Cloud interview prep

• ACI — Azure Container Instances — How Azure Container Instances runs a container group without servers or an orchestrator: sizes and quotas, per
• ACM — Certificate Manager — How ACM really issues and renews TLS certificates: DNS vs email vs HTTP validation, managed renewal under the
• ACR — Azure Container Registry — How Azure Container Registry stores and serves images: Basic, Standard and Premium, Entra roles and the new AB
• AKS — Azure Kubernetes Service — How AKS really runs a cluster: the Azure-managed control plane and the MC_ node resource group, AKS Automatic
• Amazon Athena — Serverless SQL on S3 — How Athena really works: a Trino-based engine reading tables from the Glue Data Catalog, billed per byte scann
• Amazon MQ — Managed ActiveMQ and RabbitMQ — How Amazon MQ runs ActiveMQ and RabbitMQ for you: deployment modes and what fails over, the failover URL clien
• Amazon MSK — Managed Apache Kafka — How Amazon MSK runs Kafka for you: Standard vs Express brokers vs Serverless, partitions, replication and the
• Amazon OpenSearch Service — How Amazon OpenSearch Service really works: domains of data, manager and coordinator nodes, shards and replica
• Amplify — Hosting and Gen 2 Backends — How AWS Amplify builds, hosts and serves web apps (static and server-rendered) and how Amplify Gen 2 defines t
• API Gateway — Managed API Layer — How API Gateway really handles a request: REST vs HTTP vs WebSocket APIs and what each costs, integration type
• API Management — API Gateway and Portal — How Azure API Management really handles a call: the gateway, management plane and developer portal; classic, C
• App Runner — Managed Container Service — AWS App Runner, closed to new customers since April 30, 2026: how it builds and runs web services, concurrency
• App Service — Managed Web Apps — How Azure App Service really serves your app: front ends, workers and App Service plans, Premium v4 and the 20
• Application Gateway — layer-7 load balancer and WAF — How Application Gateway v2 really works: a regional layer-7 proxy in a dedicated subnet, listeners, rules and
• Application Migration Service (Transform MGN) — Lift-and-Shift Rehost — How MGN (renamed AWS Transform MGN in June 2026) really rehosts servers: block-level replication into a stagin
• AppSync — GraphQL and Real-time APIs — How AppSync really serves GraphQL: resolvers, APPSYNC_JS vs VTL and the data sources behind them, five auth mo
• ARC — Application Recovery Controller — How Amazon Application Recovery Controller really works: zonal shift and zonal autoshift with weekly practice
• Aurora — Cloud-Native Relational Database — How Aurora really works: one shared, log-structured volume with six copies across three AZs and 4-of-6 write q
• Auto Scaling — EC2 Auto Scaling and Application Auto Scaling — How Auto Scaling groups really keep and change capacity: health checks and the grace period, lifecycle hooks,
• AWS 3-Tier Web Application Architecture — The classic interview design question end to end: CloudFront and WAF, an ALB, a stateless app tier, a Valkey c
• AWS Backup — Centralized Backup Management — How AWS Backup really works and what interviewers probe: backup plans, rules and lifecycles (with the 90-day c
• AWS Config — Resource Configuration History — How AWS Config really works and what interviewers probe: the configuration recorder and configuration items, c
• AWS Control Tower — How Control Tower really builds and governs a multi-account landing zone on top of Organizations: shared log a
• AWS Cost Optimization — Visibility, Commitments and Waste — How cost optimization really works on AWS: CUR 2.0 and Cost Explorer, allocation with accounts, tags and Cost
• AWS Disaster Recovery — RPO, RTO and Recovery Strategies — How disaster recovery really works on AWS: measuring RPO and RTO honestly, what each strategy must keep runnin
• AWS Glue — Serverless ETL & Data Catalog — How AWS Glue really works: the Data Catalog that Athena, EMR and Redshift share, crawlers and schema drift, Sp
• AWS Health — Service and Account Events — How AWS Health really works: service health vs your account health, the event model (category, status, scope,
• AWS Organizations — Accounts, OUs and Policies — How AWS Organizations really runs a multi-account estate: the management account, OUs and why accounts are the
• AWS Private CA — How AWS Private CA really runs your internal PKI: root and subordinate hierarchies, general-purpose vs short-l
• AWS Systems Manager (SSM) — How Systems Manager really reaches your servers: the agent's outbound channel, instance profiles and default h
• AWS VPN — Site-to-Site and Client VPN — How AWS VPN really works: two IPsec tunnels per connection, IKE and BGP inside them, virtual private gateway v
• AWS Well-Architected Framework — Pillars, Lenses and Reviews — How the Well-Architected Framework is really used: six pillars and their design principles, 57 questions and t
• Azure AI Search — Retrieval for Search and RAG — How Azure AI Search really works: indexes, analyzers and vector fields, indexers and skillsets, BM25, HNSW, hy
• Azure Blob Storage — How Blob Storage really works and what interviewers probe: storage account kinds and the GPv1 retirement, LRS
• Azure Compute — Choosing VMs, App Service, Functions, Container Apps and AKS — How to choose where code runs on Azure: what each compute option really runs your code on, what you still mana
• Azure Cosmos DB — Globally Distributed NoSQL — How Cosmos DB really works: request units and the 429 contract, logical vs physical partitions and hierarchica
• Azure Database for MySQL — How Azure Database for MySQL (flexible server) really runs: a VM on premium storage, zone-redundant vs same-zo
• Azure Database for PostgreSQL — How Azure Database for PostgreSQL (flexible server) really runs: a VM with managed disks, zone-redundant vs sa
• Azure DDoS Protection — How Azure DDoS Protection really works: the free infrastructure protection every public IP gets, Network Prote
• Azure DNS — How Azure DNS really answers: public zones on anycast name servers with alias records and CAA, private zones l
• Azure Event Grid — How Event Grid really routes events: system, custom and partner topics, domains, namespaces with pull delivery
• Azure Event Hubs — How Event Hubs really streams: partitions as ordered logs, partition keys and hot partitions, consumer groups
• Azure Files and File Sync — How Azure Files really works and what interviewers probe: SMB and NFS shares in a storage account or as Micros
• Azure Firewall — How Azure Firewall really works and what interviewers probe: Basic, Standard and Premium and what each can ins
• Azure Functions — Serverless Compute — How Azure Functions really runs your code: the scale controller and target-based scaling, the Flex Consumption
• Azure Landing Zones — Management Groups, Subscriptions and ALZ — How an Azure estate is organized: the tenant root and management groups (10,000 per directory, six levels), su
• Azure Load Balancer — How Azure Load Balancer really behaves: a layer-4 pass-through on the host network, Standard only since Basic
• Azure Managed Disks — How Azure Managed Disks really work and what interviewers probe: the five disk types, Premium SSD v2 with IOPS
• Azure Managed Redis — In-Memory Cache on Redis Enterprise — How Azure Managed Redis really works: Redis Enterprise nodes and shards, the Memory Optimized, Balanced, Compu
• Azure Monitor: Log Analytics, Application Insights and alerts — How telemetry really moves through Azure Monitor: the Azure Monitor Agent and data collection rules, the three
• Azure Policy — Guardrails for Every Resource — How Azure Policy evaluates every create, update and delete against the assignments on the scope chain: definit
• Azure Private Link — How Azure Private Link really works: a private endpoint is a NIC with a private IP for one sub-resource, the a
• Azure RBAC — Role-Based Access Control — How Azure decides who can do what: role assignments at four scopes, Actions minus NotActions and the data plan
• Azure Resource Manager: ARM, Bicep, deployment stacks and template specs — How a PUT becomes a resource: the Resource Manager control plane, scopes, resource providers and throttling; B
• Azure Service Bus — How Service Bus really brokers messages: queues and topics with SQL and correlation filters, peek-lock and loc
• Azure SQL Database — How Azure SQL Database really runs: the logical server and its gateway, DTU vs vCore, General Purpose remote s
• Azure SQL Managed Instance — How SQL Managed Instance really runs: a full SQL Server instance inside a delegated subnet of your VNet, VM gr
• Batch — Managed Batch Computing — How AWS Batch really schedules work: compute environments on EC2, Spot, Fargate, EKS or ECS Managed Instances,
• Bedrock — Foundation Models and Agents — How Amazon Bedrock really serves foundation models: picking a model, the Converse API, on-demand vs batch vs r
• Bedrock AgentCore — Agents in Production — How Amazon Bedrock AgentCore runs agents in production: Runtime sessions in their own microVMs and the limits
• CDK — Cloud Development Kit — How the AWS CDK really works: constructs (L1, L2, L3) synthesized to CloudFormation, how logical IDs are compu
• Cloud Security Posture — CSPM & CNAPP — CSPM and CNAPP: continuous misconfiguration detection. AWS Security Hub, GCP Security Command Center, Microsof
• Cloud WAN — Global Core Network — How AWS Cloud WAN really works: one JSON policy builds a core network with an edge in every Region you list, s
• Cloud9 — Cloud-Based IDE — AWS Cloud9 has been closed to new customers since July 25, 2024; existing environments keep working with no ne
• CloudFormation — Infrastructure as Code — How CloudFormation really builds, updates and rolls back stacks: the dependency graph, change sets and replace
• CloudFront — CDN and Edge Delivery — How CloudFront really serves a request: edge locations, regional edge caches and Origin Shield, cache keys and
• CloudHSM — Dedicated Hardware Security Modules — How AWS CloudHSM gives you single-tenant FIPS 140-3 Level 3 HSMs in your own VPC: clusters across AZs, the hsm
• CloudTrail — API Audit Logging — How CloudTrail really works and what interviewers probe: management, data, network activity and Insights event
• CloudWatch — Metrics, Logs and Alarms — How CloudWatch really works and what interviewers probe: metrics, dimensions and retention, M-of-N alarms, com
• CodeArtifact — Package Repositories — How AWS CodeArtifact stores and proxies npm, PyPI, Maven, NuGet, Ruby, Cargo, Swift and generic packages: doma
• CodeBuild — Managed Build and Test Service — How CodeBuild really runs a build: the buildspec phase by phase, Lambda vs on-demand EC2 vs reserved fleets an
• CodeCommit — Managed Git Repository Service — CodeCommit in October 2026: closed to new customers in July 2024, back to general availability in November 202
• CodeDeploy — Automated Application Deployment — How CodeDeploy really ships code to EC2, on-premises servers, Lambda and ECS: in-place vs blue/green, canary a
• CodePipeline — Continuous Delivery Orchestration — How CodePipeline really runs a release: stages, actions and artifacts in S3, V1 vs V2 and what each bills, Git
• Cognito — User Pools and Identity Pools — How Cognito really signs users in: user pools as an OAuth 2.0 and OIDC server issuing ID, access and refresh t
• Comprehend — Natural Language Processing — How Comprehend really works in 2026: the built-in APIs and their limits, PII detection and redaction, custom c
• Container Apps — Serverless Containers on Azure — How Azure Container Apps runs containers without a cluster to manage: environments and workload profiles, revi
• Copilot — AWS Copilot CLI — The AWS Copilot CLI reached end of support on June 12, 2026. What it built (applications, environments, servic
• DataSync — Automated Data Transfer Service — How DataSync really moves files and objects: agents vs agentless transfers, Basic vs Enhanced mode, what a tas
• Detective — Security Investigation — How Amazon Detective turns CloudTrail, VPC Flow Logs, GuardDuty, EKS audit and Security Hub data into a behavi
• Direct Connect — Dedicated Network Connectivity — How AWS Direct Connect really works: dedicated vs hosted connections, port speeds and LAGs, private, public an
• DMS — Database Migration Service — How DMS really moves a live database: full load then CDC from the source log, replication instances vs DMS Ser
• DocumentDB — Managed MongoDB-Compatible Database — How DocumentDB really works: the MongoDB API on AWS's own engine over an Aurora-style shared volume, versions
• DynamoDB — Managed NoSQL at Any Scale — How DynamoDB really works and what interviewers probe: partitions and hot keys, capacity-unit math, on-demand
• DynamoDB Advanced — Global Tables, DAX, and Design Patterns — DynamoDB at scale: single-table design with overloaded and sparse indexes, write sharding, global tables with
• EBS — Elastic Block Store — How EBS really works and what interviewers probe: volumes as network devices in one AZ, gp3 vs io2 vs st1 and
• EC2 — Elastic Compute Cloud — How EC2 really works and what interviewers probe: reading instance types, the newest Graviton, Intel and AMD g
• EC2 Advanced — Placement, Nitro, Networking and Fleets — What sits under an instance and how to control it: placement groups (cluster, partition, spread, precision-tim
• ECR — Elastic Container Registry — How ECR stores and serves images: token-based login, layers in S3, the VPC endpoints a private pull needs, pul
• ECS — Elastic Container Service — How ECS really runs your containers: task definitions, services and the scheduler, Fargate vs EC2 vs Managed I
• ECS — Elastic Container Service Deep Dive — Operating ECS at scale: capacity provider and managed scaling math, task placement on EC2, ENI trunking densit
• ECS vs EKS — When to Use Each — The container platform decision on AWS: what each control plane costs and asks of you, how tasks and pods get
• EFS — Elastic File System — How EFS really works and what interviewers probe: a Regional NFS file system reached through one mount target
• EKS — Elastic Kubernetes Service — How EKS really runs your cluster: the AWS-owned control plane, pods on VPC IPs, Pod Identity vs IRSA, Karpente
• EKS Deep Dive — Networking, Storage, Operations — Operating EKS at scale: custom networking and security groups for pods, network policy tiers, EBS and EFS volu
• Elastic Beanstalk — PaaS Application Deployment — How Elastic Beanstalk really deploys an app: the CloudFormation stack it builds (Auto Scaling group, load bala
• Elastic Disaster Recovery (DRS) — How AWS Elastic Disaster Recovery really protects servers: the agent, the staging area and what it costs while
• ElastiCache — Managed In-Memory Caching — How ElastiCache really works: Valkey, Redis OSS and Memcached and what each costs, cache-aside with TTLs and s
• ELB — Elastic Load Balancing — How AWS load balancers really behave: ALB vs NLB vs GWLB (and Classic), listener rules, target types, health c
• EMR — Managed Spark and Hadoop — How Amazon EMR really works: clusters with primary, core and task nodes, instance fleets with Spot for task no
• Ephemeral CI Runners on AWS — Federate GitHub Actions to AWS with OIDC (no static keys) and run ephemeral EC2 self-hosted runners with least
• EventBridge — Serverless Event Bus — How EventBridge really routes events: default, custom and partner buses, rules and event patterns, the new Cus
• Fargate — Serverless Container Patterns — Architectures on Fargate and how to size and pay for them: web services behind an ALB, queue workers scaling o
• Fargate — Serverless Containers — How Fargate runs a container without servers: an isolation boundary per task, the fixed CPU and memory sizes,
• Fault Injection Service (FIS) — How AWS Fault Injection Service really runs a chaos experiment: templates, targets and selection modes, the ac
• Firewall Manager — Org-wide Firewall Policy — How AWS Firewall Manager applies one firewall policy across an AWS Organization: the administrator model and s
• Front Door — global edge, CDN and WAF — How Azure Front Door really works: Standard vs Premium, routes and route matching, origin groups with priority
• FSx — High-Performance Managed File Systems — The four FSx file systems and how to choose: Windows File Server for SMB and Active Directory, Lustre for HPC
• GCP Compute — GCE, GKE Autopilot, Cloud Run — Google Cloud compute: Compute Engine VMs, GKE Autopilot vs Standard, Cloud Run serverless containers, Cloud Fu
• GCP Data — BigQuery, Pub/Sub, Dataflow, Spanner — Google Cloud data platform: BigQuery serverless DW, Pub/Sub messaging, Dataflow unified batch+stream, Cloud Sp
• Global Accelerator — Anycast Network Acceleration — How AWS Global Accelerator really works: two static anycast IPs in separate network zones, standard and custom
• Global Infrastructure — Regions and AZs — Partitions, Regions, Availability Zones and AZ IDs, opt-in Regions, Local Zones, Wavelength Zones, Outposts an
• GuardDuty — Intelligent Threat Detection — How GuardDuty really finds threats: the three sources it reads on its own, the protection plans (S3, EKS, Runt
• IaaS vs PaaS vs SaaS — Three cloud service models. IaaS = rent servers (you manage OS/runtime/app). PaaS = rent platform (you manage
• IAM — Advanced Patterns — IAM at organization scale: SCPs on principals and RCPs on resources, permissions boundaries that make delegate
• IAM — Identity and Access Management — How AWS really decides every API call: principals and their credentials, the policy types and the order IAM ev
• IAM Identity Center — How IAM Identity Center really gives a workforce access to many AWS accounts: organization vs account instance
• Inspector — Automated Vulnerability Management — How Amazon Inspector finds and re-finds vulnerabilities: agent-based, agentless and hybrid EC2 scanning, ECR i
• Key Vault — Secrets, Keys and Certificates — How Azure Key Vault really works: vaults vs Managed HSM, Standard vs Premium, the RBAC permission model now th
• Keyspaces — Managed Apache Cassandra — How Keyspaces really works: serverless, Cassandra-compatible tables with no nodes, partition and clustering ke
• Kinesis — Real-Time Data Streaming — How Kinesis Data Streams really works: shards and hash ranges, partition keys and hot shards, provisioned vs O
• KMS — Key Management Service — How KMS really protects data: keys whose material never leaves the service, envelope encryption with data keys
• Lake Formation — Data Lake Permissions — How AWS Lake Formation really works: grants on Glue Data Catalog databases, tables, columns, rows and cells, L
• Lambda — Serverless Architecture Patterns — The architectures built on Lambda and how they fail: API backends, SQS workers with partial batch responses, K
• Lambda — Serverless Functions — How Lambda really runs your code: execution environments and cold starts, sync vs async vs event source mappin
• Lambda Advanced — SnapStart, Concurrency and Tuning — Lambda internals and tuning: SnapStart (now on container images), provisioned vs reserved concurrency with aut
• Lex — Conversational AI — How Amazon Lex V2 really works now that V1 is gone: bots, locales, intents and slots, versions and aliases, th
• Lightsail — Simplified Cloud for Small Workloads — How Lightsail really works and what it costs: fixed-price bundles for instances, databases, containers, load b
• Logic Apps — Integration Workflows — How Azure Logic Apps really runs a workflow: Consumption (multitenant, per execution) vs Standard (single-tena
• Macie — S3 Data Security and Privacy — How Amazon Macie finds sensitive data in S3 and judges bucket posture: the bucket inventory and policy finding
• Managed Grafana — How Amazon Managed Grafana really works: workspaces, sign-in with IAM Identity Center or SAML, Admin, Editor a
• Managed Identities — Credentials for Azure Workloads — How Azure workloads authenticate without secrets: system- vs user-assigned identities, the IMDS and App Servic
• Managed Service for Prometheus — How Amazon Managed Service for Prometheus really stores and serves metrics: workspaces, remote_write with SigV
• MemoryDB — Durable In-Memory Database — How Amazon MemoryDB really works: Valkey and Redis OSS as a primary database, the Multi-AZ transaction log beh
• Migration Hub — Migration Planning and Tracking — Migration Hub and Application Discovery Service closed to new customers on November 7, 2025, and AWS Transform
• Multi-Cloud & Hybrid Architecture — Multi-cloud patterns: Crossplane, Azure Arc, Anthos. Kubernetes as universal runtime. When multi-cloud adds va
• Neptune — Managed Graph Database — How Neptune really works: Neptune Database (an Aurora-style cluster for transactional graph queries) and Neptu
• Network Firewall — Managed VPC Inspection — How AWS Network Firewall inspects VPC traffic: endpoints you route through, the stateless and Suricata statefu
• Polly — Text-to-Speech — How Amazon Polly really works: the standard, neural, long-form and generative engines and what each costs, the
• PrivateLink — Private Service Endpoints — How AWS PrivateLink really works: interface, gateway, Gateway Load Balancer, resource, service-network and tun
• Q Developer and Kiro — AI Coding on AWS — Amazon Q Developer in October 2026: sign-ups closed since May 15, 2026, IDE plugins and paid subscriptions end
• Quick Sight — BI Dashboards — How Amazon Quick Sight (formerly QuickSight, now part of Amazon Quick) really works: data sources, SPICE vs di
• RAM — Resource Access Manager — How AWS RAM shares subnets, transit gateways, Resolver rules and dozens of other resources across accounts wit
• RDS — Relational Database Service — How RDS really runs a database: the engines, Multi-AZ with one standby vs a Multi-AZ DB cluster with two reada
• Redshift — Petabyte-Scale Data Warehouse — How Redshift really runs a query (leader node, slices, columns, zone maps), RA3 and the new Graviton RG nodes
• Rekognition — Image and Video Analysis — How Rekognition really works in 2026: which features new accounts can still use, image moderation and custom a
• Resilience Hub — How AWS Resilience Hub really assesses an application: input sources, AppComponents, resiliency policies with
• Route 53 — DNS and Traffic Management — How Route 53 really answers a DNS query: the resolution path, hosted zones and alias records, every routing po
• S3 — Simple Storage Service — How S3 really works and what interviewers probe: buckets, keys and prefixes, strong consistency, request rates
• S3 Advanced — Events, Replication, and Operations at Scale — What runs around the objects: event notifications vs EventBridge, replication with a 15-minute RTC target, Obj
• S3 Glacier — Archive Storage — The three S3 Glacier storage classes as they really work: minimum durations, retrieval tiers and times, real p
• SageMaker AI — Managed ML Platform — How SageMaker AI really trains and serves models: what Unified Studio is (and is not), training jobs with mana
• SAM — Serverless Application Model — How AWS SAM really works: a CloudFormation transform that expands a few lines into functions, roles, APIs and
• Secrets Manager — Secrets and Rotation — How Secrets Manager really stores, versions and rotates credentials: staging labels, the four rotation steps,
• Security Hub — Unified Security Findings — How AWS Security Hub works since its December 2025 relaunch: exposure findings that join Inspector, GuardDuty,
• Security Lake — OCSF Security Data Lake — How Amazon Security Lake collects CloudTrail, VPC Flow Logs, Route 53, Security Hub, EKS audit, WAF and your o
• Service Catalog — Governed Self-Service — How AWS Service Catalog lets teams launch approved CloudFormation and Terraform products without broad IAM rig
• SES — Simple Email Service — How Amazon SES really delivers email: verified identities, DKIM, custom MAIL FROM and DMARC alignment, the san
• Shield — DDoS Protection — How AWS Shield really protects you: the free, always-on Standard tier at layers 3 and 4, what Shield Advanced
• Snow Family — Physical Data Transfer Devices — Snow in October 2026: Snowcone gone, Snowball Edge for existing customers only, support ending December 31, 20
• SNS — Simple Notification Service — How SNS really fans out: standard vs FIFO topics, subscription filter policies on attributes or payload, deliv
• SQS — Simple Queue Service — How SQS really delivers messages: the receive-hide-delete cycle, standard vs FIFO and high-throughput FIFO, vi
• Step Functions — Serverless Orchestration — How Step Functions really runs workflows: Standard vs Express (duration, delivery semantics, pricing), Amazon
• Storage Gateway — Hybrid Cloud Storage — How AWS Storage Gateway really works in 2026: which gateway types are still offered (S3 File, Volume, Tape; FS
• Textract — Document Text and Data Extraction — How Textract really works: plain OCR vs forms, tables, queries, signatures and layout, the specialized expense
• Timestream — Managed Time-Series Database — Timestream in October 2026: LiveAnalytics closed to new customers on June 20, 2025 and how existing users migr
• Transcribe — Speech-to-Text — How Amazon Transcribe really works: batch jobs vs HTTP/2 and WebSocket streams, diarization vs channel identif
• Transfer Family — Managed File Transfer Service — How Transfer Family really runs partner file exchange: SFTP, FTPS, FTP and AS2 servers on S3 or EFS, endpoint
• Transit Gateway — Cloud Router — Inside AWS Transit Gateway: how one packet is routed, every attachment type (VPC, VPN, Direct Connect gateway,
• Translate — Neural Machine Translation — How Amazon Translate really works: TranslateText vs TranslateDocument vs batch jobs, the byte limits, custom t
• Trusted Advisor — Best Practice Checks and Recommendations — How Trusted Advisor really works in 2026: checks and recommendations across cost, security, fault tolerance, p
• Verified Access — How AWS Verified Access really replaces a VPN for corporate apps: an instance with user and device trust provi
• Verified Permissions — How Amazon Verified Permissions really decides "can this user do this to that?" inside your own application: C
• VMs — Azure Virtual Machines — How Azure VMs really work and what interviewers probe: reading size names, the v6 and v7 generations and Cobal
• VMSS — Virtual Machine Scale Sets — How scale sets really keep and change a fleet of VMs: Flexible vs Uniform orchestration, autoscale rules and t
• VNet — Azure Virtual Network — How Azure virtual networks really work: regional VNets whose subnets span zones, the five reserved addresses,
• VPC — Virtual Private Cloud — How a VPC really moves packets: CIDRs and the five reserved addresses, subnets per AZ, route tables, internet
• VPC Advanced — Multi-VPC, Transit Gateway, and Egress — Designing networks of many VPCs: why peering is not transitive, Transit Gateway route tables for segmentation,
• VPC Lattice — Service-to-Service Networking — How Amazon VPC Lattice connects services across VPCs and accounts without peering: service networks, services,
• WAF — Web Application Firewall — How AWS WAF really decides on a request: web ACLs (protection packs) and rule priority, managed rule groups an
• X-Ray — Distributed Tracing — How distributed tracing on AWS really works in 2026: traces, segments and subsegments, the trace header across

Start free on Cariara · Coding problems · System design studio