Professional Standards & Competencies Flashcards

A cloud engineer is the only person with root access to a critical production environment and is about to take two weeks of vacation. What should they do BEFORE leaving?

Answer: Document runbooks, ensure at least one other qualified engineer has access, and brief the on-call rotation

Avoiding single points of knowledge failure is a professional responsibility; no single engineer should be an indispensable dependency.

A customer requests that a cloud engineer configure their environment to log all user activity including personal communications stored in cloud storage. The engineer should:

Answer: Assess whether the request violates privacy laws or the cloud provider's AUP before proceeding

Engineers must evaluate customer requests against legal and contractual constraints before implementation, even when the customer is paying.

Which of the following BEST describes the concept of 'infrastructure as code' governance in a professional cloud engineering context?

Answer: Enforcing code review, automated policy checks, and version-controlled repositories for all infrastructure changes

IaC governance combines version control, peer review, and automated policy gates to ensure consistent, auditable infrastructure changes.

A cloud engineer working on a government contract discovers the project will miss a security compliance deadline. The MOST appropriate action is:

Answer: Report the risk immediately to the project manager and compliance team with a remediation timeline

Early escalation allows stakeholders to make informed decisions; falsifying compliance documentation is fraud and a serious ethical violation.

When designing a multi-tenant cloud architecture, a cloud engineer must PRIMARILY ensure:

Answer: Strict tenant isolation so one tenant's data and workloads cannot be accessed by another

Tenant isolation is the foundational security requirement in multi-tenant systems, protecting both data confidentiality and workload integrity.

A cloud engineer is asked to evaluate a new open-source tool for production use. Which professional criterion is MOST important to assess first?

Answer: The tool's security posture, active maintenance status, and license compatibility

Security posture and maintenance activity determine whether an open-source tool is safe and sustainable for production use.

A cloud engineer's manager instructs them to ignore a critical CVE affecting a production workload because patching will cause downtime. The engineer should:

Answer: Document the manager's instruction, assess the risk formally, and escalate to security leadership if the risk is unacceptable

Engineers have a professional duty to formally document risk acceptance decisions and escalate when they believe unmitigated risk is unacceptable.