Top 30 AWS Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   Which statement best describes a core benefit of adopting public cloud for a new business?

   • aIt completely removes the need for any IT security management.
   • bIt ensures all data remains within a single, specified geographic region by default.
   • cIt enables rapid resource scaling and avoids large upfront capital investments.
   • dIt guarantees lower overall IT spending compared to owning hardware.
   Show the answer

   Answer: c · It enables rapid resource scaling and avoids large upfront capital investments.

   Option C is correct because the card emphasizes public cloud's ability to turn rigid capital expense into flexible operational expense, allowing rapid scaling without large upfront hardware purchases. Option D is incorrect as the card notes that public cloud may not be cost-effective for stable, high-utilization workloads and uncontrolled usage can lead to higher costs.

   Read the full bite: Public Cloud: Renting, Not Owning, Your Datacenter

2. Question 2 of 30

   For an automated pipeline loading daily CSVs from cloud storage to a database, which architecture is most efficient and scalable?

   • aA developer manually uploads the CSV to a processing server that loads the entire file into memory before a bulk insert into the database.
   • bAn S3 event triggers a Lambda function that downloads the entire CSV into memory, parses it, and inserts each row individually into RDS.
   • cAn S3 event triggers a Lambda function to stream the CSV, batch records, and execute a single batch INSERT into RDS.
   • dAn EC2 instance with a cron job polls S3, downloads the CSV, and inserts each row individually into an RDS database.
   Show the answer

   Answer: c · An S3 event triggers a Lambda function to stream the CSV, batch records, and execute a single batch INSERT into RDS.

   The correct architecture leverages event-driven serverless functions to stream and batch data, avoiding memory limits and inefficient row-by-row database operations. Distractor D, while event-driven and serverless, fails by loading the entire file into memory and performing individual inserts, which are both anti-patterns for scalability.

   Read the full bite: Build a pipeline to load CSVs into a database

3. Question 3 of 30

   Which design best distinguishes a production-ready daily CSV pipeline from a simple demo script?

   • aUsing an event trigger, validating the file, loading into a staging table, merging idempotently, and alerting on failures
   • bOrchestrating the load with a complex Airflow DAG using long-lived database credentials
   • cRunning a cron job on a VM that polls for the file and appends it directly to the final table
   • dUsing an S3 event to trigger a direct load into the final table and skipping validation to keep the architecture serverless
   Show the answer

   Answer: a · Using an event trigger, validating the file, loading into a staging table, merging idempotently, and alerting on failures

   Option A captures the card's production requirements: event-driven triggers, pre-load validation, idempotent staging-to-final loading, and observability. Option C is the most tempting distractor because a cron job on a VM is a common beginner choice, but it introduces latency, unnecessary cost, and duplicate-row risks.

   Read the full bite: Outline an automated pipeline to load a daily CSV into a database

4. Question 4 of 30

   What is the most efficient, event-driven design for a pipeline that loads a daily CSV file from an S3 bucket into a database?

   • aA scheduled cron job on an EC2 instance that checks the S3 bucket for new files once per day.
   • bA CloudWatch Event rule on a fixed schedule that invokes a Lambda function to check for the file.
   • cAn AWS Glue job scheduled to run daily, which reads from S3 and writes to the database.
   • dAn S3 Event Notification that triggers a Lambda function to parse the file and load the data.
   Show the answer

   Answer: d · An S3 Event Notification that triggers a Lambda function to parse the file and load the data.

   The correct approach is event-driven, using an S3 Event Notification to trigger a Lambda function instantly upon file creation. A scheduled job on EC2 or via CloudWatch is a polling mechanism, which is less efficient and introduces unnecessary delay.

   Read the full bite: Build a pipeline to load a daily CSV into a database

5. Question 5 of 30

   What is the primary benefit of using a machine image for deploying servers?

   • aIt enables rapid and consistent provisioning of identical virtual machines.
   • bIt simplifies server management by abstracting away the underlying hardware details.
   • cIt is primarily used for simple applications where Docker containers are too complex.
   • dIt allows for unique, custom configurations on each server instance at boot time.
   Show the answer

   Answer: a · It enables rapid and consistent provisioning of identical virtual machines.

   The card emphasizes that machine images solve "slow, error-prone, and inconsistent server provisioning" by acting as a "cookie cutter" to launch "hundreds of identical virtual machines" quickly. Option D is incorrect because images are for identical servers; unique configurations often require additional tools. Option C is incorrect as the card states images can be overkill for simple applications, where Docker might be preferred.

   Read the full bite: Machine Images: The Blueprint for Your Servers

6. Question 6 of 30

   Which scenario best illustrates the primary advantage of using cloud instances?

   • aA company with a consistent, predictable computing load that needs to minimize monthly operational costs.
   • bA website experiencing significant, unpredictable spikes in user traffic throughout the day.
   • cAn organization looking to completely eliminate the need for IT staff to manage physical hardware.
   • dA small, local business needing a single, always-on server for internal file storage.
   Show the answer

   Answer: b · A website experiencing significant, unpredictable spikes in user traffic throughout the day.

   Cloud instances are designed for elasticity, allowing users to scale computing resources up or down rapidly to meet fluctuating demand and pay only for the time they are active. A website with unpredictable traffic spikes directly benefits from this on-demand scalability, unlike scenarios with consistent loads or static needs.

   Read the full bite: Cloud Instances: Renting Servers on Demand

7. Question 7 of 30

   Which of the following best describes the primary function of an Auto Scaling Group (ASG)?

   • aTo ensure instances are provisioned across different Availability Zones for high availability.
   • bTo manage the deployment and updates of application code across a fleet of servers.
   • cTo automatically distribute incoming network traffic across multiple healthy instances.
   • dTo dynamically adjust the number of instances based on demand and automatically replace failed instances.
   Show the answer

   Answer: d · To dynamically adjust the number of instances based on demand and automatically replace failed instances.

   The card explicitly states ASGs automate both 'elasticity (matching capacity to demand)' and 'fault tolerance (recovering from instance failures),' which aligns with dynamically adjusting instance count and replacing failed instances. Option C describes the function of a load balancer, which works in conjunction with an ASG but is not the ASG's primary role.

   Read the full bite: Auto Scaling Groups: Elasticity and Self-Healing

8. Question 8 of 30

   When would an AWS customer most likely choose a Convertible Reserved Instance over a Standard Reserved Instance?

   • aTo secure the highest possible discount for a fixed, long-term workload.
   • bIf they foresee potential changes in their instance family or operating system requirements.
   • cTo ensure dedicated physical server capacity for compliance reasons.
   • dWhen their compute needs are highly variable and unpredictable throughout the day.
   Show the answer

   Answer: b · If they foresee potential changes in their instance family or operating system requirements.

   Convertible RIs offer flexibility to change instance families or operating systems later, making them suitable when future requirements are uncertain. Standard RIs, while offering the highest discount, lack this flexibility, making option A incorrect.

   Read the full bite: AWS Reserved Instances: Commit to Compute, Save Big

9. Question 9 of 30

   Which task is an ideal use case for a user data script?

   • aAutomating the initial installation of a web server and application code on a new instance.
   • bOrchestrating the deployment and inter-service communication of a complex microservices architecture.
   • cContinuously updating software packages and configurations on running servers.
   • dCreating a custom Amazon Machine Image (AMI) with pre-installed applications and settings.
   Show the answer

   Answer: a · Automating the initial installation of a web server and application code on a new instance.

   User data scripts are designed for "Day One" instance configuration, such as installing software and pulling application code on first boot. They are not suitable for ongoing updates, creating AMIs with baked-in configurations, or complex multi-service orchestration.

   Read the full bite: User Data Scripts: Day-One Instance Configuration

10. Question 10 of 30

    Which type of workload is generally LEAST appropriate for AWS Spot Instances?

    • aLarge-scale data analysis that can resume from interruption
    • bContinuous integration and deployment pipelines
    • cBatch processing for video transcoding
    • dA primary, stateful production database
    Show the answer

    Answer: d · A primary, stateful production database

    Spot Instances are explicitly advised against for critical production databases or stateful applications due to their potential for sudden interruption. The other options (batch processing, data analysis, CI/CD) are all cited as suitable use cases because they are fault-tolerant and can handle interruptions.

    Read the full bite: Spot Instances: Trade Reliability for Huge Cost Savings

11. Question 11 of 30

    Which AWS Placement Group strategy is best for a large distributed database to minimize correlated hardware failures?

    • aDedicated Host, to provide exclusive physical servers for the database instances.
    • bCluster, to ensure all nodes are in the same rack for fastest communication.
    • cSpread, to place each instance on entirely distinct hardware for maximum isolation.
    • dPartition, to distribute instances across logical hardware segments, reducing single point of failure impact.
    Show the answer

    Answer: d · Partition, to distribute instances across logical hardware segments, reducing single point of failure impact.

    Partition placement groups are designed for large distributed systems like Kafka or Cassandra, allowing instances to be spread across logical hardware partitions to reduce the chance of multiple nodes failing from a single hardware issue. While Spread groups also offer isolation, they are typically recommended for a small number of critical instances, not large distributed databases, due to the potential to exhaust distinct hardware.

    Read the full bite: AWS Placement Groups: Control Where Your Instances Run

12. Question 12 of 30

    What unique capability does an AWS Dedicated Host offer that is essential for specific software licensing and strict regulatory compliance?

    • aAutomated migration of instances to a new host if the original one fails.
    • bExclusive use of an entire physical server, with visibility into its underlying hardware.
    • cInstance-level isolation from other customers on a shared physical server.
    • dCost-effective scaling of general-purpose workloads.
    Show the answer

    Answer: b · Exclusive use of an entire physical server, with visibility into its underlying hardware.

    Dedicated Hosts provide exclusive use of a physical server and visibility into its hardware, which is critical for 'bring your own license' (BYOL) software tied to physical cores and for meeting compliance requiring physical isolation. Option C describes EC2 Dedicated Instances, which offer isolation but lack the full server control and hardware visibility for per-core licensing.

    Read the full bite: AWS Dedicated Hosts: Your Own Physical Server in the Cloud

13. Question 13 of 30

    A developer configures Cross-Region Replication (CRR) for an existing S3 bucket. What is a critical behavior they should be aware of regarding the replication process?

    • aThe replication process is synchronous, ensuring immediate consistency across regions.
    • bObjects already present in the source bucket before CRR activation will not be replicated.
    • cCRR will only replicate objects that have public read access enabled.
    • dReplication only occurs for objects updated, not newly uploaded, after CRR is enabled.
    Show the answer

    Answer: b · Objects already present in the source bucket before CRR activation will not be replicated.

    The card explicitly states that CRR "does not replicate objects that were present before replication was configured." It only applies to new objects or updates made after CRR is enabled. Option A is incorrect because the card describes CRR as an "asynchronous" feature.

    Read the full bite: Cross-Region Replication (CRR): Geographic Data Copying

14. Question 14 of 30

    What is the fundamental benefit a Virtual Private Cloud (VPC) provides within a public cloud?

    • aIt creates a logically isolated network space, giving you control over traffic and resource separation.
    • bIt guarantees that your applications will run on dedicated physical servers for optimal performance.
    • cIt ensures all your cloud resources are automatically encrypted and protected from external threats.
    • dIt allows you to completely bypass the public internet, ensuring all communication remains within the cloud provider's private backbone.
    Show the answer

    Answer: a · It creates a logically isolated network space, giving you control over traffic and resource separation.

    A VPC's core purpose is to provide a logically isolated network environment, allowing you to define network rules and separate resources like web servers from databases. While security is enhanced, automatic encryption of all resources is not its primary function, nor does it guarantee dedicated physical hardware or bypass the public internet for external communication.

    Read the full bite: VPC: Your Private Slice of the Public Cloud

15. Question 15 of 30

    What is a key advantage of using Amazon EC2 for deploying applications, especially concerning resource management?

    • aIt completely eliminates the need for any operating system or software configuration.
    • bIt ensures that all application data is automatically replicated across all AWS regions globally.
    • cIt allows dynamic scaling of computing resources to match fluctuating demand.
    • dIt provides a fixed, upfront cost model, simplifying budget planning for infrastructure.
    Show the answer

    Answer: c · It allows dynamic scaling of computing resources to match fluctuating demand.

    The card emphasizes EC2's ability to "add or remove server instances to match demand" for "fluctuating computing needs," which is dynamic scaling. EC2 operates on a pay-per-use model, meaning costs are variable rather than fixed upfront.

    Read the full bite: Amazon EC2: Rentable Virtual Servers on AWS

16. Question 16 of 30

    Which statement accurately describes a key aspect of a security group's 'stateful' behavior?

    • aIt remembers the source IP addresses of previously blocked malicious attempts.
    • bIt allows administrators to define explicit 'deny' rules based on traffic patterns.
    • cIt maintains a persistent record of all network connections for forensic analysis.
    • dIt automatically allows inbound response traffic for connections initiated from within the protected resource.
    Show the answer

    Answer: d · It automatically allows inbound response traffic for connections initiated from within the protected resource.

    A stateful firewall tracks active connections, automatically allowing return traffic for connections initiated from within the resource, even if no explicit inbound rule exists for that return traffic. Option B is incorrect because security groups are allow-only and do not support explicit deny rules.

    Read the full bite: Security Groups: Stateful Firewalls for Your Cloud Resources

17. Question 17 of 30

    For which use case would you typically deploy an AWS NAT Gateway?

    • aTo allow internet users to access a web application hosted on EC2 instances in a private subnet.
    • bTo allow instances in a private subnet to initiate outbound connections to the internet for updates.
    • cTo enable an EC2 instance in a public subnet to communicate with a database in another VPC.
    • dTo assign a static public IP address to a private EC2 instance for direct inbound SSH access.
    Show the answer

    Answer: b · To allow instances in a private subnet to initiate outbound connections to the internet for updates.

    A NAT Gateway's primary purpose is to enable instances in private subnets to initiate outbound internet traffic, such as downloading updates, without allowing unsolicited inbound connections. Option A is incorrect because NAT Gateways do not permit inbound traffic from the internet. Option D is incorrect as NAT Gateways do not provide direct public IP addresses to private instances for inbound access.

    Read the full bite: NAT Gateway: Your VPC's Outbound-Only Internet Door

18. Question 18 of 30

    Which statement accurately describes a critical configuration requirement for a Network ACL (NACL) to allow a web server in its associated subnet to successfully respond to incoming HTTP requests?

    • aThe inbound rule allowing HTTP traffic must have a lower rule number than any other inbound rule to ensure it's processed first.
    • bA separate NACL must be created for each individual web server instance to manage its specific traffic.
    • cOnly an inbound rule allowing HTTP traffic on port 80 is necessary, as NACLs automatically permit return traffic for established connections.
    • dBoth an inbound rule allowing HTTP traffic on port 80 and an outbound rule allowing traffic on ephemeral ports (1024-65535) must be explicitly defined.
    Show the answer

    Answer: d · Both an inbound rule allowing HTTP traffic on port 80 and an outbound rule allowing traffic on ephemeral ports (1024-65535) must be explicitly defined.

    NACLs are stateless, meaning they do not remember previous connections. Therefore, to allow a web server to respond to an inbound HTTP request, explicit outbound rules for the return traffic on ephemeral ports must be configured in addition to the inbound HTTP rule. Option C describes the behavior of stateful firewalls like Security Groups, not NACLs.

    Read the full bite: Network ACLs: A Stateless Firewall for Subnets

19. Question 19 of 30

    Which statement accurately describes a fundamental limitation of VPC peering?

    • aIt necessitates traffic to pass over the public internet when connecting VPCs in different regions.
    • bIt restricts connections to VPCs within the same AWS account and geographical region.
    • cIt does not support transitive routing, meaning communication cannot pass through an intermediate peered VPC.
    • dIt introduces a single point of failure and potential bandwidth bottlenecks between connected VPCs.
    Show the answer

    Answer: c · It does not support transitive routing, meaning communication cannot pass through an intermediate peered VPC.

    The card explicitly states that VPC peering connections are not transitive, meaning communication cannot pass through an intermediate VPC. This is a critical limitation for complex network designs. The other options contradict the card's description of VPC peering's security, reliability, and cross-account/region capabilities.

    Read the full bite: VPC Peering: Connect Private Networks Securely

20. Question 20 of 30

    Which characteristic is most crucial for an ML training workload to effectively leverage cloud Spot Instances?

    • aIt requires the highest possible network bandwidth for data transfer.
    • bThe training process can tolerate interruptions and resume progress from a saved state.
    • cIt needs to run on a specific GPU architecture that is rarely available on-demand.
    • dIt is a stateless workload that processes independent data batches.
    Show the answer

    Answer: b · The training process can tolerate interruptions and resume progress from a saved state.

    Spot Instances are heavily discounted because they can be interrupted and reclaimed by the cloud provider. Therefore, the most critical characteristic for an ML training job to effectively use them is its ability to handle these interruptions by checkpointing its progress and resuming later. While stateless workloads can be suitable, the ability to checkpoint and resume is more broadly applicable to stateful ML training jobs.

    Read the full bite: Slash ML Training Costs with Spot Instances

21. Question 21 of 30

    An engineer adds an RDS read replica expecting it to take over automatically if the primary fails. What is wrong with this expectation?

    • aRead replicas cannot be queried, so they hold no usable data
    • bRead replicas are synchronous, so they would block the primary on failure
    • cRead replicas always lose all data when the primary fails
    • dPromotion of a read replica is a manual action; only Multi-AZ provides automatic failover
    Show the answer

    Answer: d · Promotion of a read replica is a manual action; only Multi-AZ provides automatic failover

    Read replicas are asynchronous copies for read scaling and must be manually promoted. Automatic failover is the job of a Multi-AZ standby, which is synchronous and passive.

    Read the full bite: RDS Multi-AZ versus Read Replicas

22. Question 22 of 30

    A developer wants to ensure users are directed to the closest available server. Which statement accurately distinguishes between Geolocation and Latency-based routing for this goal?

    • aBoth policies achieve the same outcome, but Geolocation is simpler to configure for global traffic distribution.
    • bGeolocation routes based on the user's IP address mapping to a physical region, while Latency-based routing directs traffic to the server with the lowest measured network round-trip time from the user.
    • cLatency-based routing is primarily for failover scenarios, while Geolocation is for distributing traffic evenly across all regions.
    • dGeolocation prioritizes servers with the fewest active connections, whereas Latency-based routing uses predefined regional boundaries.
    Show the answer

    Answer: b · Geolocation routes based on the user's IP address mapping to a physical region, while Latency-based routing directs traffic to the server with the lowest measured network round-trip time from the user.

    Geolocation routes based on the user's inferred physical location, which may not always correspond to the lowest network latency. Latency-based routing actively measures or estimates the network delay to various endpoints to direct users to the fastest available server, directly addressing the 'closest available server' goal based on network performance.

    Read the full bite: DNS Routing Policies: Directing Traffic with Intention

23. Question 23 of 30

    For a financial firm moving petabytes of sensitive data to the cloud and running a hybrid analytics platform needing guaranteed low-latency access, which networking solution is best?

    • aEstablishing a dedicated, unmanaged fiber optic link directly to the cloud provider's core network.
    • bImplementing Cloud Direct Connect with appropriate Virtual Interfaces.
    • cTransferring data via the public internet with optimized transfer protocols.
    • dUtilizing a site-to-site VPN connection over the public internet.
    Show the answer

    Answer: b · Implementing Cloud Direct Connect with appropriate Virtual Interfaces.

    Cloud Direct Connect is designed for large-scale data transfers and hybrid applications requiring consistent, low-latency, and secure communication, precisely matching the firm's needs. A site-to-site VPN (D) is less suitable for petabytes of data and guaranteed low-latency, while the public internet (C) lacks the necessary predictability, security, and performance guarantees. Option A describes a non-standard or overly simplified approach, as Direct Connect involves specific colocation facilities and managed services, not a direct unmanaged link to the provider's core.

    Read the full bite: Cloud Direct Connect: A Private Lane to the Cloud

24. Question 24 of 30

    Which pipeline design best prevents backpressure during flash sales while enabling cost-efficient sessionization and warehouse loading?

    • aReal-time MSK ingestion into Flink for immediate sessionization with continuous Redshift streaming inserts
    • bECS ingestion to Kinesis, S3 batches, EMR Serverless Spark sessionization, and Redshift COPY via Step Functions
    • cA single auto-scaling ECS service that enriches clicks, assigns session IDs, and streams into Redshift
    • dDirect writes from an ECS fleet to Redshift using connection pooling and table partitioning
    Show the answer

    Answer: b · ECS ingestion to Kinesis, S3 batches, EMR Serverless Spark sessionization, and Redshift COPY via Step Functions

    The correct answer decouples producers from processors with a buffer and uses batch-friendly EMR Serverless for sessionization before bulk-loading to Redshift. Distractor D is tempting because MSK is a valid buffer, but streaming everything into Redshift ignores that clickstream analytics is typically cheaper and more efficient as batch or micro-batch.

    Read the full bite: Design a clickstream pipeline from ingestion to data warehouse

25. Question 25 of 30

    When designing a nightly pipeline to score millions of records with an XGBoost model, which approach best satisfies cost and reliability requirements?

    • aPartition input in S3 by shard ID, run SageMaker Batch Transform on CPU spot instances, and implement idempotent retries per shard
    • bDeploy a real-time inference endpoint and invoke it via API for each record individually
    • cStore all records in a single S3 object and process them sequentially on one large EC2 instance
    • dPartition input in S3 by customer segment but use GPU on-demand instances to maximize throughput for the XGBoost model
    Show the answer

    Answer: a · Partition input in S3 by shard ID, run SageMaker Batch Transform on CPU spot instances, and implement idempotent retries per shard

    The card recommends partitioning S3 data, using SageMaker Batch Transform on right-sized CPU spot instances, and designing idempotent shards so retries only reprocess failed batches. Option D is tempting because partitioning is correct, but GPUs are unnecessary for XGBoost and on-demand instances sacrifice the significant cost savings the card highlights.

    Read the full bite: Design a system for batch scoring millions of customer records daily

26. Question 26 of 30

    In IRSA, what actually turns the pod's projected service-account token into usable AWS credentials?

    • aThe kubelet writing credentials to a hostPath volume
    • bAn STS AssumeRoleWithWebIdentity call validated against the cluster OIDC provider
    • cA long-lived access key stored in a Kubernetes Secret
    • dThe node's EC2 instance profile shared by all pods on it
    Show the answer

    Answer: b · An STS AssumeRoleWithWebIdentity call validated against the cluster OIDC provider

    IRSA federates via OIDC: the SDK calls STS AssumeRoleWithWebIdentity with the projected token to obtain temporary credentials. The instance profile would grant identical permissions to every pod on the node, defeating per-workload isolation.

    Read the full bite: Grant an EKS pod IAM access to S3

27. Question 27 of 30

    For which database scenario are managed backups typically considered unnecessary or less critical?

    • aA database requiring recovery from an application bug that corrupted data
    • bA database storing sensitive patient health records
    • cA database used for ephemeral caching of frequently accessed data
    • dA production database for an e-commerce platform
    Show the answer

    Answer: c · A database used for ephemeral caching of frequently accessed data

    The card specifies that managed backups are often unnecessary for ephemeral databases, such as caches, where data can be easily regenerated. In contrast, production databases and those requiring recovery from corruption are prime candidates for managed backups.

    Read the full bite: Managed Database Backups: Your Cloud's Undo Button

28. Question 28 of 30

    When considering Multi-AZ for a critical database, which statement is true about its read scaling capabilities?

    • aMulti-AZ DB instances provide read scaling through their synchronously replicated standby.
    • bRead scaling is not a feature of Multi-AZ; it only provides high availability.
    • cAll Multi-AZ deployments automatically scale reads using their standby instances.
    • dOnly Multi-AZ DB clusters can distribute read traffic across multiple instances.
    Show the answer

    Answer: d · Only Multi-AZ DB clusters can distribute read traffic across multiple instances.

    The card specifies that 'Multi-AZ DB cluster' deployments include reader instances that can serve read traffic, enabling read scaling. In contrast, 'Multi-AZ DB instance' deployments have an idle standby that does not serve reads, making option C incorrect.

    Read the full bite: Database Multi-AZ: High Availability vs. Read Scaling

29. Question 29 of 30

    What is the primary benefit of defining AWS infrastructure using CloudFormation templates?

    • aIt allows for visual, drag-and-drop creation of complex AWS architectures.
    • bIt enables managing infrastructure across AWS, Azure, and Google Cloud platforms.
    • cIt ensures consistent, repeatable, and version-controlled infrastructure deployments.
    • dIt automatically selects the most cost-effective AWS services for your needs.
    Show the answer

    Answer: c · It ensures consistent, repeatable, and version-controlled infrastructure deployments.

    Option C is correct because the card emphasizes CloudFormation's role in creating "repeatable, version-controlled environments" and acting as the "single source of truth" for consistent infrastructure. Option B is a tempting distractor, but the card explicitly states CloudFormation is AWS-specific and not for multiple cloud providers.

    Read the full bite: AWS CloudFormation: Your AWS Infrastructure as a Blueprint

30. Question 30 of 30

    For a real-time e-commerce anomaly detection system, what is the most robust method for identifying a significant drop in orders?

    • aUsing a batch job to compare the total daily order count against the monthly average at the end of each day.
    • bAlerting when order volume in a 5-minute window falls 20% below the average of the preceding hour.
    • cMonitoring the data ingestion pipeline for a sudden drop in the number of incoming records per second.
    • dComparing current order volume to a dynamic baseline learned from historical data for the same time of day and day of week.
    Show the answer

    Answer: d · Comparing current order volume to a dynamic baseline learned from historical data for the same time of day and day of week.

    The most robust method accounts for natural seasonality in traffic. A dynamic baseline (D) does this, whereas a simple moving average (B) ignores daily/weekly cycles and would cause many false alerts.

    Read the full bite: Design a Real-Time Anomaly Detection System for E-commerce Events