Cloud infrastructure

1.A bike-share startup runs development, staging, and production in one cloud account. A developer's cleanup script deletes a production database. What structural change most directly limits this kind of mistake?

2.Why do many organizations keep audit logs in a dedicated account that workload teams cannot write to or delete from?

3.A county library wants each new project to start with logging, a budget alert, and blocked public storage already in place. What is the most reliable way to do this?

4.What does an organization-wide policy guardrail, applied above individual accounts, add beyond normal permission grants inside each account?

5.A payroll service shares one account between its payment processor team and its marketing site team. An auditor asks to narrow the scope of a compliance review. What helps most?

6.A grain co-op has one account per environment. A new engineer needs to fix a staging bug. What access is most appropriate?

7.What is the main reason to avoid daily use of an account's root or owner identity?

8.A clinic scheduler's app needs to read appointment files from one storage bucket. The current policy allows every storage action on every bucket. What is the right fix?

9.In identity and access management (IAM), if one policy allows an action and another policy explicitly denies it, what usually happens?

10.A team wants to find which permissions a service actually used over the past 90 days so they can trim its policy. What data source helps most?

11.A food bank's volunteer coordinator asks for admin rights because permission errors keep slowing her down. What is the best response?

12.A school district's reporting job fails with an access denied error after a security team added a new organization guardrail. The job's own role still allows the action. What is the most likely cause?

13.A wildlife survey team grants a contractor broad access for a three-month project. The project ended six months ago. What practice would have caught this?

14.Two services in the same account share one identity. One of them is compromised. Why does this make the incident worse?

15.A transit agency wants on-call engineers to get production write access only during an incident. What approach fits best?

16.A build server uses a static access key stored in a config file to deploy to the cloud. What is the better pattern?

17.An access key for a florist's ordering app was pushed to a public code repository an hour ago. What do you do first?

18.What is the main security advantage of a workload identity, where code running on a virtual machine or container gets credentials from the platform?

19.A continuous integration (CI) pipeline hosted outside the cloud needs to deploy without storing any cloud key. Which approach supports this?

20.Why is a role's trust policy, which says who may assume the role, as important as its permission policy?

21.A vendor needs access to a hospice's cloud account to run a monitoring tool. What is the safer setup?

22.A team still uses static keys for a legacy script and cannot remove them yet. What reduces risk most in the meantime?

23.What usually makes a subnet public in a cloud virtual network?

24.A recipe-sharing site puts its Postgres database in a public subnet with a public IP. What is the better layout?

25.Two teams created virtual networks with the same address range, 10.0.0.0/16. Now they need to connect them. What problem will they hit?

26.A team sizes a subnet as a /28 for a service that autoscales up to 40 instances. What is likely to go wrong?

27.Why do teams often spread subnets for one tier across several availability zones?

28.A city permit portal's app servers in a private subnet need to call a cloud storage API without going over the public internet. What helps?

29.A bastion host in a public subnet is used to reach private servers over secure shell (SSH). What is a common modern alternative that removes the open inbound port?

30.A pet adoption site's web servers have a security group rule allowing inbound secure shell (SSH) on port 22 from 0.0.0.0/0. What is the risk?

31.Security groups are usually stateful. What does that mean for return traffic?

32.An app tier should accept traffic only from the load balancer. What rule is most maintainable?

33.A seed bank's batch job cannot connect to its database. The database's security group allows the job's subnet on port 5432. The job uses port 5433. What is the likely cause?

34.A connection to a private service times out with no error. Another service with a similar setup refuses the connection right away. What does the timeout most often suggest?

35.A team opens all outbound traffic from its servers by default. Why might a security reviewer push back?

36.Over two years a theater ticketing system's security groups grew to hundreds of rules nobody understands. What do you do first?

37.Servers in a private subnet need to download security patches from the internet but must not accept inbound connections. What provides this?

38.A data team's bill shows a large network address translation (NAT) gateway charge. Their private jobs pull many terabytes from the provider's own object storage. What is a likely fix?

39.A partner requires a fixed source IP to allowlist a ski resort's booking service calls. The service runs on autoscaled instances in private subnets. What works?

40.A team puts a single network address translation (NAT) gateway in one availability zone for private subnets in three zones. What is the risk?

41.Why might a team restrict outbound traffic through an egress proxy or filtering firewall?

42.After moving app servers to private subnets, a weather station network finds its servers can no longer reach a third-party API. Inbound traffic through the load balancer works. What is most likely missing?

43.A load balancer keeps sending requests to an app instance whose process has hung but whose server is still up. What is the likely gap?

44.What is a main difference between a layer 4 load balancer and a layer 7 load balancer?

45.A rowing club's site loses sessions whenever the load balancer sends a user to a different instance. What is the most robust fix?

46.During a deploy, users of a museum ticket site see errors as old instances are removed. What load balancer setting most often helps?

47.A health check endpoint calls the database, a cache, and two partner APIs. One partner API slows down and every instance is marked unhealthy. What went wrong?

48.A team changes a DNS record to point to a new server, but some users still reach the old one for hours. What is the most likely reason?

49.Why is a CNAME or alias record usually better than a hard-coded IP when pointing a domain at a cloud load balancer?

50.A farmers market app uses an internal DNS zone for private service names. A new virtual network cannot resolve those names. What is likely missing?

51.What does DNS-based failover between two regions depend on to work quickly?

52.A marketing team deletes a cloud storage bucket but leaves a DNS CNAME pointing at it. Why is this a security concern?

53.What does an availability zone usually represent within a cloud region?

54.A hiking trail app runs its only app server and database in one availability zone. What is the main availability risk?

55.A team runs its database with a synchronous standby in a second availability zone. What does this mainly protect against?

56.A wedding venue booking site serves customers in one country and must keep data there. The team wants protection from a full region outage. What matters most when choosing a second region?

57.Why is running active in two regions much harder than running in two availability zones?

58.A service has three instances across three zones, sized so each runs at 80 percent CPU at peak. What happens if one zone fails at peak?

59.An app in one availability zone calls a cache in another zone on every request. Besides latency, what does this often add?

60.What does a recovery point objective (RPO) of 15 minutes mean?

61.What does a recovery time objective (RTO) of four hours mean?

62.A tax prep service takes nightly database backups. The business says it can lose at most one hour of filings. What is the gap?

63.A team has backed up its database daily for two years but has never restored one. What is the main risk?

64.Ransomware gets admin access to a dental office's cloud account and deletes the databases and their backups. What would most likely have prevented losing the backups?

65.Which disaster recovery approach usually gives the shortest recovery time but costs the most?

66.During a restore test, a nonprofit finds the database comes back but the app fails because secrets and config were not backed up. What lesson applies?

67.Database replication to a standby is in place. Why do you still need point-in-time backups?

68.A team writes a disaster recovery runbook but never practices it. During a real outage, steps fail because names and tools changed. What would have helped most?

69.A choir's music library app keeps 30 days of backups. A bug quietly corrupted data 45 days ago and was just noticed. What does this show?

70.A school photo vendor's storage bucket is found to be publicly readable. What control helps prevent this account-wide in the future?

71.What does encryption at rest with a provider-managed key mainly protect against?

72.Why might a team choose a customer-managed key instead of a provider-managed key for sensitive data?

73.An architecture firm stores project files in object storage. A user overwrites a large drawing by mistake. What feature would let them recover it?

74.A clinic needs to let patients download one lab report file for 15 minutes without making the bucket public. What fits best?

75.A log archive grows by several terabytes each month and logs are rarely read after 60 days. What is a cost-effective approach?

76.Cold archive storage tiers are cheap per gigabyte. What tradeoff should a team check before moving data there?

77.A compliance rule says audit records must not be changed or deleted for seven years, even by admins. What object storage feature fits?

78.An engineer changes a firewall rule by hand in the console. The next infrastructure as code (IaC) run reverts it. Why?

79.What is state drift in infrastructure as code?

80.Two engineers run the same infrastructure as code apply at the same time against a shared state file and corrupt it. What prevents this?

81.Why should infrastructure as code state files be treated as sensitive?

82.A team reviews infrastructure as code pull requests but sometimes misses that a change will replace a database instead of updating it. What practice helps most?

83.A movie theater chain's production database was destroyed when someone renamed it in the infrastructure code. What safeguard would have stopped this?

84.Why do teams build reusable infrastructure as code modules for common pieces like a standard network or service?

85.Someone created resources by hand for an urgent fix last month. Now the team wants them managed in infrastructure as code. What is the right approach?

86.A concert ticket site scales on CPU, but during on-sale events users wait while new instances boot for five minutes. What helps most?

87.An autoscaling group keeps adding and removing instances every few minutes, even under steady load. What is the likely cause?

88.A queue worker service processes uploaded videos. What metric is usually the best signal for scaling it?

89.A team's app stores uploaded files on each instance's local disk. Autoscaling removes an instance and files go missing. What is the fix?

90.Why set a maximum size on an autoscaling group even when you want to handle any traffic spike?

91.A podcast host's app tier scales out well during a spike, but the site still slows down. Database CPU is at 100 percent. What does this show?

92.A small team must run Postgres for a volunteer tutoring app. Nobody has deep database operations experience. What is usually the better choice?

93.What is a real tradeoff of choosing a managed service over running the same software yourself?

94.Under the shared responsibility model, what usually stays the customer's job even with a fully managed database?

95.A hobby electronics shop's managed database has a weekly maintenance window during their busiest sales hour. What do you do?

96.Finance cannot tell which product team is driving a rising cloud bill. What helps most?

97.A team's tagging policy exists on paper, but half of new resources lack an owner tag. What is the most effective fix?

98.A cost review at a lumber yard's inventory system finds many block storage volumes attached to nothing. What are these most likely?

99.A development environment runs 24 hours a day but is only used during working hours on weekdays. What is a simple saving?

100.A video platform's bill jumps after it starts serving files directly from object storage to users around the world. What is the likely cost driver?

101.When does buying a one-year reserved capacity or savings commitment make sense?

102.A team is surprised by a large bill after a load test. What control would have warned them during the test?

103.A data pipeline copies the same large dataset from one region to another every hour for processing. What is a likely cost issue?

104.A team finds an instance running at 4 percent CPU for months. What do you do first before downsizing?

105.Why do many teams report cloud cost per unit, such as cost per order or per active user, not just total spend?

106.During a traffic spike, a festival app's autoscaling group stops adding instances even though it is below its maximum. Logs show a limit exceeded error. What is the likely cause?

107.Why should a team review service quotas before a planned launch or a disaster recovery test in a new region?

108.An automation tool starts failing with HTTP 429 errors from a cloud provider's management API during a large deployment. What is happening?

109.A team relies on quotas being raised during an incident. What is the problem with this plan?