Companion question bank for the 12-part tutorial series in this folder: 01-fundamentals-and-account-structure.md, 02-iam-and-identity.md, 03-compute-ec2-and-autoscaling.md, 04-networking-vpc-deep-dive.md, 05-storage-s3-ebs-efs.md, 06-managed-databases-and-data-services.md, 07-containers-and-serverless.md, 08-load-balancing-cdn-and-dns.md, 09-security-and-compliance.md, 10-monitoring-logging-and-tracing.md, 11-cicd-iac-and-messaging.md, 12-multi-region-dr-migration-and-cheatsheet.md.

Answers are short and plain — expand out loud using the diagrams and worked examples in the tutorials.

---

Part 1 Questions: Fundamentals & Account Structure

1. What's the difference between a Region and an Availability Zone?#

A Region is a large geographic area; an AZ is one or more physically separate data centers within that region, with independent power/cooling, connected to other AZs via fast private links.

2. Why is a single, shared AWS account for everything considered a trap?#

No real isolation — a mistake or compromise in one area (dev, staging, one team) has a blast radius spanning the entire account, including production.

3. What does an SCP actually do?#

Sets a maximum-possible-permissions ceiling for an account/OU — it never grants anything on its own; an IAM policy inside the account still has to separately grant the actual permission.

4. Why should the Organizations management account never run workloads?#

It has ultimate authority over every member account — mixing that high-privilege control plane with ordinary application risk is unnecessary privilege concentration.

5. Why centralize audit logs in a separate log-archive account?#

A compromised workload account's own local logs could be tampered with or deleted — a separate account the workload has no delete permission on guarantees a tamper-evident trail.

6. What are the six pillars of the Well-Architected Framework?#

Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.

7. How does the Shared Responsibility Model's line move between EC2 and Lambda?#

For EC2 you patch the guest OS yourself; for Lambda AWS handles the OS entirely — your data and access configuration are always your responsibility regardless.

8. Why does a Tag Policy differ from an SCP for enforcing tagging?#

An SCP can only allow/deny an API call outright; a Tag Policy reports non-compliance without necessarily blocking the action — often the more practical, gradual enforcement path.

9. What's the risk of never reviewing Service Quotas before a launch?#

A silently-hit quota (e.g. EC2 instance limit) can look identical to an unrelated outage — new instances simply fail to launch with no obvious signal why.

---

Part 2 Questions: IAM & Identity

10. What's the single most important property of an IAM role vs an IAM user?#

A role provides temporary, automatically-expiring credentials via STS; a user's access keys are long-lived, standing credentials that can leak.

11. Precisely how does AWS evaluate a permission request?#

SCP deny wins first, then any explicit Deny anywhere wins, then any explicit Allow grants access, and everything else is implicitly denied by default.

12. What's the difference between identity-based and resource-based policies?#

Identity-based is attached to a user/group/role, answering "what can this identity do"; resource-based is attached directly to a resource, answering "who can access this resource" — and can grant cross-account access.

13. Why is IRSA needed for EKS instead of just using the node's instance profile?#

Without it, every pod on a node shares the same broad node-level IAM permissions — IRSA lets each Kubernetes ServiceAccount assume its own narrowly-scoped role.

14. What's a Permission Boundary, and how does it differ from an SCP?#

A ceiling for ONE specific IAM user/role (not an entire account/OU like an SCP) — used to safely delegate role-creation ability to a less-trusted process.

15. What does ABAC let you do that traditional RBAC-style policies can't scale to?#

One policy, using a variable comparing the principal's tag to the resource's tag, automatically scopes correctly for every team/resource pair — no new policy needed per new team.

16. Why federate through a corporate IdP instead of managing per-account IAM users?#

Exactly one place to revoke access (the IdP) instead of hunting down and deleting IAM users across every account when someone leaves.

17. What's a break-glass access path, and what must accompany it?#

Pre-provisioned emergency credentials for when normal federated access is itself unavailable — must have automatic, immediate alerting on every use.

---

Part 3 Questions: Compute: EC2 & Auto Scaling

18. What does the "t" in a "t3.micro" instance type signify?#

Burstable performance — earns CPU credits, throttles hard once credits run out.

19. Why prefer a golden AMI over a lengthy user-data bootstrap script at scale?#

Bakes configuration in ahead of time so new instances are ready to serve traffic the moment they boot, instead of waiting through a slow bootstrap script during every scale-out.

20. What's the difference between a STOPPED and a TERMINATED EC2 instance?#

Stopped: still exists, root EBS volume persists, can restart with the same ID. Terminated: gone permanently, root volume deleted by default.

21. Why does IMDSv2 matter for security?#

Requires a session token via a PUT request first — closes the SSRF-to-credential-theft attack path that IMDSv1's simple unauthenticated GET allowed (as in the 2019 Capital One breach).

22. What's the real tradeoff of Spot instances?#

Steep discount in exchange for only a 2-minute interruption notice — a strong fit for stateless, horizontally-redundant fleets, a poor fit for non-redundant stateful workloads.

23. Why must an ASG span multiple AZs with ELB (not just EC2) health checks?#

Multi-AZ spreads fault tolerance; ELB health checks catch application-level failures (deadlocks, 500s) that EC2 status checks (hardware/OS only) would miss entirely.

24. What problem do Warm Pools solve?#

Reduce cold-start lag for ASGs by keeping pre-initialized instances ready, instead of booting and bootstrapping fully from scratch during a demand spike.

25. Why use SSM Session Manager instead of SSH?#

Eliminates the need for any open inbound port, authenticating and authorizing entirely through IAM, fully logged in CloudTrail.

---

Part 4 Questions: Networking: VPC Deep Dive

26. Why must VPC CIDR ranges be planned organization-wide before creation?#

Two VPCs with overlapping CIDR blocks can never be connected via Peering or Transit Gateway — routing can't distinguish which VPC an address belongs to.

27. What makes a subnet "public" vs "private" vs "isolated"?#

Its route table configuration — public routes 0.0.0.0/0 to an Internet Gateway, private routes it to a NAT Gateway, isolated has no internet route at all.

28. Why deploy one NAT Gateway per AZ instead of sharing one?#

A shared NAT Gateway reintroduces a single point of failure — that AZ's outage removes outbound internet access for every other AZ's private subnets too.

29. What's the key difference between Security Groups and NACLs?#

Security Groups are stateful (return traffic auto-allowed), instance-level, allow-only. NACLs are stateless (return traffic needs its own rule), subnet-level, allow+deny.

30. Why chain security groups by reference instead of hardcoded CIDR blocks?#

Automatically stays correct as an Auto Scaling Group's instances scale in/out — no manual updates needed as IPs change.

31. Why is VPC Peering not transitive?#

Each peering connection is a direct, point-to-point link only — A peered with B peered with C does NOT let A reach C through B.

32. What problem does Transit Gateway solve that Peering doesn't?#

Avoids the N² mesh of pairwise peering connections as VPC count grows — a hub-and-spoke model instead.

33. What's the difference between a Gateway Endpoint and an Interface Endpoint?#

Gateway Endpoints (S3/DynamoDB only) are free route table entries. Interface Endpoints (via PrivateLink, everything else) are actual ENIs with a private IP and small cost.

34. What does VPC Reachability Analyzer do that Flow Logs alone don't?#

Automatically evaluates the entire path (route tables, SGs, NACLs, Transit Gateway routing) and names the exact blocking component in seconds — Flow Logs require manual correlation.

35. What does IPAM solve that a shared spreadsheet can't?#

Makes overlapping CIDR allocations structurally impossible by construction, since VPCs request blocks FROM a centrally tracked pool.

---

Part 5 Questions: Storage: S3, EBS & EFS

36. What's S3's current consistency model?#

Strong read-after-write consistency for ALL operations (since 2020) — a PUT followed by a GET always returns the latest version.

37. Why enable Block Public Access at the account level, not just per-bucket?#

A structural safety net overriding even a future accidental public-granting bucket policy — most real S3 data exposures trace back to a missing version of this control.

38. What's the difference between S3 Versioning and Object Lock in COMPLIANCE mode?#

Versioning lets a sufficiently privileged admin still permanently delete a version; Object Lock COMPLIANCE mode makes it structurally impossible for ANYONE, including root, until retention expires.

39. Why must EBS volumes be in the same AZ as their attached instance?#

A physical, network-attached-disk constraint — this is exactly why EBS data doesn't automatically survive an AZ failure without a snapshot.

40. What's the key improvement of gp3 over gp2 EBS volumes?#

IOPS/throughput are provisioned independently of volume size — no need to over-provision capacity just to get more speed.

41. When is EFS the right choice over EBS?#

When MANY instances need genuine, concurrent, multi-AZ shared file access with real POSIX semantics — EBS structurally can't provide this (one-instance, or narrowly-Multi-Attach with no file-level coordination).

42. What does Fast Snapshot Restore fix?#

Eliminates the lazy-loading latency penalty a volume created from a snapshot would otherwise have on first access to each block.

---

Part 6 Questions: Managed Databases & Data Services

43. Can you query an RDS Multi-AZ standby directly for read scaling?#

No — it's a synchronous failover target only, not readable. Use a dedicated Read Replica instead.

44. What makes Aurora's replication meaningfully different from standard RDS?#

Aurora's storage layer replicates 6 ways across 3 AZs BELOW the database engine, using quorum-based writes — resulting in single-digit-ms replica lag vs RDS's binlog-based tens-to-hundreds of ms.

45. Why can't you SSH into RDS to tune my.cnf directly?#

It's a managed service — Parameter Groups are the only sanctioned way to change engine-level configuration.

46. What problem does RDS Proxy solve?#

Prevents connection exhaustion from serverless (Lambda) workloads opening far more direct connections than the database can handle, by pooling and multiplexing.

47. Why must RDS encryption be enabled at creation time?#

No flag exists to encrypt an existing unencrypted instance in place — requires a snapshot-copy-with-KMS-key, then restore-as-new-instance migration.

48. When would you choose Redshift over Athena for analytics?#

Redshift for sustained, high-concurrency, performance-critical analytical workloads justifying dedicated warehouse cost; Athena for infrequent, ad hoc queries directly against S3 with zero standing infrastructure.

---

Part 7 Questions: Containers & Serverless

49. Is Fargate a competitor to EKS?#

No — Fargate is a serverless compute engine that EKS (and ECS) can both run on top of; orchestrator and compute engine are two independent decisions.

50. What's the ECS equivalent of a Kubernetes Deployment?#

An ECS Service (keeps a desired task count running); a Task Definition maps to a Pod spec, a Task maps to a running Pod.

51. Why can tasks get stuck PENDING on the EC2 launch type but not Fargate?#

On EC2, Service Auto Scaling (task count) and Cluster Auto Scaling (instance count) are separate mechanisms that must both scale together; Fargate has no underlying cluster capacity to manage.

52. What causes a Lambda cold start?#

No warm execution environment is available — AWS must provision a new one and initialize the runtime before running the invocation.

53. What's the difference between Reserved and Provisioned Concurrency?#

Reserved sets a ceiling (protects other functions' share); Provisioned sets a floor (pre-warmed environments, eliminating cold starts at a standing cost).

54. Why is ECS Exec the only way to debug a Fargate task interactively?#

Fargate tasks have no underlying EC2 instance to SSH into at all — ECS Exec provides IAM-authenticated shell access with zero open ports.

55. What happens to a Lambda event if all retries fail and no DLQ is configured?#

It's silently discarded — no error surfaces anywhere and no record of the failure is retained.

---

Part 8 Questions: Load Balancing, CDN & DNS

56. What's the key functional difference between ALB and NLB?#

ALB (Layer 7) does content-based routing on path/host/header; NLB (Layer 4) offers static IPs and extreme throughput for non-HTTP or allowlist-driven needs.

57. Why must an S3 origin behind CloudFront use Origin Access Control?#

Without it, making the bucket public enough for CloudFront also makes it public enough for anyone to bypass CloudFront and hit S3 directly.

58. Why is DNS-based failover never truly instantaneous?#

Client/resolver TTL caching means some clients keep using a stale, unhealthy IP until their local cache expires.

59. What's the ALIAS record type for, precisely?#

An AWS-specific extension letting a domain's APEX/root point at an AWS resource (like an ALB) — standard DNS forbids a CNAME at the zone apex.

60. When would you use a Weighted routing policy?#

To implement a canary deployment or gradual traffic migration at the DNS layer, splitting traffic by percentage across endpoints.

61. Why prefer CloudFront Functions over Lambda@Edge for simple logic?#

Sub-millisecond execution and meaningfully cheaper — Lambda@Edge's fuller capability is unnecessary overhead for something as simple as a header rewrite.

---

Part 9 Questions: Security & Compliance

62. Why is an IAM Allow never sufficient to grant KMS access alone?#

KMS key policies are a separate, mandatory gate — the key policy must also explicitly allow the principal, a deliberate extra defense-in-depth layer.

63. What does envelope encryption actually do, mechanically?#

KMS generates a data key in both plaintext and KMS-encrypted form; the plaintext key encrypts the actual data locally (fast), and only the encrypted data key is stored.

64. Why choose Secrets Manager over Parameter Store for a database password?#

Secrets Manager provides native automatic rotation (via a Lambda function correctly sequencing credential change); Parameter Store has none built in.

65. What's the difference between CloudTrail management and data events?#

Management events (control-plane, e.g. bucket creation) are logged by default and free; data events (e.g. individual GetObject calls) require explicit enablement and cost extra.

66. Why isolate, not immediately terminate, a suspected-compromised instance?#

Terminating destroys volatile forensic evidence (processes, connections, memory state) needed to understand how the compromise happened.

67. What does GuardDuty analyze to detect threats?#

VPC Flow Logs, CloudTrail logs, and DNS logs, using machine learning and threat-intelligence feeds — zero custom rule-writing required.

68. What does Amazon Detective add beyond a raw GuardDuty finding?#

Automatically builds a visual behavior graph correlating CloudTrail/Flow Log activity, avoiding manual multi-source log correlation during an investigation.

---

Part 10 Questions: Monitoring, Logging & Tracing

69. Why isn't EC2 memory utilization a standard, zero-setup metric?#

AWS's hypervisor has no visibility inside the guest OS's memory — only the CloudWatch Agent, running inside the instance, can observe and report it.

70. What problem do Composite Alarms solve?#

Combine multiple correlated symptom alarms (errors up AND latency up) into a single page, reducing alert-fatigue-inducing duplicate pages for one real incident.

71. Why is Embedded Metric Format preferred over direct PutMetricData calls for high-volume custom metrics?#

Writing structured JSON to logs is essentially free and adds no synchronous API call latency to the application's hot path.

72. What does CloudWatch Anomaly Detection solve that a fixed threshold can't?#

Learns a metric's own normal daily/weekly seasonal pattern, avoiding the tradeoff where one static threshold is either too loose during peaks or too tight during quiet periods.

73. Why alarm on Lambda Throttles separately from Errors?#

A throttled invocation is rejected BEFORE the function code ever runs, due to concurrency limits — it can never appear in the Errors metric.

74. Why use Synthetics alongside RUM, not instead of it?#

Synthetics proactively catches a broken flow regardless of real traffic volume; RUM shows what real users actually experience but only after they encounter a problem.

---

Part 11 Questions: CI/CD, IaC & Messaging

75. What's the CloudFormation equivalent of terraform plan?#

A Change Set — preview exactly what will change before actually applying it.

76. What does CloudFormation StackSets solve?#

Deploys the same template across many accounts/regions from one place — with auto-deployment, new accounts under an OU automatically receive the baseline.

77. Why is "no separate state file" a real CloudFormation advantage over Terraform?#

State is natively tracked by AWS as part of the stack resource — no state file that can go missing, get corrupted, or need locking.

78. What's the key difference between SQS Standard and FIFO queues?#

Standard: best-effort ordering, at-least-once delivery, near-unlimited throughput. FIFO: strict ordering, exactly-once processing, capped throughput.

79. Why can a short SQS visibility timeout cause duplicate processing?#

If processing takes longer than the timeout, the message becomes visible to a second consumer while the first is still working on it.

80. What does the SNS fan-out pattern achieve that a single SQS queue can't?#

One event reliably delivered to MULTIPLE independent consumers, each with its own queue — a slow/failing consumer never blocks the others.

81. When would you choose EventBridge over SNS?#

When routing decisions need to depend on the actual CONTENT of an event, not just which topic it was published to.

82. What makes Kinesis fundamentally different from SQS?#

Kinesis retains and allows REPLAY of data by multiple independent consumers; SQS deletes a message once successfully processed.

---

Part 12 Questions: Multi-Region, DR, Migration & Cheat Sheet

83. What's the RTO/RPO tradeoff across the four DR strategies on AWS?#

Backup & Restore (hours, cheapest) → Pilot Light (tens of minutes) → Warm Standby (minutes) → Multi-Site Active-Active (near-zero, most expensive).

84. What AWS service implements Pilot Light's continuously-replicated core?#

Aurora Global Database — kept running continuously while compute is pre-built as IaC but not running until failover.

85. What does AWS Backup's tag-based selection achieve?#

A new resource created with the right tag is automatically covered by the backup plan, with zero additional configuration — governance by construction.

86. What are the 6 R's of migration?#

Rehost, Replatform, Repurchase, Refactor/Re-architect, Retire, Retain.

87. Why is "Retire" often a genuinely valuable migration-planning outcome?#

Discovery routinely surfaces systems with zero actual users still running — retiring them is a real, immediate cost win requiring no migration effort.

88. Why run Application Discovery Service before finalizing a migration plan?#

Migration plans based on incomplete/outdated inventories miss critical dependencies discovered painfully mid-migration instead of during planning.

89. What does an FIS experiment's stopCondition do?#

Automatically halts the chaos experiment if it starts causing genuine, unacceptable customer impact, tied to a real CloudWatch alarm.

---

Quick-Fire / Rapid Recall#