🧠 Foundations Architect Assessment: Match-the-Pair Challenge
Welcome to the Foundations Platform Architect Diagnostic Matrix. Rather than superficial multiple-choice questions, this assessment evaluates your conceptual comprehension using Left-Block ↔ Right-Block Architectural Mapping.
In Staff & Principal Architect interviews, you are not asked trivia—you are presented with symptoms, system behaviors, kernel primitives, and failure modes, and expected to map them to their exact root cause, security consequence, or architectural trade-off.
🎯 How to Take This Assessment
1. Review the Left Column (Symptoms, Primitives, or Directives).
2. Mentally map each block to its corresponding partner in the Right Column.
3. Click the Solution Key & Architectural Rationale accordion below each tier to verify your answers.
2. Mentally map each block to its corresponding partner in the Right Column.
3. Click the Solution Key & Architectural Rationale accordion below each tier to verify your answers.
🟢 Tier 1: Low Difficulty (Foundations Baseline)
Validates your command of basic primitives across Linux permissions, Docker flags, CIDR mathematics, Git workflows, and systemd daemons.
📌 Left Blocks: Primitives & Directives
A
chmod 640 /etc/app.conf
B
docker run -p 8080:80
C
VPC Subnet CIDR
/28
D
git reset --soft HEAD~1
E
systemd Restart=always
🎯 Right Blocks: Behaviors & Mechanisms
1
Binds host port to container port via
iptables DNAT in the kernel.
2
Undoes the latest commit while keeping all code modifications in the staged index.
3
Automatically re-launches the daemon upon clean exit or unhandled crash.
4
Owner: Read/Write (
rw-), Group: Read-only (r--), World: Denied (---).
5
16 total IP addresses, with exactly 11 usable host addresses in AWS (5 reserved).
💡 Reveal Tier 1 Solution Key & Architectural Rationale Click to Expand
Verified Architectural Pairings:
A → 4 B → 1 C → 5 D → 2 E → 3
A → 4 (
chmod 640): Octal 6 = 4+2 (rw-), 4 = 4 (r--), 0 = ---. This is the enterprise least-privilege standard for configuration files containing sensitive credentials.B → 1 (
docker run -p 8080:80): Containers live in a private Network Namespace (netns). The Docker engine injects a Destination NAT rule into the host's iptables PREROUTING chain, translating host traffic on port 8080 to the container's private IP on port 80.C → 5 (
/28 Subnet Math): Total IPs = 2^(32-28) = 2^4 = 16. In standard IPv4, 2 are reserved (Network ID & Broadcast). In AWS VPCs, AWS reserves 5 IPs (.0 Network, .1 VPC Router, .2 Amazon DNS, .3 Future use, .15 Broadcast), leaving exactly 16 - 5 = 11 usable addresses.D → 2 (
git reset --soft): Moves the HEAD pointer backward by one commit while leaving your Working Directory and Staging Index (git status) completely untouched. Useful for amending commit messages or squashing before push.E → 3 (
systemd Restart=always): Directs the systemd supervisor to restart the process regardless of whether it exited cleanly (exit 0) or terminated abnormally (via signal or unhandled exception).🟡 Tier 2: Medium Difficulty (Core Platform Engineering)
Evaluates your understanding of networking statefulness, AWS Organizations governance, TCP handshakes, identity federation, and container attack surface minimization.
📌 Left Blocks: Primitives & Directives
A
Stateful Security Group vs Stateless NACL
B
AWS Service Control Policy (SCP)
C
TCP Handshake
SYN-ACK Packet
D
SAML 2.0 & SCIM Federation
E
Distroless Production Image
🎯 Right Blocks: Behaviors & Mechanisms
1
Establishes the maximum permission boundary for member accounts without granting access directly.
2
Strips shell binaries (
/bin/sh) and package managers to eliminate remote command execution vectors.
3
Security Groups track connection state automatically; NACLs require explicit return rules on ephemeral ports.
4
Server acknowledges client sequence number (ACK = ISN_c + 1) and transmits its own initial sequence number (ISN_s).
5
Automates cross-cloud SSO identity authentication and real-time user/group directory synchronization.
💡 Reveal Tier 2 Solution Key & Architectural Rationale Click to Expand
Verified Architectural Pairings:
A → 3 B → 1 C → 4 D → 5 E → 2
A → 3 (Security Groups vs NACLs): Security Groups operate at the virtual network interface (ENI) layer and maintain a state table. Outbound return packets are automatically permitted. NACLs operate at the subnet boundary and are stateless: outbound responses must match an explicit rule permitting ephemeral ports (
1024–65535).B → 1 (Service Control Policies): SCPs are guardrails, not grants. Even if an IAM administrator grants
AdministratorAccess (*:*) to a developer, an SCP explicit Deny on region usage or KMS actions overrides all IAM policies across the Organizational Unit.C → 4 (TCP 3-Way Handshake): During the second step of the handshake, the server responds to client's
SYN with SYN-ACK, synchronizing its own randomly generated Initial Sequence Number (ISN) and acknowledging the client's ISN+1.D → 5 (SAML & SCIM): SAML 2.0 handles authentication (verifying who the user is via XML assertion tokens), while SCIM handles user lifecycle provisioning (syncing new hires and de-provisioning terminated staff).
E → 2 (Distroless Images): By packaging only the compiled binary and essential glibc runtime libraries, attackers executing an injection exploit find no shell interpreter (
sh, bash) to spawn a reverse interactive terminal.🔴 Tier 3: Hard Difficulty (Senior & SRE Infrastructure Internals)
Tests deep knowledge of Transit Gateway routing tables, distributed state locking, kernel resource quota mechanics, cryptographic key unsealing, and declarative IaC refactoring.
📌 Left Blocks: Primitives & Directives
A
TGW Route Table Propagation
B
DynamoDB State Locking (
LockID)
C
Linux cgroups v2
cpu.cfs_quota_us
D
HashiCorp Vault Shamir Secret Sharing
E
Terraform
moved Block
🎯 Right Blocks: Behaviors & Mechanisms
1
Splits unseal master key into N cryptographic shards requiring any T threshold shards to decrypt memory.
2
Enforces declarative state address migrations in Git, preventing destructive recreate cycles in CI/CD.
3
Dynamically evaluates attached VPC CIDR blocks and automatically injects routes into the TGW routing table.
4
Executes conditional write
attribute_not_exists(LockID) to guarantee atomic mutual exclusion.
5
Freezes thread execution for the remainder of the 100ms CFS window if quota is exhausted early.
💡 Reveal Tier 3 Solution Key & Architectural Rationale Click to Expand
Verified Architectural Pairings:
A → 3 B → 4 C → 5 D → 1 E → 2
A → 3 (TGW Propagations): In AWS Transit Gateway, an Association determines which route table is used for traffic leaving an attachment. A Propagation instructs TGW to automatically learn the attachment's CIDRs and inject them as active routes into the target route table.
B → 4 (DynamoDB State Lock): DynamoDB uses strongly consistent reads and conditional writes (
PutItem with attribute_not_exists(LockID)). If two CI runners attempt to apply simultaneously, only one succeeds; the second receives ConditionalCheckFailedException.C → 5 (cgroups v2 CPU CFS Quota): Enforced over a 100ms window (
cpu.cfs_period_us = 100000). If a multi-threaded workload bursts and consumes its quota in the first 20ms, the kernel pauses all threads for the remaining 80ms, producing sharp p99 latency spikes.D → 1 (Shamir's Secret Sharing): The Vault master encryption key is split into polynomial shards (k, n). At least k shards must be presented to unseal Vault and decrypt the storage barrier in memory. In enterprise AWS deployments, this is automated via AWS KMS Auto-Unseal.
E → 2 (Terraform
moved Blocks): Solves the historical pain of manual terraform state mv commands. When code is restructured into modules, moved blocks instruct Terraform's DAG compiler to rename state addresses in-place with zero downtime.🟣 Tier 4: Complex Difficulty (Staff & Principal Architect Scenarios)
Explores subtle edge cases, kernel memory management, asynchronous routing traps, Rego evaluation semantics, and union filesystem mechanics.
📌 Left Blocks: Primitives & Directives
A
Process in
D State (Uninterruptible Sleep)
B
Container PID 1 Zombie Leakage
C
OPA Rego Silent Policy Bypass
D
OverlayFS Whiteout Device (Char 0/0)
E
Asymmetric Routing in Centralized TGW Egress
🎯 Right Blocks: Behaviors & Mechanisms
1
Missing
default statement causes missing JSON path attributes to evaluate to undefined, silently bypassing security gates.
2
Return packet egresses through a different AZ interface, causing stateful inspection firewalls to drop traffic with TCP RST.
3
Process blocked on unresponsive hardware kernel system call (NFS/EBS I/O); immune to
kill -9.
4
Application process as PID 1 ignores
SIGCHLD, failing to reap dead child processes and exhausting the kernel PID table.
5
Created dynamically in
upperdir when an immutable file in lowerdir is deleted, masking it from the merged view.
💡 Reveal Tier 4 Solution Key & Architectural Rationale Click to Expand
Verified Architectural Pairings:
A → 3 B → 4 C → 1 D → 5 E → 2
A → 3 (
D State Process): The task is executing in kernel space waiting on an I/O hardware device driver. Because signals are only delivered when a process transitions from kernel space back to user space, the process cannot be terminated by any signal, including kill -9. The only resolution is restoring the storage subsystem or rebooting the host.B → 4 (PID 1 Zombie Reaping): In standard Linux,
systemd (PID 1) reaps orphaned children. Inside a container running without an init process (like tini), if an app forks processes and terminates without calling waitpid(), the children become defunct zombies. They retain their PID table slot until the kernel PID limit is reached.C → 1 (Rego
undefined Evaluation): Rego does not use standard truthy/falsy evaluation. If a rule references input.resource.tags.owner, and the tags object is null, the rule evaluates to undefined rather than false. If you wrote allow { not deny }, an undefined deny results in an accidental allow!D → 5 (OverlayFS Whiteout Devices): Because lower image layers are strictly read-only and immutable on disk, a container deleting
/etc/hosts cannot actually delete the physical file. OverlayFS creates a character device with major/minor numbers 0/0 in upperdir. The kernel VFS intercepts lookups and returns ENOENT (No such file or directory).E → 2 (TGW Asymmetric Routing): In multi-AZ centralized egress architectures, traffic from VPC A in
us-east-1a enters the Transit Gateway and may be sent to an inspection appliance in us-east-1b. Unless TGW Appliance Mode is explicitly enabled, return traffic from the internet may be routed to an appliance in us-east-1a. Stateful inspection firewalls drop the packet because they have no record of the initial TCP handshake.📊 Self-Evaluation Scoring Rubric
18 – 20 / 20 Correct
Staff / Principal Level
Exceptional. You possess a complete mental model of both cloud abstractions and kernel internals. Ready for Phases 3 & 4.
14 – 17 / 20 Correct
Senior Platform Engineer
Solid conceptual grasp. Review Tier 3 & 4 failure modes (especially cgroups CFS throttling and asymmetric TGW routing).
10 – 13 / 20 Correct
Mid-Level Cloud Engineer
Good foundation, but gaps in low-level mechanics (file descriptors, state locking, and container init reaping).
< 10 / 20 Correct
Developing Foundation
Re-read the masterclass lessons in Phase 0 (Linux & Networking) and Phase 2 (Terraform State & Policy).
🧠 Complete Foundations One-Line Memory Bank (Lesson-by-Lesson)
Use these rapid-fire 190 one-line questions and answers across Phase 0, Phase 1, and Phase 2 to test active recall before staff architecture interviews.
🐧 Phase 0: The Primitives (60 Rapid Q&As) Lessons 1–5 + Labs
Lesson 1: Linux Primitives & systemd
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What numeric value represents Read, Write, and Execute permissions in Linux octal notation? | Read (r) = 4, Write (w) = 2, Execute (x) = 1. |
| 2 | Why is the Execute (x) bit mandatory on a Linux directory for a user to cd into it? |
The x bit on a directory controls inode traversal (cd); without it, users can list file names (r) but cannot enter or stat files. |
| 3 | What is the difference between SIGTERM (15) and SIGKILL (9)? |
SIGTERM is a catchable signal allowing graceful cleanup, whereas SIGKILL is handled directly by the kernel to terminate the process immediately. |
| 4 | Why does a process in Uninterruptible Sleep (D state) ignore kill -9? |
Signals are only delivered when a process returns from kernel space to user space, and a D-state process is blocked inside a kernel hardware I/O syscall. |
| 5 | Why does df -h show 100% disk usage when du -sh shows only 40% used? |
An open process is holding a file descriptor to a deleted file, preventing the kernel from reclaiming disk blocks until the process closes the fd or restarts. |
| 6 | How do you find deleted files still held open by active processes? | Run lsof +L1 to list all open files with a link count less than 1. |
| 7 | Where should custom systemd unit files be placed to avoid being overwritten by OS package upgrades? | Place custom unit files in /etc/systemd/system/, which takes precedence over /lib/systemd/system/. |
| 8 | What systemd directive ensures a crashed daemon waits 5 seconds before restarting? | Set Restart=always (or on-failure) combined with RestartSec=5s under the [Service] block. |
| 9 | How do you stream live systemd logs for a specific service starting from the most recent entries? | Run journalctl -u <service-name> -f -n 50. |
| 10 | What file defines the maximum number of open file descriptors permitted per process at the kernel level? | /proc/sys/fs/file-max (system-wide) and LimitNOFILE= inside the systemd service unit (per-service). |
Lesson 2: Networking & CIDR Math
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What is the mathematical formula to calculate total IPv4 addresses in a /N CIDR block? |
Total IPs = 2^(32 - N). |
| 2 | How many total IPs and AWS-usable IPs exist in a /24 subnet? |
256 total IPs, and 251 usable IPs because AWS reserves 5 IPs per subnet. |
| 3 | Which 5 IP addresses does AWS reserve in every VPC subnet (e.g., 10.0.1.0/24)? |
.0 (Network), .1 (VPC Router), .2 (AWS DNS), .3 (Future use), and .255 (Broadcast). |
| 4 | What are the three packets exchanged during a TCP 3-way handshake? | SYN (Client → Server), SYN-ACK (Server → Client), and ACK (Client → Server). |
| 5 | What is the fundamental difference between AWS Security Groups and Network ACLs (NACLs)? | Security Groups are stateful (ENI-level, allow rules only), whereas NACLs are stateless (subnet-level, explicit allow/deny rules required for both directions). |
| 6 | Why must a stateless NACL allow inbound traffic on ports 1024–65535? |
Outbound requests originate from random ephemeral source ports (1024–65535), so return responses arrive targeting those ephemeral ports. |
| 7 | What command displays all listening TCP sockets along with their owning process PIDs on modern Linux? | ss -tulpn (replaces legacy netstat -tulpn). |
| 8 | What does a TCP socket stuck in SYN_SENT state indicate? |
The client sent a TCP SYN packet, but no SYN-ACK was received—typically caused by a silent firewall drop or blackhole route. |
| 9 | What does a buildup of CLOSE_WAIT sockets on a server indicate? |
The remote peer closed the connection (FIN), but the local application has a code bug and failed to execute close() on the socket descriptor. |
| 10 | What port and protocol does standard DNS use, and when does it switch to TCP? | UDP Port 53 by default; it switches to TCP Port 53 for zone transfers (AXFR) or when responses exceed 512 bytes (or EDNS0 buffer size). |
Lesson 3: Git & GitOps Foundations
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What are the 4 core principles of OpenGitOps? | Declarative state, Versioned & Immutable storage, Pulled automatically, and Continuously Reconciled. |
| 2 | What is the difference between git merge and git rebase? |
git merge preserves chronological history with a merge commit, whereas git rebase rewrites commit hashes onto a linear tip. |
| 3 | Why should you never run git rebase on a shared public branch like main? |
Rebasing generates brand-new SHA-1 hashes for existing commits, diverging history and breaking local clones for every other developer. |
| 4 | What is the exact difference between git reset --soft HEAD~1 and git reset --hard HEAD~1? |
--soft moves HEAD back one commit while keeping changes staged; --hard permanently destroys uncommitted changes in both the index and working tree. |
| 5 | Why is git revert <commit> preferred over git reset for production rollbacks in GitOps? |
git revert creates a new forward commit that cleanly inverses the bad change, preserving an immutable audit trail for ArgoCD/Flux. |
| 6 | How do you recover a commit that was accidentally deleted by a git reset --hard? |
Run git reflog to locate the orphaned commit’s SHA hash and execute git checkout or git reset --hard <sha>. |
| 7 | Why is --force-with-lease safer than git push --force? |
--force-with-lease aborts the push if another teammate has pushed new commits to the remote branch since your last fetch. |
| 8 | What command uses binary search across commit history to pinpoint the exact commit that introduced a bug? | git bisect start, followed by git bisect bad and git bisect good <sha>. |
| 9 | Why is Pull-based GitOps (ArgoCD inside cluster) more secure than Push-based CI (kubectl apply in GitHub Actions)? |
Pull-based GitOps keeps cluster admin credentials inside the cluster, eliminating the need to expose the Kubernetes API or store god-mode tokens in external CI runners. |
| 10 | How do you sign Git commits cryptographically to verify author identity? | Configure GPG or SSH signing keys and commit using git commit -S -m "message". |
Lesson 4: Docker & Container Primitives
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Are containers lightweight virtual machines with their own kernel? | No, containers are isolated host Linux processes sharing the underlying host OS kernel via namespaces and cgroups. |
| 2 | What filesystem driver does Docker use to stack immutable image layers with a writable container layer? | OverlayFS (lowerdir for read-only image layers, upperdir for writable changes, and merged for the unified view). |
| 3 | How does OverlayFS handle deleting a file that exists in a read-only lower layer? | It creates a character 0/0 whiteout file in upperdir that masks the underlying file in the merged directory view. |
| 4 | What is the primary security and size benefit of a Multi-Stage Dockerfile? | It compiles code in a heavy builder stage and copies only the compiled binary into a minimal runtime stage, stripping compilers, source code, and build secrets. |
| 5 | Why is a distroless base image more secure than alpine or ubuntu? |
Distroless images contain zero shell (/bin/sh) and zero package managers (apt/apk), preventing attackers from spawning interactive reverse shells. |
| 6 | Why should COPY package.json . and RUN npm ci be placed before COPY . . in a Dockerfile? |
Docker caches layers sequentially; copying dependency manifests first prevents source code edits from invalidating the expensive dependency installation cache. |
| 7 | What is the difference between ENTRYPOINT and CMD in a Dockerfile? |
ENTRYPOINT defines the fixed executable binary run by the container, while CMD supplies default arguments that can be easily overridden at runtime. |
| 8 | Why should you always use exec form ["app", "--flag"] instead of shell form "app --flag" in ENTRYPOINT? |
Shell form wraps the process in /bin/sh -c as PID 1, which swallows SIGTERM signals and prevents graceful application shutdown. |
| 9 | How do you prevent a compromised container process from having root privileges on the host kernel? | Add a non-root user (USER 10001) in the Dockerfile and set allowPrivilegeEscalation: false at runtime. |
| 10 | How does docker run -p 8080:80 route host traffic into the container’s isolated network namespace? |
It injects an iptables Destination NAT (DNAT) rule in the host’s PREROUTING chain pointing to the container’s virtual Ethernet (veth) IP. |
Lesson 5: Kernel Namespaces & cgroups
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What is the exact division of responsibility between Linux Namespaces and Control Groups (cgroups)? |
Namespaces isolate visibility (what a process can see), while cgroups restrict resource consumption (how much CPU/RAM/I/O a process can use). |
| 2 | Name the 7 Linux Kernel Namespaces used by container runtimes. | pid (Process IDs), net (Networking), mnt (Mount points), uts (Hostname), ipc (Inter-process comms), user (UIDs), and cgroup (cgroup root). |
| 3 | What Linux system call creates a new process inside brand-new isolated namespaces? | clone() (passed with flags like `CLONE_NEWPID |
| 4 | What Linux command allows an SRE to enter the network namespace of a running container using its host PID? | nsenter -t <host-pid> -n ip addr (allows running host network debugging tools inside a distroless container’s netns). |
| 5 | How does a container network namespace communicate with the host root network namespace? | Through a virtual Ethernet (veth) pipe pair, where one end sits inside the container netns and the other attaches to a host bridge (docker0 or cni0). |
| 6 | What is the difference between cpu.shares (CPU requests) and cpu.cfs_quota_us (CPU limits)? |
cpu.shares is a soft proportional weight enforced only during CPU contention, whereas cpu.cfs_quota_us is a hard ceiling enforced every 100ms regardless of idle host CPU. |
| 7 | What architectural upgrade did cgroups v2 introduce over cgroups v1? |
Unified single hierarchy design and the ability to safely restrict buffered Page Cache and writeback disk I/O alongside anonymous memory. |
| 8 | What is Linux Pressure Stall Information (PSI) in /proc/pressure/{cpu,memory,io}? |
A kernel metric measuring the exact percentage of wall-clock time tasks are stalled waiting for hardware resources (some vs full). |
| 9 | What happens when a container’s memory usage (anon + non-reclaimable cache) breaches memory.max? |
The kernel invokes the cgroup OOM killer (mem_cgroup_out_of_memory), sending SIGKILL (Exit Code 137) to the highest-scoring process. |
| 10 | What system call changes the root directory of a container more securely than chroot? |
pivot_root(), which unmounts the old host root filesystem entirely so privileged processes cannot break out via file descriptors. |
Hands-On Labs: Phase 0 Exercises
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | How do you manually create an isolated network namespace named red using iproute2? |
Run sudo ip netns add red. |
| 2 | How do you create a virtual Ethernet (veth) cable connecting veth-red and veth-host? |
Run sudo ip link add veth-red type veth peer name veth-host. |
| 3 | How do you move one end of a veth interface into the red network namespace? |
Run sudo ip link set veth-red netns red. |
| 4 | Why does ping 127.0.0.1 fail inside a newly created network namespace? |
The loopback interface (lo) is down by default in a new netns and requires ip netns exec red ip link set lo up. |
| 5 | What host kernel sysctl must be set to 1 for Linux to route packets between interfaces like a router? |
sudo sysctl -w net.ipv4.ip_forward=1. |
| 6 | What iptables rule masks private container IPs behind the host’s primary interface IP for internet access? |
sudo iptables -t nat -A POSTROUTING -s 10.200.1.0/24 ! -o veth-host -j MASQUERADE. |
| 7 | How do you manually restrict a cgroup v2 group to 50% of one CPU core (50ms per 100ms)? | Run echo "50000 100000" > /sys/fs/cgroup/my-group/cpu.max. |
| 8 | How do you move an active shell process into a specific cgroup v2 directory? | Write its PID into cgroup.procs: echo $$ > /sys/fs/cgroup/my-group/cgroup.procs. |
| 9 | How do you inspect the exact namespaces a process belongs to on the Linux filesystem? | Run ls -la /proc/<pid>/ns/. |
| 10 | How do you verify image layer sizes and build history for a local Docker image? | Run docker history <image-name>. |
☁️ Phase 1: Enterprise Multi-Cloud (70 Rapid Q&As) Lessons 1–6 + Labs
Lesson 1: AWS Orgs & Landing Zones
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Why do enterprises use a Multi-Account Landing Zone instead of a single AWS account with many VPCs? | Accounts provide the hardest blast-radius boundary for IAM permissions, AWS API rate limits, security audits, and FinOps billing isolation. |
| 2 | What are the 4 standard core accounts in an AWS Security Reference Architecture (SRA) Landing Zone? | Management Account, Log Archive Account, Security Tooling (Audit) Account, and Shared Network Hub Account. |
| 3 | Do AWS Service Control Policies (SCPs) grant IAM permissions to users? | No, SCPs never grant permissions; they act as organizational guardrails defining the maximum permission ceiling for member accounts (including Account Root). |
| 4 | Does an AWS Service Control Policy (SCP) affect users or roles inside the Organization Management Account? | No, SCPs never apply to the Management Account—which is why workloads must never run in the Management Account. |
| 5 | What AWS evaluation logic applies when an SCP, Permission Boundary, and IAM Role Policy are all present? | An explicit Deny in any policy overrides everything; otherwise, an action is allowed only if all applicable policies (SCP ∩ Boundary ∩ IAM Policy) explicitly Allow it. |
| 6 | How do you prevent a compromised admin from deleting centralized CloudTrail logs in the Log Archive S3 bucket? | Apply an SCP denying s3:DeleteBucket and enable S3 Object Lock in Compliance Mode on the Log Archive bucket. |
| 7 | What service automates multi-account vending and baseline guardrail provisioning in AWS? | AWS Control Tower (using Account Factory for Terraform — AFT). |
| 8 | How do you prevent developers from launching resources outside approved Indian regions (ap-south-1, ap-south-2)? |
Attach a Region Restriction SCP with Effect: Deny and a StringNotEquals condition on aws:RequestedRegion (while excluding global services like IAM/Route53). |
| 9 | Why must global services like iam:*, sts:*, and cloudfront:* be exempted in a Region Restriction SCP? |
Global AWS services always execute API calls against us-east-1 control planes regardless of your workload region. |
| 10 | What IAM mechanism allows a central CI/CD runner to prevent a developer from creating an IAM role with higher privileges than the runner itself? | IAM Permissions Boundaries attached mandatory via condition keys on iam:CreateRole. |
Lesson 2: Transit Gateway & Egress
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Why does VPC Peering fail at enterprise scale (N > 10 VPCs)? | VPC Peering is non-transitive and requires N(N-1)/2 full-mesh connections (e.g., 100 VPCs require 4,950 peerings). |
| 2 | How does AWS Transit Gateway (TGW) solve the O(N^2) peering mesh problem? | TGW acts as a centralized L3 regional hub router where each spoke VPC connects once (O(N) topology). |
| 3 | What is the difference between a TGW Route Table Association and Propagation? | An Association binds an attachment to a single route table for its outbound routing decisions; a Propagation dynamically injects an attachment’s CIDR into target route tables. |
| 4 | How do you isolate Dev VPCs from Prod VPCs while allowing both to reach a Shared Services VPC via one TGW? |
Create separate Dev and Prod TGW Route Tables that propagate only the Shared Services CIDR, omitting cross-environment propagations. |
| 5 | What is a Blackhole route in an AWS Transit Gateway route table? | A static route configured to drop matching packets immediately, used to block unauthorized inter-VPC CIDR traffic explicitly. |
| 6 | Why do enterprises centralize outbound internet traffic through a dedicated Egress Inspection VPC? | It eliminates paying hourly fees for redundant NAT Gateways in 100+ spoke VPCs and enforces centralized L7 DPI/FQDN firewall inspection. |
| 7 | What causes 50% packet drops when routing multi-AZ traffic through stateful firewalls in an Inspection VPC? | Asymmetric routing—outbound packets pass through Firewall AZ-a, while return packets hash to Firewall AZ-b which lacks the TCP state entry. |
| 8 | What single Transit Gateway setting prevents asymmetric routing across multi-AZ stateful inspection firewalls? | Enable Appliance Mode (ApplianceModeSupport = enable) on the Inspection VPC’s Transit Gateway attachment. |
| 9 | How many concurrent connections can a single AWS NAT Gateway support to a single destination IP:Port? | 55,000 connections per destination tuple before throwing port allocation errors. |
| 10 | How do you eliminate NAT Gateway data processing charges ($0.045/GB) for high-volume S3 and DynamoDB traffic? | Provision free Gateway VPC Endpoints for S3 and DynamoDB, which route traffic directly over the private AWS backbone via route table entries. |
Lesson 3: IAM Identity Center & Azure
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What is the difference between SAML 2.0/OIDC and SCIM in enterprise identity federation? | SAML 2.0 / OIDC handles Authentication (verifying identity at login), while SCIM handles Lifecycle Provisioning (auto-creating/disabling users and groups). |
| 2 | Why are static IAM User access keys (AKIA...) banned in enterprise cloud environments? |
They never expire automatically and are the #1 vector for credential leaks in Git repositories; temporary STS tokens (ASIA...) expire in 1–12 hours. |
| 3 | What is an AWS IAM Identity Center Permission Set? | A centralized role template managed in the Organization that provisions corresponding IAM roles into target AWS accounts upon assignment. |
| 4 | What is the Azure architectural equivalent of AWS Organizations and Organizational Units (OUs)? | Azure Management Groups (organized in a hierarchy up to 6 levels deep above Azure Subscriptions). |
| 5 | What is the Azure equivalent of an AWS Service Control Policy (SCP)? | Azure Policy (which can audit, deny, or auto-remediate non-compliant resources across Management Groups). |
| 6 | What is the key difference between AWS SCPs and Azure Policy? | AWS SCPs filter IAM API actions before execution, whereas Azure Policy evaluates ARM resource properties and can auto-deploy missing configurations (DeployIfNotExists). |
| 7 | How do you authenticate an AWS workload to Azure Entra ID (or vice versa) without storing client secrets? | Configure Workload Identity Federation using OIDC trust between the AWS IAM/EKS OIDC issuer and an Azure Managed Identity / App Registration. |
| 8 | What happens to an offboarded engineer’s active AWS CLI session when you disable them in Okta/Entra ID? | Existing issued AWS STS session tokens remain active until their TTL expires unless an inline Deny policy with aws:TokenIssueTime is injected. |
| 9 | What is Azure Virtual WAN (vWAN)? | Microsoft’s managed hub-and-spoke networking service equivalent to AWS Transit Gateway + Cloud WAN. |
| 10 | How do you enforce Just-In-Time (JIT) temporary privileged access for production break-glass scenarios? | Use Azure Entra ID Privileged Identity Management (PIM) or AWS IAM Identity Center temporary elevated access requiring ticket approval and MFA. |
Lesson 4: PrivateLink, BGP & Hybrid DNS
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | How does AWS PrivateLink differ from VPC Peering or Transit Gateway? | PrivateLink is unidirectional L4 TCP exposure of a single service via an ENI without exposing the entire VPC CIDR or requiring non-overlapping IPs. |
| 2 | Can two VPCs with identical, overlapping 10.0.0.0/16 CIDRs communicate securely? |
Yes, by exposing the target application behind a Network Load Balancer (NLB) and connecting via an AWS PrivateLink Interface Endpoint. |
| 3 | What protocol dynamically exchanges routing tables between on-premises datacenters and AWS Direct Connect? | BGP (Border Gateway Protocol) over TCP Port 179. |
| 4 | In what order does a router evaluate BGP attributes to select the best outbound path? | Weight (highest, Cisco/AWS local) → Local Preference (highest, outbound) → AS_PATH (shortest) → MED (lowest, inbound). |
| 5 | How do you force AWS to prefer Direct Connect Link A over Link B for traffic returning to your datacenter? | Advertise a shorter AS_PATH (avoiding AS-Path prepending) or a lower MED (Multi-Exit Discriminator) on Link A. |
| 6 | What protocol is paired with BGP to detect physical link failures in under 300ms instead of waiting 90s for BGP Hold timers? | BFD (Bidirectional Forwarding Detection). |
| 7 | What is the difference between a Route 53 Inbound Resolver Endpoint and an Outbound Resolver Endpoint? | Inbound allows on-prem DNS servers to resolve AWS Private Hosted Zones; Outbound forwards queries from AWS VPCs to on-prem DNS servers. |
| 8 | What causes a fatal DNS query loop between Route 53 Outbound Endpoints and on-premises BIND/Windows DNS servers? | Forwarding corp.internal from AWS to on-prem while on-prem simultaneously forwards corp.internal back to the AWS Inbound Endpoint. |
| 9 | How do you connect AWS Direct Connect and Google Cloud Partner Interconnect privately without physical datacenter routers? | Provision a software-defined virtual router (MCR) on Megaport or Equinix Fabric to bridge BGP sessions across both cloud fabrics at Layer 3. |
| 10 | Why does enabling Private DNS on a VPC Interface Endpoint work seamlessly for zero-code SDK migration? | It creates a hidden Route 53 Private Hosted Zone that resolves the public service FQDN (e.g., sqs.us-east-1.amazonaws.com) directly to the local ENI’s private IP. |
Lesson 5: Cloud WAN, IPv6 & Network Forensics
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | How does AWS Cloud WAN improve upon managing multi-region Transit Gateways manually? | It replaces manual inter-region TGW peering and static route tables with a single declarative Global Core Network Policy written in JSON. |
| 2 | Why are enterprises adopting Dual-Stack IPv6 (56 VPC prefixes) for Kubernetes clusters? |
Large enterprises exhaust RFC 1918 private IPv4 space (10.0.0.0/8) when running thousands of high-density Kubernetes pods per node. |
| 3 | What device enables IPv6-only Kubernetes pods to communicate with legacy IPv4-only external APIs? | NAT64 paired with DNS64 (which synthesizes IPv6 64:ff9b::/96 records from IPv4 A records). |
| 4 | What is an Egress-Only Internet Gateway (EOIGW) in AWS? | The IPv6 equivalent of a NAT Gateway—it allows outbound IPv6 traffic from private subnets while blocking unsolicited inbound IPv6 connections. |
| 5 | Why doesn’t IPv6 require NAT (Network Address Translation) for internet routing? | Every IPv6 address assigned in an AWS VPC is a globally unique public unicast address (GUA), relying on stateful firewalls (EOIGW/Security Groups) rather than NAT. |
| 6 | What extra metadata fields must be enabled in custom VPC Flow Logs (v5) to debug Transit Gateway drops? | pkt-srcaddr, pkt-dstaddr, flow-direction, traffic-path, and sublocation-id. |
| 7 | Why are standard VPC Flow Logs (srcaddr, dstaddr) insufficient when packets traverse an NLB or Transit Gateway? |
Standard fields only show the intermediate NLB/TGW ENI IP addresses, whereas pkt-srcaddr and pkt-dstaddr reveal the original pod and final destination IPs. |
| 8 | What tcpdump flag prevents DNS reverse-lookup delays and displays numeric ports immediately during an outage? |
-nn (e.g., tcpdump -i any -nn port 443). |
| 9 | What do the [S], [S.], [P.], and [R] flags mean in tcpdump output? |
[S] = SYN, [S.] = SYN-ACK, [P.] = PUSH-ACK (data payload), and [R] = RST (Connection Reset). |
| 10 | What AWS feature clones raw network packets from an EC2 instance’s ENI and streams them via VXLAN to an IDS sensor? | AWS VPC Traffic Mirroring. |
Hands-On Labs: Phase 1 Exercises
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | How do you test if an IAM policy or SCP blocks an action without actually executing the destructive API call? | Run aws iam simulate-principal-policy --policy-source-arn <arn> --action-names <action>. |
| 2 | What AWS CLI tool traces the network topology path between two ENIs and identifies the exact blocking Security Group or Route Table? | AWS VPC Reachability Analyzer (aws ec2 start-network-insights-analysis). |
| 3 | How do you query VPC Flow Logs at scale across 50 accounts without paying for expensive CloudWatch Logs ingestion? | Deliver VPC Flow Logs directly to S3 in Apache Parquet format with hourly partitions and query via Amazon Athena. |
| 4 | What dig flag traces DNS delegation step-by-step from the root . nameservers down to the authoritative server? |
dig +trace <domain>. |
| 5 | How do you verify the exact MTU size supported along a network path between two Linux hosts? | Run ping -M do -s 1472 <dest-ip> (1472 payload + 20 IP + 8 ICMP = 1500 bytes). |
📜 Phase 2: IaC & Policy-as-Code (60 Rapid Q&As) Lessons 1–6 + Labs
Lesson 1: Terraform State & Modules
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Why does Terraform require a state file (terraform.tfstate) unlike Kubernetes manifests? |
Cloud APIs lack a built-in declarative reconciliation loop, so Terraform uses .tfstate to map HCL code blocks to real-world cloud resource IDs. |
| 2 | Why must terraform.tfstate never be committed to Git? |
It stores sensitive resource attributes and secrets in unencrypted plaintext JSON and causes merge conflicts when teams run parallel applies. |
| 3 | What are the two AWS services used together for an enterprise Terraform Remote Backend? | Amazon S3 (encrypted state storage with versioning) and Amazon DynamoDB (distributed mutual-exclusion locking via LockID). |
| 4 | How does Terraform build its execution order across hundreds of resources? | It constructs a Directed Acyclic Graph (DAG) from implicit resource references and explicit depends_on edges, executing independent nodes in parallel (default parallelism = 10). |
| 5 | What is the difference between count and for_each in Terraform resource blocks? |
count indexes resources by numeric list position ([0], [1]), whereas for_each indexes resources by stable map keys (["az-a"]). |
| 6 | Why is for_each strongly preferred over count for production subnets or IAM users? |
Deleting the first item in a count list shifts all subsequent indices down by 1, causing Terraform to destroy and recreate every remaining resource. |
| 7 | How do you pin a Terraform module to an immutable release version in Git? | Reference the module source with a Git tag or commit SHA: source = "git::https://github.com/org/vpc.git?ref=v1.4.2". |
| 8 | What command upgrades provider plugins while respecting version constraints in .terraform.lock.hcl? |
terraform init -upgrade. |
| 9 | Why must .terraform.lock.hcl always be committed to version control? |
It pins the exact cryptographic SHA-256 hashes of provider binaries so every developer and CI runner executes identical provider code. |
| 10 | What replaces the deprecated terraform taint command to force recreating a single broken resource? |
terraform apply -replace="aws_instance.web[0]". |
Lesson 2: Policy-as-Code (Checkov & OPA)
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What is the architectural difference between Checkov and Open Policy Agent (OPA)? | Checkov performs fast static graph analysis on raw HCL files, while OPA (Conftest) evaluates complex Rego policies against the compiled terraform plan JSON. |
| 2 | How do you export a binary terraform plan into a machine-readable JSON file for OPA evaluation? |
Run terraform plan -out=tfplan.binary && terraform show -json tfplan.binary > tfplan.json. |
| 3 | What happens in OPA Rego when a rule references a JSON field that does not exist in input? |
The expression evaluates to undefined (not false), halting execution of the current rule body immediately. |
| 4 | How do you prevent the “Rego Silent Bypass Trap” when writing allow/deny rules? | Always declare an explicit default (default allow = false) and write deny[msg] rules that accumulate violation strings. |
| 5 | In Rego, how is logical AND vs logical OR written? |
Logical AND is lines inside the same rule body; Logical OR is defining multiple rules with the exact same name. |
| 6 | What symbol acts as an existential quantifier (“for some index i”) when iterating over arrays in Rego? | The underscore wildcard [_] (e.g., rc := input.resource_changes[_]). |
| 7 | How do you document an approved exception to a Checkov rule directly inside a Terraform resource block? | Add an inline comment with a mandatory justification: #checkov:skip=CKV_AWS_20:Public static assets bucket approved by SecOps-104. |
| 8 | How do you unit-test Rego policies in a CI/CD pipeline before deploying them? | Create *_test.rego files with mocked with input as {...} payloads and run opa test ./policy -v. |
| 9 | What CLI tool runs OPA Rego policies specifically against structured configuration files (Terraform JSON, K8s YAML, Dockerfiles)? | Conftest (conftest test tfplan.json -p policy/). |
| 10 | What property in tfplan.json tells you whether Terraform intends to create, update, or delete a resource? |
input.resource_changes[_].change.actions. |
Lesson 3: Terragrunt Fleet Scaling
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Why do enterprises split a single monolithic Terraform state file into smaller layered states (“Terraservices”)? | Monolithic states take 30+ minutes to refresh, hit AWS API rate limits, and risk wiping out the entire company’s infrastructure from a single bad apply. |
| 2 | What core problem does Terragrunt solve when managing 50+ AWS accounts and environments? | It keeps backend configurations, provider blocks, and module invocations DRY (Don’t Repeat Yourself) via hierarchical terragrunt.hcl inheritance. |
| 3 | How does a child terragrunt.hcl inherit the S3 remote state configuration from the root directory? |
Using include "root" { path = find_in_parent_folders() }. |
| 4 | What dynamically generates provider.tf and backend.tf files on the fly before Terragrunt calls Terraform? |
The Terragrunt generate block (generate "provider" { path = "provider.tf" ... }). |
| 5 | How does Terragrunt pass the vpc_id output from the vpc module into the eks module without hardcoding terraform_remote_state data sources? |
Using a dependency "vpc" { config_path = "../vpc" } block and referencing dependency.vpc.outputs.vpc_id. |
| 6 | What causes a Terragrunt Cold-Boot Deadlock when running terragrunt run-all plan on a brand-new environment? |
The eks module tries to read dependency.vpc.outputs.vpc_id, which does not exist yet because the vpc module has never been applied. |
| 7 | How do you solve the Terragrunt Cold-Boot dependency failure during plan and validate? |
Define mock_outputs = { vpc_id = "vpc-mock123" } and mock_outputs_allowed_terraform_commands = ["validate", "plan"] inside the dependency block. |
| 8 | What command executes terraform apply across an entire directory tree of modules in topological dependency order? |
terragrunt run-all apply. |
| 9 | How do you limit Terragrunt concurrency so run-all does not trigger AWS API throttling? |
Pass --terragrunt-parallelism 4. |
| 10 | How do you deploy the exact same Terraform module version to dev, staging, and prod while promoting versions safely? |
Override the module source version tag (?ref=v1.2.0 in dev, ?ref=v1.1.0 in prod) in each environment’s env.hcl. |
Lesson 4: HashiCorp Vault Secrets
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What is the cryptographic mechanism Vault uses by default to split its Master Key into N unseal shards? | Shamir’s Secret Sharing Algorithm (requiring a threshold of K shards out of N to reconstruct the Master Key in RAM). |
| 2 | How do production Vault clusters unseal automatically upon pod restart without human operators typing unseal keys? | Cloud KMS Auto-Unseal—Vault encrypts its Master Key using an AWS KMS / GCP Cloud KMS key and decrypts it via IAM role identity on boot. |
| 3 | What storage backend replaced external Consul clusters as the modern standard for HA Vault deployments? | Integrated Storage (Raft), which embeds Raft consensus directly inside Vault nodes across 3 or 5 AZs. |
| 4 | What is the difference between Vault Static KV-v2 secrets and Vault Dynamic Secrets? | Static secrets exist until manually rotated, whereas Dynamic Secrets are generated on-demand with a short lease TTL and automatically revoked upon expiry. |
| 5 | How does a CI/CD machine or VM authenticate to Vault using the AppRole auth method? | By presenting a RoleID (like a username, baked into config) and a single-use wrapped SecretID (like a password, delivered securely at runtime). |
| 6 | What is Response Wrapping (-wrap-ttl=60s) in HashiCorp Vault? |
Vault stores the secret inside a single-use cubbyhole token that can only be unwrapped once; if an attacker intercepts and unwraps it first, the real app’s unwrap fails and triggers a security alert. |
| 7 | How does Vault verify a Kubernetes pod’s identity during Kubernetes Auth login? | The pod sends its ServiceAccount JWT to Vault, and Vault verifies it against the Kubernetes API Server’s TokenReview endpoint. |
| 8 | What happens to active PostgreSQL connections if a Vault dynamic credential lease expires? | Vault connects to PostgreSQL and executes DROP ROLE / REVOKE, terminating or invalidating the temporary database user. |
| 9 | What is Vault Transit Secrets Engine (“Encryption as a Service”)? | Microservices send plaintext to Vault’s /transit/encrypt API and receive ciphertext back without ever storing or handling encryption keys in application memory. |
| 10 | Where must Vault audit logs be sent, and what happens if all audit log devices fail to write? | Audit logs go to immutable storage/SIEM; if all configured audit sinks fail to write, Vault immediately halts and refuses to serve any API requests to guarantee zero unaudited access. |
Lesson 5: Moved Blocks & Drift Detection
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What happens if you rename resource "aws_db_instance" "db" to "primary_db" in HCL without state migration? |
Terraform plans to destroy the existing production database and create a brand-new empty one! |
| 2 | Why are declarative moved { from = ... to = ... } blocks superior to running terraform state mv manually? |
moved blocks are committed to Git, reviewed in PRs, and execute automatically across dev, staging, and prod during standard CI/CD pipelines. |
| 3 | What declarative block added in Terraform 1.5+ imports existing brownfield cloud resources without running terraform import CLI commands? |
The import { to = aws_s3_bucket.logs, id = "my-bucket-name" } block. |
| 4 | What CLI flag paired with import blocks automatically generates the matching HCL resource code from live cloud infrastructure? |
terraform plan -generate-config-out=generated_resources.tf. |
| 5 | What declarative block removes a resource from Terraform state tracking without destroying the real cloud resource? | The removed { from = aws_s3_bucket.legacy, lifecycle { destroy = false } } block (replaces terraform state rm). |
| 6 | What exit code does terraform plan -detailed-exitcode return when infrastructure drift is detected? |
Exit code 0 = No changes; Exit code 1 = Error; Exit code 2 = Drift / Changes detected. |
| 7 | What is the difference between terraform plan -refresh-only and terraform plan? |
-refresh-only only compares live cloud APIs against .tfstate to detect out-of-band console changes, ignoring unapplied HCL code modifications. |
| 8 | When should you use lifecycle { ignore_changes = [tags] }? |
When an external controller (like Kubernetes Karpenter, AWS Auto Scaling, or a Lambda) dynamically mutates specific attributes outside of Terraform. |
| 9 | What lifecycle meta-argument causes terraform plan to abort with a hard error if any change would destroy a critical database? |
lifecycle { prevent_destroy = true }. |
| 10 | How does lifecycle { create_before_destroy = true } prevent downtime during resource replacement? |
It provisions the new replacement resource first and updates downstream references before destroying the old resource. |
Lesson 6: HCL Mastery & Phase 2 Labs
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | What HCL construct dynamically generates multiple nested configuration blocks (such as ingress rules inside a aws_security_group)? |
The dynamic "ingress" { for_each = var.rules ... content { ... } } block. |
| 2 | How do you write a for expression in HCL that filters a map to include only production subnets? |
[for k, v in var.subnets : v.id if v.env == "prod"]. |
| 3 | What is the HCL Splat operator ([*]), and what does aws_instance.web[*].private_ip return? |
It iterates over a list of resources and returns a flat list of all their private_ip attributes. |
| 4 | What HCL function safely accesses deeply nested map keys and returns a fallback default instead of throwing an error if a key is missing? | try(var.config.database.port, 5432). |
| 5 | What HCL function calculates CIDR subnet ranges dynamically from a base VPC CIDR? | cidrsubnet(prefix, newbits, netnum) (e.g., cidrsubnet("10.0.0.0/16", 8, 1) → "10.0.1.0/24"). |
| 6 | How do you validate input variables in Terraform so invalid CIDRs or instance types fail immediately before API calls? | Add a validation { condition = can(cidrnetmask(var.cidr)) error_message = "..." } block inside the variable definition. |
| 7 | What is the difference between precondition and postcondition inside a resource lifecycle block? |
precondition validates assumptions before creating a resource; postcondition verifies live attributes of the resource after creation (e.g., ensuring encrypted == true). |
| 8 | What built-in Terraform testing framework (introduced in v1.6) runs .tftest.hcl unit and integration tests natively? |
terraform test (using run and assert blocks with mock_provider). |
| 9 | What HCL function merges multiple maps of AWS tags together, where later maps override earlier keys? | merge(local.common_tags, var.extra_tags). |
| 10 | What HCL function converts a list of strings into an unordered set required by for_each? |
toset(var.subnet_ids). |
Lesson 7: Python for Platform & Lambda
| # | One-Line Question | One-Line Answer |
|---|---|---|
| 1 | Why must boto3.client('s3') be initialized outside the lambda_handler(event, context) function in AWS Lambda? |
Code outside the handler runs once during container Cold Start and is reused across subsequent Warm Invocations, avoiding expensive TLS handshake overhead on every call. |
| 2 | Why does a basic s3.list_objects_v2() or ec2.describe_instances() call silently miss resources in large production accounts? |
AWS APIs paginate responses (typically returning max 1,000 items); you must use Boto3 Paginators (client.get_paginator().paginate()) to fetch all pages. |
| 3 | How do you prevent Boto3 scripts from crashing when AWS APIs return ThrottlingException (HTTP 429)? |
Configure botocore.config.Config(retries={'max_attempts': 10, 'mode': 'adaptive'}), which implements client-side token-bucket rate limiting and exponential backoff with jitter. |
| 4 | What is the primary danger of executing AWS Lambda inside private VPC subnets without capacity planning? | Each unique (SecurityGroup, Subnet) combination requires a Hyperplane ENI; if subnets use small /28 CIDRs, Lambda can exhaust available subnet IPs during scaling bursts. |
| 5 | Why must every production Lambda function interacting with SQS or EventBridge have an idempotency key check? | Cloud event queues guarantee at-least-once delivery, meaning the exact same event payload can be delivered twice and must not execute duplicate state changes. |
| 6 | How does AWS Powertools for Python enforce idempotency in Lambda functions? | Using the @idempotent decorator backed by a DynamoDB table that locks and caches results by payload hash. |
| 7 | What happens to messages that repeatedly fail processing in an SQS-triggered Lambda function? | After exceeding maxReceiveCount, SQS moves the poison message to a Dead-Letter Queue (DLQ) so it stops blocking the main queue. |
| 8 | Why should you use ReportBatchItemFailures when processing SQS batches in Lambda? |
If 1 message out of a batch of 10 fails, returning only the failed itemIdentifier prevents SQS from reprocessing the 9 messages that already succeeded. |
| 9 | What Python standard library module should be used instead of print() in Lambda to enable CloudWatch Logs Insights JSON queries? |
Structured JSON logging via logging (or aws_lambda_powertools.Logger) including correlation_id and aws_request_id. |
| 10 | How does a Python AWS Config Custom Rule remediation Lambda fix non-compliant resources in real time? | EventBridge captures the ComplianceChangeNotification, triggers the Lambda, and the Lambda uses boto3 to apply the missing encryption or security policy automatically. |