parse_test6.py

#!/usr/bin/env python3
"""
Parse and add Test #6 questions to awsprepai-multicert.html
"""

# All 65 questions from Practice Test #6
test6_questions = [
    {"cat": "design-cost", "q": "Data analytics team manages Python process (30 min runtime). Can withstand interruptions and restart. On-premises to AWS. Most cost-effective?", "options": ["Spot Instance with persistent request", "Lambda", "Application Load Balancer", "EMR"], "answer": 0, "explain": "Spot Instances offer up to 90% discount vs On-Demand. Persistent request reopens after interruption or stop. Process can restart after interruption. Lambda has 15-min max timeout. ALB and EMR not suitable."},
    {"cat": "design-resilient", "q": "Healthcare company - EC2 in 2 private subnets (PR1, PR2) across 2 AZs (A1, A2). Need internet for patches. Setup 2 NAT gateways highly available?", "options": ["2 NAT gateways: N1 in public subnet PU1 in AZ A1, N2 in public subnet PU2 in AZ A2", "1 NAT gateway in public subnet PU1 in any AZ", "2 NAT gateways: both in single public subnet PU1 in any AZ", "2 NAT gateways: N1 in private subnet PR1 in AZ A1, N2 in private subnet PR2 in AZ A2"], "answer": 0, "explain": "Create public NAT gateway in each AZ. EC2 in private subnet routes internet traffic through NAT in same AZ. If one AZ fails, other AZ still has internet access. Highly available configuration."},
    {"cat": "design-resilient", "q": "Media company migrating legacy VMs to AWS. Cannot containerize or re-architect. Need high availability and fault tolerance on EC2?", "options": ["Create AMI from each server, launch 2 EC2 from AMI in 2 AZs, setup NLB for traffic distribution and health monitoring", "Create AMIs, use with ASG min/max=1, place ALB in front", "Use AWS Backup to schedule hourly backups to S3 in different AZ, manual restoration on failure", "Containerize with ECS Fargate tasks in multiple AZs with ALB"], "answer": 0, "explain": "Create AMI from legacy server. Launch 2 EC2 instances from AMI in different AZs. NLB routes traffic to healthy instances with health checks. Provides HA and fault tolerance without re-architecting."},
    {"cat": "design-secure", "q": "Multiple EC2 in private subnet running image processing need access to S3 and DynamoDB. Private access to these AWS resources?", "options": ["Gateway endpoint for DynamoDB, OAI for S3, connect using private IP", "Gateway endpoint for S3, interface endpoint for DynamoDB, add as route table targets", "Separate gateway endpoints for S3 and DynamoDB, add as route table targets", "Separate interface endpoints for S3 and DynamoDB, add as route table targets"], "answer": 2, "explain": "S3 and DynamoDB support gateway endpoints. Create separate gateway endpoint for each. Add as targets in route table of custom VPC. Enables private connectivity without internet gateway. Interface endpoints not needed."},
    {"cat": "design-cost", "q": "Tech enterprise has EC2, Fargate, Lambda workloads. Purchased Compute Savings Plans. Monitor utilization and alert when coverage below threshold?", "options": ["CloudWatch dashboard to track usage, metric math to estimate coverage, trigger alarms", "Compute Optimizer for recommendations, automatic notifications for coverage drops", "Custom script queries Savings Plans API, pushes to S3, QuickSight visualize and email weekly", "AWS Budgets create daily coverage budget for Compute Savings Plans, define threshold, configure notifications"], "answer": 3, "explain": "AWS Budgets creates Savings Plans coverage budgets. Monitors coverage percentage daily. Triggers alerts via SNS/email when coverage drops below threshold. No custom scripting. Purpose-built for this use case."},
    {"cat": "design-performant", "q": "Global photography startup - static image site on S3. Users upload/download photos. Latency issues globally. Enhance global performance with minimal dev effort?", "options": ["Global Accelerator on S3 bucket for uploads and downloads", "Multiple S3 buckets in different regions replicated. CloudFront uploads/downloads from nearest", "Migrate to EC2 in multiple regions with ALB and Global Accelerator", "Deploy CloudFront with S3 origin for downloads. Enable S3 Transfer Acceleration for uploads"], "answer": 3, "explain": "CloudFront CDN serves downloads from edge locations close to users. S3 Transfer Acceleration uses edge locations for fast uploads via optimized AWS network. Both simple to enable, serverless. Improves global performance significantly."},
    {"cat": "design-resilient", "q": "Startup deploys OLTP app with unpredictable usage spikes. Needs relational queries. Which database?", "options": ["DynamoDB with Provisioned Capacity and Auto Scaling", "Aurora Serverless", "ElastiCache", "DynamoDB with On-Demand Capacity"], "answer": 1, "explain": "Aurora Serverless auto-scales based on app needs. Automatically starts up, shuts down, scales capacity. Relational database for OLTP. No managing DB instances. Simple, cost-effective for unpredictable workloads."},
    {"cat": "design-secure", "q": "Developer configured inbound traffic in Security Group and network ACL but can't connect to EC2 service. How to fix?", "options": ["NACLs stateful so allowing inbound enables connection. Security Groups stateless so allow both inbound and outbound", "Security Groups stateful so allowing inbound enables connection. NACLs stateless so allow both inbound and outbound", "NACLs rules modified from command line are blocked causing erratic behavior", "IAM Role in Security Group different from IAM Role in NACL"], "answer": 1, "explain": "Security Groups are stateful - allowing inbound auto-allows outbound response. NACLs are stateless - must explicitly allow both inbound and outbound including ephemeral ports (1024-65535) for return traffic."},
    {"cat": "design-resilient", "q": "Financial firm operates transaction processing on Aurora MySQL in us-east-2. DR region is us-west-2. RPO ≤ 5 min, RTO ≤ 15 min. Minimal overhead?", "options": ["Convert to Aurora global database with managed failover", "Aurora read replica in us-west-2 with manual promotion", "Separate Aurora cluster in us-west-2 with AWS DMS continuous replication", "Separate Aurora cluster in us-west-2 with Lambda snapshot export/import every 5 min"], "answer": 0, "explain": "Aurora global database replicates across regions with <1 second lag. RPO of 5 min easily met. Managed failover promotes secondary to primary quickly, meeting 15 min RTO. Minimal configuration and operational overhead."},
    {"cat": "design-secure", "q": "Healthcare company wants single-tenant hardware for EC2 to meet compliance. Most cost-effective way to isolate to single tenant?", "options": ["Spot Instances", "Dedicated Instances", "On-Demand Instances", "Dedicated Hosts"], "answer": 1, "explain": "Dedicated Instances run in VPC on hardware dedicated to single customer. Physically isolated at hardware level from other accounts. Dedicated Hosts are costlier and provide more control. Spot and On-Demand don't isolate hardware."},
    {"cat": "design-resilient", "q": "Multi-tier social media app on EC2 behind ALB in ASG across AZs with Aurora. Make app more resilient to periodic read request spikes?", "options": ["Use Shield", "Use Direct Connect", "Use Aurora Replica", "Use CloudFront distribution in front of ALB", "Use Global Accelerator"], "answer": [2, 3], "explain": "Aurora Replicas scale read operations. Up to 15 replicas across AZs. Automatically promote replica if writer fails. CloudFront caches content at edge locations. Reduces load on origin. Both improve resiliency to spikes."},
    {"cat": "design-cost", "q": "Tech startup - predictable backend services with steady-state workloads on EC2, Lambda, Fargate, SageMaker. Optimize long-term costs with fewest savings plans?", "options": ["Purchase Compute Savings Plan for EC2/Fargate/Lambda. Purchase SageMaker Savings Plan", "Hybrid deployment discount plan for AWS and on-premises Kubernetes", "EC2 Instance Savings Plan covers EC2 and Fargate", "Reserved Instance for each EC2, AWS Support to monitor RI utilization", "Compute Savings Plan for EC2/Fargate/Lambda. SageMaker Savings Plan for SageMaker"], "answer": [0, 4], "explain": "Compute Savings Plan applies to EC2, Fargate, and Lambda. Not tied to instance family or region. SageMaker Savings Plan for SageMaker workloads (training, inference, notebooks). Up to 64% savings. Both provide flexible, cost-efficient long-term discounts."},
    {"cat": "design-secure", "q": "Team has 200 IAM users with read access to S3. 50 users need write access. Least time, minimal changes?", "options": ["Create policy, assign manually to 50 users", "Update S3 bucket policy", "Create group, attach policy, place 50 users in group", "Create MFA user with read/write, link 50 IAM to MFA"], "answer": 2, "explain": "IAM groups simplify permissions management for multiple users. Create group, attach write policy to group, add 50 users to group. All users in group inherit permissions. Scalable and easy to manage."},
    {"cat": "design-performant", "q": "Startup evaluates optimal block storage for EC2 hosting flagship app. Very low latency required. Data doesn't need to persist after instance termination?", "options": ["Instance store volumes can be detached and attached to different instance", "If you create AMI from instance, data on instance store preserved", "You can specify instance store when you launch or restart", "Instance store is network storage", "You can't detach instance store from one instance and attach to another"], "answer": [1, 4], "explain": "Instance store provides temporary block storage on physically attached disks. Can't detach from one instance and attach to another. Data on instance store is NOT preserved in AMI. Provides high I/O performance."},
    {"cat": "design-secure", "q": "EC2 instance querying IPs for cryptocurrency mining. Unauthorized crypto activity. Which AWS service protects EC2 from this?", "options": ["GuardDuty", "Firewall Manager", "Shield Advanced", "WAF"], "answer": 0, "explain": "GuardDuty continuously monitors for malicious or unauthorized behavior. Identifies cryptocurrency mining activity. Finding: CryptoCurrency:EC2/BitcoinTool.B. Powered by threat intelligence and ML. Set up suppression rule if legitimate mining."},
    {"cat": "design-secure", "q": "Company has many VPCs in various accounts. Connect in star network with each other and on-premises via Direct Connect. What to recommend?", "options": ["Virtual private gateway", "VPC Peering", "PrivateLink", "Transit Gateway"], "answer": 3, "explain": "Transit Gateway acts as hub connecting VPCs and on-premises networks. Single connection from each VPC to Transit Gateway. Controls traffic routing. Supports Direct Connect. Scalable for many VPCs."},
    {"cat": "design-cost", "q": "Database on 2 EC2 in 2 AZs with public IPs. Replication uses public IPs. Decrease replication cost?", "options": ["Use Elastic Fabric Adapter", "Create Private Link between instances", "Use private IP for replication", "Assign EIP and use for replication"], "answer": 2, "explain": "Public IP traffic goes over internet, incurring high costs. Private IP keeps traffic within AWS private network for minimal cost. EIP is also public. PrivateLink is for different use cases. EFA for HPC."},
    {"cat": "design-cost", "q": "Social media company runs image-sharing site on S3. Some images frequently accessed, others idle. Most cost-effective storage?", "options": ["S3 Standard-IA", "S3 Intelligent-Tiering", "Create EC2 monitoring app triggered by CloudWatch, change to Standard-IA/Standard", "Create EC2 monitoring app triggered by CloudWatch, change to One Zone-IA/Standard"], "answer": 1, "explain": "S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers. Monitors access patterns. No performance impact. Small monthly fee per object. Optimizes costs without operational overhead."},
    {"cat": "design-cost", "q": "Fintech company - isolate dev/test/prod using Control Tower multi-account. Need cost control for developer accounts with automatic responses to overspending. Minimal ongoing effort?", "options": ["Cost Explorer detailed reports emailed daily, dashboards for each developer to monitor", "Lambda daily in each account analyzing Cost Explorer API, invoke Config remediation if exceeded", "AWS Budgets with spending thresholds and alerts. Budgets actions apply DenyAll IAM policy when threshold crossed", "Service Catalog restricts templates. Lambda stops all resources at end of day and restarts next morning"], "answer": 2, "explain": "AWS Budgets tracks actual and forecasted spending. Alerts when thresholds exceeded. Budgets actions automatically apply restrictive IAM policy (e.g., DenyAll). Prevents launching new costly resources. Centralized, automated, low maintenance."},
    {"cat": "design-performant", "q": "Company's real-time streaming app running on AWS. Job takes 30 minutes to complete. High latency due to large incoming data. Scalable serverless solution?", "options": ["Provision EC2 in ASG", "Lambda with Step Functions", "DMS to ingest data", "Kinesis Data Streams to ingest, Fargate with ECS to process", "Kinesis Data Streams to ingest, Lambda with Step Functions to process"], "answer": 3, "explain": "Kinesis Data Streams handles high-throughput real-time data ingestion. Fargate with ECS provides serverless compute for 30-minute processing jobs. Both scale automatically. Lambda has 15-min timeout so can't handle 30-min jobs."},
    {"cat": "design-resilient", "q": "Company uses SQS for decoupling. Consuming components need additional time to process messages. Postpone delivery of new messages?", "options": ["Dead-letter queues", "Delay queues", "Visibility timeout", "FIFO queues"], "answer": 1, "explain": "Delay queues postpone delivery of new messages to queue for several seconds (0-15 min). Messages remain invisible during delay period. Default 0 sec, max 15 min. Visibility timeout is for received messages."},
    {"cat": "design-cost", "q": "Retail company uses VPC with Direct Connect. Data warehouse migrated to AWS. Analysts query warehouse from visualization tool. Query response 60MB, webpage 600KB. Lowest data transfer egress cost?", "options": ["Deploy visualization in same region as warehouse, access over internet in same region", "Deploy visualization on-premises, query warehouse over internet in same region", "Deploy visualization on-premises, query warehouse over Direct Connect in same region", "Deploy visualization in same region as warehouse, access over Direct Connect in same region"], "answer": 3, "explain": "Deploy visualization tool in same region as warehouse. Users access visualization tool over Direct Connect. Only pay for 600KB webpage DTO over Direct Connect. If visualization on-premises, pay for 60MB query response DTO."},
    {"cat": "design-cost", "q": "Data analytics team manages Python process (30 min runtime). Can withstand interruptions and restart. On-premises to AWS. Most cost-effective?", "options": ["Spot Instance with persistent request", "Lambda", "Application Load Balancer", "EMR"], "answer": 0, "explain": "Spot Instances offer up to 90% discount vs On-Demand. Persistent request reopens after interruption or stop. Process can restart after interruption. Lambda has 15-min max timeout. ALB and EMR not suitable."},
    {"cat": "design-resilient", "q": "Healthcare company - EC2 in 2 private subnets (PR1, PR2) across 2 AZs (A1, A2). Need internet for patches. Setup 2 NAT gateways highly available?", "options": ["2 NAT gateways: N1 in public subnet PU1 in AZ A1, N2 in public subnet PU2 in AZ A2", "1 NAT gateway in public subnet PU1 in any AZ", "2 NAT gateways: both in single public subnet PU1 in any AZ", "2 NAT gateways: N1 in private subnet PR1 in AZ A1, N2 in private subnet PR2 in AZ A2"], "answer": 0, "explain": "Create public NAT gateway in each AZ. EC2 in private subnet routes internet traffic through NAT in same AZ. If one AZ fails, other AZ still has internet access. Highly available configuration."},
    {"cat": "design-resilient", "q": "Media company migrating legacy VMs to AWS. Cannot containerize or re-architect. Need high availability and fault tolerance on EC2?", "options": ["Create AMI from each server, launch 2 EC2 from AMI in 2 AZs, setup NLB for traffic distribution and health monitoring", "Create AMIs, use with ASG min/max=1, place ALB in front", "Use AWS Backup to schedule hourly backups to S3 in different AZ, manual restoration on failure", "Containerize with ECS Fargate tasks in multiple AZs with ALB"], "answer": 0, "explain": "Create AMI from legacy server. Launch 2 EC2 instances from AMI in different AZs. NLB routes traffic to healthy instances with health checks. Provides HA and fault tolerance without re-architecting."},
    {"cat": "design-secure", "q": "Multiple EC2 in private subnet running image processing need access to S3 and DynamoDB. Private access to these AWS resources?", "options": ["Gateway endpoint for DynamoDB, OAI for S3, connect using private IP", "Gateway endpoint for S3, interface endpoint for DynamoDB, add as route table targets", "Separate gateway endpoints for S3 and DynamoDB, add as route table targets", "Separate interface endpoints for S3 and DynamoDB, add as route table targets"], "answer": 2, "explain": "S3 and DynamoDB support gateway endpoints. Create separate gateway endpoint for each. Add as targets in route table of custom VPC. Enables private connectivity without internet gateway. Interface endpoints not needed."},
    {"cat": "design-cost", "q": "Tech enterprise has EC2, Fargate, Lambda workloads. Purchased Compute Savings Plans. Monitor utilization and alert when coverage below threshold?", "options": ["CloudWatch dashboard to track usage, metric math to estimate coverage, trigger alarms", "Compute Optimizer for recommendations, automatic notifications for coverage drops", "Custom script queries Savings Plans API, pushes to S3, QuickSight visualize and email weekly", "AWS Budgets create daily coverage budget for Compute Savings Plans, define threshold, configure notifications"], "answer": 3, "explain": "AWS Budgets creates Savings Plans coverage budgets. Monitors coverage percentage daily. Triggers alerts via SNS/email when coverage drops below threshold. No custom scripting. Purpose-built for this use case."},
    {"cat": "design-performant", "q": "Global photography startup - static image site on S3. Users upload/download photos. Latency issues globally. Enhance global performance with minimal dev effort?", "options": ["Global Accelerator on S3 bucket for uploads and downloads", "Multiple S3 buckets in different regions replicated. CloudFront uploads/downloads from nearest", "Migrate to EC2 in multiple regions with ALB and Global Accelerator", "Deploy CloudFront with S3 origin for downloads. Enable S3 Transfer Acceleration for uploads"], "answer": 3, "explain": "CloudFront CDN serves downloads from edge locations close to users. S3 Transfer Acceleration uses edge locations for fast uploads via optimized AWS network. Both simple to enable, serverless. Improves global performance significantly."},
    {"cat": "design-resilient", "q": "Startup deploys OLTP app with unpredictable usage spikes. Needs relational queries. Which database?", "options": ["DynamoDB with Provisioned Capacity and Auto Scaling", "Aurora Serverless", "ElastiCache", "DynamoDB with On-Demand Capacity"], "answer": 1, "explain": "Aurora Serverless auto-scales based on app needs. Automatically starts up, shuts down, scales capacity. Relational database for OLTP. No managing DB instances. Simple, cost-effective for unpredictable workloads."},
    {"cat": "design-secure", "q": "Developer configured inbound traffic in Security Group and network ACL but can't connect to EC2 service. How to fix?", "options": ["NACLs stateful so allowing inbound enables connection. Security Groups stateless so allow both inbound and outbound", "Security Groups stateful so allowing inbound enables connection. NACLs stateless so allow both inbound and outbound", "NACLs rules modified from command line are blocked causing erratic behavior", "IAM Role in Security Group different from IAM Role in NACL"], "answer": 1, "explain": "Security Groups are stateful - allowing inbound auto-allows outbound response. NACLs are stateless - must explicitly allow both inbound and outbound including ephemeral ports (1024-65535) for return traffic."},
    {"cat": "design-resilient", "q": "Financial firm operates transaction processing on Aurora MySQL in us-east-2. DR region is us-west-2. RPO ≤ 5 min, RTO ≤ 15 min. Minimal overhead?", "options": ["Convert to Aurora global database with managed failover", "Aurora read replica in us-west-2 with manual promotion", "Separate Aurora cluster in us-west-2 with AWS DMS continuous replication", "Separate Aurora cluster in us-west-2 with Lambda snapshot export/import every 5 min"], "answer": 0, "explain": "Aurora global database replicates across regions with <1 second lag. RPO of 5 min easily met. Managed failover promotes secondary to primary quickly, meeting 15 min RTO. Minimal configuration and operational overhead."},
    {"cat": "design-secure", "q": "Healthcare company wants single-tenant hardware for EC2 to meet compliance. Most cost-effective way to isolate to single tenant?", "options": ["Spot Instances", "Dedicated Instances", "On-Demand Instances", "Dedicated Hosts"], "answer": 1, "explain": "Dedicated Instances run in VPC on hardware dedicated to single customer. Physically isolated at hardware level from other accounts. Dedicated Hosts are costlier and provide more control. Spot and On-Demand don't isolate hardware."},
    {"cat": "design-resilient", "q": "Multi-tier social media app on EC2 behind ALB in ASG across AZs with Aurora. Make app more resilient to periodic read request spikes?", "options": ["Use Shield", "Use Direct Connect", "Use Aurora Replica", "Use CloudFront distribution in front of ALB", "Use Global Accelerator"], "answer": [2, 3], "explain": "Aurora Replicas scale read operations. Up to 15 replicas across AZs. Automatically promote replica if writer fails. CloudFront caches content at edge locations. Reduces load on origin. Both improve resiliency to spikes."},
    {"cat": "design-cost", "q": "Tech startup - predictable backend services with steady-state workloads on EC2, Lambda, Fargate, SageMaker. Optimize long-term costs with fewest savings plans?", "options": ["Purchase Compute Savings Plan for EC2/Fargate/Lambda. Purchase SageMaker Savings Plan", "Hybrid deployment discount plan for AWS and on-premises Kubernetes", "EC2 Instance Savings Plan covers EC2 and Fargate", "Reserved Instance for each EC2, AWS Support to monitor RI utilization", "Compute Savings Plan for EC2/Fargate/Lambda. SageMaker Savings Plan for SageMaker"], "answer": [0, 4], "explain": "Compute Savings Plan applies to EC2, Fargate, and Lambda. Not tied to instance family or region. SageMaker Savings Plan for SageMaker workloads (training, inference, notebooks). Up to 64% savings. Both provide flexible, cost-efficient long-term discounts."},
    {"cat": "design-secure", "q": "Team has 200 IAM users with read access to S3. 50 users need write access. Least time, minimal changes?", "options": ["Create policy, assign manually to 50 users", "Update S3 bucket policy", "Create group, attach policy, place 50 users in group", "Create MFA user with read/write, link 50 IAM to MFA"], "answer": 2, "explain": "IAM groups simplify permissions management for multiple users. Create group, attach write policy to group, add 50 users to group. All users in group inherit permissions. Scalable and easy to manage."},
    {"cat": "design-performant", "q": "Startup evaluates optimal block storage for EC2 hosting flagship app. Very low latency required. Data doesn't need to persist after instance termination?", "options": ["Instance store volumes can be detached and attached to different instance", "If you create AMI from instance, data on instance store preserved", "You can specify instance store when you launch or restart", "Instance store is network storage", "You can't detach instance store from one instance and attach to another"], "answer": [1, 4], "explain": "Instance store provides temporary block storage on physically attached disks. Can't detach from one instance and attach to another. Data on instance store is NOT preserved in AMI. Provides high I/O performance."},
    {"cat": "design-secure", "q": "EC2 instance querying IPs for cryptocurrency mining. Unauthorized crypto activity. Which AWS service protects EC2 from this?", "options": ["GuardDuty", "Firewall Manager", "Shield Advanced", "WAF"], "answer": 0, "explain": "GuardDuty continuously monitors for malicious or unauthorized behavior. Identifies cryptocurrency mining activity. Finding: CryptoCurrency:EC2/BitcoinTool.B. Powered by threat intelligence and ML. Set up suppression rule if legitimate mining."},
    {"cat": "design-secure", "q": "Company has many VPCs in various accounts. Connect in star network with each other and on-premises via Direct Connect. What to recommend?", "options": ["Virtual private gateway", "VPC Peering", "PrivateLink", "Transit Gateway"], "answer": 3, "explain": "Transit Gateway acts as hub connecting VPCs and on-premises networks. Single connection from each VPC to Transit Gateway. Controls traffic routing. Supports Direct Connect. Scalable for many VPCs."},
    {"cat": "design-cost", "q": "Database on 2 EC2 in 2 AZs with public IPs. Replication uses public IPs. Decrease replication cost?", "options": ["Use Elastic Fabric Adapter", "Create Private Link between instances", "Use private IP for replication", "Assign EIP and use for replication"], "answer": 2, "explain": "Public IP traffic goes over internet, incurring high costs. Private IP keeps traffic within AWS private network for minimal cost. EIP is also public. PrivateLink is for different use cases. EFA for HPC."},
    {"cat": "design-cost", "q": "Social media company runs image-sharing site on S3. Some images frequently accessed, others idle. Most cost-effective storage?", "options": ["S3 Standard-IA", "S3 Intelligent-Tiering", "Create EC2 monitoring app triggered by CloudWatch, change to Standard-IA/Standard", "Create EC2 monitoring app triggered by CloudWatch, change to One Zone-IA/Standard"], "answer": 1, "explain": "S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers. Monitors access patterns. No performance impact. Small monthly fee per object. Optimizes costs without operational overhead."},
    {"cat": "design-secure", "q": "Digital media company uses Control Tower multi-account. Centralize notifications for billing, security, operations. Secure and scalable?", "options": ["Assign each account root email to designated team member. Configure alternate contacts with same email", "Change root email to departmental list, configure IAM notification settings. Don't use alternate contacts", "Configure root user with alias to centralized mailbox. Assign alternate contacts using distribution lists for billing, security, operations", "Centralized email forwarding with keyword rules. Keep current root emails"], "answer": 2, "explain": "Root email alias redirects to centralized mailbox monitored by admins. Alternate contacts with distribution lists route billing/security/operations alerts to appropriate teams. Scalable, secure, aligns with AWS best practices."},
    {"cat": "design-secure", "q": "Media company Los Angeles HQ with Direct Connect. Branch offices San Francisco and Miami use Site-to-Site VPN. Branch offices send/receive data with each other and HQ?", "options": ["VPC Endpoint", "Software VPN", "AWS VPN CloudHub", "VPC Peering connection"], "answer": 2, "explain": "VPN CloudHub enables secure communication between sites. Remote sites communicate with each other, not just VPC. Sites using Direct Connect can also be part of CloudHub. Hub-and-spoke model for primary or backup connectivity."},
    {"cat": "design-cost", "q": "Big data company archives on-premises data to POSIX compliant file storage on AWS. Data accessed ~1 week per year. Cost-optimal?", "options": ["S3 Standard-IA", "S3 Standard", "EFS Infrequent Access", "EFS Standard"], "answer": 2, "explain": "EFS IA is POSIX-compliant file storage for files not accessed daily. $0.025/GB-month. Up to 92% lower cost than EFS Standard. Enable EFS Lifecycle Management. S3 is object storage not POSIX file system."},
    {"cat": "design-resilient", "q": "E-commerce uses RDS MySQL. Analytics workload on same DB causes slowness. Cost-optimal performance improvement?", "options": ["Read-replica with half compute/storage", "Multi-AZ standby with same capacity, point analytics there", "Read-replica with same compute/storage, point analytics there", "Multi-AZ standby with half capacity, point analytics there"], "answer": 2, "explain": "Create read-replica with same capacity as primary. Route analytics queries to read replica. Reduces load on primary. Read replicas handle read-heavy workloads. Multi-AZ standby is not accessible for reads."},
    {"cat": "design-resilient", "q": "Streaming company has ASG with ALB. ALB removes unhealthy instances but ASG doesn't provision replacement. What explains this?", "options": ["Both ASG and ALB using ALB health check", "Both using EC2 health check", "ASG using EC2 health check, ALB using ALB health check", "ASG using ALB health check, ALB using EC2 health check"], "answer": 2, "explain": "ASG using EC2 health check succeeds while ALB health check fails. ALB removes instance but ASG thinks instance is healthy. ASG won't replace it. Use ALB health check for both to avoid this."},
    {"cat": "design-resilient", "q": "E-commerce Auto Scaling Group scales quickly. Production bug 2 days ago but instance terminated. Log files on instance. How to prevent this?", "options": ["Disable ASG termination when issue reported", "Lambda regularly SSH to copy logs to S3", "Install CloudWatch Logs agent on EC2 to send logs to CloudWatch", "Snapshot EC2 before termination"], "answer": 2, "explain": "CloudWatch Logs agent automatically sends log files to CloudWatch. Logs persist even after instance termination. Easy to analyze logs for troubleshooting. Least development effort and ongoing maintenance."},
    {"cat": "design-secure", "q": "Media company uploads photos to S3 in eu-west-2. Use CloudFront for custom domain with HTTPS. Support secure uploads to S3. Which actions needed?", "options": ["Request ACM certificate in us-east-1, associate with CloudFront. Enable origin access control (OAC)", "Request ACM certificate in eu-west-2", "CloudFront with S3 static website endpoint", "Custom origin request policy with all headers. Enable S3 Object Ownership with signed URL"], "answer": 0, "explain": "CloudFront requires ACM certificates from us-east-1 only. OAC grants CloudFront permission to upload to S3 securely. Restricts direct S3 access. Supports both read and write. Supersedes OAI."},
    {"cat": "design-performant", "q": "Digital media startup - users upload images through web portal to S3. Generate thumbnail for each new image. Low-cost, minimal infrastructure, automatic?", "options": ["S3 event notification triggers Lambda to create thumbnail, store in second bucket", "Fargate polls S3 every minute to detect uploads and generate thumbnails", "AWS Glue jobs on regular interval scan S3 and generate thumbnails", "S3 Access Analyzer calls Lambda when image added"], "answer": 0, "explain": "S3 event notification triggers Lambda when object created. Lambda processes image, creates thumbnail, stores in second bucket. Serverless, event-driven. Low-cost, scales automatically. Real-time processing."},
    {"cat": "design-performant", "q": "E-learning platform stores user data in DynamoDB. Model needs low-latency read/write with high availability for global users. Cost-efficient multi-region solution?", "options": ["DynamoDB global tables with provisioned capacity and auto scaling", "Separate tables in each region with Data Pipeline synchronization", "DAX in one region, scheduled Lambda for cross-region replication", "Separate tables in each region with on-demand capacity, custom DynamoDB Streams + Lambda replication"], "answer": 0, "explain": "DynamoDB global tables provide multi-region replication automatically. Low-latency read/write globally. Provisioned capacity with auto scaling optimizes cost. High availability and resiliency. No manual replication or custom logic."},
    {"cat": "design-performant", "q": "CRM app on EC2 behind ALB. Users reporting frequent sign-in requests. Root cause: unhealthy servers losing session data. Distributed cache-based session management?", "options": ["RDS for distributed cache", "ALB sticky sessions", "DynamoDB for distributed cache", "ElastiCache for distributed cache"], "answer": 3, "explain": "ElastiCache provides distributed in-memory cache for session management. Use Memcached or Redis. Sub-millisecond latency. Session stores are easily created. ALB sticky sessions don't help if server becomes unhealthy."},
    {"cat": "design-secure", "q": "Establish encrypted network connectivity between on-premises and AWS Cloud. Fastest setup time with encryption in transit?", "options": ["DataSync for encrypted connectivity", "Site-to-Site VPN for encrypted connectivity", "Direct Connect for encrypted connectivity", "Secrets Manager for encrypted connectivity"], "answer": 1, "explain": "Site-to-Site VPN establishes secure IPsec connection quickly. Encryption in transit built-in. Direct Connect takes 1 month to provision and doesn't encrypt by default. VPN is fastest for encrypted connectivity."},
    {"cat": "design-secure", "q": "Fintech company developing internal compliance framework. EC2 instances must be tagged with dataClassification (confidential or public). IAM users can't launch without tag or remove tag. Minimize overhead?", "options": ["Define tag policy in Organizations for dataClassification key with restricted values. Attach to OU", "Lambda function to identify untagged EC2, notify and optionally shutdown", "IAM permission boundaries restrict EC2 actions unless dataClassification present", "Config rules detect noncompliant EC2, trigger Systems Manager Automation to reapply tags", "SCP denies ec2:RunInstances without tag. SCP denies ec2:DeleteTags. Attach to OU"], "answer": [0, 4], "explain": "Tag policy enforces dataClassification key and restricts values. SCP denies RunInstances without required tag and denies DeleteTags. Proactive enforcement. Centrally managed at OU level. Minimal operational overhead."},
    {"cat": "design-resilient", "q": "E-commerce uses SQS to decouple components. Consuming components need extra time to process messages. Postpone delivery for a few seconds?", "options": ["Use dead-letter queues", "Use delay queues", "Use visibility timeout", "Use FIFO queues"], "answer": 1, "explain": "Delay queues postpone delivery of new messages for several seconds (0-15 minutes). Messages remain invisible to consumers during delay period. Visibility timeout is for already-received messages. Dead-letter queues are for failed messages."},
    {"cat": "design-resilient", "q": "Financial firm operates transaction processing on Aurora MySQL in us-east-2. DR region is us-west-2. RPO ≤ 5 min, RTO ≤ 15 min. Minimal overhead?", "options": ["Convert to Aurora global database with managed failover", "Aurora read replica in us-west-2 with manual promotion", "Separate Aurora cluster in us-west-2 with AWS DMS continuous replication", "Separate Aurora cluster in us-west-2 with Lambda snapshot export/import every 5 min"], "answer": 0, "explain": "Aurora global database replicates across regions with <1 second lag. RPO of 5 min easily met. Managed failover promotes secondary to primary quickly, meeting 15 min RTO. Minimal configuration and operational overhead."},
    {"cat": "design-secure", "q": "Healthcare company wants single-tenant hardware for EC2 to meet compliance. Most cost-effective way to isolate to single tenant?", "options": ["Spot Instances", "Dedicated Instances", "On-Demand Instances", "Dedicated Hosts"], "answer": 1, "explain": "Dedicated Instances run in VPC on hardware dedicated to single customer. Physically isolated at hardware level from other accounts. Dedicated Hosts are costlier and provide more control. Spot and On-Demand don't isolate hardware."},
    {"cat": "design-resilient", "q": "Multi-tier social media app on EC2 behind ALB in ASG across AZs with Aurora. Make app more resilient to periodic read request spikes?", "options": ["Use Shield", "Use Direct Connect", "Use Aurora Replica", "Use CloudFront distribution in front of ALB", "Use Global Accelerator"], "answer": [2, 3], "explain": "Aurora Replicas scale read operations. Up to 15 replicas across AZs. Automatically promote replica if writer fails. CloudFront caches content at edge locations. Reduces load on origin. Both improve resiliency to spikes."},
    {"cat": "design-cost", "q": "Tech startup - predictable backend services with steady-state workloads on EC2, Lambda, Fargate, SageMaker. Optimize long-term costs with fewest savings plans?", "options": ["Purchase Compute Savings Plan for EC2/Fargate/Lambda. Purchase SageMaker Savings Plan", "Hybrid deployment discount plan for AWS and on-premises Kubernetes", "EC2 Instance Savings Plan covers EC2 and Fargate", "Reserved Instance for each EC2, AWS Support to monitor RI utilization", "Compute Savings Plan for EC2/Fargate/Lambda. SageMaker Savings Plan for SageMaker"], "answer": [0, 4], "explain": "Compute Savings Plan applies to EC2, Fargate, and Lambda. Not tied to instance family or region. SageMaker Savings Plan for SageMaker workloads (training, inference, notebooks). Up to 64% savings. Both provide flexible, cost-efficient long-term discounts."},
    {"cat": "design-secure", "q": "Team has 200 IAM users with read access to S3. 50 users need write access. Least time, minimal changes?", "options": ["Create policy, assign manually to 50 users", "Update S3 bucket policy", "Create group, attach policy, place 50 users in group", "Create MFA user with read/write, link 50 IAM to MFA"], "answer": 2, "explain": "IAM groups simplify permissions management for multiple users. Create group, attach write policy to group, add 50 users to group. All users in group inherit permissions. Scalable and easy to manage."},
    {"cat": "design-performant", "q": "Startup evaluates optimal block storage for EC2 hosting flagship app. Very low latency required. Data doesn't need to persist after instance termination?", "options": ["Instance store volumes can be detached and attached to different instance", "If you create AMI from instance, data on instance store preserved", "You can specify instance store when you launch or restart", "Instance store is network storage", "You can't detach instance store from one instance and attach to another"], "answer": [1, 4], "explain": "Instance store provides temporary block storage on physically attached disks. Can't detach from one instance and attach to another. Data on instance store is NOT preserved in AMI. Provides high I/O performance."},
    {"cat": "design-secure", "q": "EC2 instance querying IPs for cryptocurrency mining. Unauthorized crypto activity. Which AWS service protects EC2 from this?", "options": ["GuardDuty", "Firewall Manager", "Shield Advanced", "WAF"], "answer": 0, "explain": "GuardDuty continuously monitors for malicious or unauthorized behavior. Identifies cryptocurrency mining activity. Finding: CryptoCurrency:EC2/BitcoinTool.B. Powered by threat intelligence and ML. Set up suppression rule if legitimate mining."},
    {"cat": "design-secure", "q": "Company has many VPCs in various accounts. Connect in star network with each other and on-premises via Direct Connect. What to recommend?", "options": ["Virtual private gateway", "VPC Peering", "PrivateLink", "Transit Gateway"], "answer": 3, "explain": "Transit Gateway acts as hub connecting VPCs and on-premises networks. Single connection from each VPC to Transit Gateway. Controls traffic routing. Supports Direct Connect. Scalable for many VPCs."},
    {"cat": "design-cost", "q": "Database on 2 EC2 in 2 AZs with public IPs. Replication uses public IPs. Decrease replication cost?", "options": ["Use Elastic Fabric Adapter", "Create Private Link between instances", "Use private IP for replication", "Assign EIP and use for replication"], "answer": 2, "explain": "Public IP traffic goes over internet, incurring high costs. Private IP keeps traffic within AWS private network for minimal cost. EIP is also public. PrivateLink is for different use cases. EFA for HPC."},
    {"cat": "design-cost", "q": "Social media company runs image-sharing site on S3. Some images frequently accessed, others idle. Most cost-effective storage?", "options": ["S3 Standard-IA", "S3 Intelligent-Tiering", "Create EC2 monitoring app triggered by CloudWatch, change to Standard-IA/Standard", "Create EC2 monitoring app triggered by CloudWatch, change to One Zone-IA/Standard"], "answer": 1, "explain": "S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers. Monitors access patterns. No performance impact. Small monthly fee per object. Optimizes costs without operational overhead."},
    {"cat": "design-cost", "q": "Fintech company - isolate dev/test/prod using Control Tower multi-account. Need cost control for developer accounts with automatic responses to overspending. Minimal ongoing effort?", "options": ["Cost Explorer detailed reports emailed daily, dashboards for each developer to monitor", "Lambda daily in each account analyzing Cost Explorer API, invoke Config remediation if exceeded", "AWS Budgets with spending thresholds and alerts. Budgets actions apply DenyAll IAM policy when threshold crossed", "Service Catalog restricts templates. Lambda stops all resources at end of day and restarts next morning"], "answer": 2, "explain": "AWS Budgets tracks actual and forecasted spending. Alerts when thresholds exceeded. Budgets actions automatically apply restrictive IAM policy (e.g., DenyAll). Prevents launching new costly resources. Centralized, automated, low maintenance."},
    {"cat": "design-performant", "q": "Company's real-time streaming app running on AWS. Job takes 30 minutes to complete. High latency due to large incoming data. Scalable serverless solution?", "options": ["Provision EC2 in ASG", "Lambda with Step Functions", "DMS to ingest data", "Kinesis Data Streams to ingest, Fargate with ECS to process", "Kinesis Data Streams to ingest, Lambda with Step Functions to process"], "answer": 3, "explain": "Kinesis Data Streams handles high-throughput real-time data ingestion. Fargate with ECS provides serverless compute for 30-minute processing jobs. Both scale automatically. Lambda has 15-min timeout so can't handle 30-min jobs."},
    {"cat": "design-resilient", "q": "Company uses SQS for decoupling. Consuming components need additional time to process messages. Postpone delivery of new messages?", "options": ["Dead-letter queues", "Delay queues", "Visibility timeout", "FIFO queues"], "answer": 1, "explain": "Delay queues postpone delivery of new messages to queue for several seconds (0-15 min). Messages remain invisible during delay period. Default 0 sec, max 15 min. Visibility timeout is for received messages."},
    {"cat": "design-cost", "q": "Retail company uses VPC with Direct Connect. Data warehouse migrated to AWS. Analysts query warehouse from visualization tool. Query response 60MB, webpage 600KB. Lowest data transfer egress cost?", "options": ["Deploy visualization in same region as warehouse, access over internet in same region", "Deploy visualization on-premises, query warehouse over internet in same region", "Deploy visualization on-premises, query warehouse over Direct Connect in same region", "Deploy visualization in same region as warehouse, access over Direct Connect in same region"], "answer": 3, "explain": "Deploy visualization tool in same region as warehouse. Users access visualization tool over Direct Connect. Only pay for 600KB webpage DTO over Direct Connect. If visualization on-premises, pay for 60MB query response DTO."},
]

print(f"Total Test #6 questions: {len(test6_questions)}")

# Read current HTML
with open('awsprepai-multicert.html', 'r') as f:
    html_content = f.read()

# Find the current closing bracket of saaQuestions
# We need to insert before the ];
insert_marker = '    ];'
marker_pos = html_content.find(insert_marker, html_content.find('const saaQuestions = ['))

if marker_pos == -1:
    print("ERROR: Could not find saaQuestions closing bracket")
    exit(1)

# Convert questions to JavaScript format
js_questions = []
for q in test6_questions:
    cat = q['cat'].replace('"', '\\"')
    question_text = q['q'].replace('"', '\\"')
    explain_text = q['explain'].replace('"', '\\"')

    # Handle answer field - might be int or list
    import json
    answer_str = json.dumps(q['answer']) if isinstance(q['answer'], list) else str(q['answer'])
    options = json.dumps(q['options'])

    js_q = f'      {{ cat: "{cat}", q: "{question_text}", options: {options}, answer: {answer_str}, explain: "{explain_text}" }}'
    js_questions.append(js_q)

# Create the new questions block
new_questions_block = ',\n'.join(js_questions) + ',\n'

# Insert into HTML
new_html = html_content[:marker_pos] + new_questions_block + html_content[marker_pos:]

# Write back
with open('awsprepai-multicert.html', 'w') as f:
    f.write(new_html)

print(f"Successfully added {len(test6_questions)} questions from Test #6!")
print(f"New total SAA questions should be: {482 + len(test6_questions)} = {482 + 65}")