AWS Cloud Operations and Platform Engineering

Calculate IPv4 CIDR subdivisions for a multi-AZ AWS VPC without address overlap.

Trace traffic through route tables, security groups, network ACLs, NAT gateways, and internet gateways.

Diagnose AWS connectivity failures using VPC Flow Logs and Reachability Analyzer.

Design private access to AWS services using VPC endpoints and private DNS.

Configure Route 53 routing and health-check behavior for a highly available service.

Select an Elastic Load Balancing option from protocol, scaling, security, and observability requirements.

Design multi-account and hybrid connectivity using Transit Gateway, peering, VPN, or Direct Connect.

Produce a fault-isolated AWS network architecture for a production platform spanning multiple Availability Zones.

Design an AWS Organizations account and organizational-unit structure that separates workloads, environments, security, and billing responsibilities.

Apply service control policies, permission boundaries, and IAM roles to enforce layered least privilege.

Configure workforce and workload access using federation, short-lived credentials, and role assumption.

Protect application secrets and encryption keys using Secrets Manager, Systems Manager Parameter Store, and KMS.

Trace an AWS administrative action using CloudTrail and identify the principal, source, request, and affected resource.

Evaluate configuration and threat findings from AWS Config, Security Hub, and GuardDuty.

Create actionable CloudWatch metrics, logs, alarms, and dashboards for an AWS workload.

Implement tagging, budgets, and cost-allocation controls for accountable cloud operations.

Select among EC2, ECS, EKS, and Lambda for a workload based on operational and architectural constraints.

Design a multi-AZ compute tier using load balancing, health checks, and automatic scaling.

Select an AWS storage or database service from durability, consistency, latency, scaling, and recovery requirements.

Define recovery time and recovery point objectives for an AWS workload and select a matching disaster-recovery pattern.

Build a reusable Terraform module with explicit inputs, outputs, versions, and validation rules.

Configure secure remote Terraform state with encryption, locking, access control, and recovery safeguards.

Create a delivery pipeline that validates, plans, security-checks, approves, and applies Terraform changes.

Resolve Terraform drift or state refactoring without unintentionally replacing production resources.

Trace a Kubernetes API request through authentication, authorization, admission, persistence, scheduling, and reconciliation.

Explain the operational failure implications of Kubernetes control-plane and node components.

Design a private Amazon EKS cluster architecture with secure administrative and workload connectivity.

Configure AWS permissions for EKS workloads using EKS Pod Identity or IAM roles for service accounts.

Select an EKS node strategy using managed node groups, Fargate, or dynamic node provisioning.

Plan an EKS upgrade sequence covering the control plane, add-ons, nodes, and workload compatibility.

Create a backup and restore plan for Kubernetes resources and persistent application data.

Evaluate when a platform requires one cluster, multiple clusters, or multiple AWS regions.

Select Deployment, StatefulSet, DaemonSet, Job, or CronJob for a given workload behavior.

Set CPU and memory requests and limits that produce an intended Kubernetes Quality of Service class.

Configure startup, readiness, and liveness probes without causing avoidable restart or traffic failures.

Control pod placement using selectors, affinity, anti-affinity, taints, tolerations, and topology spread constraints.

Configure workload and node autoscaling using HPA, VPA recommendations, and dynamic node provisioning.

Provision persistent storage using StorageClasses, persistent volume claims, access modes, and CSI capabilities.

Package a production workload as a configurable Helm chart with safe defaults and upgrade behavior.

Diagnose a Pending pod, CrashLoopBackOff, failed rollout, or unschedulable workload from cluster evidence.

Trace packet flow between pods and Kubernetes Services through CNI, service-proxy, DNS, and load-balancing components.

Diagnose Kubernetes DNS and service-discovery failures using endpoint, CoreDNS, and packet-level evidence.

Enforce namespace traffic boundaries with default-deny and explicitly permitted NetworkPolicies.

Select Ingress, Gateway API, or service-mesh routing for a stated application communication requirement.

Construct least-privilege Kubernetes RBAC permissions for a human or workload identity.

Apply Pod Security Admission and security contexts to restrict container privileges.

Design a Kubernetes secrets workflow using encryption, external secret stores, rotation, and restricted access.

Diagnose a Kubernetes access or network outage by correlating events, audit data, policies, and traffic evidence.

Define a telemetry plan for a service using latency, traffic, errors, saturation, and dependency signals.

Configure Prometheus scraping while controlling label cardinality and retention cost.

Write PromQL queries for rate, aggregation, histogram quantiles, and resource saturation.

Create an actionable alert with a clear symptom, threshold rationale, routing rule, and runbook link.

Build a Grafana dashboard that supports both service health assessment and failure investigation.

Design structured application and platform logs with timestamps, severity, identity, and correlation fields.

Instrument and inspect a distributed request trace using OpenTelemetry context propagation.

Diagnose a cross-layer service failure by correlating metrics, logs, traces, Kubernetes events, and AWS telemetry.

Define a measurable service-level indicator from a user-visible reliability expectation.

Set a service-level objective and error budget from business impact and measurement constraints.

Calculate availability and error-budget consumption over a rolling compliance window.

Configure multi-window burn-rate alerts for fast and slow SLO violations.

Model end-to-end availability from serial, parallel, and shared service dependencies.

Classify operational work as toil and select a high-value automation target.

Design a canary or progressive-delivery policy with automated health checks and rollback criteria.

Conduct a service reliability review covering SLOs, dependencies, failure modes, capacity, and operational ownership.

Assign incident-command roles and establish an effective communication cadence for a major outage.

Create a symptom-oriented runbook with verification, mitigation, escalation, and rollback steps.

Build an outage timeline from logs, alerts, deployment records, and human actions.

Write a blameless post-incident review with causal analysis and tracked corrective actions.

Perform a failure-mode analysis for an AWS-hosted Kubernetes service.

Design a bounded chaos experiment with a hypothesis, safety controls, observations, and abort conditions.

Validate a backup by restoring an application and checking data integrity and service functionality.

Derive a scaling threshold and capacity forecast from load-test results and growth assumptions.

Identify platform users and prioritize their recurring jobs, constraints, and sources of cognitive load.

Define the boundaries and interfaces of an internal developer platform control plane.

Create a versioned golden-path service template that encodes delivery and operational standards.

Implement GitOps reconciliation and promotion for an application using Argo CD or Flux.

Design a service catalog model that records ownership, dependencies, lifecycle, and operational metadata.

Enforce deployment guardrails with policy as code using OPA, Kyverno, or an equivalent policy engine.

Design tenant isolation and self-service access across AWS accounts, clusters, namespaces, and platform APIs.

Measure platform outcomes using adoption, lead time, reliability, support burden, and developer-experience signals.

Convert an ambiguous platform scenario into functional requirements, reliability targets, constraints, and explicit assumptions.

Create a production architecture diagram integrating AWS networking, EKS, delivery, observability, security, and recovery components.

Record a consequential platform design decision in an architecture decision record with options and trade-offs.

Create a minimal demonstrable platform slice using infrastructure as code, GitOps, policy controls, and observable sample workloads.

Perform a threat model for the platform slice and prioritize mitigations by likelihood and impact.

Conduct an operational-readiness review and convert identified gaps into an actionable launch plan.

Defend the platform architecture in a time-boxed system-design interview using evidence and explicit trade-offs.

Assess readiness for senior SRE, platform, AWS, and Kubernetes interviews and certifications using a prioritized gap-remediation plan.