Skip to content

AWS_Practical_Interview_801 1000

AWS Practical Interview Questions (801-1000)

Section titled “AWS Practical Interview Questions (801-1000)”

Q751: How do you implement multi-account AWS environment?

Section titled “Q751: How do you implement multi-account AWS environment?”

Answer: Structure:

  • Root account (billing only)
  • Shared Services account
  • Security account
  • Dev/Test accounts
  • Production accounts

Implementation:

Terminal window
# Create organization
aws organizations create-organization
# Create OU
aws organizations create-organizational-unit \
--parent-id r-root \
--name Production
# Move accounts
aws organizations move-account \
--account-id 123456789012 \
--source-parent-id r-root \
--destination-parent-id ou-production

Q752: How do you implement centralized logging?

Section titled “Q752: How do you implement centralized logging?”

Answer:

  1. Create S3 bucket in Security account
  2. Enable CloudTrail in all accounts
  3. Configure S3 cross-account access
  4. Use Aggregator for CloudWatch Logs
  5. Create Athena queries
  6. Use QuickSight for visualization

Q753: How do you implement centralized security?

Section titled “Q753: How do you implement centralized security?”

Answer:

  1. Use AWS Organizations
  2. Create Security account
  3. Use GuardDuty master
  4. Use Security Hub aggregator
  5. Use Config aggregator
  6. Use IAM Access Analyzer

Q754: How do you implement DNS management?

Section titled “Q754: How do you implement DNS management?”

Answer:

  1. Create private hosted zone in shared services
  2. Use Route 53 Resolver
  3. Create conditional forwarders
  4. Enable DNS query logging

Q755: How do you implement shared services?

Section titled “Q755: How do you implement shared services?”

Answer: Common shared services:

  • Active Directory
  • CI/CD pipelines
  • Monitoring
  • Backup
  • DNS

Implementation:

  • Deploy in shared services VPC
  • Use PrivateLink for access
  • Share via RAM

Q756: How do you implement showback/chargeback?

Section titled “Q756: How do you implement showback/chargeback?”

Answer:

  1. Enable cost allocation tags
  2. Create tag policies
  3. Use CUR (Cost and Usage Report)
  4. Create reports by tag
  5. Use QuickSight for visualization
  6. Create billing alerts

Q757: How do you optimize reserved instance usage?

Section titled “Q757: How do you optimize reserved instance usage?”

Answer:

  1. Analyze usage patterns
  2. Purchase RIs for steady-state
  3. Use convertible RIs
  4. Set up coverage alerts
  5. Use Savings Plans

Answer:

  1. Create budgets with alerts
  2. Use SCP to restrict services
  3. Enable cost anomaly detection
  4. Set up spend limits
  5. Regular cost reviews

Answer:

  1. Enable Compute Optimizer
  2. Review recommendations
  3. Right-size EC2
  4. Right-size RDS
  5. Right-size ElastiCache

Q760: How do you optimize data transfer costs?

Section titled “Q760: How do you optimize data transfer costs?”

Answer:

  1. Use VPC endpoints
  2. Use PrivateLink
  3. Use Direct Connect
  4. Use CloudFront
  5. Minimize cross-region traffic

Q761: How do you implement detective controls?

Section titled “Q761: How do you implement detective controls?”

Answer:

  1. Enable CloudTrail (all regions)
  2. Enable GuardDuty
  3. Enable Config
  4. Enable Security Hub
  5. Enable Macie

Q762: How do you implement preventive controls?

Section titled “Q762: How do you implement preventive controls?”

Answer:

  1. Use SCPs
  2. Use IAM policies
  3. Use security groups
  4. Use NACLs
  5. Use WAF/Shield

Q763: How do you implement responsive controls?

Section titled “Q763: How do you implement responsive controls?”

Answer:

  1. Use EventBridge
  2. Use Lambda for remediation
  3. Create runbooks
  4. Set up incident response
  5. Use GuardDuty findings

Q764: How do you implement IAM access analyzer?

Section titled “Q764: How do you implement IAM access analyzer?”

Answer:

Terminal window
# Create analyzer
aws access-analyzer create-analyzer \
--analyzer-name organization-analyzer \
--type ORGANIZATION
# Get findings
aws access-analyzer list-findings \
--analyzer-name organization-analyzer

Q765: How do you implement secrets rotation?

Section titled “Q765: How do you implement secrets rotation?”

Answer:

Terminal window
# Create secret with rotation
aws secretsmanager create-secret \
--name prod/db-creds \
--secret-string '{"username":"admin","password":"pass"}' \
--rotation-lambda-arn arn:aws:lambda:region:account:function:rotate \
--rotation-rules AutomaticallyAfterDays=30

Q766: How do you implement AWS Network Firewall?

Section titled “Q766: How do you implement AWS Network Firewall?”

Answer:

Terminal window
# Create firewall
aws network-firewall create-firewall \
--firewall-name my-firewall \
--vpc-id vpc-123 \
--firewall-policy-arn policy-arn \
--subnet-mapping '{"us-east-1a":"subnet-123"}'
Section titled “Q767: How do you implement PrivateLink for custom service?”

Answer:

  1. Create NLB in service provider VPC
  2. Create VPC endpoint service
  3. Enable private DNS
  4. Allow principals
  5. Create VPC endpoint in consumer account

Q768: How do you implement Global Accelerator?

Section titled “Q768: How do you implement Global Accelerator?”

Answer:

Terminal window
# Create accelerator
aws globalaccelerator create-accelerator \
--name my-accelerator
# Add listener
aws globalaccelerator create-listener \
--accelerator-arn accelerator-arn \
--protocol TCP \
--port-range FromPort=80,ToPort=80

Q769: How do you implement Transit Gateway attachments?

Section titled “Q769: How do you implement Transit Gateway attachments?”

Answer:

  1. Create Transit Gateway
  2. Create attachments (VPC, VPN, Direct Connect)
  3. Create route tables
  4. Associate attachments
  5. Propagate routes

Answer:

  1. Create primary record (A)
  2. Create secondary record (A)
  3. Set evaluate target health
  4. Configure health check
  5. Set routing policy

Answer:

import boto3
s3 = boto3.client('s3')
response = s3.select_object_content(
Bucket='my-bucket',
Key='data.csv',
ExpressionType='SQL',
Expression="SELECT * FROM s3object WHERE age > 25",
InputSerialization={'CSV': {}},
OutputSerialization={'CSV': {}}
)

Q772: How do you implement S3 batch operations?

Section titled “Q772: How do you implement S3 batch operations?”

Answer:

  1. Create manifest
  2. Create job
  3. Choose operation (copy, tag, etc.)
  4. Run and monitor job

Answer:

Terminal window
# Create inventory config
aws s3api put-bucket-inventory-configuration \
--bucket my-bucket \
--id daily-inventory \
--inventory-configuration '{
"Destination": {"S3BucketDestination":{"Bucket":"arn:aws:s3:::inventory-bucket"}},
"Schedule":{"Frequency":"Daily"}
}'

Q774: How do you implement EFS access points?

Section titled “Q774: How do you implement EFS access points?”

Answer:

Terminal window
# Create access point
aws efs create-access-point \
--file-system-id fs-123 \
--access-point-name app-access \
--posix-user '{"Uid":1000,"Gid":1000}'

Q775: How do you implement FSx for Windows?

Section titled “Q775: How do you implement FSx for Windows?”

Answer:

Terminal window
# Create FSx
aws fsx create-file-system \
--file-system-type WINDOWS \
--storage-capacity 3000 \
--subnet-ids subnet-123 \
--windows-configuration '{
"ActiveDirectoryId": "d-1234567890",
"ThroughputCapacity": 8
}'

Q776: How do you implement DynamoDB on-demand backup?

Section titled “Q776: How do you implement DynamoDB on-demand backup?”

Answer:

Terminal window
# Create backup
aws dynamodb create-backup \
--table-name my-table \
--backup-name my-backup
# Restore
aws dynamodb restore-table-to-point-in-time \
--source-table-name my-table \
--target-table-name my-table-restore

Q777: How do you implement DynamoDB transactions?

Section titled “Q777: How do you implement DynamoDB transactions?”

Answer:

import boto3
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('orders')
try:
with table.transactions_write() as tx:
tx.put_item(Item={'order_id': '123', 'status': 'processing'})
tx.update_item(
Key={'product_id': '456'},
UpdateExpression='SET stock = stock - :val',
ExpressionAttributeValues={':val': 1}
)
except Exception as e:
print(f"Transaction failed: {e}")

Q778: How do you implement Aurora Serverless?

Section titled “Q778: How do you implement Aurora Serverless?”

Answer:

Terminal window
# Create Aurora Serverless
aws rds create-db-cluster \
--db-cluster-identifier serverless-cluster \
--engine aurora-postgresql \
--engine-mode serverless \
--scaling-configuration '{
"MinCapacity": 2,
"MaxCapacity": 64,
"AutoPause": true
}'

Answer:

Terminal window
# Create proxy
aws rds create-db-proxy \
--db-proxy-name my-proxy \
--engine-family MYSQL \
--auth '[{"SecretArn":"arn:secret","IAMAuth":"DISABLED"}]' \
--vpc-subnet-ids subnet-123 subnet-456

Q780: How do you implement ElastiCache Serverless?

Section titled “Q780: How do you implement ElastiCache Serverless?”

Answer:

Terminal window
# Create serverless cache
aws elasticache create-serverless-cache \
--serverless-cache-name my-cache \
--engine redis \
--description "Serverless Redis"

Q781: How do you implement Lambda VPC endpoint?

Section titled “Q781: How do you implement Lambda VPC endpoint?”

Answer:

Terminal window
# Create VPC endpoint
aws ec2 create-vpc-endpoint \
--vpc-id vpc-123 \
--service-name com.amazonaws.us-east-1.lambda \
--vpc-endpoint-type Interface \
--subnet-ids subnet-123

Answer:

Terminal window
# Create layer
aws lambda publish-layer-version \
--layer-name my-layer \
--zip-file fileb://layer.zip \
--compatible-runtimes python3.9
# Use in function
aws lambda create-function \
--function-name my-func \
--layers arn:aws:lambda:us-east-1:123456789012:layer:my-layer:1

Q783: How do you implement Lambda cold start optimization?

Section titled “Q783: How do you implement Lambda cold start optimization?”

Answer:

# Best practices:
# 1. Minimize package size
# 2. Avoid VPC if not needed
# 3. Use arm64
# 4. Use provisioned concurrency
# 5. Reduce dependencies

Q784: How do you implement Lambda error handling?

Section titled “Q784: How do you implement Lambda error handling?”

Answer:

import boto3
def handler(event, context):
try:
process(event)
except Exception as e:
# Send to DLQ
sqs = boto3.client('sqs')
sqs.send_message(
QueueUrl='https://sqs.../dlq',
MessageBody=str(event)
)
raise

Q785: How do you implement Lambda async invocation?

Section titled “Q785: How do you implement Lambda async invocation?”

Answer:

Terminal window
# Invoke async
aws lambda invoke \
--function-name my-function \
--invocation-type Event \
--payload '{}' response.json

Q786: How do you implement EKS managed node groups?

Section titled “Q786: How do you implement EKS managed node groups?”

Answer:

Terminal window
# Create node group
aws eks create-nodegroup \
--cluster-name my-cluster \
--nodegroup-name managed-nodes \
--scaling-config minSize=2,maxSize=5,desiredSize=3 \
--instance-types t3.medium

Answer:

Terminal window
# Create Fargate profile
aws eks create-fargate-profile \
--cluster-name my-cluster \
--fargate-profile-name my-fargate \
--selectors namespace=default

Q788: How do you implement ECS service discovery?

Section titled “Q788: How do you implement ECS service discovery?”

Answer:

Terminal window
# Create namespace
aws servicediscovery create-private-dns-namespace \
--name local \
--vpc vpc-123
# Create service
aws ecs create-service \
--service-name my-service \
--service-registries '[{"registryArn":"arn:service:srv-123"}]'

Q789: How do you implement ECS capacity providers?

Section titled “Q789: How do you implement ECS capacity providers?”

Answer:

Terminal window
# Create capacity provider
aws ecs create-capacity-provider \
--name my-provider \
--auto-scaling-group-provider '{
"autoScalingGroupArn": "arn:aws:autoscaling:asg"
}'
# Update service
aws ecs update-service \
--cluster my-cluster \
--service my-service \
--capacity-provider-strategy '[{"capacityProvider":"my-provider","weight":1}]'

Q790: How do you implement EKS security groups?

Section titled “Q790: How do you implement EKS security groups?”

Answer:

security-group-policy.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: aws-node
namespace: kube-system
---
apiVersion: networking.k8s.io/v1
kind: SecurityGroupPolicy
metadata:
name: my-policy
spec:
podSelector:
matchLabels:
role: db
securityGroups:
- id: sg-123

Q791: How do you implement CodePipeline with CloudFormation?

Section titled “Q791: How do you implement CodePipeline with CloudFormation?”

Answer:

pipeline.yaml
Resources:
Pipeline:
Type: AWS::CodePipeline::Pipeline
Properties:
Stages:
- Name: Source
Actions:
- Name: SourceAction
ActionTypeId:
Category: Source
Owner: AWS
Provider: CodeCommit
Version: 1
- Name: Deploy
Actions:
- Name: DeployAction
ActionTypeId:
Category: Deploy
Owner: AWS
Provider: CloudFormation
Version: 1

Q792: How do you implement CodeBuild with testing?

Section titled “Q792: How do you implement CodeBuild with testing?”

Answer:

buildspec.yml
version: 0.2
phases:
install:
commands:
- npm install
pre_build:
commands:
- npm run lint
build:
commands:
- npm test
- npm run build
artifacts:
files:
- '**/*'

Q793: How do you implement CodeDeploy rollback?

Section titled “Q793: How do you implement CodeDeploy rollback?”

Answer:

Terminal window
# Enable auto rollback
aws codedeploy create-deployment-group \
--deployment-group-name my-group \
--auto-rollback-configuration '{
"enabled": true,
"events": ["DEPLOYMENT_FAILURE"]
}'

Q794: How do you implement cross-account CI/CD?

Section titled “Q794: How do you implement cross-account CI/CD?”

Answer:

  1. Create pipeline in tools account
  2. Use IAM role for deployment
  3. Assume role in target account
  4. Use CloudFormation StackSets
  5. Use deployment accounts

Q795: How do you implement feature branch deployments?

Section titled “Q795: How do you implement feature branch deployments?”

Answer:

  1. Use CodePipeline webhooks
  2. Create branch-specific deployments
  3. Use parameter overrides
  4. Use environment-specific configs

Q796: How do you implement custom CloudWatch metrics?

Section titled “Q796: How do you implement custom CloudWatch metrics?”

Answer:

import boto3
cloudwatch = boto3.client('cloudwatch')
cloudwatch.put_metric_data(
Namespace='MyApp',
MetricData=[
{
'MetricName': 'OrderCount',
'Value': 1,
'Unit': 'Count'
}
]
)

Q797: How do you implement CloudWatch Anomaly Detection?

Section titled “Q797: How do you implement CloudWatch Anomaly Detection?”

Answer:

Terminal window
# Create anomaly detection alarm
aws cloudwatch put-anomaly-detection \
--namespace AWS/EC2 \
--metric-name CPUUtilization \
--statistic Average

Q798: How do you implement CloudWatch Contributor Insights?

Section titled “Q798: How do you implement CloudWatch Contributor Insights?”

Answer:

Terminal window
# Create insight rule
aws cloudwatch put-insight-rule \
--rule-name my-rule \
--rule-pattern '{"schema":{"root":"LogGroup","fields":[{"field":"@timestamp"},{"field":"@message"}]},"match":[{"equals":"ERROR","field":"@message"}]}'

Q799: How do you implement CloudWatch Logs Insights?

Section titled “Q799: How do you implement CloudWatch Logs Insights?”

Answer:

Terminal window
# Query logs
aws logs insights-query \
--log-group-name /aws/lambda/my-function \
--query "fields @timestamp, @message | filter @message like 'ERROR' | stats count() by @message"

Q800: How do you implement X-Ray custom segments?

Section titled “Q800: How do you implement X-Ray custom segments?”

Answer:

from aws_xray_sdk.core import xray_recorder
@xray_recorder.capture('my_function')
def my_function():
with xray_recorder.in_segment('subsegment') as subsegment:
subsegment.put_annotation('key', 'value')
# Do work

Q801: How do you implement dead letter queue pattern?

Section titled “Q801: How do you implement dead letter queue pattern?”

Answer:

import boto3
sqs = boto3.client('sqs')
def process_with_dlq(message):
try:
process(message)
except Exception as e:
sqs.send_message(
QueueUrl='https://sqs.../dlq',
MessageBody=message['Body']
)
raise

Q802: How do you implement retry with exponential backoff?

Section titled “Q802: How do you implement retry with exponential backoff?”

Answer:

import time
def retry_with_backoff(func, max_retries=3):
for i in range(max_retries):
try:
return func()
except Exception:
if i == max_retries - 1:
raise
time.sleep(2 ** i)

Q803: How do you implement circuit breaker?

Section titled “Q803: How do you implement circuit breaker?”

Answer:

class CircuitBreaker:
def __init__(self, failure_threshold=5):
self.failures = 0
self.failure_threshold = failure_threshold
self.state = "closed"
def call(self, func):
if self.state == "open":
raise Exception("Circuit open")
try:
result = func()
self.failures = 0
return result
except:
self.failures += 1
if self.failures >= self.failure_threshold:
self.state = "open"
raise

Q804: How do you implement bulkhead pattern?

Section titled “Q804: How do you implement bulkhead pattern?”

Answer:

import concurrent.futures
# Use thread pool executor as bulkhead
with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
futures = [executor.submit(process, item) for item in items]
results = [f.result() for f in futures]

Answer:

def process_order(order):
try:
reserve_inventory(order)
process_payment(order)
confirm_order(order)
except Exception as e:
compensate(order)
raise

Q806: How do you implement event sourcing?

Section titled “Q806: How do you implement event sourcing?”

Answer:

# Store events
def append_event(order_id, event):
dynamodb.put_item(Item={
'order_id': order_id,
'timestamp': now(),
'event_type': event.type,
'data': event.data
})
# Replay events
def replay_events(order_id):
events = dynamodb.query(
KeyConditionExpression='order_id = :id',
ExpressionAttributeValues={':id': order_id}
)
return reduce(apply_event, events)

Answer:

# Command side
def create_order(order):
dynamodb.put_item(Item=order.to_dict())
eventbridge.put_events(Event=order.created)
# Query side
def get_order(order_id):
return elasticache.get(f"order:{order_id}") or dynamodb.get_item(Key={'order_id': order_id})

Answer:

def get_product(product_id):
# Check cache first
cached = redis.get(f"product:{product_id}")
if cached:
return cached
# Fetch from DB
product = dynamodb.get_item(Key={'product_id': product_id})
# Store in cache
redis.setex(f"product:{product_id}", 3600, product)
return product

Q809: How do you implement write-through cache?

Section titled “Q809: How do you implement write-through cache?”

Answer:

def save_product(product):
# Write to cache first
redis.set(f"product:{product.id}", product)
# Then write to DB
dynamodb.put_item(Item=product.to_dict())

Q810: How do you implement distributed lock?

Section titled “Q810: How do you implement distributed lock?”

Answer:

import boto3
def acquire_lock(key, ttl=30):
return dynamodb.put_item(
Item={'lock_key': key, 'timestamp': now()},
ConditionExpression='attribute_not_exists(lock_key)'
)
def release_lock(key):
dynamodb.delete_item(Key={'lock_key': key})

Answer: Components:

  • S3 for photo storage
  • Lambda for processing (resize, thumbnail)
  • DynamoDB for metadata
  • CloudFront for delivery
  • Cognito for auth
  • Rekognition for moderation

Q812: Design a real-time notification system

Section titled “Q812: Design a real-time notification system”

Answer: Components:

  • API Gateway WebSocket
  • DynamoDB for connections
  • Lambda for processing
  • SNS for fanout
  • Pinpoint for mobile push

Q813: Design a streaming analytics platform

Section titled “Q813: Design a streaming analytics platform”

Answer: Components:

  • Kinesis Data Streams
  • Kinesis Data Analytics
  • Kinesis Firehose → S3
  • Athena for queries
  • QuickSight for visualization

Answer: Components:

  • S3 event triggers
  • Lambda for extraction
  • Glue for transformation
  • Lambda for loading
  • Redshift for analytics

Answer: Components:

  • API Gateway
  • Lambda/ECS services
  • DynamoDB/RDS per service
  • EventBridge for communication
  • X-Ray for tracing
  • App Mesh for service mesh

Answer: Components:

  • Direct Connect
  • VPN backup
  • Route 53 hybrid DNS
  • Storage Gateway
  • IAM federation

Answer: Components:

  • Global Accelerator
  • Route 53 geolocation
  • DynamoDB global tables
  • Aurora global database
  • S3 cross-region replication
  • CloudFront

Answer: Components:

  • S3 as data lake
  • Lake Formation
  • Glue crawlers
  • Athena for queries
  • Redshift Spectrum
  • QuickSight

Answer: Components:

  • S3 for data storage
  • SageMaker for training
  • Ground Truth for labeling
  • Model Registry
  • Endpoint for inference
  • Batch transform for batch

Answer: Components:

  • IoT Core for ingestion
  • IoT Rules for processing
  • Kinesis for streaming
  • Lambda for real-time
  • S3 for storage
  • OpenSearch for search

Q821: How to secure S3 bucket with CloudFront?

Section titled “Q821: How to secure S3 bucket with CloudFront?”

Answer:

  1. Create OAI
  2. Update S3 policy to allow OAI only
  3. Create CloudFront distribution
  4. Point to S3 origin with OAI
  5. Use signed URLs for private content

Answer:

Terminal window
# Create peering connection
aws ec2 create-vpc-peering-connection \
--vpc-id vpc-123 \
--peer-vpc-id vpc-456
# Accept peering
aws ec2 accept-vpc-peering-connection \
--vpc-peering-connection-id pcx-123
# Add routes
aws ec2 create-route \
--route-table-id rtb-123 \
--destination-cidr-block 10.1.0.0/16 \
--vpc-peering-connection-id pcx-123

Q823: How to set up IAM role for cross-account access?

Section titled “Q823: How to set up IAM role for cross-account access?”

Answer:

Terminal window
# Create role in target account
aws iam create-role \
--role-name CrossAccountRole \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::source-account:root"},
"Action": "sts:AssumeRole"
}]
}'

Q824: How to configure Route 53 health checks?

Section titled “Q824: How to configure Route 53 health checks?”

Answer:

Terminal window
# Create health check
aws route53 create-health-check \
--health-check-config '{
"Type": "HTTPS",
"FullyQualifiedDomainName": "example.com",
"Port": 443,
"ResourcePath": "/health"
}'

Answer:

Terminal window
# Create web ACL
aws wafv2 create-web-acl \
--name my-acl \
--scope CLOUDFRONT \
--default-action Allow={}
# Associate with distribution
aws cloudfront update-distribution \
--id distribution-id \
--web-acl-id acl-id

Answer:

import boto3
s3 = boto3.client('s3')
url = s3.generate_presigned_url(
'get_object',
Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
ExpiresIn=3600
)

Answer:

def handler(event, context):
auth = event['headers'].get('authorization')
if not validate_token(auth):
return {'statusCode': 401}
return {'statusCode': 200}

Q828: How to set up DynamoDB auto scaling?

Section titled “Q828: How to set up DynamoDB auto scaling?”

Answer:

Terminal window
# Register scalable target
aws application-autoscaling register-scalable-target \
--service-namespace dynamodb \
--resource-id table/my-table \
--scalable-dimension dynamodb:table:ReadCapacityUnits \
--min-capacity 5 \
--max-capacity 100
# Create policy
aws application-autoscaling put-scaling-policy \
--policy-name my-policy \
--service-namespace dynamodb \
--resource-id table/my-table \
--scalable-dimension dynamodb:table:ReadCapacityUnits \
--target-tracking-scaling-policy-configuration '{
"TargetValue": 70,
"PredefinedMetricSpecification": {"PredefinedMetricType":"DynamoDBReadCapacityUtilization"}
}'

Q829: How to implement ECS task placement?

Section titled “Q829: How to implement ECS task placement?”

Answer:

{
"placementStrategy": [
{
"type": "spread",
"field": "attribute:ecs.availability-zone"
},
{
"type": "binpack",
"field": "memory"
}
]
}

Answer:

Terminal window
# Install App Mesh controller
helm install appmesh-controller eks/appmesh-controller \
--namespace appmesh-system
# Add mesh resource
kubectl apply -f mesh.yaml

Answer:

Terminal window
# Get session token
aws sts get-session-token \
--serial-number arn:aws:iam::123456789012:mfa/user \
--token-code 123456
# Use credentials
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...

Q832: How do you configure AWS config for multiple accounts?

Section titled “Q832: How do you configure AWS config for multiple accounts?”

Answer:

  1. Enable Config in each account
  2. Create aggregator in Security account
  3. Grant read permissions
  4. Query aggregated data

Q833: How do you use Systems Manager Parameter Store?

Section titled “Q833: How do you use Systems Manager Parameter Store?”

Answer:

Terminal window
# Create parameter
aws ssm put-parameter \
--name /myapp/dbpass \
--value "secret" \
--type SecureString
# Get parameter
aws ssm get-parameter \
--name /myapp/dbpass \
--with-decryption

Answer:

Terminal window
# Create secret
aws secretsmanager create-secret \
--name prod/db-creds \
--secret-string '{"user":"admin","pass":"secret"}'
# Get secret
aws secretsmanager get-secret-value \
--secret-id prod/db-creds

Answer:

  1. Create portfolio
  2. Add products
  3. Create launch constraints
  4. Grant access to users
  5. Users launch products

Answer:

Terminal window
# Create application
aws appconfig create-application --name my-app
# Create environment
aws appconfig create-environment \
--application-id app-id \
--name production
# Deploy configuration
aws appconfig start-deployment \
--application-id app-id \
--environment-id env-id \
--deployment-strategy-id strategy-id \
--configuration-profile-id profile-id

Answer:

  1. Register service template
  2. Create environment template
  3. Provision environments
  4. Deploy services

Answer:

Terminal window
# Initialize Amplify
amplify init
# Add API
amplify add api
# Deploy
amplify publish

Answer:

Terminal window
# Create service
aws apprunner create-service \
--service-name my-service \
--source-configuration '{
"ImageRepository": {"RepositoryUrl": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image"}
}'

Answer:

Terminal window
# Create compute environment
aws batch create-compute-environment \
--compute-environment-name my-env \
--type MANAGED \
--compute-resources '{"type":"FARGATE","maxvCpus":64}'
# Submit job
aws batch submit-job \
--job-name my-job \
--job-queue my-queue \
--job-definition my-definition

Answer:

Terminal window
# Create instance
aws lightsail create-instances \
--instance-name my-instance \
--blueprint-id ubuntu_20_04 \
--bundle-id medium_2_0
# Create static IP
aws lightsail allocate-static-ip --static-ip-name my-ip

Answer:

Terminal window
# Create directory
aws workspaces create-workspace-directory \
--directory-service-arn arn:aws:ds:region:account:directory/directory-id
# Create workspace
aws workspaces create-workspaces \
--workspaces '[{"DirectoryId":"directory-id","UserName":"user","BundleId":"value"}]'

Answer:

Terminal window
# Create fleet
aws appstream create-fleet \
--name my-fleet \
--instance-type stream.standard.small \
--image-name AppStream-2.0-Latest

Answer:

Answer:

Terminal window
# Create dataset group
aws personalize create-dataset-group --name my-group
# Import data
aws personalize create-dataset-import-job \
--dataset-group-arn arn \
--data-source location=s3://bucket/data

Answer:

Terminal window
# Create dataset
aws forecast create-dataset \
--name my-dataset \
--domain CUSTOM
# Create predictor
aws forecast create-predictor \
--predictor-name my-predictor \
--dataset-group-arn arn

Answer:

import boto3
textract = boto3.client('textract')
response = textract.analyze_document(
Document={'S3Object': {'Bucket': 'my-bucket', 'Name': 'doc.pdf'}},
FeatureTypes=['TABLES', 'FORMS']
)

Answer:

import boto3
rekognition = boto3.client('rekognition')
response = rekognition.detect_labels(
Image={'S3Object': {'Bucket': 'my-bucket', 'Name': 'image.jpg'}},
MaxLabels=10
)

Answer:

import boto3
polly = boto3.client('polly')
response = polly.synthesize_speech(
Text='Hello world',
OutputFormat='mp3',
VoiceId='Joanna'
)

Answer:

import boto3
transcribe = boto3.client('transcribe')
# Start transcription
transcribe.start_transcription_job(
TranscriptionJobName='my-job',
Media={'MediaFileUri': 's3://bucket/audio.mp4'},
MediaFormat='mp4',
LanguageCode='en-US'
)

Answer:

import boto3
translate = boto3.client('translate')
response = translate.translate_text(
Text='Hello',
SourceLanguageCode='auto',
TargetLanguageCode='es'
)

Answer:

import boto3
lex = boto3.client('lex-runtime')
response = lex.post_text(
botName='my-bot',
botAlias='prod',
userId='user123',
inputText='Hello'
)

Answer:

import boto3
comprehend = boto3.client('comprehend')
response = comprehend.detect_entities(
Text='Amazon is a company based in Seattle.',
LanguageCode='en'
)

Answer:

Terminal window
# Create index
aws kendra create-index --name my-index
# Add documents
aws kendra batch-put-document \
--index-id index-id \
--documents '[{"Id":"1","Title":"Doc","Body":"Content"}]'

Q855: How do you use AWS Lookout for Vision?

Section titled “Q855: How do you use AWS Lookout for Vision?”

Answer:

Terminal window
# Create project
aws lookoutvision create-project --project-name my-project
# Create dataset
aws lookoutvision create-dataset \
--project-name my-project \
--dataset-type TRAIN

Answer:

Terminal window
# Enable DevOps Guru
aws devops-guru enable-resource-collection
# Get insights
aws devops-guru list-insights --status ACTIVE

Answer:

Terminal window
# Create configuration
aws chatbot create-chatbot-configuration \
--configuration-name my-config \
--slack-channel-id C123 \
--iam-role-arn role-arn

Answer:

Q859: How do you use AWS CodeGuru Profiler?

Section titled “Q859: How do you use AWS CodeGuru Profiler?”

Answer:

import aws_cg_profiler
profiler = aws_cg_profiler.Profiler()
profiler.start()
# Your code
profiler.stop()

Answer:


Q861: How do you implement AWS CDK Pipelines?

Section titled “Q861: How do you implement AWS CDK Pipelines?”

Answer:

from aws_cdk import pipelines
pipeline = pipelines.CodePipeline(self, "Pipeline",
synth=pipelines.ShellStep("Synth",
commands=["npm ci", "cdk synth"]
)
)

Answer:

from aws_cdk import Aspects, aws_iam as iam
class ValidateNoWildcardsAspect:
def visit(self, node):
if isinstance(node, iam.CfnManagedPolicy):
# Check and warn
pass

Q863: How do you use AWS CDK Custom Resources?

Section titled “Q863: How do you use AWS CDK Custom Resources?”

Answer:

from aws_cdk import custom_resources as cr
custom = cr.AwsCustomResource(self, "Custom",
on_create=cr.AwsSdkCall(
service="SSM",
action="putParameter",
parameters={"Name": "param", "Value": "value", "Type": "String"}
)
)

Answer:

Terminal window
sam deploy \
--guided \
--stack-name my-stack \
--capabilities CAPABILITY_IAM

Answer:

template.yaml
Resources:
MyFunction:
Type: AWS::Serverless::Function
Properties:
Layers:
- !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:my-layer:1

Q866: How do you use Terraform remote state?

Section titled “Q866: How do you use Terraform remote state?”

Answer:

backend.tf
terraform {
backend "s3" {
bucket = "my-terraform-state"
key = "prod/terraform.tfstate"
region = "us-east-1"
}
}

Answer:

main.tf
module "vpc" {
source = "./modules/vpc"
cidr = "10.0.0.0/16"
}

Answer:

resource "aws_instance" "server" {
for_each = toset(["web1", "web2", "web3"])
ami = "ami-12345"
instance_type = "t3.micro"
tags = {
Name = each.value
}
}

Answer:

playbook.yml
- name: Launch EC2
hosts: localhost
tasks:
- ec2:
image: ami-12345
instance_type: t2.micro
count: 1

Answer:

template.json
{
"builders": [{
"type": "amazon-ebs",
"ami_name": "my-ami",
"instance_type": "t2.micro",
"source_ami": "ami-12345"
}]
}

Q871: How do you implement AWS Service Discovery?

Section titled “Q871: How do you implement AWS Service Discovery?”

Answer:

Terminal window
# Create private DNS namespace
aws servicediscovery create-private-dns-namespace \
--name local \
--vpc vpc-123
# Create service
aws servicediscovery create-service \
--name my-service \
--namespace-id ns-123

Answer:

Terminal window
# Create mesh
aws appmesh create-mesh \
--mesh-name my-mesh
# Create virtual node
aws appmesh create-virtual-node \
--mesh-name my-mesh \
--spec '{"listeners":[{"portMapping":{"port":80,"protocol":"http"}}]}'

Answer:

Terminal window
# Create namespace
aws servicediscovery create-private-dns-namespace \
--name service.local \
--vpc vpc-123
# Create service
aws servicediscovery create-service \
--name my-service \
--namespace-id ns-123

Q874: How do you implement AWS Step Functions Distributed Map?

Section titled “Q874: How do you implement AWS Step Functions Distributed Map?”

Answer:

{
"Comment": "Distributed Map",
"StartAt": "Map",
"States": {
"Map": {
"Type": "Map",
"ItemProcessor": {
"Processor": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke"
}
},
"End": true
}
}
}

Q875: How do you implement AWS EventBridge Scheduler?

Section titled “Q875: How do you implement AWS EventBridge Scheduler?”

Answer:

Terminal window
# Create schedule
aws eventsv2 create-schedule \
--name my-schedule \
--schedule-expression "rate(1 hour)" \
--target '{"Arn":"arn:aws:lambda:us-east-1:123:function:my-function"}'

Q876: How do you implement AWS Control Tower guardrails?

Section titled “Q876: How do you implement AWS Control Tower guardrails?”

Answer:

Q877: How do you implement AWS Audit Manager?

Section titled “Q877: How do you implement AWS Audit Manager?”

Answer:

Terminal window
# Create assessment
aws auditmanager create-assessment \
--name my-assessment \
--framework-id framework-id

Answer:

Q879: How do you implement AWS Resource Access Manager?

Section titled “Q879: How do you implement AWS Resource Access Manager?”

Answer:

Terminal window
# Create resource share
aws ram create-resource-share \
--name my-share \
--resource-arns arn:aws:ec2:us-east-1:123:subnet/subnet-123

Q880: How do you implement AWS Tag Editor?

Section titled “Q880: How do you implement AWS Tag Editor?”

Answer:


Q881: How do you implement AWS Cost Explorer API?

Section titled “Q881: How do you implement AWS Cost Explorer API?”

Answer:

Terminal window
aws ce get-cost-and-usage \
--time-period Start=2024-01-01,End=2024-01-31 \
--granularity DAILY \
--metrics UnblendedCost

Q882: How do you implement AWS Budgets Actions?

Section titled “Q882: How do you implement AWS Budgets Actions?”

Answer:

Terminal window
# Create budget action
aws budgets create-budget-action \
--account-id 123456789012 \
--budget-name my-budget \
--action-type STOP_EC2_INSTANCES \
--action-threshold '{"Type":"PERCENTAGE","Value":100}'

Q883: How do you implement AWS Compute Optimizer?

Section titled “Q883: How do you implement AWS Compute Optimizer?”

Answer:

Terminal window
# Opt-in
aws compute-optimizer update-enrollment-status \
--status Active
# Get recommendations
aws compute-optimizer get-ec2-instance-recommendations

Q884: How do you implement AWS License Manager?

Section titled “Q884: How do you implement AWS License Manager?”

Answer:

Terminal window
# Create license configuration
aws license-manager create-license-configuration \
--name my-license \
--license-counting-type vCPU

Q885: How do you implement AWS Marketplace subscriptions?

Section titled “Q885: How do you implement AWS Marketplace subscriptions?”

Answer:

Q886: How do you implement AWS Managed Services?

Section titled “Q886: How do you implement AWS Managed Services?”

Answer:

Q887: How do you use AWS Professional Services?

Section titled “Q887: How do you use AWS Professional Services?”

Answer:

Q888: How do you implement AWS QuickSight embed?

Section titled “Q888: How do you implement AWS QuickSight embed?”

Answer:

# Generate embed URL
quicksight = boto3.client('quicksight')
url = quicksight.get-dashboard-embed-url(
AwsAccountId='123456789012',
DashboardId='dashboard-id'
)

Q889: How do you implement AWS Data Exchange?

Section titled “Q889: How do you implement AWS Data Exchange?”

Answer:

Terminal window
# Create data set
aws dataexchange create-data-set \
--name my-dataset \
--asset-type S3_SNAPSHOT

Q890: How do you implement AWS Clean Rooms?

Section titled “Q890: How do you implement AWS Clean Rooms?”

Answer:

Terminal window
# Create collaboration
aws cleanrooms create-collaboration \
--name my-collab \
--members '[{"accountId":"111111111111","capabilities":["CAN_QUERY"]}]'

Q891: How do you implement AWS HealthLake?

Section titled “Q891: How do you implement AWS HealthLake?”

Answer:

Terminal window
# Create data store
aws healthlake create-fhir-datastore \
--datastore-name my-datastore \
--datastore-type-version R4

Q892: How do you implement AWS IoT Greengrass?

Section titled “Q892: How do you implement AWS IoT Greengrass?”

Answer:

Terminal window
# Create thing group
aws iot create-thing-group --thing-group-name my-group

Q893: How do you implement AWS IoT Core for edge?

Section titled “Q893: How do you implement AWS IoT Core for edge?”

Answer:

Terminal window
# Create edge configuration
aws iotthingsgraph create-flow-template \
--definition '{"nodes":[]}'

Answer:

Q895: How do you implement AWS Snow Family?

Section titled “Q895: How do you implement AWS Snow Family?”

Answer:

Terminal window
# Create job
aws snowball create-job \
--job-type EXPORT \
--address-id address-id \
--s3-resources '[{"BucketName":"my-bucket"}]'

Answer:

Q897: How do you implement AWS Local Zones?

Section titled “Q897: How do you implement AWS Local Zones?”

Answer:

Terminal window
# Enable Local Zone
aws ec2 describe-availability-zones \
--filters "Name=zone-type,Values=local-zone"
# Create subnet in Local Zone
aws ec2 create-subnet \
--vpc-id vpc-123 \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1-wl1-bos-wl-1

Q898: How do you implement AWS Wavelength?

Section titled “Q898: How do you implement AWS Wavelength?”

Answer:

Terminal window
# Create subnet in Wavelength Zone
aws ec2 create-subnet \
--vpc-id vpc-123 \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1-wl1-nyc-wl-1

Answer:

Answer:


Q901: Design a serverless data processing pipeline

Section titled “Q901: Design a serverless data processing pipeline”

Answer: S3 Events → Lambda → Kinesis → Firehose → S3 → Athena

Q902: Design a multi-tenant SaaS architecture

Section titled “Q902: Design a multi-tenant SaaS architecture”

Answer: Account isolation + Cognito + Per-tenant data + WAF

Answer: Multi-region with automated failover + backups + tested RTO/RPO

Answer: CodeCommit + CodeBuild + CodeDeploy + IAM + VPC + WAF

Q905: Design a real-time analytics dashboard

Section titled “Q905: Design a real-time analytics dashboard”

Answer: Kinesis + Firehose + OpenSearch + Kibana

Answer: API Gateway + Lambda + DynamoDB + Cognito + S3

Q907: Design a machine learning inference API

Section titled “Q907: Design a machine learning inference API”

Answer: API Gateway + Lambda + SageMaker endpoint

Answer: CloudFront + S3 + WAF + Route 53

Answer: Direct Connect + VPN + Storage Gateway + IAM federation

Answer: S3 Lifecycle → Glacier + Vault Lock + Cross-region replication

Q911: How do you optimize Lambda cold starts?

Section titled “Q911: How do you optimize Lambda cold starts?”

Answer: Use provisioned concurrency, minimize package, avoid VPC

Answer: IAM policies, VPC endpoints, encryption, fine-grained access

Answer: Multipart upload, CloudFront, prefix partitioning

Q914: How do you implement RDS high availability?

Section titled “Q914: How do you implement RDS high availability?”

Answer: Multi-AZ deployment, read replicas, automated backups

Answer: RBAC, network policies, pod security, secrets encryption

Answer: Target tracking, step scaling, scheduled scaling

Q917: How do you implement caching strategy?

Section titled “Q917: How do you implement caching strategy?”

Answer: CloudFront, ElastiCache, DAX, proper TTL

Q918: How do you implement disaster recovery testing?

Section titled “Q918: How do you implement disaster recovery testing?”

Answer: Regular DR drills, document procedures, automated testing

Q919: How do you implement cost allocation?

Section titled “Q919: How do you implement cost allocation?”

Answer: Tags, Cost Explorer, budgets, reports

Q920: How do you implement security monitoring?

Section titled “Q920: How do you implement security monitoring?”

Answer: GuardDuty, Security Hub, CloudTrail, Config

Q921: How do you implement incident response?

Section titled “Q921: How do you implement incident response?”

Answer: Runbooks, automation, escalation, communication

Q922: How do you implement change management?

Section titled “Q922: How do you implement change management?”

Answer: Code review, testing, deployment automation, rollback

Q923: How do you implement compliance monitoring?

Section titled “Q923: How do you implement compliance monitoring?”

Answer: Config rules, Security Hub, Audit Manager

Q924: How do you implement performance monitoring?

Section titled “Q924: How do you implement performance monitoring?”

Answer: CloudWatch, X-Ray, Performance Insights

Q925: How do you implement operational monitoring?

Section titled “Q925: How do you implement operational monitoring?”

Answer: CloudWatch dashboards, alarms, escalation

Q926: How do you implement backup automation?

Section titled “Q926: How do you implement backup automation?”

Answer: AWS Backup, lifecycle policies, cross-region replication

Q927: How do you implement secrets management?

Section titled “Q927: How do you implement secrets management?”

Answer: Secrets Manager, rotation, IAM policies

Q928: How do you implement access management?

Section titled “Q928: How do you implement access management?”

Answer: IAM roles, policies, MFA, access analyzer

Q929: How do you implement network security?

Section titled “Q929: How do you implement network security?”

Answer: VPC, security groups, NACLs, WAF, Shield

Q930: How do you implement data encryption?

Section titled “Q930: How do you implement data encryption?”

Answer: KMS, client-side encryption, SSL/TLS

Q931: How do you implement logging strategy?

Section titled “Q931: How do you implement logging strategy?”

Answer: CloudTrail, CloudWatch, centralized S3, retention policies

Q932: How do you implement alerting strategy?

Section titled “Q932: How do you implement alerting strategy?”

Answer: CloudWatch alarms, SNS, escalation, runbooks

Q933: How do you implement automation strategy?

Section titled “Q933: How do you implement automation strategy?”

Answer: Systems Manager, Lambda, EventBridge, pipelines

Q934: How do you implement infrastructure testing?

Section titled “Q934: How do you implement infrastructure testing?”

Answer: CloudFormation validation, cfn-lint, taskcat

Q935: How do you implement blue-green deployment?

Section titled “Q935: How do you implement blue-green deployment?”

Answer: Two environments, weighted routing, automated rollback

Q936: How do you implement canary deployment?

Section titled “Q936: How do you implement canary deployment?”

Answer: Gradual rollout, monitoring, automated rollback

Answer: AppConfig, code integration, monitoring

Answer: CloudFront, Lambda@Edge, user segmentation

Q939: How do you implement chaos engineering?

Section titled “Q939: How do you implement chaos engineering?”

Answer: AWS Fault Injection Simulator, controlled experiments

Answer: CloudWatch, X-Ray, distributed tracing, logging

Q941: How do you implement cost optimization?

Section titled “Q941: How do you implement cost optimization?”

Answer: Rightsizing, reservations, spot, automation

Q942: How do you implement sustainability?

Section titled “Q942: How do you implement sustainability?”

Answer: Serverless, right-sizing, managed services, regions

Answer: Consistent tooling, abstraction, portability

Answer: Direct Connect, VPN, consistent networking

Q945: How do you implement edge computing?

Section titled “Q945: How do you implement edge computing?”

Answer: Lambda@Edge, Outposts, Wavelength, Local Zones

Answer: IoT Core, rules, stream processing, analytics

Answer: SageMaker, MLOps, model registry, monitoring

Q948: How do you implement data governance?

Section titled “Q948: How do you implement data governance?”

Answer: Lake Formation, Glue, access control, catalog

Q949: How do you implement API management?

Section titled “Q949: How do you implement API management?”

Answer: API Gateway, throttling, auth, versioning

Q950: How do you implement message patterns?

Section titled “Q950: How do you implement message patterns?”

Answer: SQS, SNS, EventBridge, Kinesis

Q951: How do you implement event sourcing?

Section titled “Q951: How do you implement event sourcing?”

Answer: Store events, replay, CQRS pattern

Answer: Separate read/write models, eventual consistency

Answer: Orchestrated compensation, event-driven

Q954: How do you implement circuit breaker?

Section titled “Q954: How do you implement circuit breaker?”

Answer: State machine, fallback, recovery

Answer: Thread pools, isolation, resource limits

Q956: How do you implement retry strategy?

Section titled “Q956: How do you implement retry strategy?”

Answer: Exponential backoff, jitter, limits

Answer: Deduplication, conditional writes

Answer: Cache-aside, write-through, invalidation

Answer: Token bucket, throttling, quotas

Answer: API Gateway throttling, WAF rate rules

Q961: How do you implement queue depth monitoring?

Section titled “Q961: How do you implement queue depth monitoring?”

Answer: CloudWatch metrics, alarms, scaling

Q962: How do you implement connection pooling?

Section titled “Q962: How do you implement connection pooling?”

Answer: RDS Proxy, ElastiCache, proper configuration

Q963: How do you implement connection draining?

Section titled “Q963: How do you implement connection draining?”

Answer: ALB draining, instance replacement delays

Q964: How do you implement graceful shutdown?

Section titled “Q964: How do you implement graceful shutdown?”

Answer: Lifecycle hooks, signal handling, cleanup

Answer: ELB health checks, auto-scaling, replacement

Q966: How do you implement circuit isolation?

Section titled “Q966: How do you implement circuit isolation?”

Answer: Security groups, network isolation, VPC

Q967: How do you implement data partitioning?

Section titled “Q967: How do you implement data partitioning?”

Answer: Shard keys, partition strategy, distribution

Answer: Application-level, DynamoDB partition keys

Answer: Cross-region, read replicas, multi-master

Answer: Aurora, DynamoDB global tables, consensus protocols

Answer: DynamoDB conditional writes, database locks

Answer: Database transactions, distributed transactions

Q973: How do you implement two-phase commit?

Section titled “Q973: How do you implement two-phase commit?”

Answer: Prepare phase, commit phase, rollback

Q974: How do you implement optimistic locking?

Section titled “Q974: How do you implement optimistic locking?”

Answer: Version fields, conditional updates

Q975: How do you implement pessimistic locking?

Section titled “Q975: How do you implement pessimistic locking?”

Answer: Locks, SELECT FOR UPDATE

Q976: How do you implement eventually consistent reads?

Section titled “Q976: How do you implement eventually consistent reads?”

Answer: Read replicas, consistency models

Q977: How do you implement strong consistency?

Section titled “Q977: How do you implement strong consistency?”

Answer: Primary writes, read-after-write

Answer: DynamoDB TTL, S3 lifecycle, cleanup

Answer: Lifecycle policies, Glacier, cold storage

Q980: How do you implement data retention?

Section titled “Q980: How do you implement data retention?”

Answer: Policies, versioning, cleanup

Q981: How do you implement data compliance?

Section titled “Q981: How do you implement data compliance?”

Answer: Encryption, access control, audit

Q982: How do you implement data residency?

Section titled “Q982: How do you implement data residency?”

Answer: Region selection, controls, compliance

Q983: How do you implement GDPR compliance?

Section titled “Q983: How do you implement GDPR compliance?”

Answer: Data encryption, access control, deletion

Q984: How do you implement HIPAA compliance?

Section titled “Q984: How do you implement HIPAA compliance?”

Answer: Encryption, audit logging, BAA

Q985: How do you implement PCI compliance?

Section titled “Q985: How do you implement PCI compliance?”

Answer: Encryption, segmentation, monitoring

Q986: How do you implement SOC compliance?

Section titled “Q986: How do you implement SOC compliance?”

Answer: Logging, access control, monitoring

Q987: How do you implement ISO compliance?

Section titled “Q987: How do you implement ISO compliance?”

Answer: Documentation, controls, audits

Q988: How do you implement FedRAMP compliance?

Section titled “Q988: How do you implement FedRAMP compliance?”

Answer: High security controls, region selection

Q989: How do you implement CJIS compliance?

Section titled “Q989: How do you implement CJIS compliance?”

Answer: Criminal justice data controls

Q990: How do you implement ITAR compliance?

Section titled “Q990: How do you implement ITAR compliance?”

Answer: Export controls, data residency

Answer: Lambda transformation, column-level security

Answer: Secrets Manager, KMS, token vaults

Q993: How do you implement field-level encryption?

Section titled “Q993: How do you implement field-level encryption?”

Answer: KMS, client-side encryption, application logic

Answer: KMS automatic rotation, manual rotation

Q995: How do you implement key management?

Section titled “Q995: How do you implement key management?”

Answer: KMS, HSM, key policies, access control

Q996: How do you implement certificate management?

Section titled “Q996: How do you implement certificate management?”

Answer: ACM, rotation, import, validation

Answer: ACM client certificates, API Gateway

Answer: IAM Identity Center, third-party IdP

Answer: Cognito, external IdP integration

Answer: Cognito, API Gateway authorizer, scopes