Architecture write-up — GSA full stack + Well-Architected

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-33-architecture-writeup.md and gsa-architecture-map.md. Answer without peeking at night-33-quiz-answers.json first.

1. 1.An interviewer asks which Well-Architected pillar is best demonstrated by Step Functions execution history, per-step Catch routing, and the Night 26 CloudWatch dashboard for CloudFront cache hit rate. Which pillar fits both?

   A.Operational Excellence — runbooks, observability, and controlled changeB.Cost Optimization — because Step Functions bills only per state transitionC.Sustainability — fewer EC2 instances left running overnight for batch workD.Performance Efficiency — faster state transitions measured only at the edge

2. 2.Global Ski Atlas wiki static HTML is served from S3 via CloudFront with CachingOptimized, while resort_stats JSON is cached in ElastiCache Redis inside the VPC. A junior architect proposes replacing Redis with CloudFront for DB rows. What is the best response?

   A.Agree — consolidating on one CDN layer is always simpler for every cache needB.Reject — CloudFront caches HTTP at the edge; Redis caches app objects near AuroraC.Use DynamoDB DAX alone and remove both CloudFront and Redis from the whole designD.Move the Aurora cluster into CloudFront as a custom origin for SQL query responses

3. 3.For the GSA pipeline tier, which combination best satisfies Security, Reliability, and Cost in one design?

   A.Public-subnet Fargate, open 0.0.0.0/0 task SG, EBS for durable output, 24/7 serviceB.Lambda with a 15-minute timeout for full Iceland download and Instance Store outputC.Private scheduled Fargate, scoped S3 task role, SQS/SNS failure path, S3 lifecycleD.Single-AZ NAT spanning two AZs with no VPC endpoints — simplest networking choice

4. 4.A report asks 'average resorts per country for the last three years.' Live wiki counters update in DynamoDB; historical aggregates live in S3 Iceberg. Which query path matches the analytics tier?

   A.Aurora writer endpoint running INSERT … SELECT against live OLTP tablesB.ElastiCache GET on resort_stats:all-countries as the historical report sourceC.CloudFront invalidation on /api/wiki* to recompute three-year country averagesD.Athena SQL against the Glue-cataloged Iceberg table stored in the S3 data lake

5. 5.Which control is the strongest Security-pillar example on the edge/frontend tier of globalskiatlas.com?

   A.Cognito JWT validation on mutating wiki API methods behind API GatewayB.CachingDisabled on every CloudFront behavior to shrink the HTTP attack surfaceC.Storing the Cognito client secret in public S3 config.json for faster cold startsD.Disabling TLS at CloudFront so operators can inspect origin traffic in cleartext

6. 6.Night 9 VPC uses one NAT Gateway in public subnet AZ-a. Private subnets exist in two AZs. What Reliability caveat belongs in the network-tier write-up?

   A.NAT Gateway is Region-global — impairment of AZ-a has no outbound internet impactB.If AZ-a is impaired, private workloads may lose outbound internet until NAT recoversC.S3 gateway endpoints remove every NAT failure mode including non-S3 internet egressD.Security groups are stateless — NAT return traffic needs a new NACL edit per flow

7. 7.Exam scenario: monthly Iceland batch runs up to two hours, must enqueue SQS on success, invoke Lambda, and route failures to SNS with different retries per step. Which orchestration choice matches the pipeline tier capstone?

   A.SQS FIFO with content-based deduplication as the only orchestration controlB.Kinesis Data Firehose writing each pipeline stage directly into an S3 prefixC.Step Functions Standard with ecs:runTask.sync plus Catch states for failuresD.EventBridge schedule with one rule per step and no shared execution history

8. 8.Which Cost Optimization win spans both the analytics tier and the pipeline tier in GSA?

   A.Keep current-month Iceland output in Glacier Deep Archive for fastest retrievalB.Replace S3 with EBS gp3 volumes for all pipeline output and lake table storageC.Run Aurora Serverless v2 at minimum ACU 24/7 solely for Athena federation queriesD.Lifecycle aging on pipeline prefixes plus Athena partition filters on lake tables

9. 9.Aurora Multi-AZ for resort_stats, DynamoDB PITR for wiki tables, and Route 53 failover with a health check on the PRIMARY record. Which Well-Architected pillar do these primarily support?

   A.Reliability — failover paths, backups, and recovery objectives across tiersB.Performance Efficiency — lower query latency treated as the only design goalC.Cost Optimization — fewer Aurora read replicas than a comparable single-AZ designD.Sustainability — reduced carbon attributed only to higher edge caching hit rates

10. 10.Secrets Manager stores the Cognito client secret; Lambda decrypts via KMS; wiki Lambda runs with least-privilege IAM. Which tier does this primarily document?

    A.Network — VPC endpoint policy controlling Secrets Manager API access onlyB.Application — identity, secrets handling, and function IAM permissionsC.Analytics — encrypting Parquet files at rest in the S3 data lake prefixesD.Pipeline — ECS task role limited to ECR image pull for Fargate starts

11. 11.A partner needs per-API-key rate limits on wiki reads. Which edge/application control is the exam-correct first choice?

    A.Security group inbound rule attached directly to the CloudFront distributionB.S3 bucket policy Condition on aws:Referer for every wiki HTML objectC.API Gateway usage plan with an API key and throttle settings for the partnerD.Disable CloudFront and expose the API Gateway URL with no throttling controls

12. 12.Fargate task definition is 1 vCPU / 2 GiB but CloudWatch p95 CPU is 20% for monthly Iceland runs. Night 31 already rightsized. The bill still shows high NAT Gateway data processing. What tier should the write-up address next?

    A.Application — raise Lambda memory on the wiki API to reduce NAT Gateway spendB.Analytics — switch Athena engine version to cut VPC NAT data processingC.Edge — enable CachingOptimized on /api/wiki* to eliminate NAT Gateway hoursD.Network — add S3 gateway and ECR interface endpoints to reduce NAT egress

13. 13.Which pairing correctly maps a GSA exam trap to the right tier?

    A.Public S3 flagged by Config while CloudFront serves — modernize to OAC + private bucketB.Athena used for live wiki counter UPSERT — analytics tier best practice for OLTP writesC.Durable Iceland GeoParquet kept only on Instance Store — pipeline tier best practiceD.ElastiCache treated as source of truth for resort_stats — data tier best practice path

14. 14.Sustainability lens (awareness): which GSA design choice best reduces wasted compute compared to a always-on EC2 worker polling for monthly work?

    A.m6i.2xlarge On-Demand left running 24/7 with cron inside the guest operating systemB.EventBridge schedule that triggers RunTask only on the first day of each monthC.Two NAT Gateways in every AZ with no VPC endpoints for S3 or ECR image trafficD.Glacier Flexible Retrieval on every wiki HTML object for each anonymous page view

15. 15.You are documenting the full stack for Night 33. Which order is the best interview narrative?

    A.Start with DynamoDB streams, then VPN tunnels, then Glacier vault lock policiesB.Start with AWS Backup vault policies and skip user-facing traffic paths entirelyC.Start at Route 53/CloudFront, walk app and data paths, then pipeline and VPCD.Start with Step Functions ASL only and omit edge caching and OLTP stores