Hard Difficulty Questions

Use Amazon RDS Proxy with a single database

Why wrong: RDS Proxy does not address the shared database coupling.

Use Amazon DynamoDB for all microservices

Why wrong: DynamoDB may not support complex relational queries.

Use a single Amazon RDS instance shared across all microservices

Why wrong: Shared database creates tight coupling and scaling issues.

Migrate the application to use Amazon DynamoDB with global tables.

Why wrong: This requires significant application changes.

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Why wrong: Multi-AZ standby is not used for read traffic.

Implement Amazon ElastiCache in front of the database to cache read queries.

Why wrong: ElastiCache requires application changes to implement caching logic.

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Why wrong: Lifecycle policies do not affect access permissions.

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Why wrong: The analyst already has read-only access; assuming a role may not be necessary.

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Why wrong: The question does not mention encryption; this is not the most likely cause.

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Why wrong: SCPs cannot enforce a password policy or require MFA; they only deny or allow actions.

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Why wrong: AWS Config rules can detect but not remediate automatically unless combined with custom automation.

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Why wrong: CloudTrail logs but does not enforce or remediate.

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Why wrong: CloudTrail logs but does not enforce.

Use Service Quotas to restrict the number of instances of specific types.

Why wrong: Service Quotas limit the count, not the type.

Create an IAM policy in each account that denies the specified instance types.

Why wrong: IAM policies are not automatically inherited; would require per-account setup.

Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

Why wrong: Not automatic.

Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

Why wrong: SCPs cannot check password policy content.

Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

Why wrong: Reactive, not preventive.

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Why wrong: Tags can be changed; SCPs at OU level are more effective.

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Why wrong: Permissions boundaries are per-role and do not prevent cross-account access at the organization level.

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Why wrong: Does not prevent access to resources that are not shared; SCP is more comprehensive.

Use step scaling policies based on memory utilization.

Why wrong: Step scaling is more complex, not necessary here.

Use scheduled scaling to increase capacity during business hours.

Why wrong: Scheduled scaling cannot handle unexpected spikes.

Use simple scaling policies based on CPU utilization.

Why wrong: Simple scaling is less responsive.

Use DynamoDB Streams to trigger the Lambda function for each record.

Why wrong: DynamoDB Streams are not the source; the source is Kinesis.

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Why wrong: SQS FIFO does not directly integrate with Kinesis Data Streams.

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Why wrong: Step Functions can orchestrate but does not guarantee ordering from Kinesis.

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Why wrong: ASCP is recommended for integration with Secrets Manager.

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Why wrong: Kubernetes Secrets are not automatically rotated and are less secure.

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Why wrong: Single region does not provide multi-region distribution.

Use Amazon CloudFront with origins in each region.

Why wrong: CloudFront is for static content caching.

Use AWS Global Accelerator with Network Load Balancers in each region.

Why wrong: Global Accelerator is for TCP/UDP, not HTTP.

Amazon Route 53

Why wrong: Route 53 is for DNS, not service discovery in mesh.

AWS Direct Connect

Why wrong: Direct Connect is for hybrid connectivity.

Enable DynamoDB Accelerator (DAX) for the Lambda function

Why wrong: DAX is a cache, not relevant to message processing.

Provisioned Concurrency on the Lambda function

Why wrong: Provisioned Concurrency is for cold starts, not for preventing message loss.

Increase the SQS queue visibility timeout and retention period

Why wrong: This does not prevent message loss during throttling.

The Lambda function does not have permission to create log groups.

Why wrong: Log permissions are granted, and missing log permissions would cause a different error.

The Lambda function is not in the same VPC as DynamoDB.

Why wrong: DynamoDB is accessible over the internet; VPC is not required.

The DynamoDB table 'Orders' does not exist.

Why wrong: The error is AccessDenied, not ResourceNotFoundException.

Attach an IAM role to the underlying EC2 instance.

Why wrong: Fargate does not use underlying EC2 instances.

Assign an IAM role to the ECS service using the ECS service-linked role.

Why wrong: The service-linked role is for ECS to manage resources, not for the application.

Store AWS credentials in the container environment variables.

Why wrong: Storing credentials in environment variables is insecure.

Create a custom AMI that pre-populates session data from Amazon S3.

Why wrong: Session data is dynamic and cannot be pre-populated in an AMI.

Increase the Auto Scaling group's cooldown period to 600 seconds.

Why wrong: Longer cooldown delays scaling, which can cause performance issues.

Enable sticky sessions (session affinity) on the ALB.

Why wrong: Sticky sessions route traffic to the same instance but do not protect against instance termination.

Use AWS CloudTrail to capture log file changes.

Why wrong: CloudTrail records API calls, not application logs.

Modify the application to write logs to stdout and use the awslogs driver.

Why wrong: Requires code modification, which may not be feasible.

Set up an Amazon S3 bucket and use an AWS Lambda function to periodically copy log files.

Why wrong: Running a Lambda function to copy logs is less efficient and adds complexity.

{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}

Why wrong: Grants full S3 access, violating least privilege.

{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}

Why wrong: Resource wildcard is too permissive.

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Why wrong: PutImage is for ECR, not ECS service update.

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Why wrong: RunTask starts a task, not updates a service.

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Why wrong: RegisterTaskDefinition is for registering task definitions, not updating services.

The user cannot describe instances or terminate instances.

Why wrong: Describe is allowed by the first statement.

The user can terminate instances and describe instances.

Why wrong: Deny overrides Allow for termination.

The user can describe instances but cannot terminate any instances.

Why wrong: The user can describe, but the Deny prevents termination.