Interviewing an AWS Cloud Engineer — What tough questions to ask (Landing Zone focus)?

Hey all,

I’m interviewing an AWS Cloud Engineer for our consultancy.

We build and manage AWS Landing Zones for enterprise, government, and banking clients — so deep expertise in multi-account setups, security, and governance is critical.

What technical or scenario-based questions would you ask to really assess someone’s hands-on knowledge with Landing Zones (e.g., Control Tower vs custom Terraform LZ, SCPs, networking, guardrails, etc.)?

Looking for questions that go beyond cert-level knowledge and test real-world thinking.

Thanks.