Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. An identity policy allows s3:GetObject, but an SCP on the account denies it. Result?

   1. AAllowed
   2. BDenied: an explicit deny anywhere in the evaluation wins
   3. CDepends on the region
   4. DAllowed for admins
   Show answer

   B. SCPs set the maximum for an account. An explicit Deny in any applicable policy always wins.

   From lesson 01 · IAM in depth

2. Q2. What does a role's trust policy define?

   1. AWhat the role can do
   2. BWho is allowed to assume the role (which principals, under which conditions)
   3. CThe role's password
   4. DWhich region it lives in
   Show answer

   B. Permissions policies say what the role can do; the trust policy says who can become the role.

   From lesson 01 · IAM in depth

3. Q3. Why prefer roles with temporary credentials over IAM users with access keys?

   1. ARoles are cheaper
   2. BTemporary credentials expire automatically and aren't stored long-term, so leaks are far less damaging
   3. CUsers can't use the CLI
   4. DRoles don't need policies
   Show answer

   B. Long-lived keys leak into laptops, repos and logs. Roles (via SSO, instance profiles, Pod Identity/IRSA) give short-lived credentials.

   From lesson 01 · IAM in depth

4. Q4. What makes a subnet 'public'?

   1. AIts name
   2. BIts route table has a default route (0.0.0.0/0) to an Internet Gateway
   3. CIt has a security group
   4. DIt's in the first AZ
   Show answer

   B. Public vs private is purely about routing. Instances in a public subnet also need a public IP to be reachable.

   From lesson 02 · VPC design

5. Q5. Private-subnet nodes pull container images from ECR and read S3 all day. What cuts NAT Gateway cost?

   1. ABigger instances
   2. BVPC endpoints: a gateway endpoint for S3 and interface endpoints for ECR, so traffic doesn't go through NAT
   3. CMore NAT gateways
   4. DPublic subnets for everything
   Show answer

   B. NAT Gateways charge per GB processed. Endpoints keep AWS-service traffic on the AWS network, often cheaper and more private.

   From lesson 02 · VPC design

6. Q6. Why plan VPC CIDRs carefully before creating anything?

   1. AAWS charges per CIDR
   2. BOverlapping ranges block peering/VPN/Transit Gateway connections later, and Kubernetes pods may need many IPs
   3. CCIDRs can't be seen later
   4. DIt speeds up DNS
   Show answer

   B. Networks you'll want to connect must not overlap. EKS with the VPC CNI consumes VPC IPs for pods, so size generously.

   From lesson 02 · VPC design

7. Q7. Why enforce IMDSv2 (tokens required) on instances that run containers?

   1. AIt's faster
   2. BIt blocks simple SSRF-style requests from reaching instance credentials, and with a hop limit of 1, containers can't reach the node's metadata at all
   3. CIt's required for Spot
   4. DIt enables IPv6
   Show answer

   B. The instance metadata service hands out the instance role's credentials. IMDSv2 requires a session token (PUT request), and the hop limit stops extra network hops such as containers.

   From lesson 03 · Compute

8. Q8. What's the main trade-off of Spot instances?

   1. AThey're slower
   2. BLarge discounts, but AWS can reclaim them with a two-minute warning
   3. CThey can't run containers
   4. DThey need a separate account
   Show answer

   B. Use Spot for fault-tolerant, stateless or batch workloads, diversify instance types, and handle interruption notices.

   From lesson 03 · Compute

9. Q9. What does an Auto Scaling group's instance refresh do?

   1. AReboots all instances at once
   2. BReplaces instances gradually with ones from the current launch template, respecting a minimum healthy percentage
   3. CDeletes the group
   4. DChanges the region
   Show answer

   B. It's the immutable-node rollout: new template (e.g. a new AMI), then instances are replaced in batches.

   From lesson 03 · Compute

10. Q10. You need host- and path-based routing with TLS termination for web apps. Which load balancer?

    1. ANLB
    2. BALB
    3. CClassic LB
    4. DRoute 53
    Show answer

    B. ALB is layer 7: it reads HTTP, routes by host and path, and terminates TLS with ACM certificates.

    From lesson 04 · Load balancing & DNS

11. Q11. A partner requires allow-listing a fixed IP address for your endpoint. Which load balancer helps?

    1. AALB
    2. BNLB with Elastic IPs per AZ
    3. CRoute 53 weighted records
    4. DAn internet gateway
    Show answer

    B. NLBs can use static Elastic IPs per AZ; ALB IP addresses change over time.

    From lesson 04 · Load balancing & DNS

12. Q12. Why use a Route 53 alias record instead of a CNAME for the zone apex (example.com)?

    1. AAliases are cheaper
    2. BA CNAME isn't allowed at the zone apex; an alias points the apex to AWS resources like a load balancer, and queries to aliases for AWS targets aren't charged
    3. CAliases are faster to update
    4. DCNAMEs don't support HTTPS
    Show answer

    B. DNS forbids CNAMEs at the apex. Route 53 aliases solve that for AWS targets.

    From lesson 04 · Load balancing & DNS

13. Q13. An EBS volume is in eu-west-1a. Can an instance in eu-west-1b attach it?

    1. AYes
    2. BNo: EBS volumes are zonal; restore a snapshot into the other AZ instead
    3. COnly if it's gp3
    4. DOnly read-only
    Show answer

    B. EBS lives in one availability zone. This is why Kubernetes uses WaitForFirstConsumer with EBS-backed storage classes.

    From lesson 05 · Storage

14. Q14. Which S3 feature lets you recover an object someone overwrote or deleted?

    1. ALifecycle rules
    2. BVersioning (previous versions are kept)
    3. CStorage classes
    4. DTransfer acceleration
    Show answer

    B. With versioning, overwrites and deletes create new versions or delete markers; the old versions remain recoverable.

    From lesson 05 · Storage

15. Q15. Which storage offers a shared filesystem that pods in several AZs can mount read-write at the same time?

    1. AEBS
    2. BEFS
    3. CInstance store
    4. DS3 Glacier
    Show answer

    B. EFS is a regional NFS service (ReadWriteMany). EBS is single-AZ block storage, typically attached to one node.

    From lesson 05 · Storage

16. Q16. What is envelope encryption?

    1. AEncrypting emails
    2. BData is encrypted with a data key; the data key is encrypted with a KMS key that never leaves KMS
    3. CDouble encryption with two passwords
    4. DEncryption only in transit
    Show answer

    B. Services (S3, EBS, EKS secrets) use envelope encryption so bulk data is encrypted locally and fast, while the master key stays in KMS with policies and audit.

    From lesson 06 · Security services

17. Q17. Which service answers 'who called DeleteBucket yesterday, from which IP?'

    1. AGuardDuty
    2. BCloudTrail
    3. CKMS
    4. DRoute 53
    Show answer

    B. CloudTrail records AWS API calls: who, what, when, from where. Send it to a central, protected bucket for the long term.

    From lesson 06 · Security services

18. Q18. What does GuardDuty do?

    1. AEncrypts disks
    2. BAnalyses logs and events (CloudTrail, VPC flow logs, DNS, EKS audit and runtime data) to detect threats like credential misuse or crypto-mining
    3. CManages passwords
    4. DBlocks all traffic
    Show answer

    B. GuardDuty is managed threat detection. It raises findings that you route to your alerting and incident process.

    From lesson 06 · Security services

19. Q19. Why use separate AWS accounts for prod and dev instead of one account with naming conventions?

    1. AAccounts are free
    2. BAn account is the strongest isolation boundary: separate IAM, limits, blast radius and billing
    3. CAWS requires it
    4. DIt's faster
    Show answer

    B. Mistakes and compromises in dev can't touch prod resources in another account, and quotas and costs are separated too.

    From lesson 07 · Multi-account & cost

20. Q20. What's a Service Control Policy used for?

    1. AGranting permissions
    2. BSetting the maximum permissions for every principal in the targeted accounts, e.g. deny disabling CloudTrail or using unapproved regions
    3. CBilling alerts
    4. DTagging
    Show answer

    B. SCPs never grant anything; they cap what IAM policies in those accounts can allow.

    From lesson 07 · Multi-account & cost

21. Q21. A team's bill jumps with 'NatGateway-Bytes' and 'DataTransfer' charges. What's a likely fix?

    1. ABigger instances
    2. BVPC endpoints for AWS services, keeping traffic in-AZ where possible, and reviewing cross-region/internet egress
    3. CMore NAT gateways
    4. DTurning off CloudTrail
    Show answer

    B. Data processed by NAT and data transfer between AZs, regions and the internet are common hidden costs.

    From lesson 07 · Multi-account & cost