
  --alarm-name my-alarm \
  --alarm-rule "ALARM(metric1) OR ALARM(metric2)"

Interview talking point: “The rule is pure state algebra — ALARM, OK, INSUFFICIENT_DATA with AND, OR, NOT over same-account, same-region alarms. There is no time window, and it re-evaluates only when member states change, so design the metric alarms first.”

Q1818: How do you use X-Ray Sampling Strategy?

What it is: X-Ray sampling strategy sets a reservoir of always-traced requests per second plus a rate applied to the remaining traffic.

Why it is used: Caps trace volume and cost while keeping enough samples to debug production issues.

# Set strategy
xray_recorder.configure(
    sampling_strategy={
        'version': 1,
        'default': {'fixed_target': 10, 'rate': 0.1}
    }
)

Interview talking point: “fixed_target traces the first N requests per second, then rate samples the remainder — target 10 with rate 0.1 is about 109 traces per second at 1000 rps. Rules are priority-ordered with first match wins, and inconsistent rates across services orphan subsegments.”

Q1819: How do you implement Systems Manager Parameter Policies?

What it is: SSM parameter policies attach Expiration, ExpirationNotification, or NoChangeNotification metadata to a parameter through put-parameter —policies.

Why it is used: Makes stored credentials expire on a date and warns the team before secrets go stale.

# Add policy
aws ssm put-parameter \
  --name /app/config \
  --value "value" \
  --type String \
  --policies '[{"Type":"Expiration","Version":"1.0","Attributes":{"Date":"2024-12-31"}}]'

Interview talking point: “Expiration makes GetParameter stop returning the value after the Date — the parameter is not deleted, just unreadable. Notification policies need ExpirationNotification’s AfterDays plus Arn, and the SNS topic must allow ssm.amazonaws.com to Publish or nothing is ever sent.”

Q1820: How do you use Secrets Manager Rotation Schedule?

What it is: Secrets Manager rotation schedules invoke a rotation Lambda on a cadence set with rotate-secret and AutomaticallyAfterDays.

Why it is used: Recycles database passwords and API keys unattended so leaked credentials are short-lived.

# Configure
aws secretsmanager rotate-secret \
  --secret-id my-secret \
  --rotation-lambda-arn lambda-arn \
  --rotation-rules AutomaticallyAfterDays=30

Interview talking point: “The Lambda must follow the four-step createSecret, setSecret, testSecret, finishSecret protocol or the secret sticks in AWSPENDING. AutomaticallyAfterDays counts from the last rotation, not a calendar date, and the Lambda needs KMS decrypt plus PutSecretValue permissions.”

Q1821: How do you implement IAM Access Analyzer Archive Rules?

What it is: IAM Access Analyzer archive rules automatically archive findings matching a filter built from eq, neq, exists, and includes operators.

Why it is used: Keeps accepted-risk findings out of the active queue so analysts only see genuine exposure.

# Create rule
aws access-analyzer create-archive-rule \
  --analyzer-name my-analyzer \
  --rule-name my-rule \
  --filter '{"resource":{"eq":"s3://bucket"}}'

Interview talking point: “create-archive-rule archives findings as they arrive while apply-archive-rule sweeps existing ones. The resource criterion must be a full ARN like arn:aws:s3:::bucket rather than s3://bucket, and archiving is a status — findings stay queryable, never deleted.”

Q1822: How do you use KMS Key Alias Rotation?

What it is: KMS alias rotation means repointing an alias at a newer key with update-alias, while material rotation refreshes key material on the same key ID.

Why it is used: Moves consumers to new key material without editing every reference, and rotates material in place under one identity.

# Alias rotation
aws kms alias rotate-key-on-alias \
  --alias-name alias/my-alias

Interview talking point: “There is no rotate-key-on-alias command — the verb is update-alias with alias-name and target-key-id. Alias repointing and material rotation are different things, and rotation never re-encrypts existing ciphertext; KMS just tracks old key versions.”

Q1823: How do you implement GuardDuty Suppressions?

What it is: GuardDuty finding filters with an action of ARCHIVE automatically archive matching new findings as they are generated.

Why it is used: Stops known-benign patterns like vulnerability scanner probes from paging the team every night.

# Create filter
aws guardduty create-filter \
  --detector-id detector-id \
  --name suppress \
  --action ARCHIVE \
  --finding-criteria '{"criterion":{"type":{"eq":["UnauthorizedAccess:EC2/SSHBruteForce"}}}'

Interview talking point: “The filter lives per-detector behind —detector-id, and action NO_ARCHIVE gives a passive saved view you can flip to ARCHIVE later. Archived findings still count for analytics, so review them — a scanner changing ports silently stops matching the old filter.”

Q1824: How do you use Security Hub Integration Tests?

What it is: Testing a Security Hub integration means round-tripping a crafted ASFF finding through batch-import-findings and reading it back with get-findings.

Why it is used: Proves the finding pipeline works end-to-end before real alerts start depending on it.

# Run test
aws securityhub run-feed-import-test

Interview talking point: “There is no run-feed-import-test command — test with batch-import-findings using a valid ASFF finding, check FailedCount in the response, then verify via get-findings on the Id. The ProductArn must match the exact product format or the import fails.”

Q1825: How do you implement Macie Allow List Patterns?

What it is: Macie allow lists suppress sensitive-data findings at detection time using one —criteria object holding either a regex or an S3 word list.

Why it is used: Stops false positives on legitimately public text like internal domains, license boilerplate, or product names.

# Create
aws macie2 create-allow-list \
  --name "patterns" \
  --pattern "*.internal.example.com"

Interview talking point: “The doc’s —pattern flag does not exist; the parameter is —criteria with either a regex or an s3WordsList, never both. A glob like *.internal.example.com is not valid regex, and update-allow-list replaces criteria wholesale rather than merging.”

Q1826: How do you use Detective Investigation Timeline?

What it is: A Detective investigation scopes a timeline over an entity ARN and time window with start-investigation, then reads the report via get-investigation.

Why it is used: Answers what an identity did during a suspicious window using Detective’s behavior graph data.

# Get timeline
aws detective get-investigation \
  --investigation-id inv-123 \
  --include-events

Interview talking point: “get-investigation has no —include-events flag — event detail is console-only, and inv-123 is not valid since investigation IDs are 21 characters returned by start-investigation. Nearly every Detective command also needs —graph-arn, and polling ends when Status leaves RUNNING.”

Q1827: How do you implement Audit Manager Evidence Retainer?

What it is: Audit Manager evidence retention is a fixed two-year deletion policy rather than a configurable setting, with a separate deregistration policy for disposal.

Why it is used: Gives a defensible retention story for compliance — you know exactly what evidence survives until assessment time.

# Configure
aws auditmanager update-settings \
  --default-assessment-owner owner

Interview talking point: “There is no —evidence-retention-period flag; evidence is simply deleted two years after collection. The doc’s —default-assessment-owner is wrong — the real flag is —default-process-owners — and —deregistration-policy with deleteResources ALL purges everything within seven days of deregistration.”

Q1828: How do you use Control Tower Audit Notifications?

What it is: Control Tower audit notifications come from the pre-provisioned aws-controltower-AggregateSecurityNotifications SNS topic in the audit account plus EventBridge rules on source aws.controltower.

Why it is used: Tells the security team about guardrail breaches, account lifecycle events, and landing-zone drift instead of hiding them in the console.

# Configure SNS
aws controltower create-landing-zone \
  --manifest file://manifest.json

Interview talking point: “create-landing-zone —manifest sets up the landing zone, not notifications. Guardrail alerts flow through the AggregateSecurityNotifications topic in the audit account, while landing zone 4.0+ drift arrives as EventBridge detail-type Drift Detected in the management account.”

Q1829: How do you implement AWS Config Organization Aggregation?

What it is: AWS Config organization aggregation pairs put-aggregation-authorization in the source account with put-configuration-aggregator where the aggregator itself lives.

Why it is used: Pulls compliance state and resources from every account and region into a single dashboard.

# Authorize
aws configservice put-aggregation-authorization \
  --authorized-account-id 123456789012 \
  --authorized-region us-east-1

Interview talking point: “The authorization direction is the trap — put-aggregation-authorization runs in the source account with authorized-account-id set to the aggregator’s account. Organization aggregation needs the management or delegated admin account, and rules still evaluate per source account; the aggregator only reads.”

Q1830: How do you use CloudTrail Lake Event Data Stores?

What it is: CloudTrail Lake event data stores are scoped at creation with —advanced-event-selectors, lists of fieldSelectors filtering eventCategory, eventName, and resources.type.

Why it is used: Ingests only the events you will query, keeping ingestion quotas, cost, and query results focused.

# Create
aws cloudtrail create-event-data-store \
  --name my-eds \
  --event-data-store-advanced-event-selector '{
    "fieldSelectors": [{"field":"eventCategory","equals":["Data"]}]
  }'

Interview talking point: “The flag is —advanced-event-selectors as a list; the doc’s singular event-data-store-advanced-event-selector does not exist. Selectors are fixed at creation with no update flag, and put-event-data-store-access-policy grants other accounts query access to the store.”

Q1831: How do you implement VPC Subnet IPv6 CIDR?

What it is: Subnet IPv6 addressing associates a /64 from the VPC’s Amazon-provided /56, using associate-vpc-cidr-block then associate-subnet-cidr-block or create-subnet —ipv6-cidr-block.

Why it is used: Gives subnets global IPv6 reachability for dual-stack or IPv6-only tiers without redesigning the network.

# Allocate
aws ec2 allocate-address \
  --domain vpc

Interview talking point: “allocate-address —domain vpc is an Elastic IP command, not subnet addressing. You associate a /56 to the VPC first, then carve /64s for subnets — the ordering matters — and do not forget the ::/0 routes and IPv6 security group rules.”

Q1832: How do you use Direct Connect Lag Encryption?

What it is: Direct Connect MACsec encryption is set per dedicated connection with encryption-mode values no_encrypt, should_encrypt, or must_encrypt plus a CKN/CAK key pair.

Why it is used: Encrypts the physical DX link at layer two with no IPsec or VPN configuration on the virtual interfaces.

# Enable
aws directconnect create-lag \
  --lag-name my-lag \
  --number-of-connections 2 \
  --location EqDC2 \
  --encryption-mode "aes_256"

Interview talking point: “The doc’s create-lag with encryption-mode aes_256 is wrong twice — aes_256 is not a valid mode, and MACsec lives on the connection via create-connection or update-connection, not on the LAG. Keys are CKN/CAK pairs in Secrets Manager via associate-mac-sec-key.”

Q1833: How do you implement Route 53 Traffic Policy Instances?

What it is: A Route 53 traffic policy is a versioned rules document; an instance applies that policy and a pinned version to a record name in a hosted zone.

Why it is used: Applies weighted, latency, or geo routing to many names without hand-editing individual records.

# Create
aws route53 create-traffic-policy-instance \
  --hosted-zone-id Z123 \
  --name example.com \
  --traffic-policy-id policy-id \
  --traffic-policy-version 1

Interview talking point: “The doc’s policy-id is the traffic policy ID — update, get, and delete take the instance ID instead, a classic mix-up. Policies are immutable and versioned so instances pin a version, and you must delete instances before the policy itself can be deleted.”

Q1834: How do you use CloudFront Continuous Deployment?

What it is: CloudFront continuous deployment uses a policy linking the production distribution to a staging distribution, with weighted or header-based traffic configuration.

Why it is used: Canaries a real config change against live production traffic before full promotion, with no DNS swap involved.

# Create staging distribution
aws cloudfront create-distribution \
  --staging

Interview talking point: “There is no —staging flag on create-distribution — you create a normal staging distribution, then create-continuous-deployment-policy and attach it through ContinuousDeploymentPolicyId in update-distribution. Detach the policy from the distribution before you can delete it.”

Q1835: How do you implement S3 Multi-Region Access Point Failover?

What it is: An S3 Multi-Region Access Point gives one global endpoint routing to buckets in several regions, with a traffic dial per bucket.

Why it is used: Fails traffic away from a degraded region by dialing that bucket to zero, with no client or DNS changes.

# Configure
aws s3control create-multi-region-access-point \
  --region us-east-1 \
  --bucket my-bucket

Interview talking point: “The doc’s create-multi-region-access-point with —region and —bucket is malformed — the command takes —account-id and —details with a Regions array of bucket ARNs. Failover is a separate API: submit-multi-region-access-point-routes with TrafficDialPercentage 0 on the failing region.”

Q1836: How do you use Lambda Function URL Auth Type?

What it is: Lambda function URL auth-type is either NONE for public access or AWS_IAM requiring SigV4 signing on every incoming request.

Why it is used: Controls who can invoke the public HTTPS endpoint — signed machine calls versus genuinely public webhooks.

# Create with IAM auth
aws lambda put-function-url-config \
  --function-name my-function \
  --auth-type AWS_IAM

Interview talking point: “auth-type accepts only NONE or AWS_IAM, and AWS_IAM also needs the resource policy to allow lambda:InvokeFunctionUrl. Switching from NONE breaks unsigned clients, and IAM auth gates identity rather than attack traffic, so rate limiting still needs CloudFront or WAF.”

Q1837: How do you implement ECS Fargate IPC Mode?

What it is: ECS ipcMode and pidMode set task-level namespaces: task shares IPC or process namespaces across a task’s containers, host shares the EC2 host’s.

Why it is used: Lets sibling containers share memory segments and signal each other while staying isolated from other tasks.

{
  "ipcMode": "task"
}

Interview talking point: “Fargate allows ipcMode task or none and pidMode task — host mode fails validation because it is EC2-only. These are Linux-only and separate from networking: Fargate still requires awsvpc regardless of the namespace modes.”

Q1838: How do you use EKS Windows Container Support?

What it is: EKS Windows support runs Windows Server containers through node groups with ami-type enums such as WINDOWS_CORE_2022 or WINDOWS_FULL_2022.

Why it is used: Hosts legacy .NET and IIS workloads on the same EKS control plane as Linux nodes.

# `--ami-type` takes enum constants (WINDOWS_CORE_2022 etc.), not an AMI
# name -- and --node-role-arn/--subnets are required on create-nodegroup:
aws eks create-nodegroup \
  --cluster-name my-cluster \
  --nodegroup-name windows \
  --ami-type WINDOWS_CORE_2022 \
  --instance-types '["m5.large"]' \
  --node-role-arn arn:aws:iam::123456789012:role/eks-nodegroup \
  --subnets '["subnet-abc","subnet-def"]'

Interview talking point: “—ami-type takes enum constants like WINDOWS_CORE_2022, not the long Windows_Server-2022 AMI name string from the doc. Linux node groups must still run the cluster add-ons, and Windows container images must match the host OS version or they fail to start.”

Q1839: How do you implement CloudFormation Drift Status?

What it is: CloudFormation drift detection is an explicit async flow: detect-stack-drift, poll describe-stack-drift-detection-status, then read describe-stack-resource-drifts.

Why it is used: Finds manual edits that diverged from the template so drift is flagged rather than lost silently.

# Check
aws cloudformation describe-stacks \
  --stack-name my-stack \
  --query "Stacks[0].DriftInformation"

Interview talking point: “describe-stacks only reads the stored flag — detect-stack-drift triggers the actual check. Per-resource results show MODIFIED, DELETED, or CHECK_FAILED with expected-versus-actual property diffs, and drift is purely informational: it never blocks an update or delete.”

Q1840: How do you use CDK Asset Publishing?

What it is: CDK asset publishing uploads file assets to a bootstrap S3 bucket and Docker assets to an ECR repository, keyed by content hash.

Why it is used: Gets Lambda code and container images into the account before CloudFormation deploys the referencing template.

# Publish
cdk publish

Interview talking point: “cdk publish is not a real CDK command — the verbs are ls, synth, bootstrap, deploy, diff, and import. Assets are published inside cdk deploy, after cdk bootstrap creates the S3 bucket and ECR repo once per account and region.”

Q1841: How do you implement SAM Package Include?

What it is: sam package uploads artifacts referenced by a template’s CodeUri or ImageUri to S3 or ECR and rewrites the template to those locations.

Why it is used: Stages built function code so CloudFormation deploys references to real objects instead of local paths.

# Include files
sam package --template-file template.yaml --output-template packaged.yaml --include "function.zip"

Interview talking point: “There is no —include flag on sam package — artifact selection comes from the template’s CodeUri, and the output flag is —output-template-file, not —output-template. Packaging without a prior sam build uploads raw source missing dependencies.”

Q1842: How do you use CodePipeline Deploy to Multiple Regions?

What it is: CodePipeline multi-region deploys use cross-region actions: each action declares a region and the pipeline lists an artifact store bucket per region.

Why it is used: Fans one build artifact out to stacks in several regions without duplicating the whole pipeline.

# Configure action
aws codepipeline create-pipeline \
  --region us-west-2

Interview talking point: “create-pipeline —region just places the pipeline — it does not deploy anywhere. Real multi-region needs an action-level region field plus a matching S3 bucket in artifactStores for each target region; CodePipeline copies artifacts there before running the action.”

Q1843: How do you implement CodeBuild Cache Modes?

What it is: CodeBuild cache configuration splits between project-level S3 cache set with the —cache flag and buildspec LOCAL modes plus paths.

Why it is used: Reuses dependencies across builds to cut build time, either persistently in S3 or fast on the runner.

cache:
  type: S3
  bucket: my-bucket

Interview talking point: “The doc’s buildspec cache bucket key is wrong — the S3 location is a project property set with create-project —cache type S3 and location bucket/prefix, while the buildspec only holds paths and LOCAL modes such as LOCAL_DOCKER_LAYER_CACHE.”

Q1844: How do you use CodeDeploy Blue-Green Traffic Routing?

What it is: CodeDeploy blue/green routing is configured on the deployment group with deploymentType BLUE_GREEN and deploymentOption WITH_TRAFFIC_CONTROL plus a load balancer.

Why it is used: Deploys to a green fleet while blue keeps serving, then shifts traffic and terminates blue on success.

# Configure
aws codedeploy create-deployment \
  --deployment-config-name CodeDeployDefault.AllAtOnce

Interview talking point: “create-deployment with a config name just triggers a run — blue/green belongs to create-deployment-group, and without WITH_TRAFFIC_CONTROL and a load balancer there is no gradual routing. The sub-config controls the ready timeout and whether blue is terminated or kept alive.”

Q1845: How do you implement CloudWatch Logs Retention Policy?

What it is: CloudWatch Logs retention sets a per-log-group expiry with put-retention-policy using only documented enum day values, or 0 for never expire.

Why it is used: Caps log storage cost, since Lambda and ECS groups grow unbounded by default.

# Set
aws logs put-retention-policy \
  --log-group-name /aws/lambda/my-function \
  --retention-in-days 7

Interview talking point: “Retention only accepts enum values like 7, 30, or 365 — not arbitrary numbers — and 0 means never expire, which is the default. delete-retention-policy reverts to that, and retention deletes only the CloudWatch copy, never your S3 exports.”

Q1846: How do you use X-Ray Trace ID Format?

What it is: An X-Ray trace ID is 35 characters: version 1-, eight hex digits of epoch seconds, and 24 hex digits of uniqueness.

Why it is used: Correlates logs, headers, and traces when following one request across services.

# Format: 1-57595e98-42ddef02e6a596924e4d680c-Root=1-57595e98-42ddef02e6a596924e4d680c

Interview talking point: “The doc putting Root= inside the ID is a conflation — the trace ID is just 1- then 8 hex seconds then 24 hex, while Root, Parent, and Sampled belong to the X-Amzn-Trace-Id header. Sampled=0 means the trace propagates but is not recorded.”

Q1847: How do you implement Systems Manager Session Recording?

What it is: Session Manager recording is configured by a Session Preferences document of type Session declaring S3 and CloudWatch destinations plus encryption and timeouts.

Why it is used: Captures every session’s keystrokes and output for compliance and post-incident review.

# Enable
aws ssm update-service-setting \
  --setting-id arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/session \
  --setting-value enabled

Interview talking point: “The doc’s update-service-setting with a servicesetting/ssm/parameter-store/session ID points at the wrong surface — recording comes from a Session document with s3BucketName and cloudWatchLogGroupName inputs. That same document carries idleSessionTimeout, maxSessionDuration, and runAsEnabled.”

Q1848: How do you use Secrets Manager Tags Rotation?

What it is: Secrets Manager tag-resource only attaches metadata tags; rotation is enabled separately with rotate-secret, a rotation Lambda, and rotation rules.

Why it is used: Labels secrets for cost and inventory while scheduling actual credential rotation on its own.

# Configure
aws secretsmanager tag-resource \
  --secret-id my-secret \
  --tags Key=rotation,Value=automatic

Interview talking point: “tag-resource does not enable rotation — it is just metadata. Rotation only happens through rotate-secret with a Lambda and AutomaticallyAfterDays; teams use tags as an automation pointer, and describe-secret’s RotationEnabled reveals the real state.”

Q1849: How do you implement IAM Policy Conditions?

What it is: IAM policy conditions scope statements with a Condition block of operator, key, and value triples, using typed operators like StringEquals, IpAddress, and Bool.

Why it is used: Turns static allow rules into contextual ones — region limits, office IPs, or fresh MFA requirements.

{
  "Condition": {
    "StringEquals": {"aws:RequestedRegion": ["us-east-1", "us-west-2"]}
  }
}

Interview talking point: “The operator must match the key’s type — IpAddress for IPs, NumericEquals for numbers — and values in an array are OR while separate keys are AND. aws:RequestedRegion is often absent on global services like IAM, so StringEquals never matches there.”

Q1850: How do you use KMS Key Deletion Wait Period?

What it is: KMS schedule-key-deletion puts a key into PendingDeletion with a pending window of 7 to 30 days, defaulting to 30.

Why it is used: Makes key destruction deliberate and reversible, so a mistaken schedule on a production key can be rescued.

# Configure
aws kms schedule-key-deletion \
  --key-id key-id \
  --pending-window-in-days 7

Interview talking point: “The window must be 7 to 30 days or the call fails validation, and the key becomes unusable the moment it is scheduled. cancel-key-deletion restores it during that window, but after deletion all ciphertext under that key is unrecoverable.”

Q1851: How do you implement GuardDuty EC2 Malware Protection?

What it is: GuardDuty agentless malware scanning of EC2 instances via EBS volume snapshots, publishing findings with instance and volume context.

Why it is used: Catches crypto-miners and backdoors in running instances without installing any agent on the box.

# Enable
aws guardduty update-detector \
  --detector-id detector-id \
  --features '[{"Name":"EC2_MALWARE_PROTECTION","Status":"ENABLED"}]'

Interview talking point: “update-detector validates the enum, so the real feature name is EBS_MALWARE_PROTECTION, not EC2_MALWARE_PROTECTION; scanning is snapshot-based and agentless, with —scan-frequency setting the recurring cadence.”

Q1852: How do you use Security Hub Finding Workflow?

What it is: Security Hub triage that moves a finding through NEW, NOTIFIED, SUPPRESSED, or RESOLVED, plus notes and record state.

Why it is used: Lets analysts mark findings fixed or noisy while keeping the evidence and audit trail intact.

# Update status
aws securityhub batch-update-findings \
  --finding-identifiers '[{"Id":"id","ProductArn":"arn"}]' \
  --workflow '{"Status":"RESOLVED"}'

Interview talking point: “batch-update-findings is real and RESOLVED is a valid workflow status; pair every status move with —note, and remember finding-identifiers needs both Id and ProductArn or the update silently no-ops.”

Q1853: How do you implement Macie Custom Data Identifiers?

What it is: Macie custom data identifiers define your own sensitive-data regexes, tuned with keywords, maximum match distance, and ignore words.

Why it is used: Detects company-specific identifiers like employee numbers that AWS’s managed patterns miss.

# Create
aws macie2 create-custom-data-identifier \
  --name "SSN" \
  --regex "\\b\\d{3}-\\d{2}-\\d{4}\\b"

Interview talking point: “create-custom-data-identifier is real but bare, so add —keywords, —maximum-match-distance, and —ignore-words for tuning, and remember identifiers only see data when a discovery job actually runs.”

Q1854: How do you use Detective Graph Visualization?

What it is: Detective’s behavioral graph, explored through investigations that scope an entity over a time window in the console.

Why it is used: Turns raw graph data into a presentable story of entity behaviors and relationships.

# Get
aws detective get-graph \
  --graph-arn graph-arn

Interview talking point: “get-graph only returns graph metadata; visualization lives in the console, while the API story is start-investigation and list-indicators. get-investigation takes only —graph-arn and —investigation-id, not an —include-events flag.”

Q1855: How do you implement Audit Manager Evidence Collection?

What it is: Audit Manager assessments gather compliance evidence from framework control data sources into per-control evidence folders.

Why it is used: Proves control assertions with artifacts reviewers can sign off, instead of screenshots.

# Configure automated collection
aws auditmanager create-assessment \
  --name my-assessment \
  --scope '{\"awsAccounts\":[{\"id\":\"123456789012\"}]}'

Interview talking point: “create-assessment is real but under-specified: it requires —assessment-reports-destination and —roles, and automated evidence only flows when you pass —framework-id so controls inherit their data sources.”

Q1856: How do you use Control Tower Guardrail Enforcement?

What it is: Control Tower applies preventive and detective controls to OUs; preventive controls become SCPs, detective controls become Config rules.

Why it is used: Enforces a policy posture accounts cannot bypass, with drift visibility for detective controls.

# Enable
aws controltower enable-guardrail \
  --guardrail-identifier arn

Interview talking point: “enable-guardrail does not exist; the API uses enable-control with a Control Catalog control ARN and a target OU ARN, then you poll get-control-operation until it succeeds.”

Q1857: How do you implement AWS Config Aggregator Filters?

What it is: Config aggregators collect compliance data from chosen accounts and regions; select-aggregate-resource-config runs SQL queries over that inventory.

Why it is used: Scopes compliance data by territory so queries return faster and dashboards stay free of noise.

# Filter
aws configservice select-aggregate-resource-config \
  --expression "SELECT * WHERE resourceType = 'AWS::S3::Bucket'"

Interview talking point: “select-aggregate-resource-config only queries existing aggregated data; the filter lives in put-configuration-aggregator’s account-aggregation-sources, and cross-account data requires put-aggregation-authorization before anything flows.”

Q1858: How do you use CloudTrail Insights Event Analysis?

What it is: CloudTrail Insights baselines your account’s API activity and flags anomalies in call volume or error rates.

Why it is used: Catches behavior static trails miss, like bursts of failed AssumeRole or RunInstances storms.

# Enable
aws cloudtrail update-trail \
  --name my-trail \
  --enable-insight-selectors

Interview talking point: “update-trail has no —enable-insight-selectors flag; that flag is fabricated. Insights are configured with put-insight-selectors using ApiCallRateInsight or ApiErrorRateInsight, and read back with get-insight-selectors.”

Q1859: How do you implement VPC Flow Logs Partitioning?

What it is: S3-bound flow logs get Hive-compatible hourly partitions and parquet format for cheap Athena queries.

Why it is used: Partition pruning and columnar compression shrink scanned bytes, so flow-log SQL costs drop dramatically.

# Configure partition
aws logs put-log-group-resource-policy \
  --policy-name my-policy \
  --policy-document '{"Statement":[{"Effect":"Allow","Principal":{"Service":"delivery.logs.amazonaws.com"}}]}'

Interview talking point: “put-log-group-resource-policy is a CloudWatch Logs authorization verb, not a partition knob; S3 partitioning rides on create-flow-logs —destination-options with FileFormat, HiveCompatiblePartitions, and PerHourPartition.”

Q1860: How do you use Transit Gateway Route Propagation?

What it is: Transit Gateway route propagation copies an attachment’s announced prefixes into a TGW route table automatically.

Why it is used: Makes networks reachable across the hub without hand-writing routes for every attachment.

# Enable
aws ec2 enable-vgw-route-propagation \
  --route-table-id rtb-123 \
  --gateway-id vgw-123

Interview talking point: “enable-vgw-route-propagation is the classic VPN gateway verb; TGW uses enable-transit-gateway-route-table-propagation with the route table ID and attachment ID, and static routes take precedence over propagated ones.”

Q1861: How do you implement Direct Connect Gateway Route Filter?

What it is: DX gateway associations carry allowed prefix lists that constrain which CIDRs advertise across the connection.

Why it is used: Keeps on-prem routes tight, preventing stray-route propagation and oversized routing tables in either direction.

# `--amazon-side-asn` doesn't exist (telemetry toggles with --enable/--no-enable);
# route filtering = allowed prefixes on the gateway ASSOCIATION:
aws directconnect update-direct-connect-gateway-association \
  --association-id dxga-fgbt4abc \
  --add-allowed-prefixes-to-direct-connect-gateway '[{"cidr":"10.10.0.0/16"}]'

Interview talking point: “update-virtual-interface-telemetry exists but has no —amazon-side-asn flag; that flag is fabricated. Route filtering happens through update-direct-connect-gateway-association with —add-allowed-prefixes-to-direct-connect-gateway, verified via describe-direct-connect-gateway-associations.”

Q1862: How do you use Route 53 Health Checkers Count?

What it is: Route 53 runs a fixed distributed fleet of health checkers; you tune thresholds and intervals, not the count.

Why it is used: The fleet’s geographic diversity makes single-zone failures tolerable while you tune failure sensitivity.

# Configure
aws route53 create-health-check \
  --health-check-config '{"Type":"CLOUDWATCH_METRIC","CloudWatchAlarmConfiguration":{"MetricName":"HealthCheck"}}'

Interview talking point: “The checker count is not a setting; Route 53 decides the fleet. The real knobs are FailureThreshold, RequestInterval, and health-check-regions, and CLOUDWATCH_METRIC config needs Namespace, Statistic, Period, Threshold, and ComparisonOperator, not just MetricName.”

Q1863: How do you implement CloudFront Origin Request Policy?

What it is: An origin request policy declares which headers, cookies, and query strings CloudFront forwards to the origin.

Why it is used: Keeps origins lean while preserving needed request context, decoupled from the cache key.

# Create
aws cloudfront create-origin-request-policy \
  --origin-request-policy-config '{
    "Name": "my-policy",
    "cookiesConfig": {"forward": "whitelist","cookies":["session"]}
  }'

Interview talking point: “create-origin-request-policy validates all three blocks, cookiesConfig, headersConfig, and queryStringsConfig, so cookies-only JSON fails; the cache policy sets the key, while the origin request policy sets what is actually sent.”

Q1864: How do you use S3 Access Point Policy Variables?

What it is: Access point policies use policy variables like version ID, username, or principal tags resolved at evaluation time.

Why it is used: One statement bends per request, covering many concrete values without writing one rule per object.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:accesspoint:my-ap/object/${s3:version-id}"
  }]
}

Interview talking point: ”${s3:version-id} is a real policy variable, but the resource must use the regional ARN arn:aws:s3:::accesspoint/, since the regionless form is deprecated.”

Q1865: How do you implement Lambda VPC Endpoints Configuration?

What it is: An interface endpoint for Lambda lets functions in private subnets reach the Lambda API without NAT.

Why it is used: Avoids the NAT gateway tax and keeps Lambda API traffic inside the VPC with tighter security groups.

# Create endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-123 \
  --service-name com.amazonaws.us-east-1.lambda \
  --vpc-endpoint-type Interface

Interview talking point: “create-vpc-endpoint for Lambda is real but incomplete: interface endpoints require —subnet-ids, plus —security-group-ids and typically —private-dns-enabled; sibling services are lambda.runtime and lambda.api.”

Q1866: How do you use ECS Service Discovery DNS Config?

What it is: ECS service discovery registers tasks in AWS Cloud Map so containers resolve each other through DNS names.

Why it is used: Lets clients find healthy endpoints by name as tasks scale, without hard-coded IPs.

# Configure
aws ecs create-service \
  --service-name my-service \
  --service-registries '[{"registryArn":"arn:aws:servicediscovery:service/srv"}]'

Interview talking point: “create-service —service-registries is only the last step; you must first create a private DNS namespace and a Cloud Map service with A or SRV records, and the service needs awsvpc networking.”

Q1867: How do you implement EKS OIDC Provider Setup?

What it is: Two OIDC surfaces: associate-identity-provider-config authenticates users to the cluster API, while the IAM OIDC provider enables IRSA for pods.

Why it is used: Conflating cluster authentication with pod IAM role assumption is a classic interview stumble.

# Create
aws eks associate-identity-provider-config \
  --cluster-name my-cluster \
  --oidc '{"identityProviderConfigName":"okta","issuerUrl":"https://issuer"}'

Interview talking point: “associate-identity-provider-config is real, but the —oidc block requires clientId, not just issuerUrl; IRSA is a separate resource, iam create-open-id-connect-provider against the cluster’s own issuer URL.”

Q1868: How do you use CloudFormation Change Set Preview?

What it is: Change sets dry-run a stack update, previewing which resources are added, modified, deleted, or replaced.

Why it is used: Shows the blast radius before execution so risky replacements are caught early.

# Preview
aws cloudformation create-change-set \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --change-set-type UPDATE \
  --no-execute-changeset

Interview talking point: “—no-execute-changeset does not exist, because create-change-set never executes; —change-set-name is also required. The flow is create-change-set, review with describe-change-set, then apply with execute-change-set.”

Q1869: How do you implement CDK Context Access?

What it is: CDK context reads deployment-time values via node.try_get_context with a fallback, or get_context which raises.

Why it is used: Keeps configuration out of code so one app deploys to dev and prod with different flags.

region = self.node.try_get_context("region") or "us-east-1"

Interview talking point: “try_get_context returns undefined and pairs with a fallback, while get_context raises when the key is missing; context is baked at synth time, with CLI -c flags overriding cdk.json.”

Q1870: How do you use SAM Local Invoke Events?

What it is: sam local invoke runs a Lambda handler in a local Docker container with a file or inline JSON event.

Why it is used: Gives a full test-and-debug loop in seconds without deploying anything to AWS.

sam local invoke MyFunction --event event.json

Interview talking point: “sam local invoke —event is exactly right; the flag accepts a file path or inline JSON, and the useful siblings are —env-vars, —debug-port, and sam local generate-event for building test payloads.”

Q1871: How do you implement CodePipeline Manual Approval Timeout?

What it is: Manual approval actions hold a pipeline for a reviewer decision, bounded by a timeoutInMinutes property on the action.

Why it is used: Keeps gates from stalling pipelines for the default seven days while stale reviews fail the stage.

# Configure
aws codepipeline put-approval-result \
  --pipeline-name my-pipeline \
  --stage-name Deploy \
  --action-name Approval \
  --result Approved

Interview talking point: “put-approval-result only records the decision and requires —token from get-pipeline-state; the timeout is the action’s timeoutInMinutes field, default seven days, range one to 43200 minutes, declared in the pipeline JSON.”

Q1872: How do you use CodeBuild Pull Request Builds?

What it is: CodeBuild runs builds on pull requests through project-level GitHub webhook filters with event and ref patterns.

Why it is used: Gives reviewers a green or red signal on the diff without building every push.

triggers:
  pull_request:
    branches:
      include:
        - main

Interview talking point: “The buildspec triggers block does not drive GitHub PR builds; that is the legacy self-hosted surface. GitHub PR automation lives at project level via create-project —webhook and —webhook-filter with EVENT and BASE_REF patterns.”

Q1873: How do you implement CodeDeploy AppSpec Environments?

What it is: AppSpec files differ per compute plane: files and hooks for EC2, Resources with alias for Lambda, TargetService for ECS.

Why it is used: Speaks each deployment target’s dialect; the wrong shape fails validation before any instance is contacted.

version: 0.0
os: linux
Resources:
  - Target:
      Location: /var/www/html

Interview talking point: “Resources with Target and Location is not valid for any flavor; EC2 deployments use a files block with source and destination, Lambda uses Resources with function name and alias, and ECS uses TargetService.”

Q1874: How do you use CloudWatch Embedded Metrics Format?

What it is: Embedded Metrics Format is a single line of JSON written to logs that CloudWatch parses into metrics.

Why it is used: One log line carries metrics and context together, so no extra PutMetricData API calls are needed.

def handler(event, context):
    return {
        "_aws": {"CloudWatchMetrics": [{"Namespace": "MyApp"}]},
        "metric": 100
    }

Interview talking point: “The JSON shape is right but delivery is wrong; EMF lines must be printed to stdout, not returned from the handler, and the _aws block needs Timestamp, Dimensions key names, and Metrics with Name and Unit.”

Q1875: How do you implement X-Ray Sampling Rules Priority?

What it is: X-Ray sampling rules order by priority, where lower numbers win, with a reservoir kept before fixed-rate sampling.

Why it is used: Keeps trace volume within budget while guaranteeing the traces you care about still get captured.

{
  "Rules": [{
    "RuleName": "priority",
    "Priority": 1,
    "FixedRate": 0.5
  }]
}

Interview talking point: “The three-field rule is a fragment; put-sampling-rule requires ServiceName, ServiceType, Host, HTTPMethod, URLPath, and ResourceARN plus ReservoirSize. Lower priority numbers are evaluated first, with the default rule at 10000.”

Q1876: How do you use Systems Manager Documents JSON?

What it is: SSM documents declare executable automation steps in JSON, using schemaVersion 2.2 with a mainSteps array of actions.

Why it is used: The schema defines the grammar the SSM agent executes, so correct action names keep documents portable.

{
  "schemaVersion": "2.2",
  "mainSteps": [{
    "action": "aws:runCommand",
    "name": "RunCommand",
    "inputs": {"commands": ["echo hello"]}
  }]
}

Interview talking point: “aws:runCommand is not a valid schema 2.2 action; the shell runners are aws:runShellScript and aws:runPowerShellScript, and inputs.runCommand must be an array of strings, not a bare string.”

Q1877: How do you implement Secrets Manager Replica Secret?

What it is: Replica secrets copy a secret to other regions for local reads, while updates stay on the primary.

Why it is used: Serves secrets close to regional workloads for lower latency without global round trips.

# Replicate
aws secretsmanager replicate-secret-to-regions \
  --secret-id my-secret \
  --add-replica-regions Region=us-west-2

Interview talking point: “replicate-secret-to-regions is correct; each replica takes its own KmsKeyId, and replication fails if the name exists unless you pass —force-overwrite-replica-secret. There is no promote-replica verb, so failover happens at the app layer.”

Q1878: How do you use IAM Policy Simulation API?

What it is: The IAM policy simulator evaluates a principal’s policies against actions, resources, and condition context before production.

Why it is used: Proves a policy behaves as designed and explains why an action was denied.

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123:user/john \
  --action-names "s3:GetObject"

Interview talking point: “simulate-principal-policy is real, but s3 actions need —resource-arns or results misleadingly show notApplicable; read the four EvalDecision values, allowed, explicitDeny, implicitDeny, notApplicable, where explicitDeny always beats allowed.”

Q1879: How do you implement KMS External Key Store?

What it is: An external key store keeps key material in your own HSM appliance while exposing the standard KMS API.

Why it is used: Satisfies key-sovereignty requirements where key material must never live inside AWS.

# Create XKS
aws kms create-external-key-store \
  --xks-key-store-id my-xks \
  --key-artifact "encrypted-key" \
  --public-key "public-key"

Interview talking point: “The flags xks-key-store-id, key-artifact, and public-key are fabricated; create-external-key-store takes —external-key-store-name, —xks-proxy-uri-endpoint, and —xks-proxy-authentication-credential, then connect-custom-key-store before create-key —origin EXTERNAL_KEY_STORE works.”

Q1880: How do you use GuardDuty Cost Optimization Filters?

What it is: Finding criteria filter GuardDuty results by severity, service, and archived state for queries and suppression.

Why it is used: Restricts what you fetch and archive, cutting billable query volume and dashboard noise.

# get-findings takes --finding-ids, not criteria -- the filtered read is
# list-findings --finding-criteria (dotted keys + typed operators):
aws guardduty list-findings \
  --detector-id detector-id \
  --finding-criteria '{"Criterion":{"severity":{"GreaterThanOrEqual":5},"service.archived":{"Equals":["false"]}}}'

Interview talking point: “get-findings takes —finding-ids, not —finding-criteria; that verb is wrong. Criteria belong on list-findings, with a Criterion object using dotted keys like severity and service.archived plus typed operators, and create-filter then archives matches automatically.”

Q1881: How do you implement Security Hub Finding Aggregation?

What it is: Finding aggregation copies findings from linked regions into one home region for a single pane of glass.

Why it is used: Consolidates multi-region posture so dashboards and automations read one regional store.

# Create aggregator
aws securityhub create-finding-aggregator \
  --region-linking-mode INCLUDE_ALL

Interview talking point: “INCLUDE_ALL is not a valid region-linking mode; the enum accepts ALL_REGIONS, ALL_REGIONS_EXCEPT_SPECIFIED, or SPECIFIED_REGIONS, alongside —aggregation-region, and the API errors on an invalid mode.”

Q1882: How do you use Macie Auto-Enable for Organization?

What it is: Macie organization configuration auto-enables Macie in newly joined accounts and designates a delegated admin account.

Why it is used: Closes the new-account gap so sensitive-data discovery starts before data lands.

# Enable
aws macie2 enable-organization

Interview talking point: “macie2 enable-organization does not exist; the real verbs are update-organization-configuration —auto-enable for future accounts and enable-organization-admin-account for the delegated admin, while existing accounts still need enable-macie individually.”

Q1883: How do you implement Detective Investigation Export?

What it is: Detective investigations scope an entity over a time window, with indicators gathered as the evidence trail.

Why it is used: Packages evidence for reporting instead of screenshots, feeding indicators into your own pipeline.

# Export
aws detective create-investigation \
  --graph-arn graph-arn \
  --title "Export"

Interview talking point: “create-investigation has no —title flag; it takes —entity-arn, —scope-start-time, and —scope-end-time with a window capped at 180 days. There is no export verb: the console exports CSV or PDF, and the API path is list-indicators.”

Q1884: How do you use Audit Manager Automated Evidence?

What it is: Automated evidence is collected from framework-mapped data sources like Config rules, CloudTrail, and Security Hub.

Why it is used: Keeps assessments continuously current so reviewers find ready artifacts instead of quarterly scrambles.

# Configure
aws auditmanager create-assessment \
  --name my-assessment

Interview talking point: “create-assessment with just —name collects nothing; it requires —scope, —assessment-reports-destination, and —roles, and automated evidence only flows when —framework-id wires in the controls’ data sources.”

Q1885: How do you implement Control Tower Organization Events?

What it is: Control Tower landing zones emit organization events to EventBridge and an SNS topic for drift and guardrail activity.

Why it is used: Lets the security pipeline react to drift, guardrail failures, and account lifecycle events org-wide.

# `--logging-configuration` isn't a flag -- create-landing-zone takes
# --manifest-path + --version (logging lives inside the manifest):
aws controltower create-landing-zone \
  --manifest-path file://manifest.json \
  --version 3.3

Interview talking point: “—logging-configuration is not a flag; create-landing-zone takes —manifest-path and —version, with logging declared inside the manifest. Organization events surface through EventBridge source aws.controltower and the AggregateSecurityNotifications SNS topic.”

Q1886: How do you use AWS Config Conformance Pack Updates?

What it is: Conformance packs bundle compliance rules in one template, updated as a unit with optional parameter overrides.

Why it is used: Changes many rules in lockstep across accounts, like PCI or CIS baselines at scale.

# Update
aws configservice update-conformance-pack \
  --conformance-pack-name my-pack \
  --template-s3-uri s3://bucket/new-template.yaml

Interview talking point: “update-conformance-pack is real, so add —conformance-pack-input-parameters for overrides, but unlike CloudFormation change sets there is no preview: updates apply directly, so verify with describe-conformance-packs afterward.”

Q1887: How do you implement CloudTrail Organization Trail?

What it is: An organization trail logs management events from the management account and every member account into one bucket.

Why it is used: Audits the whole org with one trail, simplifying retention, analysis, and SIEM ingestion.

# Create
aws cloudtrail create-trail \
  --name my-trail \
  --is-organization-trail

Interview talking point: “create-trail with only —name and —is-organization-trail fails; —s3-bucket-name is mandatory, the bucket policy must allow cloudtrail.amazonaws.com from every member account, and you must call start-logging.”

Q1888: How do you use VPC Flow Logs to S3 Partitioning?

What it is: S3-bound flow logs gain parquet format and Hive-compatible hourly partitions through create-flow-logs destination options.

Why it is used: Makes flow-log analysis a cheap Athena query through partition pruning and columnar compression.

# Configure partition
aws ec2 create-flow-logs \
  --resource-type VPC \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs

Interview talking point: “cloud-watch-logs is a valid destination type but carries no partition options; S3 partitioning requires —log-destination-type s3 with an S3 ARN and —destination-options setting FileFormat, HiveCompatiblePartitions, and PerHourPartition.”

Q1889: How do you implement Transit Gateway Connect Peer?

What it is: TGW Connect peers create GRE tunnels over an existing transport attachment like Direct Connect or VPN.

Why it is used: Adds tunneling connectivity over existing circuits without laying new physical links.

# Create
aws ec2 create-transit-gateway-connect-peer \
  --transit-gateway-attachment-id tgw-attach \
  --peer-address 203.0.113.1

Interview talking point: “The command is real but incomplete; —inside-cidr-blocks is required for the GRE tunnel’s inside addressing, and the attachment must be a Connect attachment from create-transit-gateway-connect, not a plain VPC attachment.”

Q1890: How do you use Direct Connect Virtual Interface BGP MD5?

What it is: Direct Connect virtual interfaces support BGP MD5 authentication through an authKey set at VIF creation or on the peer.

Why it is used: Validates the BGP neighbor so routes are only accepted from the peer holding the shared secret.

# Set password
aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-123 \
  --vpn-gateway-id vpg-123 \
  --options '{"TunnelOptions":[{"TunnelInsideCidr":"169.254.0.0/30"}]}'

Interview talking point: “create-vpn-connection is a Site-to-Site VPN command, the wrong service entirely; DX BGP MD5 rides on create-private-virtual-interface’s authKey field or create-bgp-peer —auth-key, set identically on both ends.”

Q1891: How do you implement Route 53 Resolver Query Logs?

What it is: Resolver query log configs capture every DNS query made in a VPC, delivered to S3, CloudWatch Logs, or Firehose.

Why it is used: Provides DNS forensics for data exfiltration, split-horizon misrouting, and resolver-side outages.

# `--resolver-endpoint-id` isn't a parameter -- query logs need
# --destination-arn (S3/CW/Firehose) and bind VPCs:
aws route53 create-resolver-query-log-config \
  --name my-logs \
  --destination-arn arn:aws:s3:::dns-logs/us-east-1 \
  --associated-vpcs '["vpc-123"]'

Interview talking point: “—resolver-endpoint-id is not a real parameter; create-resolver-query-log-config takes —destination-arn and —associated-vpcs, then associate-resolver-query-log-config binds each VPC to the log config.”

Q1892: How do you use CloudFront Function Code?

What it is: CloudFront Functions run sub-millisecond JavaScript at the edge for header injection, URL rewrites, and geo blocking.

Why it is used: Cheaper and lower-latency than Lambda@Edge for simple viewer-request and viewer-response transforms.

function handler(event) {
  var request = event.request;
  request.headers['x-custom'] = { value: 'value' };
  return request;
}

Interview talking point: “The handler code is valid; headers must be objects like {value: “x”} and the request must be returned. Deployment still needs create-function, publish-function, then association in the cache behavior with an EventType.”

Q1893: How do you implement S3 Inventory Destination Config?

What it is: S3 inventory configurations periodically list every object’s metadata to a destination bucket as CSV, ORC, or Parquet.

Why it is used: Powers lifecycle tuning, cost analytics, and replication reconciliation without scanning the live bucket.

# Configure
aws s3api put-bucket-inventory-configuration \
  --bucket my-bucket \
  --id daily \
  --inventory-configuration '{
    "Destination": {"S3BucketDestination":{"Bucket":"arn:aws:s3:::dest"}}"
  }'

Interview talking point: “The verb is right but the JSON is broken; Destination, IncludedObjectVersions, and Schedule are all mandatory, and S3BucketDestination needs Format, a Bucket ARN, and Prefix or the config is rejected.”

Q1894: How do you use Lambda Destination Configuration?

What it is: Async invocation destinations route invocation records to Lambda, SQS, SNS, or EventBridge on success or failure.

Why it is used: Keeps event pipelines moving when a function fails, acting as a DLQ that is not a queue.

# Configure
aws lambda put-function-event-invoke-config \
  --function-name my-function \
  --destination-config '{"OnSuccess":{"Destination":"arn:aws:lambda:dest:function"}}'

Interview talking point: “put-function-event-invoke-config is correct; add —maximum-retry-attempts and —maximum-event-age-in-seconds on the same call, and note it only applies to asynchronous invocations, with four destination types supported.”

Q1895: How do you implement ECS Service Scheduling Strategy?

What it is: ECS services place tasks with REPLICA, which runs a desired count across the cluster, or DAEMON, one per instance.

Why it is used: Matches the placement model to the workload: scaled stateless tiers versus per-host infrastructure agents.

# Configure
aws ecs create-service \
  --scheduling-strategy DAEMON \
  --service-name my-service

Interview talking point: “The strategy and enum are real, but create-service requires —task-definition at minimum and REPLICA also needs —desired-count; DAEMON ignores desiredCount because the fleet size follows the cluster.”

Q1896: How do you use EKS Managed Node Group Update Strategy?

What it is: Managed node group updates roll instances onto a new AMI or Kubernetes version in controlled batches.

Why it is used: Upgrades the fleet without downtime, draining and replacing nodes so pods reschedule gracefully.

# Update
aws eks update-nodegroup-version \
  --cluster-name my-cluster \
  --nodegroup-name my-nodes

Interview talking point: “update-nodegroup-version is correct; pacing comes from —update-config with maxUnavailable or maxUnavailablePercentage, —force only overrides version-mismatch validation, and scaling changes belong to the sibling update-nodegroup-config.”

Q1897: How do you implement CloudFormation Stack Export?

What it is: Stack exports publish an output under a unique name that other stacks in the same region and account import.

Why it is used: Lets one team own topology while consumer stacks reference values without recreating resources.

Outputs:
  VPCId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VPC"

Interview talking point: “Export names must be unique per region and account and cannot change while imported; Fn::ImportValue goes in resource properties, not parameter defaults, and exports never cross accounts or regions.”

Q1898: How do you use CDK Nested Stacks?

What it is: NestedStack composes a child stack inside a parent, synthesizing and uploading the nested template as an asset.

Why it is used: Breaks large systems into reviewable units while keeping one deployment family and accessible outputs.

# Create nested stack
nested = CfnStack(
    self, "Nested",
    template_url="https://s3.amazonaws.com/templates/nested.yaml"
)

Interview talking point: “CfnStack with a manual template_url is a workable escape hatch, but the idiomatic construct is NestedStack from aws-cdk-lib, which handles the template asset, parameters, and outputs automatically.”

Q1899: How do you implement SAM Local Docker Networking?

What it is: sam local commands join the Lambda container to an existing Docker network so it reaches sibling containers.

Why it is used: Tests handlers against real local databases and queues exactly like production composition, minus the cloud.

sam local start-api --docker-network my-network

Interview talking point: “—docker-network is real, but the network must already exist via docker network create, and dependencies must run on that same network; then resolve them by container name, never localhost.”

Q1900: How do you use CodePipeline State Machine Integration?

What it is: CodePipeline can invoke a Step Functions state machine as an action, waiting for its execution to reach a terminal state.

Why it is used: Brings custom orchestration, such as validations and approvals, into the approval-ordered pipeline.

# Add action
aws codepipeline create-pipeline \
  --pipeline '{
    "stages": [{
      "name": "Deploy",
      "actions": [{
        "actionTypeId": {"category":"Deploy","owner":"AWS","provider":"StepFunctions"}
      }]
    }]
  }'

Interview talking point: “The action category is Invoke, not Deploy; Deploy belongs to ECS, CodeDeploy, and CloudFormation. The configuration keys are StateMachineArn, ExecutionNamePrefix, and Input, and the pipeline service role needs states:StartExecution.”

Q1901: How do you implement CodeBuild Pre-Build Commands?

What it is: CodeBuild pre_build phase runs dependency installs and auth before the build phase in a buildspec.yml.

Why it is used: Separates setup and credential work from compilation so build failures are cleanly attributable.

phases:
  pre_build:
    commands:
      - npm install

Interview talking point: “buildspec phase order is install then pre_build then build then post_build; pre_build is where npm install and ECR login (aws ecr get-login-password piped to docker login) happen, keeping credentials out of the build phase.”

Q1902: How do you use CodeDeploy Lifecycle Event Hooks?

What it is: CodeDeploy appspec hooks run shell scripts at named deployment events like BeforeInstall, AfterInstall, and ValidateService.

Why it is used: Lets you stop services, fix permissions, and validate readiness at the precise deployment phase.

hooks:
  BeforeInstall:
    - location: scripts/before_install.sh

Interview talking point: “The EC2 hook chain runs ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService; blue/green adds traffic hooks and Lambda has only BeforeAllowTraffic/AfterAllowTraffic. Hook exit codes decide the deployment, and timeout caps hangs.”

Q1903: How do you implement CloudWatch Custom Metrics Dashboard?

What it is: CloudWatch dashboard made of widgets (metric, alarm, text, log) that render custom and built-in metrics.

Why it is used: Puts team metrics in one pane and keeps dashboards repeatable as IaC via CDK or JSON.

dashboard = cloudwatch.Dashboard(
    self, "Dashboard",
    widgets=[
        [single_metric, single_metric]
    ]
)

Interview talking point: “put-dashboard takes a JSON body of widget rows and is idempotent by name; a widget over a namespace that never received PutMetricData or EMF data simply renders blank.”

Q1904: How do you use X-Ray Subsegment Closing?

What it is: X-Ray subsegments nest inside segments to show internal call timing; the Python SDK closes them with a context manager.

Why it is used: Names inner work like DB queries so each trace shows where the latency went.

with xray_recorder.subsegment('mysql'):
    # query
    pass

Interview talking point: “Use “with xray_recorder.subsegment(‘mysql’)” so it auto-closes even on exceptions; manual begin/end_subsegment needs try/finally or the segment leaks, and subsegments must close before their parent segment.”

Q1905: How do you implement Systems Manager Service Role?

What it is: Two distinct roles: an EC2 instance profile role trusting ec2.amazonaws.com, and an SSM service role trusting ssm.amazonaws.com.

Why it is used: Gives the agent and SSM automation separate least-privilege permissions instead of one over-broad role.

# Create role
aws iam create-role \
  --role-name ssm-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service":"ec2.amazonaws.com"},
      "Action":"sts:AssumeRole"
    }]
  }'

Interview talking point: “The doc’s ec2.amazonaws.com trust is only the instance side and still needs AmazonSSMManagedInstanceCore attached; SSM’s own service role trusts ssm.amazonaws.com, and the service-linked role AWSServiceRoleForAmazonSSM already exists by default.”

Q1906: How do you use Secrets Manager Secret Policy?

What it is: A resource policy attached to a secret via put-resource-policy, granting cross-account or role-level access to secret values.

Why it is used: Lets another account’s role read GetSecretValue without touching the owning account’s IAM users.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::123:root"},
    "Action": "secretsmanager:*",
    "Resource": "*"
  }]
}

Interview talking point: “Attach with put-resource-policy —secret-id —resource-policy; Principal cannot be ”*” and Condition blocks are unsupported. Access needs all three layers to pass: the secret policy, the caller’s identity policy, and the KMS key policy.”

Q1907: How do you implement IAM Role Session Tags?

What it is: Tags passed to sts assume-role that become the temporary session’s principal tags, usable in aws:PrincipalTag conditions.

Why it is used: Carries project and owner context onto temporary credentials so policies and audits can distinguish sessions.

client = boto3.client('sts')
response = client.assume_role(
    RoleArn='arn:aws:iam::123:role/my-role',
    RoleSessionName='session',
    Tags=[{'Key': 'project', 'Value': 'myapp'}]
)

Interview talking point: “—tags sets session tags and —transitive-tag-keys makes them survive chained assume-role calls; non-transitive tags vanish at the next hop, and the role’s trust policy must allow iam:TagSession.”

Q1908: How do you use KMS Key Deletion Schedule?

What it is: schedule-key-deletion puts a KMS key in PendingDeletion for a 7-30 day window before permanent destruction.

Why it is used: The pending window is an undo button, so a mistaken production-key deletion stays reversible.

# Schedule
aws kms schedule-key-deletion \
  --key-id key-id \
  --pending-window-in-days 7

Interview talking point: “—pending-window-in-days accepts 7-30 (default 30); the key stops encrypting and decrypting the moment you schedule, and cancel-key-deletion rescues it only within the window, after which ciphertext is unrecoverable.”

Q1909: How do you implement GuardDuty Auto-Enable New Accounts?

What it is: GuardDuty delegated admin plus auto-enable turns on detectors automatically for accounts that join the organization.

Why it is used: Prevents new accounts from sitting unmonitored between creation and security onboarding.

# Enable
aws guardduty enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “enable-organization-admin-account alone is only half the setup, pair it with update-organization-configuration —auto-enable; auto-enable covers future accounts only, so existing members still need create-members plus update-member-detectors.”

Q1910: How do you use Security Hub Cross-Region Aggregation?

What it is: Finding aggregator that copies findings from linked regions into one home region’s central store.

Why it is used: Consolidates company-wide findings so one export pipeline serves every region instead of N.

# Create
aws securityhub create-finding-aggregator \
  --region-linking-mode INCLUDE_ALL

Interview talking point: “INCLUDE_ALL is not a valid RegionLinkingMode, the enums are ALL_REGIONS, SPECIFIED_REGIONS, ALL_REGIONS_EXCEPT_SPECIFIED, so the real call is create-finding-aggregator —region-linking-mode ALL_REGIONS —aggregation-region us-east-1 (—regions for the SPECIFIED forms).”

Q1911: How do you implement Macie Organization Auto-Enable?

What it is: Macie org-wide enablement via update-organization-configuration —auto-enable plus a designated delegated admin account.

Why it is used: Switches Macie on the instant a new account joins, closing the un-scanned window.

# Enable
aws macie2 enable-organization

Interview talking point: ""aws macie2 enable-organization” does not exist, the real verbs are update-organization-configuration —auto-enable and enable-organization-admin-account —admin-account-id; existing members still need enable-macie, and discovery jobs do the actual scanning.”

Q1912: How do you use Detective Organization Data?

What it is: Detective delegated admin creates a graph spanning member accounts’ GuardDuty, CloudTrail, and flow-log data.

Why it is used: Lets investigators examine a finding in one account with other accounts’ behavioral context.

# Enable
aws detective enable-organization-admin-account \
  --admin-account-id admin-id

Interview talking point: “enable-organization-admin-account is correct and real; the admin then runs create-graph and members join via create-members/invite-members. The registered admin reads via organizations list-delegated-administrators —service-principal detective.amazonaws.com, since Detective has no admin-list verb of its own.”

Q1913: How do you implement Audit Manager Auto-Enable?

What it is: Audit Manager has no auto-enable; delegation happens through register-organization-admin-account for org-wide audit administration.

Why it is used: Lets a dedicated audit team run assessments org-wide while the management account keeps ownership.

# `enable-organization` is not an auditmanager command -- the org surface is
# register-organization-admin-account:
aws auditmanager register-organization-admin-account \
  --admin-account-id 123456789012

Interview talking point: ""aws auditmanager enable-organization” is fabricated, the real verb is register-organization-admin-account —admin-account-id (reverse: deregister-organization-admin-account), and org defaults like the report destination go through update-settings. There is no auto-enable for Audit Manager.”

Q1914: How do you use Control Tower OU Guardrail Status?

What it is: Reading which controls are enabled on an OU, with per-control status, parameters, and drift.

Why it is used: Proves the guardrail posture at audit time and flags controls stuck UNDER_CHANGE.

# `list-guardrails-for-ou` doesn't exist -- the real read is
# list-enabled-controls --target-identifier (the OU ARN, not an ou-123 id):
aws controltower list-enabled-controls \
  --target-identifier arn:aws:organizations::123456789012:ou/o-abc/ou-123

Interview talking point: “list-guardrails-for-ou —organizational-unit-id is fabricated and ou-123 ids are the old format; the real read is list-enabled-controls —target-identifier , reporting status ENABLED/DISABLED/UNDER_CHANGE, with get-control-operation for in-flight ops.”

Q1915: How do you implement AWS Config Multi-Account Aggregation?

What it is: Two-step cross-account Config aggregation: the source account authorizes, then the aggregator account pools accounts and regions.

Why it is used: Lets a security team run one aggregated query across every account’s Config inventory.

# Authorize
aws configservice put-aggregation-authorization \
  --authorized-account-id 123456789012

Interview talking point: “put-aggregation-authorization needs BOTH —authorized-account-id and the required —authorized-aws-region (it is region-scoped), then the aggregator calls put-configuration-aggregator with account-aggregation-sources; a missing authorization is the classic empty-aggregate symptom.”

Q1916: How do you use CloudTrail Organization Management Events?

What it is: update-trail flags —include-global-service-events and —is-organization-trail extend one trail to global services and all member accounts.

Why it is used: Guarantees IAM and STS activity plus every account’s management events land in one archive.

# Enable
aws cloudtrail update-trail \
  --name my-trail \
  --include-global-service-events \
  --is-organization-trail

Interview talking point: “Both flags are real; reverse them with —no-include-global-service-events and —no-is-organization-trail. The org trail also needs the bucket policy accepting every account’s PutObject, and usually pairs with —is-multi-region-trail.”

Q1917: How do you implement VPC Endpoint Policies?

What it is: A policy attached to a VPC endpoint that restricts what traffic through it can reach.

Why it is used: Narrows what instances inside the VPC can touch, limiting blast radius if one is compromised.

{
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::bucket/*"
  }]
}

Interview talking point: “The default endpoint policy is FullAccess, so attach one with create-vpc-endpoint —policy-document or modify-vpc-endpoint —policy-document. An endpoint policy cannot grant what the bucket policy or IAM denies, it is one gate of several.”

Q1918: How do you use Transit Gateway Route Table Propagation?

What it is: Association binds an attachment to a route table; propagation imports that attachment’s routes into the table.

Why it is used: Both are needed: association sets the traffic path, propagation supplies the routes.

# Enable
aws ec2 associate-transit-gateway-route-table \
  --transit-gateway-attachment-id tgw-attach \
  --transit-gateway-route-table-id rtb-123

Interview talking point: “The doc’s associate-transit-gateway-route-table is the ASSOCIATION verb, not propagation; propagation is enable-transit-gateway-route-table-propagation with the same attachment and table args. Static routes from create-transit-gateway-route beat propagated routes on match.”

Q1919: How do you implement Direct Connect Gateway Associations?

What it is: associate-virtual-interface links a virtual interface to a Direct Connect gateway, which then attaches to a VGW or TGW.

Why it is used: Lets multiple VIFs and accounts converge on one gateway namespace reaching VPCs and VPNs.

# The second flag is `--gateway-id` (dxgw-...), not --connection-id -- and the
# gateway must exist first (create-direct-connect-gateway):
aws directconnect associate-virtual-interface \
  --virtual-interface-id vif-123 \
  --gateway-id dxgw-yyy

Interview talking point: “The second flag is —gateway-id (dxgw-), not —connection-id, which belongs to create-connection. The gateway must exist first via create-direct-connect-gateway, and allowed-prefix filtering rides on the association.”

Q1920: How do you use Route 53 DNSSEC Signing?

What it is: DNSSEC signing backs a key signing key with a KMS key, then enables signing on the hosted zone.

Why it is used: Lets resolvers cryptographically verify answers so spoofed DNS responses fail validation.

# `--key-signing-key-algorithms` doesn't exist -- the KSK is backed by a KMS
# key (ECC_NIST_P256, us-east-1, principal dnssec-route53.amazonaws.com):
aws route53 create-key-signing-key \
  --caller-reference ref-1 \
  --hosted-zone-id Z123 \
  --name ksk \
  --key-management-service-arn arn:aws:kms:us-east-1:123456789012:key/abcd-1234 \
  --status ACTIVE

Interview talking point: “—key-signing-key-algorithms does not exist; use create-key-signing-key —caller-reference —key-management-service-arn with an ECC_NIST_P256 key in us-east-1 granting dnssec-route53.amazonaws.com, then enable-dnssec. No DS record at the registrar means SERVFAIL for validating resolvers.”

Q1921: How do you implement CloudFront Signed URL Policy?

What it is: Signed URLs restrict CloudFront access by an expiry, and signing happens locally with your private key.

Why it is used: Gives a URL a time window so a leaked link eventually stops working.

# boto3's cloudfront client has no generate_signing_url -- use botocore's
# CloudFrontSigner (or `aws cloudfront sign` on the CLI):
from botocore.signers import CloudFrontSigner
signer = CloudFrontSigner(key_pair_id, rsa_signer)
url = signer.generate_presigned_url(url, date_less_than=datetime.now() + timedelta(hours=1))

Interview talking point: “boto3’s cloudfront client has no generate_signing_url, use aws cloudfront sign (canned: —date-less-than or —duration; custom: —policy file://) or botocore’s CloudFrontSigner. The cache behavior must require signed URLs or the link stays public.”

Q1922: How do you use S3 Object Lock Legal Hold?

What it is: A legal hold pins one object version against deletion, with no expiry, until it is explicitly lifted.

Why it is used: Blocks deletion during litigation independently of retention-period clocks.

# Set
aws s3api put-object-legal-hold \
  --bucket my-bucket \
  --key file.txt \
  --legal-hold Status=ON

Interview talking point: “put-object-legal-hold requires —version-id (holds are version-scoped) and —legal-hold takes JSON {“Status”:“ON”}, the Status=ON shorthand is invalid. Object Lock must already be enabled on the bucket, and holds never expire.”

Q1923: How do you implement Lambda VPC Security Groups?

What it is: VpcConfig with SubnetIds and SecurityGroupIds attaches a Lambda function’s ENIs inside your VPC subnets.

Why it is used: Lets the function reach private resources like RDS without internet exposure.

# Configure
aws lambda create-function \
  --vpc-config '{
    "SubnetIds":["subnet-123"],
    "SecurityGroupIds":["sg-123"]
  }'

Interview talking point: “The —vpc-config shape is correct, but the execution role needs AWSLambdaVPCAccessExecutionRole for ENI permissions. VPC functions have no internet by default, so NAT or VPC endpoints are required; detach with empty arrays via update-function-configuration.”

Q1924: How do you use ECS Task Elastic Network Interface?

What it is: With networkMode awsvpc, ECS creates one ENI per task; subnets and SGs come from runtime awsvpcConfiguration.

Why it is used: Gives every task its own IP and security group, which Fargate requires.

{
  "networkMode": "awsvpc",
  "containerDefinitions": [{
    "name": "web",
    "networkInterfaces": [{"deviceIndex": 0}]
  }]
}

Interview talking point: “networkInterfaces inside containerDefinitions is fictional, that is an EC2 launch-config field and fails task-def registration. The task def only sets networkMode: awsvpc; wire subnets and SGs at run time with run-task/create-service —network-configuration ’{“awsvpcConfiguration”:…}’.”

Q1925: How do you implement EKS Fargate Profile Namespace?

What it is: A Fargate profile routes pods matching a namespace and labels onto serverless Fargate capacity.

Why it is used: Offloads selected namespaces to Fargate so node groups shrink to what Fargate cannot run.

# Create
aws eks create-fargate-profile \
  --cluster-name my-cluster \
  --fargate-profile-name my-profile \
  --selectors '[{"namespace":"default"}]'

Interview talking point: “create-fargate-profile is missing its required —pod-execution-role-arn, a role trusting eks-fargate-pods.amazonaws.com. One namespace can belong to only one profile, and kube-system can be selected only with label selectors.”

Q1926: How do you use CloudFormation Fn::ImportValue?

What it is: Fn::ImportValue pulls another stack’s exported Output into a resource property, in the same account and region.

Why it is used: Lets stacks wire together without hand-copying IDs between templates.

# Import
Resources:
  VPC:
    Type: AWS::EC2::VPC::Id
    DefaultFn::ImportValue: NetworkStack-VPCID

Interview talking point: “AWS::EC2::VPC::Id is a PARAMETER type, not a resource, and DefaultFn::ImportValue is not syntax; imports live in resource properties as VpcId: !ImportValue NetworkStack-VPCID, never in parameter Defaults, and both stacks must share account and region.”

Q1927: How do you implement CDK Cross-Account References?

What it is: Bucket.from_bucket_arn imports an existing bucket as a read-only IBucket reference without creating a resource.

Why it is used: Composes remote resources as typed objects while ownership stays with the source account.

# Reference
bucket = s3.Bucket.from_bucket_arn(
    self, "Bucket",
    bucket_arn="arn:aws:s3:::bucket"
)

Interview talking point: “from_bucket_arn is real and emits no AWS::S3::Bucket, and S3 ARNs are global (arn:aws:s3:::bucket, no region). The reference grants nothing itself, cross-account access needs grant_read_write plus the target account’s bucket policy.”

Q1928: How do you use SAM CLI Local Invoke Debug?

What it is: sam local invoke -d exposes the local container’s debug port so you can attach a debugger before deploying.

Why it is used: Surfaces logic errors in seconds instead of a full deploy cycle.

sam local invoke -d 5858

Interview talking point: “sam local invoke -d 5858 is real but you must name the function and pass —event event.json; the port speaks the runtime’s protocol (Python debugpy, Node V8 inspector, Java JDWP), and sam build runs first.”

Q1929: How do you implement CodePipeline Approval Token?

What it is: The approval token from get-pipeline-state binds a put-approval-result call to the current pipeline execution.

Why it is used: Prevents stale or out-of-band approvals from unblocking the wrong execution.

# get-pipeline-execution REQUIRES --pipeline-execution-id (the doc omits it)
# -- the id comes from list-pipeline-executions:
aws codepipeline get-pipeline-execution \
  --pipeline-name my-pipeline \
  --pipeline-execution-id <id>

Interview talking point: “get-pipeline-execution requires —pipeline-execution-id from list-pipeline-executions, name alone fails. The token comes from get-pipeline-state’s stageStates[].actionStates[].latestExecution.token, then put-approval-result submits it with status Approved or Rejected.”

Q1930: How do you use CodeBuild Build Status Notifications?

What it is: Build status alerts flow through EventBridge BUILD_STATE_CHANGED events or codestar-notifications create-notification-rule, not the buildspec.

Why it is used: Wakes the team on failed builds and enables automated remediation on state transitions.

notifications:
  rules:
    - events:
        - build.succeeded
      channels:
        - type: EMAIL

Interview talking point: “The buildspec has NO notifications block, that schema is version/env/phases/artifacts/cache/reports only. Use codestar-notifications create-notification-rule —resource —event-type-ids [“codebuild-project-build-state-failed”,…], and the SNS topic policy must accept codestar-notifications.amazonaws.com.”

Q1931: How do you implement CodeDeploy Deployment Groups?

What it is: A deployment group binds an application to a fleet (tags, ASGs, ECS services) plus a deployment strategy.

Why it is used: Gives create-deployment a ready-made target and failure-handling configuration.

# Create
aws codedeploy create-deployment-group \
  --application-name my-app \
  --deployment-group-name my-group

Interview talking point: “create-deployment-group requires —service-role-arn plus a fleet target, the two-arg call fails validation. EC2 groups use —ec2-tag-filters or —auto-scaling-groups; Lambda needs —deployment-style, ECS needs —ecs-services with —load-balancer-info.”

Q1932: How do you use CloudWatch Alarm Actions?

What it is: Alarm actions fire SNS, Auto Scaling, or EC2 stop/terminate/reboot/recover operations when an alarm changes state.

Why it is used: Turns metric breaches into paging, scaling, or self-healing without a human watching graphs.

# Configure
aws cloudwatch put-metric-alarm \
  --alarm-name my-alarm \
  --alarm-actions arn:aws:sns:region:account:topic

Interview talking point: “put-metric-alarm requires the full metric block, metric-name, namespace, statistic, period, evaluation-periods, threshold, comparison-operator; the 3-arg call fails. Actions also split into —alarm-actions, —ok-actions, and —insufficient-data-actions for the three states.”

Q1933: How do you implement X-Ray Context Propagation?

What it is: Context propagation hands the X-Amzn-Trace-Id header across services so one request stays a single trace.

Why it is used: Stitches service spans together so latency is traced to the exact downstream hop.

def handler(event, context):
    with xray_recorder.capture('my-subsegment'):
        call_service()

Interview talking point: “xray_recorder.capture(‘name’) only creates a subsegment; propagation is the X-Amzn-Trace-Id header via patched SDKs (patch_all), and in Lambda the _X_AMZN_TRACE_ID env var plus tracing Mode=Active resumes the trace.”

Q1934: How do you use Systems Manager Maintenance Window Targets?

What it is: Maintenance window targets declare which instances or resource groups a scheduled maintenance task runs against.

Why it is used: Pins scheduled maintenance to an exact fleet so tasks do not drift.

# Register
aws ssm register-target-with-maintenance-window \
  --window-id mw-123 \
  --targets '[{"Key":"instanceids","Values":["i-123"]}]'

Interview talking point: “register-target-with-maintenance-window requires —resource-type (INSTANCE or RESOURCE_GROUP), the doc omits it. Target keys are InstanceIds (canonical) or tag:Env; tasks then bind via register-task-with-maintenance-window using the returned target id.”

Q1935: How do you implement Secrets Manager Rotation Templates?

What it is: Rotation templates are AWS-managed Lambda functions implementing CreateSecret, SetSecret, TestSecret, FinishSecret for RDS, Redshift, DocumentDB.

Why it is used: Gives you the multi-step secret swap without writing the choreography yourself.

# Lambda rotation
def handler(event, context):
    # Get secret
    # Rotate
    pass

Interview talking point: “The blank handler stub does nothing, real wiring is rotate-secret —rotation-lambda-arn —rotation-rules ’{“AutomaticallyAfterDays”:30}’. The Lambda’s role needs GetSecretValue/PutSecretValue scoped to the secret’s -?????? ARN pattern plus KMS decrypt and encrypt.”

Q1936: How do you use IAM Policy Last Accessed Info?

What it is: Last-accessed data comes from an async pair: generate-service-last-accessed-details then get-service-last-accessed-details with a JobId.

Why it is used: Shows which services and actions a role actually used so permissions can be pruned with evidence.

# Get
aws iam get-policy-version \
  --policy-arn arn \
  --version-id v1

Interview talking point: “get-policy-version returns the policy JSON document, not usage; last-accessed is the generate/get-service-last-accessed-details job pair. Use —job-type ACTION_LEVEL for per-action timestamps, and a fresh principal takes about 4 hours to populate.”

Q1937: How do you implement KMS Key Usage Audit?

What it is: KMS usage is audited through CloudTrail, which records Decrypt, Encrypt, and GenerateDataKey calls as management events.

Why it is used: Gives a per-key trail of who used the key and lets you alert on failures.

# Enable logging
aws kms enable-key \
  --key-id key-id

Interview talking point: “aws kms enable-key just flips a disabled key to ENABLED, it is not an audit tool. Audit is cloudtrail lookup-events —lookup-attributes AttributeKey=ResourceName,AttributeValue=; KMS calls are default management events, no data-event enable needed.”

Q1938: How do you use GuardDuty Findings Export Config?

What it is: create-publishing-destination streams GuardDuty findings into your own S3 bucket for SIEM ingestion and retention.

Why it is used: Keeps findings outside the console for long-term storage and cross-account aggregation.

# Configure
aws guardduty create-publishing-destination \
  --detector-id detector-id \
  --destination-type S3

Interview talking point: “create-publishing-destination requires —destination-properties with both BucketArn and KmsKeyArn, the bare call fails. The bucket policy must allow guardduty.amazonaws.com PutObject, and S3 is the only destination type.”

Q1939: How do you implement Security Hub Compliance Standards?

What it is: Standards subscriptions (CIS, FSBP, PCI) run benchmark checks and produce the findings Security Hub ranks.

Why it is used: Benchmarks the account against globally recognized compliance frameworks.

# `enable-standards` doesn't exist and the ARN is garbled -- subscribe via
# batch-enable-standards (after enable-security-hub):
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[{"StandardsArn":"arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"}]'

Interview talking point: “enable-standards does not exist, use batch-enable-standards —standards-subscription-requests after enable-security-hub. The CIS ARN is arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0, the doc’s cis/v/ form is malformed; FSBP uses the region-qualified standards/ ARN.”

Q1940: How do you use Macie Discovery Job Scope?

What it is: A Macie discovery job scans chosen S3 buckets or prefix criteria for sensitive data, once or on a schedule.

Why it is used: Defines which buckets get scanned and how often, balancing coverage against cost.

# Create
aws macie2 create-discovery-job \
  --name my-job \
  --s3-job-definition '{
    "bucketDefinitions": [{"accountId":"123","buckets":["bucket"]}]
  }'

Interview talking point: “create-discovery-job requires —job-type (ONE_TIME or SCHEDULED) and —client-token, the doc omits both; SCHEDULED adds —schedule-frequency. Scope is bucketDefinitions (explicit) or bucketCriteria (includes/excludes by bucketNames and prefixes).”

Q1941: How do you implement Detective Investigation Findings?

What it is: Detective investigations return their evidence through list-indicators, keyed by graph ARN and investigation id.

Why it is used: Pulls the indicator items, GuardDuty hits, API events, flow records, that a case references.

# `detective get-findings` doesn't exist -- the read is list-indicators
# (get-findings --finding-ids belongs to GuardDuty):
aws detective list-indicators \
  --graph-arn graph-arn \
  --investigation-id inv-123

Interview talking point: ""aws detective get-findings” is fabricated, that is GuardDuty’s verb with —detector-id/—finding-ids. The Detective read is list-indicators —graph-arn —investigation-id, after create-investigation returns the id.”

Q1942: How do you use Audit Manager Assessment Evidence?

What it is: get-evidence fetches one evidence item and requires the full id chain: assessment, control set, folder, evidence.

Why it is used: Locates a specific artifact inside an assessment’s evidence hierarchy for audit response.

# Get evidence
aws auditmanager get-evidence \
  --assessment-id id

Interview talking point: “get-evidence requires all four ids, —assessment-id, —control-set-id, —evidence-folder-id, —evidence-id; a single —assessment-id fails. Browse first with list-evidence-folders then list-evidence before fetching one item.”

Q1943: How do you implement Control Tower Guardrail Details?

What it is: get-enabled-control reads one enabled control’s status, parameters, and drift for a target OU or account.

Why it is used: Justifies or debugs a single guardrail instead of listing every control.

# `describe-guardrail` doesn't exist -- the single-control read is
# get-enabled-control (target + control identifiers):
aws controltower get-enabled-control \
  --target-identifier arn:aws:organizations::123456789012:ou/o-abc/ou-123 \
  --control-identifier arn:aws:controlcatalog:::control/abc-123

Interview talking point: “describe-guardrail is fabricated, guardrail is legacy console vocabulary and the API is control-*: get-enabled-control —target-identifier —control-identifier , paired with get-control-operation when status is UNDER_CHANGE.”

Q1944: How do you use AWS Config Resource Timeline?

What it is: get-resource-config-history replays every recorded configuration change for one resource, in order.

Why it is used: Provides the change forensics and drift review trail for a resource.

# `get-resource-timeline` doesn't exist -- the history read is
# get-resource-config-history (the resource id is required):
aws configservice get-resource-config-history \
  --resource-type AWS::EC2::Instance \
  --resource-id i-123

Interview talking point: “get-resource-timeline does not exist, the real read is get-resource-config-history —resource-type —resource-id, and the doc also omits the resource id. The console’s Resource timeline tab is this API, and history requires the recorder to have been running.”

Q1945: How do you implement CloudTrail Event History Filters?

What it is: lookup-events searches CloudTrail’s 90-day rolling event history by one of eight attribute keys.

Why it is used: Enables quick incident triage without the S3 and Athena trail pipeline.

# Lookup
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=ec2

Interview talking point: “The EventSource value must be the full domain, ec2.amazonaws.com, not bare ec2. Add —start-time/—end-time, only one LookupAttributes entry per call, and —event-category insight for insight events; older than 90 days needs Athena.”

Q1946: How do you use VPC Flow Logs Log Format?

What it is: —log-format sets a space-separated custom field list for flow logs, trimming or adding output columns.

Why it is used: Fewer fields per record cuts CloudWatch ingestion and Athena scan costs.

# Configure format
aws ec2 create-flow-logs \
  --log-format 'version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status'

Interview talking point: “The doc’s 14-field string IS the default set and is valid; omit fields to slim output, add vpc-id/tcp-flags/region for context. Unknown field names are rejected, and S3 parquet delivery uses —destination-options FileFormat instead.”

Q1947: How do you implement Transit Gateway Attachments?

What it is: create-transit-gateway-vpc-attachment wires a VPC into the transit gateway via one subnet per AZ.

Why it is used: Gives the VPC a doorway into the transit network for route association and propagation.

# Create
aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id tgw-123 \
  --vpc-id vpc-123 \
  --subnet-ids subnet-123

Interview talking point: “The three args are correct; —subnet-ids is a comma-separated list, one per AZ for HA, and —options sets ApplianceModeSupport/DnsSupport. A VPC attaches to only one TGW per region, then associate and propagate routes.”

Q1948: How do you use Direct Connect Lag Member Connection?

What it is: create-connection with —lag-id creates a new connection directly as a member of an existing LAG.

Why it is used: Bundles connections into one logical interface for added bandwidth and redundancy.

# Add
aws directconnect create-connection \
  --lag-id lag-123 \
  --location EqDC2

Interview talking point: “create-connection REQUIRES —connection-name and —bandwidth in addition to —location; —lag-id is optional. For an already-created connection use associate-connection-with-lag —connection-id —lag-id, and both must share a location with a free LAG slot (max ~4).”

Q1949: How do you implement Route 53 Private Hosted Zone?

What it is: A private hosted zone created with —vpc resolves records only inside its associated VPCs.

Why it is used: Keeps internal service names private and never exposed to public DNS.

# Create
aws route53 create-hosted-zone \
  --name internal.example.com \
  --vpc '{"VPCRegion":"us-east-1","VPCId":"vpc-123"}'

Interview talking point: “The —vpc shape is right but —caller-reference is required. Add more VPCs with associate-vpc-with-hosted-zone, cross-account VPCs need create-vpc-association-authorization, and the same name can exist as both a public and a private zone.”

Q1950: How do you use CloudFront Cache Policy?

What it is: A cache policy bundles TTL bounds and cache-key inputs (headers, cookies, query strings) for a cache behavior.

Why it is used: Declares what the cache keys on so behaviors stop repeating TTL boilerplate.

# Create
aws cloudfront create-cache-policy \
  --cache-policy-config '{
    "Name": "my-policy",
    "DefaultTTL": 86400
  }'

Interview talking point: “The config requires MinTTL/MaxTTL/DefaultTTL plus the whole ParametersInCacheKey block, Name+DefaultTTL alone fails validation. Creating the policy does nothing until it is attached to a behavior via —cache-policy-id on create/update-distribution.”

Q1951: How do you implement S3 Bucket Policy Conditions?

What it is: S3 bucket policy conditions gate requests by context like transport, source IP, or org; the Condition fragment must sit inside a full statement envelope to be a valid policy.

Why it is used: Makes policies environmental, not just identity-based, enforcing HTTPS, IP, or org scope on a bucket.

{
  "Condition": {
    "Bool": {"aws:SecureTransport": "true"}
  }
}

Interview talking point: “put-bucket-policy rejects a Condition-only fragment; the full Version, Statement, Effect, Principal, Action, and Resource envelope is required. The HTTPS idiom is Deny with Bool aws:SecureTransport false, and Resource must list both bucket and bucket/*.”

Q1952: How do you use Lambda Function Url Cors Config?

What it is: Lambda function URL CORS configures browser cross-origin access for the public HTTPS endpoint, with fields for origins, methods, headers, exposure, max age, and credentials.

Why it is used: Lets single-page apps call Lambda directly over its function URL without API Gateway.

# Configure
aws lambda put-function-url-config \
  --function-name my-function \
  --cors-config '{"AllowOrigins":["*"],"AllowMethods":["GET"]}'

Interview talking point: “put-function-url-config requires —auth-type (NONE or AWS_IAM), which the doc omits, and the URL config must exist first, so run create-function-url-config before put. AllowCredentials true cannot combine with wildcard origins.”

Q1953: How do you implement ECS Task IAM Role?

What it is: The ECS task IAM role is a root-level task-definition field set with register-task-definition —task-role-arn; containers fetch its credentials from 169.254.170.2.

Why it is used: Gives containers their own least-privilege identity instead of inheriting the instance role.

{
  "taskRoleArn": "arn:aws:iam::123:role/task-role"
}

Interview talking point: “taskRoleArn sits at the task-definition root, not per container, and is applied with register-task-definition —task-role-arn. Distinguish it from —execution-role-arn, which the agent uses to pull images and secrets; Fargate requires the execution role.”

Q1954: How do you use EKS Cluster Logging?

What it is: EKS cluster logging ships five control-plane log types — api, audit, authenticator, controllerManager, scheduler — to CloudWatch through update-cluster-config —logging.

Why it is used: Makes control-plane admission and authorization activity greppable in CloudWatch after the fact.

# Enable
aws eks update-cluster-config \
  --name my-cluster \
  --logging '{"clusterLogging":[{"types":["api","audit"],"enabled":true}]}'

Interview talking point: “update-cluster-config —logging with the clusterLogging array is real, but it replaces the entire config — re-running with fewer types silently disables the rest, and disabling means listing a type with enabled:false. Logs land in /aws/eks//cluster.”

Q1955: How do you implement CloudFormation Stack Import?

What it is: CloudFormation stack import brings unmanaged resources under stack control through a change set of type IMPORT rather than create-stack.

Why it is used: Adopts legacy buckets or databases into infrastructure as code without recreating them.

# `create-stack --import-resources` doesn't exist -- imports go through a
# change set (--change-set-type IMPORT) then execute-change-set:
aws cloudformation create-change-set \
  --stack-name my-stack \
  --change-set-name import-cs \
  --change-set-type IMPORT \
  --resources-to-import '[{"ResourceType":"AWS::S3::Bucket","LogicalResourceId":"MyBucket","ResourceIdentifier":{"BucketName":"my-bucket"}}]' \
  --template-body file://template.yaml

Interview talking point: “create-stack has no —import-resources flag; imports go through create-change-set —change-set-type IMPORT with —resources-to-import, then execute-change-set. The template must declare the same logical IDs, and the resources must not already belong to the stack.”

Q1956: How do you use CDK Asset Hash Computation?

What it is: CDK aws_s3_assets.Asset computes a content hash embedded in the S3 object key, so unchanged code is never re-uploaded on redeploy.

Why it is used: Content-addressed assets make redeploys cheap and give stacks immutable references.

asset = aws_s3_assets.Asset(
    self, "Asset",
    path="./assets",
    readers=[group]
)

Interview talking point: “aws_s3_assets.Asset with path and readers is real; the sha256 asset hash lands in the S3 object key, so unchanged content means no re-upload. path must be a directory, readers grants GetObject, and cdk bootstrap provides the bucket.”

Q1957: How do you implement SAM CLI Local API Logs?

What it is: sam local start-api —log-file, also -l, writes local runtime logs to a file while they still stream to stdout.

Why it is used: Preserves local API runtime output for debugging across restarts and container recycles.

sam local start-api --log-file my.log

Interview talking point: “—log-file is a real documented flag on sam local start-api with -l shorthand, and logs still reach stdout. For deployed functions tail CloudWatch with sam logs —stack-name, and —warm-containers EAGER keeps containers alive between requests.”

Q1958: How do you use CodePipeline Webhook Events?

What it is: CodePipeline webhooks post GitHub push events to a pipeline; create-webhook requires target action, filters, authentication, and authentication-configuration.

Why it is used: Starts builds moments after a commit instead of waiting on a poll interval.

# Create
aws codepipeline create-webhook \
  --name my-webhook \
  --pipeline-name my-pipeline

Interview talking point: “create-webhook needs four arguments the doc omits: —target-action, —filters as a JSON-path matcher, —authentication GITHUB_HMAC, and —authentication-configuration with a SecretToken. The returned URL registers in GitHub, and the source action must reference the webhook.”

Q1959: How do you implement CodeBuild Environment Variables From Parameter Store?

What it is: The buildspec env parameter-store mapping injects SSM parameter values as build environment variables; secrets-manager is the Secrets Manager twin.

Why it is used: Keeps config and credentials out of the repo while builds consume them by name.

env:
  parameter-store:
    PARAM: /my/param

Interview talking point: “env: parameter-store: {PARAM: /my/param} is valid buildspec syntax, but the CodeBuild service role needs ssm:GetParameters on the parameter ARN or the build fails at phase start. The project-level alternative is update-project —environment-variables-override with type PARAMETER_STORE.”

Q1960: How do you use CodeDeploy Deployment Config?

What it is: create-deployment-config defines rollout aggressiveness; EC2 configs take minimum-healthy-hosts as a value and type pair, HOST_COUNT or FLEET_PERCENT.

Why it is used: Codifies how fast and how safely a deploy proceeds so releases stay repeatable.

# Create
aws codedeploy create-deployment-config \
  --deployment-config-name my-config \
  --minimum-healthy-hosts '{"value":2,"type":"HOST_COUNT"}'

Interview talking point: “create-deployment-config —minimum-healthy-hosts with a value and type pair is the EC2 form; Lambda and ECS configs instead take —traffic-routing-config with TimeBasedCanary, TimeBasedLinear, or AllAtOnce, shifting traffic percentages rather than host counts.”

Q1961: How do you implement CloudWatch Logs Destination Policy?

What it is: A CloudWatch Logs destination policy is a resource policy letting other accounts wire subscription filters into your Kinesis or S3 destination.

Why it is used: Centralizes log collection across accounts with a legal cross-account handshake.

# Configure
aws logs put-destination-policy \
  --destination-name my-dest \
  --access-policy '{"Version":"2012-10-17"}'

Interview talking point: “put-destination-policy expects a full Statement granting logs:PutSubscriptionFilter to the peer — the doc’s Version-only document fails validation. The order is put-destination for target and role, then the policy, then the peer runs put-subscription-filter with the destination ARN.”

Q1962: How do you use X-Ray SDK Patch Libraries?

What it is: The X-Ray SDK patch wraps HTTP and SQL client libraries so outbound calls become subsegments automatically, without editing each call site.

Why it is used: Instruments every outbound call with one line and propagates the trace header downstream.

from aws_xray_sdk.ext import botocore
xray_recorder.patch(botocore)

Interview talking point: “xray_recorder.patch takes library-name strings — patch((‘botocore’,‘requests’)) or patch_all() — not imported module objects, which is the doc’s loose form. Patched clients emit subsegments and inject the X-Amzn-Trace-Id header for downstream propagation.”

Q1963: How do you implement Systems Manager OpsItems?

What it is: SSM OpsItems are OpsCenter’s incident case objects created with create-ops-item, taking a required title and optional priority from 1 to 5.

Why it is used: Converges alarms and resources into one tracked, prioritized incident instead of scattered alerts.

# Create
aws ssm create-ops-item \
  --title "Incident" \
  --priority 1

Interview talking point: “create-ops-item —title is valid, but OpsCenter must be enabled in the account first or the call errors. Enrich with —source, —ops-data, and —related-ops-items to fold multiple alerts into one incident; get and update-ops-item manage the lifecycle.”

Q1964: How do you use Secrets Manager Secret Tags?

What it is: secretsmanager tag-resource with —secret-id and Key/Value pairs tags a secret; untag-resource and list-tags-for-resource complete the trio.

Why it is used: Tags drive cost allocation, ownership, and IAM conditions scoping who may use a secret.

# Tag
aws secretsmanager tag-resource \
  --secret-id my-secret \
  --tags Key=environment,Value=prod

Interview talking point: “tag-resource —secret-id with Key/Value pairs is exactly right, and tags feed secretsmanager:ResourceTag IAM conditions. On multi-region secrets, tag changes need —force-overwrite-replica-secret to reach the replicas; untag-resource and list-tags-for-resource complete the trio.”

Q1965: How do you implement IAM User Access Keys Creation?

What it is: create-access-key issues programmatic credentials for an IAM user, returning an AccessKeyId and a SecretAccessKey shown only once.

Why it is used: Long-lived credentials for machine identities with a rotation pattern that avoids downtime.

# Create
aws iam create-access-key --user-name john

Interview talking point: “create-access-key —user-name is valid, but each user holds at most two keys and the secret appears only at creation. Rotate by creating a new key, flipping the old to Inactive with update-access-key, switching clients, then deleting it — humans should use SSO.”

Q1966: How do you use KMS Key Policy Conditions?

What it is: KMS key policy conditions scope key usage by account, service, or encryption context, riding inside a full policy statement.

Why it is used: Lets a broad Principal stay safe by restricting it with narrow conditions.

{
  "Condition": {
    "StringEquals": {"aws:PrincipalAccount": "123456789012"}
  }
}

Interview talking point: “aws:PrincipalAccount in StringEquals is a valid key, but the Condition is a fragment needing Effect, Principal, Action, and Resource around it. KMS adds kms:ViaService and kms:EncryptionContextKeys, and get-key-policy reads the document back.”

Q1967: How do you implement GuardDuty Findings Suppression?

What it is: GuardDuty create-filter archives or hides noisy findings that match criteria such as severity threshold or finding type.

Why it is used: Stops repeated false alarms from burying real threats in the findings list.

# Create filter
aws guardduty create-filter \
  --detector-id detector-id \
  --name my-filter \
  --action ARCHIVE

Interview talking point: “create-filter requires —finding-criteria, which the doc omits — a Criterion map with Gte, Lte, and Equals fields. NOOP only hides a finding from the filtered view while ARCHIVE sets the archive flag; either way findings are never deleted.”

Q1968: How do you use Security Hub Standards Control Status?

What it is: update-standards-control enables or disables a single Security Hub control, recording an auditable disabled reason alongside the status.

Why it is used: Turns off a control the standard cannot satisfy while keeping the compliance record accurate.

# The status flags are fabricated -- the real pair is --control-status
# (ENABLED|DISABLED) + --disabled-reason:
aws securityhub update-standards-control \
  --standards-control-arn arn:aws:securityhub:us-east-1:123456789012:control/cis-aws-foundations-benchmark/v/1.2.0/1.1 \
  --control-status DISABLED \
  --disabled-reason "Compensating control in place"

Interview talking point: “The doc’s —status REASON= flags are fabricated; the real pair is —control-status ENABLED|DISABLED plus a plain-string —disabled-reason. The control ARN comes from list-standards-controls, and disabling a control also stops that control’s findings.”

Q1969: How do you implement Macie Classification Results?

What it is: Macie classification results are the findings a scan produces, read through list-findings scoped by jobId and then get-findings.

Why it is used: Separates the job definition from what the scan actually discovered.

# Get
aws macie2 get-classification-job \
  --job-id job-id

Interview talking point: “get-classification-job is real but returns job metadata — type, status, scope — not results. The outcomes are findings: list-findings with a classificationDetails.jobId criterion, then get-findings, or the classification export configuration delivering them to S3.”

Q1970: How do you use Detective Member Associations?

What it is: Detective create-members invites accounts into a behavioral graph, taking AccountId and EmailAddress entries in the —accounts list.

Why it is used: Grows the shared graph so more accounts’ GuardDuty, CloudTrail, and flow data joins it.

# Associate
aws detective create-members \
  --graph-arn graph-arn \
  --accounts '[{"AccountId":"123","EmailAddress":"a@b.com"}]'

Interview talking point: “create-members is real, but it only creates INVITED members — the member side must run accept-invitation with the invitation id, after which list-members shows INVITED versus VERIFIED. disassociate-members removes a member later.”

Q1971: How do you implement Audit Manager Framework Delegation?

What it is: Audit Manager shares custom frameworks across accounts through start-assessment-framework-sharing with source and destination account and region pairs.

Why it is used: Lets other accounts reuse your control sets and evidence design without rework.

# `delegate-assessment` doesn't exist -- custom FRAMEWORKS (not assessments)
# are shared via start-assessment-framework-sharing:
aws auditmanager start-assessment-framework-sharing \
  --framework-id <fid> \
  --assessment-framework-sharing-request '{"comment":"shared for Q3 audit","destinationAccount":"123456789012","destinationRegion":"us-east-1","sourceAccount":"123456789012","sourceRegion":"us-east-1"}'

Interview talking point: “delegate-assessment does not exist, and it is the framework, not the assessment, that gets shared. Use start-assessment-framework-sharing with a payload naming source and destination account and region, tracked via list-assessment-framework-share-requests; live assessments stay account-local.”

Q1972: How do you use Control Tower Landing Zone Version?

What it is: get-landing-zone reads a landing zone’s managed state by identifier, returning version, status, and ARN as response fields.

Why it is used: Confirms which baseline version is running before an upgrade or drift review.

# `--version` is a response field, not an input -- get-landing-zone takes
# --landing-zone-identifier (the version comes back in the response):
aws controltower get-landing-zone \
  --landing-zone-identifier arn:aws:controltower:us-east-1::landingzone/lz-123

Interview talking point: “get-landing-zone takes —landing-zone-identifier, not the doc’s —version flag — version is a response field, not an input. list-landing-zones finds the id, and update-landing-zone —version is the actual upgrade verb.”

Q1973: How do you implement AWS Config Organization Settings?

What it is: put-organization-config-rule creates an organization-wide Config rule that evaluates every member account automatically, no per-account setup needed.

Why it is used: Enforces one rule across all accounts instead of per-account choreography.

# `enable-organization-config-rule` doesn't exist -- org rules are PUT:
aws configservice put-organization-config-rule \
  --organization-config-rule-name my-rule \
  --config-rule-name s3-bucket-ssl-requests-only

Interview talking point: “enable-organization-config-rule does not exist — the verb family is put, describe, and delete-organization-config-rule. Managed rules use —config-rule-name, custom ones —organization-custom-rule-metadata, and a Config delegated administrator running config-multiaccountsetup.amazonaws.com manages the lane.”

Q1974: How do you use CloudTrail Insights Event Pattern?

What it is: get-insight-selectors returns a trail’s enabled insight selectors: ApiCallRateInsight and ApiErrorRateInsight, the two selectable types.

Why it is used: Flags unusual API call and error rates against a rolling 35-day baseline.

# Get
aws cloudtrail get-insight-selectors \
  --trail-name my-trail

Interview talking point: “get-insight-selectors —trail-name is a real read; put-insight-selectors —insight-types enables or changes the selectors. Insights compare current rates against a rolling 35-day baseline, and the resulting events read via lookup-events —event-category insight.”

Q1975: How do you implement VPC Endpoint Service Allowed Principals?

What it is: modify-vpc-endpoint-service-permissions adds or removes the allowed principals for a VPC endpoint service.

Why it is used: Keeps a private endpoint service hidden until specific accounts are whitelisted.

# `allow-vpc-endpoint-connection-principal` doesn't exist -- the mutator is
# modify-vpc-endpoint-service-permissions:
aws ec2 modify-vpc-endpoint-service-permissions \
  --service-id vpce-svc-123 \
  --add-allowed-principals '["arn:aws:iam::123:root"]'

Interview talking point: “allow-vpc-endpoint-connection-principal is fabricated — the real verb is modify-vpc-endpoint-service-permissions with —add-allowed-principals and —remove-allowed-principals. Even allowlisted principals still face a second gate: the owner must accept with accept-vpc-endpoint-connections.”

Q1976: How do you use Transit Gateway Attachment Association?

What it is: associate-transit-gateway-route-table binds a Transit Gateway attachment to the single route table that governs its traffic.

Why it is used: Pins each attachment to one routing context so its traffic resolves correctly.

# Associate
aws ec2 associate-transit-gateway-route-table \
  --transit-gateway-attachment-id tgw-attach \
  --transit-gateway-route-table-id rtb

Interview talking point: “associate-transit-gateway-route-table is real and exact, but an attachment binds to only one table at a time — re-associating moves it. Association picks the table; enable-transit-gateway-route-table-propagation, taking the same two arguments, imports routes into it.”

Q1977: How do you implement Direct Connect BGP Peer Update?

What it is: update-bgp-peer rotates a virtual interface’s BGP MD5 authentication key without recreating the interface.

Why it is used: Refreshes the BGP credential between your router and AWS on a live session.

# update-virtual-interface is the MTU/structure updater -- the BGP peer edit
# is update-bgp-peer (MD5 key rotation; the session re-establishes):
aws directconnect update-bgp-peer \
  --virtual-interface-id dxvif-123 \
  --new-auth-key <new-md5-key>

Interview talking point: “update-virtual-interface is real but only updates the MTU — the BGP peer edit is update-bgp-peer —virtual-interface-id —new-auth-key. The session drops and re-establishes after the change, so expect a brief convergence window.”

Q1978: How do you use Route 53 Health Check Status?

What it is: get-health-check-status returns what Route 53’s regional checkers currently observe for a health check, with timestamps.

Why it is used: Shows live checker observations, and the same signal drives DNS failover.

# Get
aws route53 get-health-check-status \
  --health-check-id id

Interview talking point: “get-health-check-status is real and returns per-region HealthCheckObservations; get-health-check reads the configuration instead — type, endpoint, threshold. Failover records with PRIMARY or SECONDARY and a health-check id consume the same signal to switch DNS.”

Q1979: How do you implement CloudFront Distribution Tags?

What it is: cloudfront tag-resource tags a distribution with Key/Value pairs, with untag-resource and list-tags-for-resource completing the lifecycle.

Why it is used: Tags feed cost allocation, team ownership, and aws:ResourceTag IAM conditions.

# Tag
aws cloudfront tag-resource \
  --resource arn \
  --tags Key=Environment,Value=prod

Interview talking point: “tag-resource is real, but the CloudFront ARN carries no region segment — arn:aws:cloudfront::account:distribution/id — because it is a global service. The distribution id comes from list-distributions, and untag-resource and list-tags-for-resource complete the trio.”

Q1980: How do you use S3 Bucket Policy Version?

What it is: The Version element of an AWS resource policy selects the policy-language version, 2012-10-17 being the current one.

Why it is used: Pairs with Statement to make a policy document deployable across every AWS resource policy.

{"Version": "2012-10-17", "Statement": [{"Sid": "ReadOnly", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*"}]}

Interview talking point: “A Version-only document is not a policy — put-bucket-policy rejects it without a Statement. Every resource policy needs the same skeleton: Version plus Statement entries with Effect, Principal, Action, and Resource, for buckets, keys, endpoints, and destinations alike.”

Q1981: How do you implement Lambda Function Version Description?

What it is: publish-version snapshots a Lambda function into an immutable numbered version that only $LATEST escapes.

Why it is used: Gives releases fixed references so aliases can shift traffic and roll back instantly.

# Get
aws lambda publish-version --function-name my-function

Interview talking point: “publish-version is real; published versions freeze code and config while only $LATEST keeps changing. update-alias —function-version points a stable name at a version, —routing-config AdditionalVersionWeights gives canary splits, and rollback is pointing the alias back.”

Q1982: How do you use ECS Service Task Count?

What it is: update-service —desired-count sets an ECS service’s target running-task count, with —force-new-deployment to roll a fresh deployment.

Why it is used: The manual scaling lever on the same field Application Auto Scaling writes continuously.

# Update
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --desired-count 5

Interview talking point: “update-service —cluster —service —desired-count is valid, but when Application Auto Scaling owns the service via register-scalable-target for ecs:service:DesiredCount, the policy may immediately overwrite your manual value — last write wins on a shared field.”

Q1983: How do you implement EKS Node Group Instance Types?

What it is: create-nodegroup provisions managed worker nodes for an EKS cluster, handling AMI patching, draining, and health checks for you.

Why it is used: A nodegroup is the cluster’s managed scaling unit; instance types ride on top of identity and placement.

# create-nodegroup REQUIRES --nodegroup-name + --node-role-arn + --subnets
# (the doc's cluster+instance-types call fails without them):
aws eks create-nodegroup \
  --cluster-name my-cluster \
  --nodegroup-name workers \
  --node-role-arn arn:aws:iam::123456789012:role/eks-nodegroup-role \
  --subnets subnet-abc123 subnet-def456 \
  --instance-types t3.medium

Interview talking point: “create-nodegroup requires —nodegroup-name, —node-role-arn, and —subnets, all omitted by the doc, so the call fails without that trio. The create is asynchronous — poll describe-nodegroup until the group reaches ACTIVE.”

Q1984: How do you use CloudFormation Stack Resources List?

What it is: list-stack-resources maps each of a stack’s LogicalResourceIds to the PhysicalResourceIds of the real AWS resources.

Why it is used: Translates template names into the actual resource identifiers for troubleshooting.

# List
aws cloudformation list-stack-resources \
  --stack-name my-stack

Interview talking point: “list-stack-resources —stack-name is real and gives the logical-to-physical map; describe-stack-resources also accepts —physical-resource-id to find the owning stack from an ARN, and deleted stacks keep answering for about 90 days.”

Q1985: How do you implement CDK Stack Output Export?

What it is: core.CfnOutput writes a CloudFormation stack output, optionally exporting the value so other stacks can import it.

Why it is used: Turns stack boundaries into clean interfaces, one stack publishing and another importing.

self.vpc = vpc.vpc_id
core.CfnOutput(self, "VPCId", value=self.vpc)

Interview talking point: “core.CfnOutput is real, but value must resolve to a string or synth fails. export_name publishes a cross-stack export consumed by core.Fn.import_value, and CloudFormation blocks deleting an export while any stack still imports it.”

Q1986: How do you use SAM CLI Package Command?

What it is: sam package uploads local artifacts to S3 and rewrites CodeUri and ImageUri in a transformed template ready for deployment.

Why it is used: Converts local code references into S3 locations CloudFormation can deploy.

sam package --s3-bucket my-bucket

Interview talking point: “sam package —s3-bucket is real and pairs with —output-template-file, but the modern flow collapses both steps: sam deploy —s3-bucket —stack-name —capabilities CAPABILITY_IAM packages and deploys in a single call.”

Q1987: How do you implement CodePipeline Execution Details?

What it is: get-pipeline-execution reads one CodePipeline run’s status, stage states, and artifact revisions by execution id.

Why it is used: Inspects exactly which run failed and which stage stopped it.

# get-pipeline-execution REQUIRES --pipeline-execution-id (the doc omits it)
# -- the id comes from list-pipeline-executions:
aws codepipeline get-pipeline-execution \
  --pipeline-name my-pipeline \
  --pipeline-execution-id <id>

Interview talking point: “get-pipeline-execution requires —pipeline-execution-id, which the doc omits — get ids first from list-pipeline-executions. The response carries status, per-stage states, and artifact revisions, and retry-stage-execution recovers a failed stage.”

Q1988: How do you use CodeBuild Build Status Actions?

What it is: The buildspec env exported-variables list names whose values persist across build phases and into downstream pipeline actions.

Why it is used: Hands computed values past the phase boundary without re-deriving them.

env:
  exported-variables:
    - BUILD_ID

Interview talking point: “env: exported-variables is real and its values survive across phases and into downstream actions, unlike plain env.variables which stay phase-local. Avoid exporting names like BUILD_ID, which would shadow CodeBuild’s generated variables.”

Q1989: How do you implement CodeDeploy Deployment Status?

What it is: get-deployment returns one CodeDeploy deployment’s deploymentInfo: status, deployment group, creator, and rollback information.

Why it is used: Reads the full state of one rollout, where it stopped and who started it.

# Get
aws codedeploy get-deployment \
  --deployment-id id

Interview talking point: “get-deployment —deployment-id is real and valid; deploymentInfo gives status, deploymentGroupName, creator, and rollbackInfo. list-deployments enumerates runs for a group, and create-deployment with an —s3-location launches a new wave.”

Q1990: How do you use CloudWatch Alarm History?

What it is: describe-alarm-history returns an alarm’s time-ordered trail of state changes, actions fired, and configuration edits.

Why it is used: Answers forensic questions like why a page went off.

# Get
aws cloudwatch describe-alarm-history \
  --alarm-name my-alarm

Interview talking point: “describe-alarm-history —alarm-name is real; —history-item-type selects the lens — StateUpdate, Action, or ConfigurationUpdate — with start and end date windows and —max-records/—next-token paging for long histories.”

Q1991: How do you implement X-Ray Segment Document?

What it is: begin_segment, put_annotation, and end_segment create a root X-Ray segment with searchable key-value labels attached.

Why it is used: Annotations turn the trace store into a queryable record of business context.

segment = xray_recorder.begin_segment('name')
segment.put_annotation('key', 'value')
segment.close()

Interview talking point: “The trio is real, but put_annotation values are indexed and filterable while put_metadata values are not. Inside an existing trace like Lambda, prefer begin_subsegment over begin_segment so the whole request stays one tree.”

Q1992: How do you use Systems Manager Parameter History?

What it is: get-parameter-history returns every stored version of an SSM parameter with its value, timestamps, and labels.

Why it is used: Provides the versioned change trail behind audits and rollbacks.

# Get
aws ssm get-parameter-history \
  --name /my/param

Interview talking point: “get-parameter-history —name is real; add —with-decryption or SecureString values come back as ciphertext. Each put-parameter mutation creates a version, while get-parameter reads only the latest — the current-versus-trail split.”

Q1993: How do you implement Secrets Manager Secret Versions?

What it is: list-secret-version-ids returns every version of a secret with its VersionStages, such as AWSCURRENT and AWSPREVIOUS.

Why it is used: Shows which stage points where, the raw material for rotation and rollback.

# List
aws secretsmanager list-secret-version-ids \
  --secret-id my-secret

Interview talking point: “list-secret-version-ids is real; VersionStages are the pointers — get-secret-value reads the AWSCURRENT version, and rotation alternates AWSCURRENT with AWSPREVIOUS across two live versions. update-secret-version-stage —move-to-version-id manually re-points a stage.”

Q1994: How do you use IAM Policy Version List?

What it is: list-policy-versions returns a managed policy’s versions with an IsDefaultVersion flag marking the live one.

Why it is used: Lets you edit policies and flip back if a change breaks access.

# List
aws iam list-policy-versions \
  --policy-arn policy-arn

Interview talking point: “list-policy-versions is real; managed policies cap at five versions, and a sixth evicts the oldest non-default. Only the default version evaluates for attached entities, so rollback is set-default-policy-version pointing back at an earlier version id.”

Q1995: How do you implement KMS Key Alias List?

What it is: list-aliases inventories an account’s KMS aliases and the target keys they currently resolve to.

Why it is used: Gives code stable human-friendly names while key ids rotate underneath.

# List
aws kms list-aliases

Interview talking point: “list-aliases is real with optional —key-id filtering; names must start with alias/ and alias/aws/ is reserved for AWS-managed keys. update-alias-primary-key re-points an alias so applications keep the same name through rotation.”

Q1996: How do you use GuardDuty Finding Count?

What it is: get-findings-statistics aggregates GuardDuty findings into counts by severity and by finding type for a detector.

Why it is used: Summarizes the threat picture without pulling every individual finding record.

# `get-findings-count` doesn't exist -- the aggregator is
# get-findings-statistics with the statistic-type enums:
aws guardduty get-findings-statistics \
  --detector-id detector-id \
  --finding-statistic-types '["COUNT_BY_SEVERITY","COUNT_BY_FINDING_TYPE"]'

Interview talking point: “get-findings-count does not exist — the real aggregator is get-findings-statistics with —finding-statistic-types COUNT_BY_SEVERITY and COUNT_BY_FINDING_TYPE. The raw records still come from list-findings and get-findings.”

Q1997: How do you implement Security Hub Finding Severity Count?

What it is: Security Hub get-findings filters findings with typed filter objects — StringFilter, NumberFilter, DateRangeFilter — per attribute.

Why it is used: Expresses precise queries like critical severity in a region against the findings store.

# --filters values are TYPED filter objects (StringFilter/NumberFilter/
# DateRangeFilter), not bare-string arrays:
aws securityhub get-findings \
  --filters '{"Severity":{"Label":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}}'

Interview talking point: “—filters takes structured objects like Severity Label with Value and Comparison — the doc’s bare array of strings is the wrong shape. Conditions AND across different attributes, while value arrays within one attribute OR.”

Q1998: How do you use Macie Finding Statistics?

What it is: get-finding-statistics aggregates Macie findings by nested fields expressed as dotted paths in —group-by.

Why it is used: Rolls findings into dashboard counts grouped by category, type, or severity.

# --group-by takes DOTTED PATHS (severity.description -- plain 'severity' is
# not a valid group-by value):
aws macie2 get-finding-statistics \
  --group-by severity.description

Interview talking point: “—group-by takes dotted paths — severity.description, sensitiveData.category, sensitiveData.detections.type, classificationDetails.jobId — and plain severity is not a valid value. Repeat the flag to cross-tab multiple dimensions.”

Q1999: How do you implement Detective Investigation List?

What it is: list-investigations lists Detective’s investigation cases for a graph, with filter and sort criteria and NextToken paging.

Why it is used: Case-manages entity and IP hunts so open work shows severity and status.

# List
aws detective list-investigations \
  --graph-arn graph-arn

Interview talking point: “list-investigations —graph-arn is real; —filter-criteria and —sort-criteria narrow and order cases, and get-investigation —investigation-id gives one case’s status — RUNNING, SUCCEEDED, or FAILED — and severity. Accepted graph members supply the data.”

Q2000: How do you use AWS Resource Final Message?

What it is: The series closer wraps 2000 AWS interview records across 8 files, each in the What, Why, command, and talking-point format.

Why it is used: A revision-recall shape pairing exact CLI with motivation and a recitable close for active practice.

This concludes the 2000 practical AWS interview questions!

Topics covered:

- Compute (EC2, Lambda, ECS, EKS)

- Storage (S3, EBS, EFS, FSx)

- Database (RDS, Aurora, DynamoDB, ElastiCache)

- Networking (VPC, Route53, CloudFront, Direct Connect)

- Security (IAM, KMS, GuardDuty, WAF)

- DevOps (CodePipeline, CloudFormation, CDK, Terraform)

- Analytics (Kinesis, Athena, Redshift)

- ML/AI (SageMaker, Rekognition, Comprehend)

- Architecture Patterns

- Real-world Scenarios

Interview talking point: “Every record’s contract is a correct CLI verb, a preserved correction, and a recitable close — fabricated verbs like delegate-assessment and get-findings-count were fixed, and required args like —finding-criteria and —pipeline-execution-id restored. This set is revision compression, not the AWS documentation.”