Skip to content
Job preparation

AWS Cloud Engineer · 5-8 Years

Architecture, scalability, reliability, security, cost, and cross-team ownership.

Try each answer before revealing the suggested coaching answer.

← All AWS Cloud Engineer levels

25 questions

01Design a scalable and secure approach for EC2 lifecycle in a mid-sized engineering organization.

A system-design answer

Say this first: EC2 lifecycle should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply EC2 lifecycle, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → EC2 lifecycle → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 1
02What trade-offs would you consider while choosing a solution for AMI and launch templates?

A system-design answer

Say this first: AMI and launch templates should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AMI and launch templates, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → AMI and launch templates → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 2
03How would you improve reliability, security, and cost around VPC design?

A system-design answer

Say this first: VPC design should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply VPC design, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → VPC design → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 3
04How would you review an existing implementation of subnets and route tables and identify design gaps?

A system-design answer

Say this first: subnets and route tables should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply subnets and route tables, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → subnets and route tables → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 4
05How would you handle failure scenarios related to security groups vs NACLs at scale?

A system-design answer

Say this first: security groups vs NACLs is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply security groups vs NACLs, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Choose the option that fits the workload and constraints; do not present one option as universally superior.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Concrete check

Review the least-privilege policy, then test the denied path as well as the allowed path.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → security groups vs NACLs → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 5
06Design a scalable and secure approach for IAM users roles and policies in a mid-sized engineering organization.

A system-design answer

Say this first: IAM users roles and policies should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply IAM users roles and policies, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → IAM users roles and policies → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 6
07What trade-offs would you consider while choosing a solution for S3 storage classes?

A system-design answer

Say this first: Retrieval-augmented generation fetches relevant, approved context at answer time so a model can ground its response in current source material.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply S3 storage classes, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → S3 storage classes → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 7
08How would you improve reliability, security, and cost around S3 security?

A system-design answer

Say this first: S3 security should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply S3 security, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Concrete check

Review the least-privilege policy, then test the denied path as well as the allowed path.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → S3 security → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 8
09How would you review an existing implementation of RDS backup and scaling and identify design gaps?

A system-design answer

Say this first: RDS backup and scaling should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply RDS backup and scaling, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → RDS backup and scaling → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 9
10How would you handle failure scenarios related to load balancers at scale?

A system-design answer

Say this first: The important point about load balancers is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply load balancers, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → load balancers → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 10
11Design a scalable and secure approach for Auto Scaling Groups in a mid-sized engineering organization.

A system-design answer

Say this first: Auto Scaling Groups should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Auto Scaling Groups, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → Auto Scaling Groups → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 11
12What trade-offs would you consider while choosing a solution for CloudWatch logs and alarms?

A system-design answer

Say this first: CloudWatch logs and alarms should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply CloudWatch logs and alarms, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → CloudWatch logs and alarms → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 12
13How would you improve reliability, security, and cost around Route 53 routing?

A system-design answer

Say this first: Route 53 routing should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Route 53 routing, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → Route 53 routing → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 13
14How would you review an existing implementation of Lambda basics and identify design gaps?

A system-design answer

Say this first: Lambda basics should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Lambda basics, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → Lambda basics → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 14
15How would you handle failure scenarios related to API Gateway at scale?

A system-design answer

Say this first: The important point about API Gateway is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply API Gateway, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → API Gateway → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 15
16Design a scalable and secure approach for EKS basics in a mid-sized engineering organization.

A system-design answer

Say this first: EKS basics should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply EKS basics, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → EKS basics → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 16
17What trade-offs would you consider while choosing a solution for ECS vs EKS?

A system-design answer

Say this first: ECS vs EKS is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply ECS vs EKS, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Choose the option that fits the workload and constraints; do not present one option as universally superior.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → ECS vs EKS → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 17
18How would you improve reliability, security, and cost around Secrets Manager and KMS?

A system-design answer

Say this first: Secrets Manager and KMS should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Secrets Manager and KMS, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → Secrets Manager and KMS → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 18
19How would you review an existing implementation of CloudFormation vs Terraform and identify design gaps?

A system-design answer

Say this first: CloudFormation vs Terraform is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply CloudFormation vs Terraform, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Choose the option that fits the workload and constraints; do not present one option as universally superior.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → CloudFormation vs Terraform → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 19
20How would you handle failure scenarios related to AWS cost optimization at scale?

A system-design answer

Say this first: The important point about AWS cost optimization is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AWS cost optimization, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → AWS cost optimization → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 20
21Design a scalable and secure approach for Well-Architected Framework in a mid-sized engineering organization.

A system-design answer

Say this first: Well-Architected Framework should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Well-Architected Framework, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → Well-Architected Framework → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 21
22What trade-offs would you consider while choosing a solution for high availability design?

A system-design answer

Say this first: high availability design should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply high availability design, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → high availability design → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 22
23How would you improve reliability, security, and cost around disaster recovery patterns?

A system-design answer

Say this first: disaster recovery patterns should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply disaster recovery patterns, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → disaster recovery patterns → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 23
24How would you review an existing implementation of private connectivity and identify design gaps?

A system-design answer

Say this first: private connectivity should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply private connectivity, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → private connectivity → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 24
25How would you handle failure scenarios related to AWS security best practices at scale?

A system-design answer

Say this first: The important point about AWS security best practices is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.

Use a real scenario

Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AWS security best practices, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.

Show judgment

  • define boundaries, ownership, failure modes, and the operational feedback loop.
  • Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
  • Call out a broad outage or an untested recovery path and the control that reduces it.

Concrete check

Review the least-privilege policy, then test the denied path as well as the allowed path.

Evidence to mention

Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.

request or change → guardrail / validation → AWS security best practices → observable result → owner review

Practice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.

Link to question 25

Further reading

These are original practice questions and suggested answers. Adapt them to your own work and explain evidence, trade-offs, and limitations.