Question 1 Which design best meets the requirement with the least long-lived credential risk?A CI workload in a tooling AWS account must deploy to production accounts. Security requires centralized control, short-lived credentials, least privilege, and auditable sessions. The team wants to avoid storing production access keys in CI.
A. Create an IAM user in every production account and store each access key in the CI secret store.B. Use a workload identity in the tooling account to assume narrowly scoped cross-account IAM roles with short-lived sessions.C. Give the tooling account administrator access to every production account through one shared access key.D. Copy the production deployment policy into the CI repository so permissions are visible to developers.
Start with the identity boundary, not the policy syntax. The workload needs a trusted way to obtain temporary production permissions. Cross-account role assumption separates who may assume the role from what the role may do, supports session logging, and avoids distributing long-lived production keys.
A: This creates long-lived credentials in multiple accounts and increases rotation and compromise risk.B: Correct. The trust boundary and role permissions can be controlled separately, while temporary credentials reduce long-lived secret exposure.C: A shared powerful key has excessive blast radius and weakens least privilege and attribution.D: A policy document alone does not establish secure authentication or remove the need for a safe workload identity.Review IAM Architecture Essentials → Question 2 Which change most directly addresses both zone failure and duplicate-order risk?An order API runs across two Availability Zones. During a zone failure, clients retry requests and occasionally create duplicate orders. Compute capacity exists in both zones, but the current request handler writes directly to a datastore without an idempotency design.
A. Increase the Auto Scaling maximum so more instances can launch after a failure.B. Add a CDN in front of the API so repeated requests are cached.C. Use multi-AZ request handling plus an idempotency key or equivalent deduplication boundary for order creation.D. Disable client retries whenever one Availability Zone is unhealthy.
Multi-AZ compute solves only part of the problem. A resilient write path must also tolerate retries. An idempotency boundary lets the service recognize repeated intent and return the existing result rather than creating a second order.
A: More compute may help capacity, but it does not make retries safe or remove duplicate side effects.B: Order creation is a state-changing operation and should not be treated as a cacheable GET-style response.C: Correct. Availability and correctness must be designed together: requests can reach healthy capacity while retries remain safe.D: Removing retries can reduce duplicates but may turn transient failures into user-visible failures and does not fix the underlying operation semantics.Review resilient design practice → Question 3 Which architecture best matches the access patterns while keeping operational complexity reasonable?A document platform stores files from 5 MB to 2 GB. Users search metadata by owner, date, status, and tags. Files are downloaded far more often than metadata is changed. The design must support lifecycle policies for older files.
A. Store file bytes and all searchable metadata in one relational database table.B. Store files in object storage and searchable metadata in a datastore chosen for the query/update pattern, with explicit consistency and recovery handling between them.C. Store everything in instance-local disks and rebuild metadata from filenames when an instance is replaced.D. Put the files in an in-memory cache so downloads remain fast and use object storage only for backups.
Choose storage from the dominant access pattern and durability requirement. Object storage is a natural file boundary with lifecycle controls, while metadata belongs where indexed queries and updates are efficient. The important expert nuance is to design for partial failure between the two stores instead of pretending the split is free.
A: Possible, but large binary objects can create unnecessary database cost, backup, and scaling pressure for this access pattern.B: Correct. The design separates large durable objects from frequently queried metadata while acknowledging the cross-service consistency boundary.C: Instance-local storage is a poor durability boundary for persistent user documents and makes recovery fragile.D: A cache should not become the primary durable store for multi-gigabyte user documents.Practice document-storage architecture → Question 4 What should drive the compute choice before selecting a service?A media pipeline receives unpredictable bursts. Work can queue for a few minutes. Individual jobs usually run for 4-20 seconds, but some image transformations take several minutes. The team wants low idle cost without overwhelming downstream services.
A. Always choose functions because serverless is always cheaper for bursty workloads.B. Always choose continuously running containers because long-running processes are easier to debug.C. Characterize duration, concurrency, baseline utilization, queue tolerance, downstream limits, and unit economics; then choose or combine elastic functions and container workers accordingly.D. Process every event synchronously at ingestion so no queue infrastructure is required.
Cost optimization is a workload decision. Decoupling ingestion gives you time to absorb bursts, but the worker model should be chosen from execution duration, concurrency, idle capacity, downstream throttles, and operational ownership. Hybrid designs can be appropriate when short and long jobs behave differently.
A: Service labels are not a cost model. Duration, concurrency, startup behavior, downstream limits, and operational needs all matter.B: Debugging convenience does not justify paying for idle capacity when workload shape may favor elastic execution.C: Correct. The architecture decision follows workload shape and full-path constraints rather than a universal service preference.D: This couples ingestion to processing capacity and makes bursts more likely to become user-facing failures.Practice cost-aware event processing → Question 5 Which design best reduces origin load and user latency for repeatable public content?A learning platform serves public images and downloadable study files globally. Objects change infrequently, requests are read-heavy, and the application currently serves every object request from the origin region.
A. Place a CDN in front of durable object storage, use appropriate cache behavior, and design invalidation/versioning for the relatively rare content changes.B. Move the object files into the application database so every request uses the same data layer.C. Increase the origin instance size so it can send more files concurrently to global users.D. Disable caching so users never receive stale objects.
The requirement is dominated by read frequency, geographic distribution, and infrequent changes. Edge caching moves repeated delivery closer to users and reduces origin work. The architecture still needs a deliberate freshness mechanism so cache behavior matches how files are updated.
A: Correct. Read-heavy, repeatable public assets are a strong fit for edge caching when freshness behavior is explicit.B: This increases pressure on a transactional data layer without addressing global edge latency.C: A larger origin can improve throughput but still forces distant users and repeat requests back to the origin region.D: This maximizes origin traffic and latency. Versioned object names or controlled invalidation can provide freshness without abandoning caching.Review AWS architecture decision-making → 