Hard Difficulty Questions

Launch the database instance in a public subnet.

Why wrong: Public subnets are internet-facing; database should be in private subnet.

Store database credentials in AWS Systems Manager Parameter Store.

Why wrong: This is a best practice but does not address network security.

Migrate the proprietary storage to Amazon S3

Why wrong: S3 is object storage, not suitable as a direct replacement for file-based or relational storage.

Migrate the proprietary storage to Amazon RDS for PostgreSQL

Why wrong: Migrating proprietary file-based storage to Amazon RDS for PostgreSQL is not a valid strategy because it requires rewriting the application to use JDBC/SQL, contradicting the goal of minimizing code changes. Additionally, file-based storage is not suited for relational databases.

Refactor the application into microservices and deploy on Amazon EKS

Why wrong: Refactoring to microservices requires significant code changes, not minimal.

The GuardDuty detector in the management account is not configured to publish findings to S3.

Why wrong: The management account can publish its own findings, but member accounts need separate configuration.

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Why wrong: GuardDuty can publish to S3.

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

Why wrong: The bucket policy likely includes the service principal.

Attach an IAM role to the underlying EC2 instance.

Why wrong: Fargate does not use underlying EC2 instances.

Assign an IAM role to the ECS service using the ECS service-linked role.

Why wrong: The service-linked role is for ECS to manage resources, not for the application.

Store AWS credentials in the container environment variables.

Why wrong: Storing credentials in environment variables is insecure.

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Why wrong: Manual setup per account/region is inefficient.

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Why wrong: This adds complexity; AWS Config already supports automatic remediation natively.

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Why wrong: SCPs are preventive, not reactive; they cannot trigger remediation.

AWS CloudFormation

Why wrong: CloudFormation is for infrastructure as code, not CI/CD pipeline.

AWS CodeDeploy

Why wrong: CodeDeploy does not natively support EKS; use Helm or kubectl.

AWS Lambda

Why wrong: Lambda can process streaming data but does not natively support Apache Flink.

Amazon Kinesis Data Firehose

Why wrong: Firehose is for loading data to destinations like S3 or Redshift, not for Flink processing.

Amazon Simple Queue Service (SQS)

Why wrong: SQS is a message queue, not designed for streaming ingestion.

SSE-S3

Why wrong: Uses AWS-managed keys, not CloudHSM.

Client-side encryption

Why wrong: Encryption is done before upload, not S3-managed.

SSE-KMS

Why wrong: Uses KMS, not CloudHSM.

Use a NAT instance to perform SSL termination and redirect.

Why wrong: NAT instances are not designed for SSL termination.

Install the certificate on each EC2 instance and configure the web server to redirect HTTP to HTTPS.

Why wrong: Instance-level termination is not recommended; ACM certificates are best used with load balancers.

Deploy a CloudFront distribution with the ACM certificate and redirect HTTP to HTTPS at the distribution level.

Why wrong: CloudFront is overkill for a simple redirect; it adds cost and complexity.

Amazon RDS

Why wrong: Shared database creates coupling.

Amazon ElastiCache

Why wrong: Caching, not decoupling.

Connection draining (deregistration delay).

Why wrong: Helps with graceful shutdown, not sticky sessions.

Health checks to ensure only healthy instances receive traffic.

Why wrong: Not related to session stickiness.

Cross-zone load balancing.

Why wrong: Does not relate to session stickiness.

Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

Why wrong: A single EC2 instance is a single point of failure; read replicas are for read scaling, not automatic failover.

Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

Why wrong: Snapshot backup RPO can be up to 24 hours; restoring from S3 is slow, RTO will exceed 30 minutes.

Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

Why wrong: Multi-AZ is within a region; cross-Region load balancing is not a native feature; keeping instances running incurs cost.

Manually create and copy AMIs to the secondary region weekly

Why wrong: Manual weekly copies do not meet the 15-minute RPO.

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Why wrong: Multi-AZ Auto Scaling groups replicate EC2 instances across Availability Zones within a single AWS Region, not across AWS Regions, so they cannot achieve cross-region data replication for an RPO of 15 minutes. This option is tempting because Multi-AZ deployment is a standard pattern for high availability and fault tolerance within a Region, and it would be the correct choice if the requirement were to survive an Availability Zone failure rather than a full Region outage.

Use Amazon DynamoDB Accelerator (DAX) to cache database queries.

Why wrong: DAX is for DynamoDB, not Aurora.

Add an Amazon ElastiCache Redis cluster in front of the database.

Why wrong: Caching would require significant application changes.

Increase the instance size of the Aurora primary instance.

Why wrong: This may help but is less efficient than adding replicas for read-heavy workloads.

Migrate the database to Amazon Aurora MySQL-Compatible Edition with Auto Scaling and enable performance insights.

Why wrong: Migrating to Aurora is a significant change and may not be considered minimal.

Implement an in-memory caching layer using Amazon ElastiCache for Memcached and modify the application to check the cache first.

Why wrong: Requires application code modifications.

Replace the RDS database with Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching.

Why wrong: Complete database change is not minimal and requires major code changes.

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Why wrong: SSE-S3 not customer-managed; server access logs do not capture KMS operations.

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Why wrong: SSE-S3 uses AWS-managed keys, not customer-managed.

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

Why wrong: Client-side encryption is not server-side; CloudWatch logs are not for auditing.

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Why wrong: Permissions boundaries are per-role and need to be applied to each role.

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Why wrong: Reactive approach; instances can be launched and incur cost before termination.

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Why wrong: Denying disallowed Regions is correct, but the answer as written is ambiguous; the best practice is to explicitly allow only allowed Regions.

The member account must create an IAM role to assume for launching resources in the shared subnet.

Why wrong: No IAM role is needed; resources can be launched directly.

The member account must create a VPC and then associate the shared subnet.

Why wrong: The shared subnet is already associated with the member account's VPC.

The member account must accept the resource share invitation.

Why wrong: Resource shares within the organization are automatically accepted.

Amazon Route 53

Why wrong: Route 53 is for DNS, not service discovery in mesh.

AWS Direct Connect

Why wrong: Direct Connect is for hybrid connectivity.

AWS Config

Why wrong: Config tracks resource configuration but does not audit IAM permissions.

Amazon GuardDuty

Why wrong: GuardDuty detects threats, not IAM permission audit.