▸case-01 We need an AWS CLI v2 command to list all EC2 instances in us-east-1, but output only a JSON array containing objects with the InstanceId and State Name. Developers usually run `aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name]'`, but that returns nested lists. How should the query parameter be structured using JMESPath projection to flatten the output into a single flat array of objects with keys `InstanceId` and `State`? | pass→pass | 4,369 | 5,510 | +26% | 1 | 1 | 0% | 938 | 1,627 | +73% | 0 | 0 | — |
▸case-02 We are configuring an EKS pod to access an S3 bucket without hardcoding static credentials. Engineers suggest creating an IAM user and putting AWS access keys into Kubernetes secrets. How should IAM authentication be properly wired to a Kubernetes ServiceAccount using AWS IAM Roles for Service Accounts (IRSA)? | pass→pass | 12,206 | 15,963 | +31% | 1 | 1 | 0% | 2,465 | 3,733 | +51% | 0 | 0 | — |
▸case-03 A team wants to check if manual changes were made to an existing AWS CloudFormation stack without modifying the stack template or re-deploying. They plan to run `aws cloudformation update-stack` in dry-run mode. What is the correct AWS CLI command sequence to trigger and review stack drift detection? | pass→pass | 8,926 | 7,182 | -20% | 1 | 1 | 0% | 2,073 | 1,982 | -4% | 0 | 0 | — |
▸case-04 We have 15 VPCs across multiple AWS accounts that all need full interconnectivity. An engineer recommends creating pairwise VPC Peering connections between all 15 VPCs to avoid additional infrastructure components. How should this multi-VPC routing architecture be designed to scale without manageability overhead? | pass→pass | 14,218 | 19,288 | +36% | 1 | 1 | 0% | 2,549 | 4,099 | +61% | 0 | 0 | — |
▸case-05 We are creating a DynamoDB table for an application with highly unpredictable, spikey traffic patterns that idle for hours and then burst suddenly. Engineers want to set provisioned read/write capacity units with Auto Scaling set to min 5 CUs. What billing and capacity mode should be selected for this table? | pass→pass | 8,492 | 9,116 | +7% | 1 | 1 | 0% | 1,519 | 2,263 | +49% | 0 | 0 | — |
▸case-06 Security compliance requires that all requests to an S3 bucket `my-data-bucket` use encrypted transport over HTTPS. A developer suggests enabling Default Encryption (SSE-S3) on the bucket properties. Why is SSE-S3 alone insufficient for enforcing HTTPS, and what policy condition forces TLS? | pass→pass | 8,360 | 6,861 | -18% | 1 | 1 | 0% | 1,685 | 1,783 | +6% | 0 | 0 | — |
▸case-07 We are setting up an Amazon EKS cluster with default AWS VPC CNI for Pod IP allocation. We need to enforce granular Kubernetes NetworkPolicies between pods. Developers assume VPC Security Groups automatically enforce Kubernetes NetworkPolicy manifests applied via `kubectl apply -f policy.yaml`. What component is needed to enforce Kubernetes NetworkPolicies when using VPC CNI? | fail→pass | 8,264 | 8,263 | -0% | 1 | 1 | 0% | 1,641 | 2,056 | +25% | 0 | 0 | — |
▸case-08 An application running in AWS ECS Fargate needs to read parameters from AWS Secrets Manager and also write application logs to CloudWatch. Developers configured a single IAM Role under `executionRoleArn` with permissions for Secrets Manager, CloudWatch, and S3 for the app code. Explain the distinction between `executionRoleArn` and `taskRoleArn` and how these permissions should be assigned. | pass→pass | 11,945 | 12,782 | +7% | 1 | 1 | 0% | 2,310 | 2,980 | +29% | 0 | 0 | — |
▸case-09 An AWS Lambda function backing an interactive API experiences unacceptable latency spikes due to cold starts during traffic bursts. A developer suggests increasing memory allocation to 10 GB to solve cold starts. What specific Lambda configuration guarantees pre-warmed execution environments for predictable latency? | pass→pass | 5,761 | 8,262 | +43% | 1 | 1 | 0% | 1,018 | 1,967 | +93% | 0 | 0 | — |
▸case-10 In an AWS CDK application, we need to route traffic from a CloudFront distribution created in a stack deployed to `us-east-1` to an ALB created in `eu-west-1`. A developer attempts to directly pass the ALB construct instance into the CloudFront distribution stack props in CDK. What issue occurs with direct construct references across regions in CDK, and how should configuration be passed? | pass→pass | 15,546 | 13,992 | -10% | 1 | 1 | 0% | 2,830 | 3,180 | +12% | 0 | 0 | — |
▸case-11 We have an application deployed in both `us-east-1` and `eu-central-1`. We want end users to automatically resolve the DNS name to whichever region provides the lowest round-trip network response time from their location. A developer suggests setting up Geolocation routing records based on the user's country code. Which Route53 routing policy directly measures network performance to route requests? | pass→pass | 4,770 | 6,798 | +43% | 1 | 1 | 0% | 859 | 1,750 | +104% | 0 | 0 | — |
▸case-12 A high-throughput PostgreSQL database on EC2 requires sustained performance of 30,000 IOPS and 1,000 MB/s throughput with low latency. An engineer proposes using a `gp3` EBS volume with default settings. What EBS volume type should be selected to guarantee this level of dedicated IOPS performance independently of storage size? | pass→pass | 6,843 | 8,274 | +21% | 1 | 1 | 0% | 1,516 | 2,287 | +51% | 0 | 0 | — |
▸case-13 An administrator wants to restrict member accounts in an AWS Organization from launching any resources in regions other than `us-west-2` and `us-east-1`. A developer proposes attaching an IAM permission boundary to every user created inside each member account. What organization-level mechanism enforces this guardrail across all IAM principals in member accounts? | pass→pass | 7,570 | 8,800 | +16% | 1 | 1 | 0% | 1,403 | 2,285 | +63% | 0 | 0 | — |
▸case-14 We are defining a serverless application consisting of API Gateway endpoints, Lambda functions, and DynamoDB tables. Engineers are writing raw CloudFormation templates with verbose `AWS::Lambda::Function`, `AWS::ApiGateway::RestApi`, and `AWS::IAM::Role` resources. What transform framework simplifies this by providing concise resource types like `AWS::Serverless::Function`? | pass→pass | 5,424 | 6,223 | +15% | 1 | 1 | 0% | 1,070 | 1,779 | +66% | 0 | 0 | — |
▸case-15 A Redis workload on AWS ElastiCache requires horizontal scaling for write operations and sharding across multiple node groups as dataset size exceeds 50 GB. An engineer proposes using ElastiCache Redis Cluster Mode Disabled with read replicas. Why does Cluster Mode Disabled fail to meet the write scaling requirement, and what configuration is needed? | pass→pass | 10,790 | 9,168 | -15% | 1 | 1 | 0% | 2,231 | 2,141 | -4% | 0 | 0 | — |
▸case-16 Account A owns a Customer Managed KMS Key (CMK) used to encrypt S3 objects. Account B needs permission to decrypt objects from that bucket using the KMS key. An engineer added an IAM policy in Account B allowing `kms:Decrypt` on the key ARN in Account A, but access is still denied. What policy in Account A must also explicitly grant access to Account B? | pass→pass | 4,883 | 5,350 | +10% | 1 | 1 | 0% | 979 | 1,493 | +53% | 0 | 0 | — |
▸case-17 An Auto Scaling Group (ASG) behind an Application Load Balancer needs to dynamically adjust instance count to maintain an average CPU utilization of 60%. An engineer suggests configuring CloudWatch alarms with manual step scaling policies for +1 and -1 instances. What simpler scaling policy type automatically creates the required CloudWatch alarms to maintain a target metric? | pass→pass | 3,082 | 4,980 | +62% | 1 | 1 | 0% | 613 | 1,416 | +131% | 0 | 0 | — |
▸case-18 Security policy requires database passwords stored in AWS Secrets Manager to be rotated automatically every 30 days without downtime. A developer suggests running a cron job on a local administrative server to run `aws secretsmanager update-secret`. How does AWS Secrets Manager natively execute automatic secret rotation? | pass→pass | 11,356 | 11,515 | +1% | 1 | 1 | 0% | 2,065 | 2,565 | +24% | 0 | 0 | — |
▸case-19 We are configuring an Amazon CloudFront distribution with an Amazon S3 bucket origin. A developer proposes using Origin Access Identity (OAI) to restrict access so S3 objects are only reachable via CloudFront. What newer AWS security feature replaces OAI and supports SSE-KMS encryption and POST/PUT requests? | pass→pass | 4,029 | 6,185 | +54% | 1 | 1 | 0% | 651 | 1,707 | +162% | 0 | 0 | — |
▸case-20 We are designing infrastructure as code for a deployment on Microsoft Azure containing an Azure App Service and Azure SQL Database. We need to define Bicep templates for provisioning these Azure resources. Provide the Bicep template structure and deployment command using Azure CLI (`az deployment group create`). | fail→fail | 13,024 | 12,705 | -2% | 1 | 1 | 0% | 2,917 | 3,392 | +16% | 0 | 0 | — |
▸case-21 We are setting up a bare-metal Kubernetes v1.28 cluster on physical servers in our local datacenter using `kubeadm init` and `kubeadm join`. We need step-by-step guidance on initializing the control plane with a specific CIDR for Flannel CNI on Linux enterprise hosts. | fail→fail | 19,058 | 15,579 | -18% | 1 | 1 | 0% | 3,847 | 3,944 | +3% | 0 | 0 | — |
▸case-22 We are writing a `docker-compose.yml` file to run a local development environment with Nginx, Node.js, and PostgreSQL containers on a developer's laptop without any cloud dependencies. Provide the docker-compose YAML configuration. | fail→fail | 11,547 | 8,840 | -23% | 1 | 1 | 0% | 2,430 | 2,616 | +8% | 0 | 0 | — |