[ { "front": "Explain the eventual consistency model of Amazon S3 for overwrite PUTS and DELETES, and how it differs from read-after-write consistency for new object PUTS.", "back": "Amazon S3 provides read-after-write consistency for new object PUTS in all regions. This means you can immediately read an object after writing it. However, for overwrite PUTS and DELETES, S3 offers eventual consistency. This implies that changes might take some time to propagate across all S3 storage locations. A read operation immediately after an overwrite or delete might return the old data or the deleted object, respectively, until the change is fully propagated. Applications must be designed to handle this potential delay.", "difficulty": "intermediate", "tags": ["S3", "Consistency", "Storage", "Data Management"], "suggested_review_interval_days": 3 }, { "front": "Differentiate between a VPC Gateway Endpoint and a VPC Interface Endpoint, including which AWS services each supports and their underlying technology.", "back": "A VPC Gateway Endpoint provides private connectivity to Amazon S3 and DynamoDB from your VPC without traversing the internet. It acts as a target for a route in your route table, directing traffic to the endpoint. It's free to use. A VPC Interface Endpoint (powered by AWS PrivateLink) provides private connectivity to a wide range of AWS services (e.g., EC2, Kinesis, SageMaker) and services hosted by other AWS customers or partners. It creates an Elastic Network Interface (ENI) with private IP addresses in your subnets, allowing traffic to flow privately. Interface endpoints incur charges for ENI hours and data processing.", "difficulty": "advanced", "tags": ["VPC", "Networking", "Security", "PrivateLink"], "suggested_review_interval_days": 5 }, { "front": "Describe the IAM policy evaluation logic when both explicit DENY and explicit ALLOW statements are present for a specific action on a resource.", "back": "When evaluating an IAM policy, AWS follows a 'deny by default' principle. If an explicit DENY statement exists for a specific action on a resource, it will always override any explicit ALLOW statements. This means that even if a user has an ALLOW permission from one policy, a DENY from another policy (or the same policy) for the same action on the same resource will prevent them from performing that action. An action is only allowed if there is an explicit ALLOW and no explicit DENY.", "difficulty": "intermediate", "tags": ["IAM", "Security", "Permissions", "Policy"], "suggested_review_interval_days": 4 }, { "front": "When would you choose an Application Load Balancer (ALB) over a Network Load Balancer (NLB) for an application, and vice versa?", "back": "Choose an ALB when you need advanced request routing at the application layer (Layer 7), such as path-based routing, host-based routing, or routing based on HTTP headers. ALBs support sticky sessions, WebSockets, HTTP/2, and integrate with WAF. They are ideal for microservices and container-based applications. Choose an NLB when you need extreme performance, static IP addresses, and low latency at the transport layer (Layer 4). NLBs handle millions of requests per second, preserve client IP addresses, and are suitable for TCP/UDP traffic, gaming, and high-throughput applications where layer 7 features are not required. NLBs are also preferred for exposing a static IP address for your application.", "difficulty": "advanced", "tags": ["Load Balancer", "Networking", "High Availability", "EC2"], "suggested_review_interval_days": 6 } ]
