Cloud Engineer Case Studies & Practical Application 4

Question 1

A startup uses a single AWS account for all environments. Security audit finds developers can access production RDS from their laptops. What is the correct architectural fix?

Accepted Answer

Separate production into its own AWS account and use AWS Organizations SCPs to restrict access

Answer

Account-level isolation using AWS Organizations and SCPs provides the strongest boundary; IAM policies within the same account can be misconfigured or overridden by admins.

Question 2

A video encoding pipeline on GCP uses Cloud Run to process uploads from Cloud Storage. During peak hours, unprocessed files accumulate for 2 hours. Cloud Run scales to max instances but CPU is only 40%. What is the bottleneck?

Accepted Answer

The Cloud Storage trigger uses Pub/Sub, and the subscription's max outstanding messages limit is too low

Answer

Pub/Sub's max outstanding messages setting limits how many messages are delivered to subscribers concurrently; increasing it allows more Cloud Run instances to process files simultaneously.

Question 3

An Azure-hosted app uses Managed Identity to access Key Vault. After deploying a new version of the app, it fails to read secrets with a 403 error. The Managed Identity and Key Vault access policy are unchanged. What changed?

Accepted Answer

The new deployment uses a different App Service plan that has a new Managed Identity object ID

Answer

If the new deployment created a new App Service or slot, it may have a different system-assigned Managed Identity principal ID that is not in the Key Vault access policy.

Question 4

A company runs a Kafka cluster on AWS EC2. Producers experience high latency when a broker goes down. The cluster has 3 brokers with replication factor 3. What configuration change reduces leader election time?

Accepted Answer

Enable Kafka KRaft mode to remove ZooKeeper dependency

Answer

KRaft mode replaces ZooKeeper-based metadata management with a built-in Raft consensus protocol, significantly reducing controller failover and leader election time.

Question 5

A microservices app on GKE uses ConfigMaps for environment-specific configuration. After a ConfigMap update, pods continue using old values. What is the cause?

Accepted Answer

Environment variables from ConfigMaps are injected at pod startup and do not update in running pods

Answer

Kubernetes injects ConfigMap values as environment variables only at pod creation; to pick up changes, pods must be restarted or the ConfigMap must be mounted as a volume (which updates dynamically).

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Case Studies & Practical Application 4