Cloud Engineer Case Studies & Practical Application 5

Question 1

A company's GCP project is unexpectedly billed $50,000 for BigQuery queries run by a data science team. No budget alerts fired. What two controls should be implemented immediately?

Accepted Answer

Set BigQuery custom cost controls (maximum bytes billed per query) and create a GCP Budget with Pub/Sub alert actions

Answer

Maximum bytes billed per query prevents runaway scans at execution time, while Pub/Sub-triggered budget alerts can automatically restrict access or notify ops when thresholds are crossed.

Question 2

An AWS Lambda function writes processed records to DynamoDB. Under load, the function receives ProvisionedThroughputExceededException errors. The DynamoDB table uses a single partition key with high cardinality. What is the issue?

Accepted Answer

Lambda concurrency is sending too many requests to a DynamoDB hot partition due to non-uniform key access patterns

Answer

Even with high-cardinality keys, if certain key values are accessed far more frequently, those partitions become hot and exceed their individual throughput limits regardless of total table capacity.

Question 3

A company runs a critical Azure SQL Database. During a DR test, they restore a geo-redundant backup to the secondary region and find data is 2 hours old. Their RPO requirement is 15 minutes. What change is needed?

Accepted Answer

Enable Active Geo-Replication or Auto-Failover Groups, which provide near-real-time replication with RPO of ~5 seconds

Answer

Geo-redundant backups have an RPO of 1-2 hours; Active Geo-Replication continuously replicates transactions to a secondary database, achieving RPO of seconds to meet the 15-minute SLA.

Question 4

A team uses Terraform to manage GCP infrastructure. After a colleague manually modified a Cloud SQL instance's tier in the GCP Console, the next `terraform plan` shows no changes. What explains this?

Accepted Answer

The Terraform state file still reflects the old configuration; running `terraform refresh` updates state to match real infrastructure

Answer

Terraform compares its state file against the declared configuration, not live infrastructure; `terraform refresh` (or `terraform plan -refresh=true`) syncs state with actual resource attributes, revealing the drift.

Question 5

A containerized app on AWS ECS Fargate needs to access a secret stored in AWS Secrets Manager. The developer hardcodes the secret in the Docker image as an environment variable for simplicity. What is the security risk and correct approach?

Accepted Answer

Container images are often stored in ECR and inspectable; use ECS task definition secrets injection with IAM role-based access instead

Answer

Environment variables baked into Docker images are visible in image layers, ECR image metadata, and ECS task definitions; secrets injection from Secrets Manager via IAM ensures secrets are fetched at runtime and never stored in the image.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Case Studies & Practical Application 5