Cloud Engineer Case Studies & Practical Application 5 — Questions and Answers
Question 1: A company's GCP project is unexpectedly billed $50,000 for BigQuery queries run by a data science team. No budget alerts fired. What two controls should be implemented immediately?
- Set BigQuery custom cost controls (maximum bytes billed per query) and create a GCP Budget with Pub/Sub alert actions (Correct answer)
- Revoke all data scientist IAM roles until the investigation is complete
- Move BigQuery datasets to a different project with lower pricing
- Enable BigQuery column-level security to restrict expensive queries
Correct answer: Set BigQuery custom cost controls (maximum bytes billed per query) and create a GCP Budget with Pub/Sub alert actions
Maximum bytes billed per query prevents runaway scans at execution time, while Pub/Sub-triggered budget alerts can automatically restrict access or notify ops when thresholds are crossed.
Question 2: An AWS Lambda function writes processed records to DynamoDB. Under load, the function receives ProvisionedThroughputExceededException errors. The DynamoDB table uses a single partition key with high cardinality. What is the issue?
- Lambda concurrency is sending too many requests to a DynamoDB hot partition due to non-uniform key access patterns (Correct answer)
- DynamoDB provisioned capacity is set too low for the total RCU/WCU needed
- Lambda retry behavior is amplifying write volume beyond capacity
- The partition key data type should be changed from String to Number
Correct answer: Lambda concurrency is sending too many requests to a DynamoDB hot partition due to non-uniform key access patterns
Even with high-cardinality keys, if certain key values are accessed far more frequently, those partitions become hot and exceed their individual throughput limits regardless of total table capacity.
Question 3: A company runs a critical Azure SQL Database. During a DR test, they restore a geo-redundant backup to the secondary region and find data is 2 hours old. Their RPO requirement is 15 minutes. What change is needed?
- Enable Active Geo-Replication or Auto-Failover Groups, which provide near-real-time replication with RPO of ~5 seconds (Correct answer)
- Increase backup frequency from daily to hourly
- Switch to Azure SQL Hyperscale tier for faster backups
- Enable zone-redundant backups in the primary region
Correct answer: Enable Active Geo-Replication or Auto-Failover Groups, which provide near-real-time replication with RPO of ~5 seconds
Geo-redundant backups have an RPO of 1-2 hours; Active Geo-Replication continuously replicates transactions to a secondary database, achieving RPO of seconds to meet the 15-minute SLA.
Question 4: A team uses Terraform to manage GCP infrastructure. After a colleague manually modified a Cloud SQL instance's tier in the GCP Console, the next `terraform plan` shows no changes. What explains this?
- The Terraform state file still reflects the old configuration; running `terraform refresh` updates state to match real infrastructure (Correct answer)
- Terraform ignores changes made outside its management
- The Terraform Google provider caches resource state for 24 hours
- The Cloud SQL resource was imported with a wrong resource ID
Correct answer: The Terraform state file still reflects the old configuration; running `terraform refresh` updates state to match real infrastructure
Terraform compares its state file against the declared configuration, not live infrastructure; `terraform refresh` (or `terraform plan -refresh=true`) syncs state with actual resource attributes, revealing the drift.
Question 5: A containerized app on AWS ECS Fargate needs to access a secret stored in AWS Secrets Manager. The developer hardcodes the secret in the Docker image as an environment variable for simplicity. What is the security risk and correct approach?
- Container images are often stored in ECR and inspectable; use ECS task definition secrets injection with IAM role-based access instead (Correct answer)
- Docker images encrypt environment variables by default, so this is acceptable
- The risk is only relevant if the ECR repository is public
- Use AWS Parameter Store instead because it encrypts values at rest automatically
Correct answer: Container images are often stored in ECR and inspectable; use ECS task definition secrets injection with IAM role-based access instead
Environment variables baked into Docker images are visible in image layers, ECR image metadata, and ECS task definitions; secrets injection from Secrets Manager via IAM ensures secrets are fetched at runtime and never stored in the image.
Question 6: A startup's MongoDB Atlas cluster on GCP starts receiving read timeouts during business hours. Atlas charts show the primary node's opcounters are normal but query executor scanned 10M documents per query. What should the engineer do?
- Identify the queries using Atlas Performance Advisor and create compound indexes on the high-cardinality filter fields (Correct answer)
- Increase the Atlas cluster tier to M50 for more RAM
- Enable MongoDB Atlas Auto-Scaling
- Add read replicas to distribute the query load
Correct answer: Identify the queries using Atlas Performance Advisor and create compound indexes on the high-cardinality filter fields
Scanning 10M documents per query is a collection scan; the correct fix is indexing the fields used in query filters, which reduces the scanned document count from millions to the result set size.
Question 7: A company migrates a stateful legacy app to Azure that stores session data in local files. After deploying to Azure App Service with 3 instances, users are randomly logged out. What is the root cause?
- Azure App Service load balances across instances, and session files on one instance are not available to the others (Correct answer)
- Azure App Service has a 20-minute session timeout by default
- The app's authentication middleware is incompatible with Linux-based App Service plans
- Azure App Service deletes local files during deployment slots swaps
Correct answer: Azure App Service load balances across instances, and session files on one instance are not available to the others
Local file-based sessions are instance-local; when a user's subsequent request hits a different instance, that instance has no session file, appearing as a logout — the fix is centralized session storage like Azure Redis Cache.
Cloud Engineer Case Studies & Practical Application 5
A company's GCP project is unexpectedly billed $50,000 for BigQuery queries run by a data science team.
No budget alerts fired.
What two controls should be implemented immediately?