Cloud Engineer Case Studies & Practical Application 4 — Questions and Answers
Question 1: A startup uses a single AWS account for all environments. Security audit finds developers can access production RDS from their laptops. What is the correct architectural fix?
- Separate production into its own AWS account and use AWS Organizations SCPs to restrict access (Correct answer)
- Add an IAM deny policy on the production RDS resource
- Enable RDS encryption at rest
- Place the RDS instance in a private subnet
Correct answer: Separate production into its own AWS account and use AWS Organizations SCPs to restrict access
Account-level isolation using AWS Organizations and SCPs provides the strongest boundary; IAM policies within the same account can be misconfigured or overridden by admins.
Question 2: A video encoding pipeline on GCP uses Cloud Run to process uploads from Cloud Storage. During peak hours, unprocessed files accumulate for 2 hours. Cloud Run scales to max instances but CPU is only 40%. What is the bottleneck?
- The Cloud Storage trigger uses Pub/Sub, and the subscription's max outstanding messages limit is too low (Correct answer)
- Cloud Run max instances limit is reached
- The video codec library is single-threaded
- Cloud Storage bucket is in a different region than Cloud Run
Correct answer: The Cloud Storage trigger uses Pub/Sub, and the subscription's max outstanding messages limit is too low
Pub/Sub's max outstanding messages setting limits how many messages are delivered to subscribers concurrently; increasing it allows more Cloud Run instances to process files simultaneously.
Question 3: An Azure-hosted app uses Managed Identity to access Key Vault. After deploying a new version of the app, it fails to read secrets with a 403 error. The Managed Identity and Key Vault access policy are unchanged. What changed?
- The new deployment uses a different App Service plan that has a new Managed Identity object ID (Correct answer)
- Key Vault firewall was enabled blocking the app's IP
- The secret version was rotated and the app references a specific version
- Azure AD token cache expired
Correct answer: The new deployment uses a different App Service plan that has a new Managed Identity object ID
If the new deployment created a new App Service or slot, it may have a different system-assigned Managed Identity principal ID that is not in the Key Vault access policy.
Question 4: A company runs a Kafka cluster on AWS EC2. Producers experience high latency when a broker goes down. The cluster has 3 brokers with replication factor 3. What configuration change reduces leader election time?
- Reduce the unclean.leader.election.enable timeout and tune replica.lag.time.max.ms
- Increase the number of brokers to 5
- Enable Kafka KRaft mode to remove ZooKeeper dependency (Correct answer)
- Increase producer batch.size and linger.ms
Correct answer: Enable Kafka KRaft mode to remove ZooKeeper dependency
KRaft mode replaces ZooKeeper-based metadata management with a built-in Raft consensus protocol, significantly reducing controller failover and leader election time.
Question 5: A microservices app on GKE uses ConfigMaps for environment-specific configuration. After a ConfigMap update, pods continue using old values. What is the cause?
- Environment variables from ConfigMaps are injected at pod startup and do not update in running pods (Correct answer)
- The ConfigMap is in a different namespace than the pods
- GKE caches ConfigMap values for 10 minutes
- The ConfigMap requires a rolling restart to take effect automatically
Correct answer: Environment variables from ConfigMaps are injected at pod startup and do not update in running pods
Kubernetes injects ConfigMap values as environment variables only at pod creation; to pick up changes, pods must be restarted or the ConfigMap must be mounted as a volume (which updates dynamically).
Question 6: A global company uses AWS CloudFront with an ALB origin. European users report GDPR-sensitive data appearing in US CloudFront logs. What is the correct control to restrict where logs are stored?
- Configure CloudFront to deliver access logs to an S3 bucket located in an EU region and restrict replication (Correct answer)
- Disable CloudFront logging for the distribution
- Use AWS Shield Advanced to filter log data by geography
- Set a Cache-Control: no-store header on all responses
Correct answer: Configure CloudFront to deliver access logs to an S3 bucket located in an EU region and restrict replication
CloudFront access logs can be delivered to any S3 bucket you specify; choosing an EU-region bucket with no cross-region replication keeps log data within the required jurisdiction.
Question 7: A team deploys a new Azure Function with a consumption plan. The function processes images from Blob Storage. Large images (>10MB) cause timeout errors despite a 5-minute function timeout setting. What is the actual constraint?
- Azure Functions consumption plan has a default 230-second HTTP request timeout enforced by Azure Front Door/Load Balancer (Correct answer)
- The function's memory is limited to 1.5GB and large images exceed this
- Blob Storage throughput is throttled to 60MB/s on consumption plans
- The function runtime enforces a 100MB payload size limit
Correct answer: Azure Functions consumption plan has a default 230-second HTTP request timeout enforced by Azure Front Door/Load Balancer
The Azure infrastructure load balancer enforces a 230-second idle timeout for HTTP-triggered functions, which can preempt the function's own timeout setting for long-running operations.
Cloud Engineer Case Studies & Practical Application 4
A startup uses a single AWS account for all environments.
Security audit finds developers can access production RDS from their laptops.
What is the correct architectural fix?