1. Walk us through how you would design a multi-region active-active architecture on AWS for a financial services application requiring sub-100ms latency and 99.99% uptime.

I'd use Route 53 with geolocation routing to direct traffic to the nearest region, deploy identical stacks in 2+ regions with DynamoDB Global Tables or Aurora Global Database for data replication, and implement cross-region failover with health checks to automatically reroute traffic if a region becomes unhealthy.

2. Describe the differences between RDS Multi-AZ, Read Replicas, and Aurora Global Database. When would you recommend each?

Multi-AZ provides synchronous failover within a region for HA; Read Replicas are asynchronous copies for scaling reads across regions; Aurora Global Database enables fast reads globally with RPO of <1 second. Use Multi-AZ for mission-critical single-region apps, Read Replicas for read-heavy workloads in multiple regions, and Global Database for global applications needing low-latency reads everywhere.

3. You inherit a legacy monolithic application running on EC2 that costs $400K/month. How would you approach modernization and cost optimization?

I'd start with AWS Compute Optimizer and Cost Explorer to identify waste, then containerize critical components using ECS/EKS for better resource utilization, migrate stateless services to Lambda/Fargate to eliminate idle capacity, and implement reserved instances or Savings Plans for baseline load, potentially reducing costs 40-60%.

4. How would you design a secure CI/CD pipeline on AWS for a regulated healthcare application (HIPAA compliance)?

I'd use CodePipeline with CodeBuild in a VPC for isolated builds, enable encryption at rest with KMS, implement IAM roles with least privilege, scan images with ECR image scanning and third-party tools like Aqua, use Secrets Manager for credentials, log all actions to CloudTrail, and run infrastructure-as-code through CodeBuild with approval gates before production deployment.

5. Explain how you would troubleshoot a Lambda function that intermittently times out during peak traffic. Walk through your diagnostic approach.

I'd check CloudWatch Logs for actual execution times and cold start patterns, verify the timeout setting and allocated memory (which affects CPU), examine VPC configuration if present (ENI throttling), check IAM permissions for downstream resource access, monitor concurrent execution limits in Lambda metrics, and increase memory allocation or implement provisioned concurrency if cold starts are the culprit.

6. Design a data lake on AWS for a company ingesting 10TB of unstructured data daily from multiple IoT devices. What services would you use and why?

I'd use Kinesis Data Streams or Firehose for real-time ingestion, land raw data in S3 with partitioning by date/device, use Glue for ETL and cataloging, store transformed data in S3 with Parquet format, query via Athena for ad-hoc analysis, and implement Lake Formation for governance and row-level access control.

7. What are the key differences between SQS, SNS, and EventBridge? Design a system using all three appropriately.

SQS is a message queue for decoupling producers and consumers; SNS is a pub/sub service for broadcasting; EventBridge is an event router with pattern matching and multiple targets. I'd use SNS to publish order events, SQS to decouple invoice processing from order service, and EventBridge to route events to Lambda, SNS, and SQS based on event patterns, enabling flexible event-driven architecture.

8. A customer is migrating a 500-server on-premises VMware environment to AWS. Outline your migration strategy, timeline, and potential risks.

I'd use AWS Application Discovery Service and Migration Evaluator to profile workloads, categorize into 6Rs (rehost, replatform, refactor, repurchase, retire, retain), prioritize business-critical applications first using waves over 12-18 months, leverage AWS MGN for lift-and-shift, implement network connectivity via Direct Connect or VPN, and establish a dedicated migration team with runbooks for rollback scenarios.

9. How would you implement cross-account access patterns in AWS for a multi-tenant SaaS application with 50 customer AWS accounts?

I'd set up a master account for central services, use role assumption with external IDs for cross-account access, implement SCP policies to enforce guardrails across tenant accounts, use CloudFormation StackSets for consistent resource deployment, and configure AWS Organizations for centralized billing and compliance policies.

10. Explain how you would design disaster recovery for a mission-critical ERP system with RPO of 1 hour and RTO of 4 hours using AWS.

I'd implement automated daily snapshots of EBS volumes and RDS databases to a secondary region, use AWS Backup for centralized management with cross-region copies, maintain a warm standby environment with scaled-down EC2/RDS, use Route 53 health checks to trigger failover within 5 minutes, and regularly test failover procedures to ensure RTO/RPO targets are met.

11. A customer wants to implement machine learning for fraud detection on real-time transactions. Design an end-to-end solution.

I'd ingest transactions via Kinesis, preprocess features using Lambda or Glue, train models with SageMaker using historical fraud data, deploy models to SageMaker endpoints for real-time inference, invoke endpoints from transaction processing Lambda, and store predictions in DynamoDB for rapid lookup, with CloudWatch monitoring to detect model drift.

12. How would you approach optimizing CloudFront distribution performance and costs for a global content delivery network serving 1PB annually?

I'd analyze traffic patterns with CloudFront reports, enable compression and HTTP/2, use S3 as origin with CloudFront origin access identity (OAI), implement cache behaviors with appropriate TTLs by content type, leverage Lambda@Edge for dynamic content personalization, use Origin Shield to reduce origin load, and apply custom error pages to reduce 4xx traffic costs.