Design for New Solutions practice questions

Amazon DynamoDB

Why wrong: DynamoDB is a NoSQL database and does not support MySQL.

Amazon Redshift

Why wrong: Redshift is a data warehouse, not suited for online transaction processing (OLTP) workloads.

Amazon Aurora

Why wrong: Aurora is MySQL-compatible but is a specific engine under RDS; the broader service answer is RDS.

Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

Why wrong: Lambda cannot be invoked asynchronously by SQS; it polls the queue synchronously.

Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

Why wrong: A batch size of 100 may cause Lambda timeouts, and this configuration does not address scaling.

Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

Why wrong: FIFO queues are for exactly-once processing, but throughput is limited, and a concurrency of 1 may cause backlogs.

Configure VPC endpoints in each business unit VPC to access the shared VPC.

Why wrong: VPC endpoints are for accessing AWS services, not for inter-VPC connectivity.

Create VPC peering connections between the shared VPC and each business unit's VPC.

Why wrong: VPC peering does not support transitive routing, making it difficult to scale.

Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.

Why wrong: PrivateLink is for accessing services, not for connecting VPCs.

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Why wrong: Multi-AZ is for high availability within a Region, not for cross-Region DR.

Deploy the application on Amazon Aurora Global Database.

Why wrong: Aurora is a different database engine, not RDS MySQL.

Use DynamoDB Streams to trigger the Lambda function for each record.

Why wrong: DynamoDB Streams are not the source; the source is Kinesis.

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Why wrong: SQS FIFO does not directly integrate with Kinesis Data Streams.

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Why wrong: Step Functions can orchestrate but does not guarantee ordering from Kinesis.

Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

Why wrong: This approach lacks automatic rotation and requires custom code to fetch secrets.

Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

Why wrong: While Parameter Store is similar, Secrets Manager is the recommended service for secrets.

Store the configuration data in environment variables in the ECS task definition.

Why wrong: Environment variables are not encrypted at rest.

Stop all instances, launch new instances with the new version, and update the target group.

Why wrong: This causes downtime.

Update the existing target group's instances to the new version, one at a time.

Why wrong: This is a rolling update, not blue/green.

Create a new ALB and update DNS to point to the new ALB.

Why wrong: This is a manual cutover, not seamless.

Amazon RDS for MySQL

Why wrong: RDS is not ideal for session state.

Amazon DynamoDB

Why wrong: DynamoDB can be used but is not the best for session state.

Amazon S3

Why wrong: S3 is not designed for low-latency session state.

Use step scaling policies based on memory utilization.

Why wrong: Step scaling is more complex, not necessary here.

Use scheduled scaling to increase capacity during business hours.

Why wrong: Scheduled scaling cannot handle unexpected spikes.

Use simple scaling policies based on CPU utilization.

Why wrong: Simple scaling is less responsive.

Use automated backups with 5-minute retention.

Why wrong: Automated backups are not for failover.

Take manual snapshots every 5 minutes and copy to another region.

Why wrong: Snapshot restore takes longer than 15 minutes.

Create a cross-region read replica in us-west-2.

Why wrong: Asynchronous replication may exceed RPO.

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Why wrong: Single region does not provide multi-region distribution.

Use Amazon CloudFront with origins in each region.

Why wrong: CloudFront is for static content caching.

Use AWS Global Accelerator with Network Load Balancers in each region.

Why wrong: Global Accelerator is for TCP/UDP, not HTTP.

AWS Certificate Manager (ACM) for all encryption

Why wrong: ACM provides certificates, not encryption at rest.

SSL certificates for all connections

Why wrong: TLS is the modern standard, SSL is deprecated.

AWS Identity and Access Management (IAM) for data encryption

Why wrong: IAM controls access, not encryption.

Amazon Route 53

Why wrong: Route 53 is for DNS, not service discovery in mesh.

AWS Direct Connect

Why wrong: Direct Connect is for hybrid connectivity.

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Why wrong: Cross-Region read replicas for RDS MySQL do not support automatic failover.

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Why wrong: Cross-Region read replicas for RDS PostgreSQL do not support automatic failover.

Amazon DynamoDB Global Tables

Why wrong: DynamoDB is NoSQL, not relational.

Enable DynamoDB Accelerator (DAX) for the Lambda function

Why wrong: DAX is a cache, not relevant to message processing.

Provisioned Concurrency on the Lambda function

Why wrong: Provisioned Concurrency is for cold starts, not for preventing message loss.

Increase the SQS queue visibility timeout and retention period

Why wrong: This does not prevent message loss during throttling.

Use Amazon API Gateway with VPC Link

Why wrong: API Gateway is for external APIs, not internal service-to-service communication.

Use an Application Load Balancer with target groups per service

Why wrong: ALB does not natively support canary deployments between services.

Use Amazon Route 53 with weighted routing policies

Why wrong: Route 53 is DNS-level, not suitable for fine-grained traffic splitting.

Use Amazon RDS Proxy with a single database

Why wrong: RDS Proxy does not address the shared database coupling.

Use Amazon DynamoDB for all microservices

Why wrong: DynamoDB may not support complex relational queries.

Use a single Amazon RDS instance shared across all microservices

Why wrong: Shared database creates tight coupling and scaling issues.

Use S3 bucket policies with condition keys for tags

Why wrong: Bucket policies can check object tags but not enforce fine-grained access control per object.

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Why wrong: SSE-C does not provide tag-based access control.

Use AWS Lake Formation with column-level permissions

Why wrong: Lake Formation does not support tag-based access control natively.

Configure lifecycle hooks in the Auto Scaling group to drain connections

Why wrong: Lifecycle hooks are not needed for scaling based on CPU.

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Why wrong: Single large instance is not highly available.

Use a Network Load Balancer to distribute traffic to web servers

Why wrong: NLB is for TCP/UDP; for HTTP traffic, ALB is better.

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Why wrong: ASCP is recommended for integration with Secrets Manager.

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Why wrong: Kubernetes Secrets are not automatically rotated and are less secure.