Hard Difficulty Questions

Deploy all resources to the largest EC2 instance type available

Why wrong: Scaling vertically (larger instances) doesn't address AZ-level failures — a single oversized instance in one AZ is still a single point of failure.

Use Amazon S3 for all data storage

Why wrong: S3 is highly durable but using S3 alone doesn't make compute and database layers fault-tolerant against AZ failures.

Enable AWS CloudTrail in all regions

Why wrong: CloudTrail provides audit logging — it doesn't affect application reliability or AZ fault tolerance.

On-Demand Instances

Why wrong: On-Demand provides immediate availability with no interruption, but at the highest per-hour cost — not the lowest cost option.

Reserved Instances (1-year, No Upfront)

Why wrong: Reserved Instances require a 1 or 3-year commitment — inappropriate for unpredictable short-lived workloads that may not run consistently enough to justify the commitment.

Dedicated Hosts

Why wrong: Dedicated Hosts are the most expensive EC2 option, used for license compliance with software that requires dedicated physical servers.

Performing large batch deployments monthly to minimize change frequency

Why wrong: Large infrequent deployments increase risk — each change is harder to isolate, rollback is complex, and failures affect more functionality simultaneously.

Requiring manual approval for every code change

Why wrong: Manual approval for every change creates bottlenecks and slows delivery — automation with appropriate gates is preferred.

Deploying all microservices simultaneously in coordinated releases

Why wrong: Coordinated multi-service deployments increase blast radius and complicate rollback — independent deployment per service is preferred in microservices architectures.

Provisioning maximum instance sizes to ensure peak performance at all times

Why wrong: Over-provisioning wastes energy on idle capacity — sustainability requires right-sizing to match actual demand.

Running workloads 24/7 even when not needed to maintain warm state

Why wrong: Always-on resources that aren't needed consume unnecessary energy — sustainability practices recommend turning off unused resources.

Replicating all data to multiple regions for maximum redundancy

Why wrong: Unnecessary replication increases energy consumption and data transfer — sustainability requires balancing redundancy needs against environmental impact.

Compute Savings Plans provide higher discounts than EC2 Instance Savings Plans

Why wrong: EC2 Instance Savings Plans provide the higher discount (up to 72%) in exchange for committing to a specific instance family and region. Compute Savings Plans offer up to 66% for maximum flexibility.

EC2 Instance Savings Plans are more flexible and apply across all instance families

Why wrong: EC2 Instance Savings Plans are the less flexible option — they're committed to a specific instance family in a specific region.

Both Savings Plans types require specifying the exact instance size at purchase

Why wrong: Neither Savings Plans type requires specifying a specific instance size — both apply to any size within their scope (family for EC2 Instance Plans, any for Compute Plans).

Have all services call each other directly via synchronous API calls

Why wrong: Direct synchronous calls create tight coupling — if the downstream service is slow or fails, it directly impacts the upstream caller.

Deploy all application components on a single large EC2 instance

Why wrong: A monolith on a single instance is the most tightly coupled architecture — all components fail together and can't scale independently.

Use a single shared database for all microservices

Why wrong: A shared database creates tight coupling through the data layer — services become interdependent through shared schema and transactions.

AWS CloudFormation for repeatable deployments

Why wrong: CloudFormation provides consistent, repeatable infrastructure provisioning — it doesn't automatically adjust capacity based on demand.

AWS Trusted Advisor cost optimization checks

Why wrong: Trusted Advisor identifies idle and underutilized resources — it recommends changes but doesn't automatically adjust capacity.

AWS Cost Explorer right-sizing recommendations

Why wrong: Right-sizing recommendations help select appropriate instance types based on historical usage, but don't automatically scale capacity in response to demand changes.

SSE-S3 (Amazon S3-managed keys)

Why wrong: SSE-S3 uses AWS-managed keys — AWS controls the keys and can decrypt data. A customer has no independent control over the encryption keys.

SSE-KMS with an AWS managed CMK (aws/s3)

Why wrong: AWS managed CMKs are controlled by AWS — the customer doesn't have independent control over key rotation, access policies, or deletion.

S3 Versioning with MFA Delete

Why wrong: MFA Delete protects against unauthorized deletion of object versions — it doesn't encrypt the data or control encryption key ownership.

Manual restart procedures documented in a runbook

Why wrong: Manual procedures don't implement automatic recovery — they require human intervention and increase recovery time.

AWS CloudTrail + Amazon CloudWatch

Why wrong: CloudTrail and CloudWatch provide logging and alerting — they detect failures but don't automatically recover from them.

AWS Config rules with manual remediation

Why wrong: Config rules detect configuration drift — manual remediation doesn't implement automatic recovery.

AWS Cost Explorer only

Why wrong: Cost Explorer alone provides historical analysis but lacks the budget alerting, automated actions, granular data export, and commitment discount planning of a complete FinOps setup.

AWS Pricing Calculator + CloudWatch Billing Alarms

Why wrong: Pricing Calculator is for pre-deployment estimates and CloudWatch billing alarms are a basic alerting mechanism — this combination lacks the depth needed for comprehensive FinOps.

AWS Trusted Advisor only

Why wrong: Trusted Advisor provides cost optimization recommendations but doesn't provide granular billing data, budgeting, or commitment discount management.

AWS CloudTrail

Why wrong: CloudTrail records when keys were created and used but doesn't proactively evaluate key age compliance against a 90-day policy.

Amazon GuardDuty

Why wrong: GuardDuty uses ML to detect threats — it doesn't evaluate access key rotation policy compliance.

AWS IAM Access Analyzer

Why wrong: IAM Access Analyzer identifies resources accessible from outside the account and generates least-privilege policies — it doesn't track credential rotation compliance.

Encrypt all data at rest using AWS KMS

Why wrong: Encrypting data at rest is a Security pillar recommendation — not Operational Excellence.

Use Reserved Instances to minimize cost

Why wrong: Using Reserved Instances is a Cost Optimization pillar recommendation — not Operational Excellence.

Deploy across multiple Availability Zones

Why wrong: Multi-AZ deployment is a Reliability pillar recommendation for fault tolerance — not specifically Operational Excellence.

Design for failure

Why wrong: Design for failure is a Reliability pillar principle focused on fault tolerance architecture, not eliminating commodity infrastructure work.

Implement least-privilege access controls

Why wrong: Least-privilege is a Security pillar principle focused on IAM permissions, not operational cost reduction.

Automate infrastructure provisioning

Why wrong: Infrastructure automation (IaC) reduces manual effort but is about operational efficiency, not the broader concept of eliminating undifferentiated work.

Enable S3 server-side encryption on all buckets

Why wrong: Encryption protects data at rest from unauthorized physical access — it doesn't prevent public exposure via misconfigured bucket policies.

Enable S3 versioning on all buckets

Why wrong: S3 versioning preserves deleted and overwritten objects — it doesn't control public access permissions.

Enable S3 Transfer Acceleration for all buckets

Why wrong: Transfer Acceleration improves upload speed from geographically dispersed clients — it has no effect on access permissions.

The remaining 4 instances are free since the Savings Plan covers all usage

Why wrong: Savings Plans discount usage up to the committed amount — they don't provide free usage beyond the commitment.

The remaining 4 instances are charged at Spot Instance rates

Why wrong: Savings Plans don't convert excess usage to Spot pricing — unplanned excess is charged at On-Demand rates.

AWS suspends the 4 excess instances to enforce the Savings Plan limit

Why wrong: AWS never suspends instances due to Savings Plan limits — excess usage above the commitment is simply charged at On-Demand rates.

Eliminating hardware refresh cycles

Why wrong: Eliminating hardware refresh is a major TCO reduction benefit of cloud migration.

Reducing data center facility costs

Why wrong: Reducing facility costs (power, cooling, space) is a key TCO benefit.

Pay-as-you-go pricing model

Why wrong: Pay-as-you-go eliminates over-provisioning, reducing overall TCO.

AWS Trusted Advisor

Why wrong: Trusted Advisor offers recommendations across multiple categories but is not specifically a continuous security assessment service.

Amazon Detective

Why wrong: Detective helps investigate and analyze security incidents after detection, not proactive assessment.

AWS Config

Why wrong: Config tracks resource configuration changes; Security Hub is the comprehensive security posture management service.

AWS DataSync

Why wrong: DataSync automates data transfer over the network, suitable for smaller or ongoing transfers, not petabyte-scale offline transfer.

AWS Transfer Family

Why wrong: Transfer Family supports SFTP/FTP transfers into S3, not offline petabyte-scale transfer.

Amazon S3 Multipart Upload

Why wrong: Multipart Upload improves transfer efficiency over the network but cannot replace physical transfer for petabyte datasets.

Standard Reserved Instances

Why wrong: Standard RIs are locked to specific instance types and regions, not flexible across instance families.

Spot Instances

Why wrong: Spot Instances do not involve term commitments; they can be interrupted at any time.

Convertible Reserved Instances

Why wrong: Convertible RIs allow attribute changes but are still locked to EC2 and offer less flexibility than Savings Plans.

AWS Config

Why wrong: AWS Config evaluates resource configurations and tracks compliance against rules, but it does not provide downloadable AWS compliance reports like SOC or PCI DSS AOC.

AWS Audit Manager

Why wrong: AWS Audit Manager helps continuously audit AWS usage to simplify risk assessment and compliance. It assists in collecting evidence from customer workloads, but it does not provide the underlying AWS compliance reports.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides recommendations for optimizing cost, performance, security, and fault tolerance, but it does not provide compliance reports or attestations from AWS.