Day 5 - Week 15 Wrap-Up: The Art of Reading Clues Across Cases and Judging Trade-offs

Scenario questions on the Pro exam are decided not by how much you know but by how fast you read clues and how well you judge trade-offs. Even for the same "deployment" question, one or two constraint words such as "regulated", "no internet outbound", "no static keys", "minimum operational overhead", "least cost", or "across all accounts" decide the answer. Of four options, two don't even work, and the other two both work but only one fits the constraints. Today we cut across the four cases Week 15 covered (multi-account in Day 1, hybrid in Day 2, containers in Day 3, serverless incidents in Day 4), build a solving system that narrows clues to a domain, a domain to candidates, and candidates to an answer, and then sharpen it with integrated scenarios.

The 5 Steps of Solving a Scenario - A Procedure to Cut Cognitive Load

The most common failure in front of a long scenario is "burning time trying to understand the whole thing at once." Instead, split the cognitive load with these 5 steps.

1. Mark the constraint words: first find and underline "regulated", "zero internet", "no static keys", "minimum overhead", "least cost", "all accounts", and so on.
2. Identify the domain: is it CI/CD, IaC, or monitoring, security, resilience, incidents?
3. Narrow to 2 candidates: keep only candidates that "work and fit the constraints," and remove options that don't work or are clearly overkill (elimination).
4. Pick the final 1 by trade-off: compare the remaining two on operational burden, cost, and security. Pro almost always prefers managed, standard, minimal-burden choices.
5. If your confidence is 50% or less, mark it and pass: preserving time is the skill that gets you through.

💡 Related theory: This procedure applies chunking and recognition-primed decision making from cognitive psychology. Experts don't analyze a problem whole; they first recognize familiar patterns (clues) to narrow the solution space and then compare only within it (Gary Klein's RPD model). Building clue-to-answer mappings in advance, such as "no internet outbound → PrivateLink" and "all accounts → StackSets/Delegated Admin," amounts to transplanting an expert's pattern library. The exam is 75 questions x 180 minutes = an average of 2 minutes 24 seconds per question, so reasoning from zero on every question runs out of time. Narrowing candidates instantly through clue recognition is the core of time economics.

Quick Clue → Answer Mapping (Week 15 Consolidated)

⚠️ Pitfall: If you apply the clue mapping mechanically and miss a compound clue, you get it wrong. For example, you see only "no static keys" and pick IAM Roles Anywhere, but if the question is in an EKS pod context, the answer is Pod Identity/IRSA. You see only "no internet" and pick PrivateLink, but if there is an extra clue that DNS resolution fails, a Route 53 Resolver Endpoint may be the real crux. In Pro questions, the second clue is often the real differentiator: use the first clue to narrow the domain, and the second clue to choose the exact service within that domain. Don't stop after one clue; mark all the constraint words and find the intersection.

Managed vs Self-Built - The Pro Exam's Default Bias

The Pro exam's preference for managed services rests on a clear operating philosophy: eliminating undifferentiated heavy lifting. The Operational Excellence pillar of the AWS Well-Architected Framework advises pushing operational work that doesn't create business value onto managed services. Self-built options (self-run Jenkins, a custom autoscaler, custom credential rotation) work, but you take on the toil of patching, scaling, and incident response. So when one of the "two working options" is managed (CodePipeline, Karpenter, Pod Identity, Incident Manager), it is almost always the answer. There are exception clues, though: when an explicit constraint such as "keep existing Jenkins assets" or "specific custom control required" appears, a gradual migration (CodePipeline + Jenkins Action) or a stronger-control choice like EKS becomes the answer. The default is managed; with a clue, the exception applies.

The Common Axes Across Cases - Five Pillars Linking the Four Domains

The four cases of Week 15 look different on the surface, but they actually stand on the same five pillars. Seeing these common axes speeds up decomposition of any scenario.

Common core (cutting across the four cases)
├─ IaC           : Everything as code with CDK / CloudFormation / Terraform
├─ Pipeline      : CodePipeline standard (Tooling Account Hub) + governance gates
├─ Observability : CloudWatch + ADOT (OpenTelemetry) + X-Ray (metrics, logs, traces)
├─ Security      : GuardDuty / Security Hub / Config aggregated into the Audit account
└─ Cost          : Enforced tags + Cost Categories + Anomaly Detection

• Multi-account (Day 1) is a governance problem of enforcing these five pillars on every account via OUs/StackSets.
• Hybrid (Day 2) is a boundary problem of extending the same five pillars to internet isolation and on-premises (PrivateLink, SSM, Roles Anywhere).
• Containers (Day 3) is a scale problem of solving the pipeline, observability, and cost pillars at hundreds of containers (Karpenter, GitOps, Container Insights).
• Serverless incidents (Day 4) is a response problem of taking signals from the security and observability pillars and closing them with automatic recovery (EventBridge, Step Functions).

These five pillars correspond almost one-to-one with the operating axes of the AWS Well-Architected Framework: IaC and pipelines map to Operational Excellence, security aggregation to Security, cost to Cost Optimization, and observability cuts across Operational Excellence and Reliability. That is why the Pro exam asks not only about specific service knowledge but "how do you weave these five axes into one system." So when one question touches several domains at once (for example, "visualize container cost across all accounts in a multi-account environment"), the answer is not one axis but a combination of axes (enforced tags + Cost Categories + Delegated Admin). Options that answer with a single service are usually traps.

Time Allocation - Passing Is About Time Management, Not Accuracy

With 75 questions in 180 minutes you get an average of 2 minutes 24 seconds, but long scenarios can take 4 to 5 minutes. Strategy: if you don't know it or are under 50% confident, Mark for Review immediately and pass. If you cling to one question and burn 5 minutes, you can't get to the next two. On the first pass, skim the whole exam quickly and solve the sure ones first, and allocate the last 30 minutes to the marked questions plus rechecking very long scenarios. "Preserving time beats one perfect question" is the skill that gets you through.

🎯 Scenario: "A regulated-industry company operates 60 accounts, an on-premises DC, EKS, and serverless. The single question: 'When launching a new microservice, provide all of (1) automatic account and pipeline provisioning, (2) integration with an internet-isolated DC, (3) container cost optimization, and (4) automatic security incident response as standards.' Where do you start decomposing?" → In 5 steps: mark the constraint words ("regulated", "zero internet DC", "cost", "auto response"), split into four domains, then apply the clue-to-answer mapping for each domain: (1) AFT/Control Tower + Service Catalog + Permission Boundary, (2) SSM Hybrid + Roles Anywhere + PrivateLink + (MACsec if DX encryption is required), (3) Karpenter + Graviton/Spot + GitOps, (4) EventBridge → Step Functions → Incident Manager. The common pillars (IaC, observability, security aggregation, cost) run through all four domains. Remember that for compound questions the answer is a combination of axes, not a single service.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

A fintech operates 60 AWS accounts. It must automatically deploy the same Config Rule security baseline to all accounts, and it must also be applied automatically to new accounts that join the OU in the future. What is the best combination?

• AAn IAM administrator manually configures the same Config Rules in each account's console, using an onboarding checklist to prevent omissions when a new account joins
• BDeploy with AWS Organizations + CloudFormation StackSets Service-Managed (Auto-Deployment Enabled) targeting the OU
• CEventBridge Scheduler triggers a Lambda daily that scans for new accounts and syncs and deploys Config Rules through the API
• DSet up a Config Aggregator in the Audit account to aggregate findings from all accounts into one dashboard and alert on noncompliance

Question 2

You want to patch-manage 5,000 servers in a fully internet-isolated data center the same way as EC2. The DC servers must also retrieve Secrets Manager secrets over a private path. What is the best combination?

• ASelf-run Ansible + a NAT Gateway to fetch patch metadata from the internet and inject secrets as environment variables
• BSSM Hybrid Activation followed by Patch Manager + an Interface VPC Endpoint (PrivateLink) for Secrets Manager accessed over DX
• CUse the CodeDeploy On-Prem agent to put patch scripts in AppSpec hooks and roll them out to the 5,000 servers
• DA Lambda connects to each server over SSH to run patch commands and passes secrets through Lambda environment variables

Question 3

An EKS cluster has very large traffic swings, so minute-level node scaling isn't enough. To dynamically launch diverse instance types and make aggressive use of Spot as well, what should you use?

• ACluster Autoscaler - predefine ASGs per instance type and scale the matching ASG at minute granularity when pending pods appear
• BKarpenter
• CA Lambda watches CloudWatch metrics and dynamically updates ASG Scheduled Actions to reserve and adjust capacity by time of day
• DManually configure mixed Spot/On-Demand requests with EC2 Fleet and have operators manage the type pool directly

Question 4

What is the currently recommended standard for granting per-pod IAM more simply on a new EKS cluster, without setting up an IRSA OIDC Provider?

• ACombine permissions for all pods onto the node Instance Profile and let pods share those credentials through IMDS
• BCreate an IAM User per pod and inject long-term access keys as Kubernetes Secrets
• CEKS Pod Identity
• DHave pods manually call STS GetSessionToken at startup to receive MFA-based temporary credentials and cache them

Question 5

GuardDuty detected EC2 instance credential exfiltration (InstanceCredentialExfiltration). Without human intervention it must (1) disable the keys immediately, (2) analyze impact with CloudTrail, and (3) open an incident automatically.

• AImplement key disabling, a CloudTrail query, and incident opening sequentially in a single Lambda function
• BEventBridge → Step Functions (Runbook) → Incident Manager Response Plan
• CUse a Config Auto-Remediation rule to automatically correct the resource settings of the leaked credentials and notify via SNS
• DSet a metric filter on CloudTrail + a CloudWatch alarm to alert the SRE on suspicious API calls

Question 6

You must provide a standard pipeline to 50 microservice teams, where teams can create it themselves (self-service) and must not deviate from the company standard.

• AKeep the pipeline definition in Git with GitOps (Argo CD) and have each team clone the manifest and operate it self-service
• BRun Jenkins centrally and enforce a standard pipeline with per-team folder permissions + a shared library
• CAWS Service Catalog Portfolio + CDK Pipelines template
• DEach team manually writes a CodeCatalyst Blueprint, with the security team reviewing standards compliance via PR every time

Question 7

You use a Direct Connect 10Gbps connection and regulations require line encryption. What satisfies this with minimal change?

• ATurn on S3 SSE-KMS so transferred data is encrypted with a CMK when stored
• BEnforce TLS 1.3 on all application traffic and add mutual authentication with mTLS
• CApply MACsec or IPSec over DX
• DTerminate DX and fully replace it with Site-to-Site VPN so the line is encrypted with IPSec tunnels

Question 8

When an SQS DLQ accumulates, you want to re-drive automatically but must prevent an infinite loop (poison message).

• AIncrease the Lambda timeout and memory to allow more processing time and reduce the batch size to spread load
• BPut a short TTL on DLQ messages so old poison messages expire and disappear automatically
• CRecord a reprocessing count in the message attributes and, when it exceeds a threshold, stop automatic reprocessing and hand it to a human
• DWrap the re-drive in a Step Functions Express workflow to add fast retries and state tracking

Question 9

SREs must be able to safely run a restricted AWS CLI from a Slack channel.

• ASend commands to a Lambda through a Slack Incoming Webhook, and the Lambda runs the CLI with an assumed Role
• BAWS Chatbot + a restricted IAM Role
• CStore a Slack Bot OAuth token on EC2 and have the bot receive channel commands with that token and run the CLI
• DShare an IAM Identity Center console SSO link in the channel so the SRE clicks it and takes action in the console

Question 10

There is pressure to cut container workload cost by 30% or more. What is the single best action?

• ABuy a large 1-year or 3-year Compute Savings Plan/Reserved Instance commitment to lower the On-Demand unit price
• BApply Graviton (arm64) node groups + Spot/Fargate Spot
• CMove the workload to a cheaper Region such as us-east-1 to save on the Regional price difference
• DSwitch container logs from CloudWatch to S3 Infrequent Access and shorten the retention period

Question 11

In an internet-isolated DC with 5,000 servers, how can you give them temporary credentials for AWS API calls using the corporate PKI (X.509 certificates) without placing static access keys on them?

• AIssue IAM User long-term keys, deploy them to each server, and replace them with a rotation script every 90 days
• BIAM Roles Anywhere - register the corporate CA as a Trust Anchor, authenticate with the server certificate, and obtain short-lived STS credentials
• CIntegrate the corporate PKI into a Cognito Identity Pool as an OIDC IdP so servers receive temporary credentials
• DImitate an EC2 Instance Profile by standing up an IMDS proxy in the DC and have servers look up credentials from that endpoint

Question 12

An organization runs a mix of EKS (payments) and ECS Fargate (general). It needs manifest changes to roll back automatically with one Git revert, and ECS Fargate needs Canary traffic shifting and instant rollback. What is the standard combination for each?

• AFor EKS, operators roll back directly with kubectl apply, and for ECS, gradual replacement with the service's default Rolling Update
• BEKS reconciles manifests with GitOps (Argo CD/Flux) (rollback = git revert), and ECS Fargate uses CodeDeploy Blue/Green + two ALB Target Groups/Listeners
• CBoth detect changes with CloudFormation Drift Detection and roll back with update-stack to the previous stack version
• DEKS splits Canary traffic with Lambda Alias weights, and ECS with Route 53 Weighted records

📌 Today's Summary

There are five key points today. First, Pro scenarios are solved in 5 steps: mark the clues → identify the domain → 2 candidates → trade-off → (if confidence is low) mark and pass; narrowing the solution space instantly through clue recognition (RPD) is the core of time economics. Second, the mappings are: "all accounts/new accounts" = Service-Managed StackSets + Auto-Deployment/Delegated Admin, "no internet" = PrivateLink (+ Resolver), "no static keys" = Roles Anywhere/Pod Identity, "burst + Spot" = Karpenter, "git revert" = GitOps, and "auto remediation" = EventBridge → Step Functions. Third, in compound clues the second clue can be the real differentiator, so mark all the constraints and find the intersection. Fourth, Pro's default is eliminating undifferentiated heavy lifting (preferring managed), with an exception when there is a "keep existing assets / custom control" clue. Fifth, passing is about time management, not accuracy: the habit of passing with Mark for Review and preserving time is decisive.