Hard Difficulty Questions

S3 mounted as a POSIX file system without a file gateway

Why wrong: S3 is object storage and does not provide native POSIX shared file semantics.

Instance store volumes

Why wrong: Instance store is ephemeral and tied to a single instance.

An EBS volume attached to all instances

Why wrong: A standard EBS volume is zonal and cannot be attached broadly as shared file storage.

Allow the Account B root principal to assume the role if the caller knows the role ARN.

Why wrong: This would work technically, but it is far too broad and does not protect against confused deputy abuse. Any principal in Account B that can reach the role could potentially use it, which violates the customer’s security requirement.

Attach a permissions boundary to the role so that the vendor cannot exceed the approved permissions.

Why wrong: A permissions boundary limits what permissions the role can have after it is assumed, but it does not stop an unintended principal from assuming the role. It addresses privilege scope, not confused deputy risk.

Require MFA for the role assumption because it ensures only the vendor’s production automation can use the role.

Why wrong: MFA is not a practical control for non-human automation and does not solve cross-account confused deputy risk. The vendor’s automation should use a trust policy with a specific principal and an ExternalId instead.

Increase the Lambda timeout so the function has more time to initialize during the spike.

Why wrong: A longer timeout does not remove cold starts or pre-initialize execution environments. It only changes how long a function may run before timing out. The user-facing latency issue would remain, so this does not solve the core problem.

Double the memory size during the spike without changing the concurrency model.

Why wrong: More memory can improve CPU allocation and sometimes reduce execution duration, but it does not guarantee that the environment is already warm. Without provisioned concurrency, the first requests can still incur cold-start penalties. The scenario specifically calls for stable p95 latency.

Move the function into more Availability Zones so the platform can spread cold starts across regions.

Why wrong: Lambda already runs as a managed regional service and does not need the customer to place individual functions across AZs. Spreading across AZs does not eliminate cold starts. The issue is initialization time, not geographic distribution.

Use CloudFront signed URLs

Why wrong: Signed URLs control content access and do not provide event delivery.

Use UDP messages sent directly to workers

Why wrong: UDP does not provide durable at-least-once delivery.

Use an in-memory queue on one EC2 instance

Why wrong: A single in-memory queue is not durable or highly available.

Keep the files in S3 Standard indefinitely so retrieval is always fast.

Why wrong: S3 Standard provides fast access, but it is unnecessarily expensive for multi-year retention of footage that is rarely needed.

Copy the files to a single EBS volume for lower per-GB cost.

Why wrong: EBS is block storage and is not suitable for massive archival libraries with lifecycle and retention requirements like these.

Replace the instances with a larger instance family so each server has more headroom.

Why wrong: Bigger instances can help only when compute saturation is the main bottleneck, but the exhibit points to queue buildup and request concurrency.

Use scheduled scaling to add instances only during the business hours peak window.

Why wrong: Scheduled scaling follows the clock, not live demand, so it cannot react well to sudden surges or shifting traffic patterns.

Replace the ALB with a Network Load Balancer to reduce request latency.

Why wrong: A Network Load Balancer changes the front end, but the logs show application thread exhaustion rather than load balancer overhead.

Deploy a NAT Gateway in each Availability Zone and route artifact traffic through it.

Why wrong: A NAT Gateway would work for connectivity, but it creates exactly the cost the team wants to remove. The gateway endpoint is the cost-optimized private option.

Use the S3 static website endpoint because it automatically enforces HTTPS.

Why wrong: S3 website endpoints are not the right choice for private CI uploads and do not provide the required transport and encryption controls. They are intended for public website hosting patterns.

AWS Organizations service control policies

Why wrong: SCPs enforce permissions and do not provide regional failover.

S3 Transfer Acceleration

Why wrong: Transfer Acceleration improves upload paths to S3 but does not provide application failover.

DAX

Why wrong: DAX improves read performance but does not provide recovery.

Global secondary indexes

Why wrong: GSIs support query access patterns but do not protect against data loss.

Tag encrypted volumes after creation

Why wrong: Tags identify resources but do not enforce encryption.

Enable VPC Flow Logs

Why wrong: Flow Logs monitor network traffic and do not control EBS encryption.

Run a daily Lambda function to encrypt unencrypted volumes

Why wrong: Reactive remediation leaves a window of exposure.

Add a permission boundary to the developer role that points to ApprovedAppBoundary.

Why wrong: That only constrains the developer role itself; it does not force new roles to use the approved boundary.

Use an S3 bucket policy to block policy documents that grant AdministratorAccess.

Why wrong: S3 bucket policies do not control IAM role creation or IAM policy attachment.

Require team members to use STS session policies when they create new roles.

Why wrong: Session policies only limit temporary sessions and do not force a permissions boundary on newly created roles.

Create a global secondary index with the same date key

Why wrong: A GSI with the same hot key can suffer the same partition problem.

Move the table to S3 Glacier Instant Retrieval

Why wrong: S3 Glacier is object storage and not a DynamoDB write scaling solution.

Reduce the table's write capacity

Why wrong: Reducing capacity worsens throttling.

Spread the instances across three Availability Zones for better fault tolerance.

Why wrong: Spreading across AZs improves resilience, but it increases network distance and typically adds latency. The scenario is explicitly about minimizing jitter and latency for frequent east-west traffic within one AZ, so multi-AZ spread is the wrong optimization.

Front the nodes with an Application Load Balancer to balance the internal messages.

Why wrong: An ALB is for HTTP/HTTPS application traffic, not for direct node-to-node messaging performance. It adds a layer that does not solve the underlying east-west latency issue. The workload needs closer physical placement and better networking, not a web load balancer.

Store the messages on EBS volumes so the nodes avoid network communication.

Why wrong: EBS is block storage for persistent data, not a low-latency message bus. Writing messages to disk would add storage latency and does not create efficient inter-node communication. It also changes the workload architecture in an unsupported way for this requirement.

Keep sending all traffic to the writer endpoint because it always has the freshest data.

Why wrong: Incorrect. Although the writer has the most recent committed data, forcing all reads through it creates a bottleneck and defeats Aurora's read-scaling design. A reader endpoint is the appropriate choice for read traffic.

Replace Aurora with a single larger RDS instance and continue using the same read pattern.

Why wrong: Incorrect. A larger single instance may provide more CPU or memory, but it still concentrates reads and writes on one node and does not provide the same horizontal read scaling or failover abstraction as Aurora replicas and cluster endpoints.

Store the database password in user data

Why wrong: User data can be read from the instance and is not appropriate for secrets.

Embed the database password in the AMI

Why wrong: Baking secrets into an AMI makes rotation and exposure control difficult.

Use a security group rule that allows only application instances

Why wrong: Security groups limit network access but do not replace database authentication.

Create a global secondary index with the same date key

Why wrong: A GSI with the same hot key can suffer the same partition problem.

Reduce the table's write capacity

Why wrong: Reducing capacity worsens throttling.

Move the table to S3 Glacier Instant Retrieval

Why wrong: S3 Glacier is object storage and not a DynamoDB write scaling solution.

Amazon S3 with multipart uploads because it provides durable object storage and high throughput.

Why wrong: S3 is object storage, not block storage, and it cannot serve the low-latency random I/O pattern shown in the benchmark.

Amazon EFS because it can be mounted by EC2 and supports persistent file access.

Why wrong: EFS is shared file storage, but it generally has higher latency than provisioned block storage for this single-instance random I/O workload.

Amazon FSx for Windows File Server because it offers durable storage and low latency.

Why wrong: FSx for Windows File Server is a managed file system for Windows-based use cases, not the best fit for a single Linux EC2 block-storage workload.

Use an Application Load Balancer because path-based routing improves throughput for binary protocols.

Why wrong: Incorrect because ALB is an HTTP/HTTPS layer-7 load balancer. Its routing features do not help a custom TCP protocol and add unnecessary protocol overhead.

Expose the service through API Gateway because it supports raw TCP and UDP pass-through.

Why wrong: Incorrect because API Gateway is for API protocols such as HTTP and WebSocket, not raw TCP or UDP pass-through. It is not the right fit for a custom binary telemetry stream.

Use a single large x86 instance with On-Demand pricing to avoid interruptions.

Why wrong: A single On-Demand instance is usually more expensive and less flexible than a checkpointed fleet. It also creates a single point of failure for the batch window. Since the workload explicitly tolerates interruption, paying for uninterrupted capacity is not the best economic choice.

Replace the batch workers with a Lambda function to eliminate instance management.

Why wrong: Lambda is not a general-purpose replacement for CPU-bound rendering pipelines that may run for a long time and rely on checkpointing. Its execution model and resource profile do not match this workload well. This would likely increase complexity and limit performance rather than improve throughput per dollar.

Move the workload to a spread placement group to increase cost efficiency.

Why wrong: Spread placement groups are designed for fault isolation, not cost reduction. They do not lower instance pricing and are unnecessary for a checkpointed batch workload that can resume after interruption. The question asks about throughput per dollar, which is better addressed by instance family selection and purchasing model.

Keep both workloads on large provisioned RDS instances and add read replicas for the cart store.

Why wrong: Incorrect. This keeps both systems on fixed-capacity relational infrastructure even where a simpler managed database would be cheaper. The cart workload does not justify expensive relational replicas.

Use DynamoDB provisioned capacity with a fixed minimum despite the unpredictable traffic.

Why wrong: Incorrect. Fixed provisioned capacity can be cheaper only when traffic is stable and predictable. Here, the company explicitly wants to avoid paying for idle capacity during variable demand.

Replace the relational order system with a wide-column table to reduce SQL licensing.

Why wrong: Incorrect. Replacing the relational system would force a redesign and remove the SQL and transaction model that order processing usually needs. Cost optimization should not break the application requirements.