Cloud Engineer Professional Standards & Competencies 4 — Questions and Answers
Question 1: A cloud engineer is the only person with root access to a critical production environment and is about to take two weeks of vacation. What should they do BEFORE leaving?
- Leave credentials in a shared Slack message for the team
- Document runbooks, ensure at least one other qualified engineer has access, and brief the on-call rotation (Correct answer)
- Cancel the vacation to maintain system availability
- Configure auto-scaling to handle issues automatically
Correct answer: Document runbooks, ensure at least one other qualified engineer has access, and brief the on-call rotation
Avoiding single points of knowledge failure is a professional responsibility; no single engineer should be an indispensable dependency.
Question 2: A customer requests that a cloud engineer configure their environment to log all user activity including personal communications stored in cloud storage. The engineer should:
- Implement logging immediately since the customer pays for the service
- Assess whether the request violates privacy laws or the cloud provider's AUP before proceeding (Correct answer)
- Implement logging but anonymize data first without telling the customer
- Refuse all logging requests to protect end users
Correct answer: Assess whether the request violates privacy laws or the cloud provider's AUP before proceeding
Engineers must evaluate customer requests against legal and contractual constraints before implementation, even when the customer is paying.
Question 3: Which of the following BEST describes the concept of 'infrastructure as code' governance in a professional cloud engineering context?
- Storing Terraform state files locally on each engineer's laptop
- Enforcing code review, automated policy checks, and version-controlled repositories for all infrastructure changes (Correct answer)
- Allowing only senior engineers to write infrastructure code without review
- Using cloud provider consoles for rapid prototyping in production
Correct answer: Enforcing code review, automated policy checks, and version-controlled repositories for all infrastructure changes
IaC governance combines version control, peer review, and automated policy gates to ensure consistent, auditable infrastructure changes.
Question 4: A cloud engineer working on a government contract discovers the project will miss a security compliance deadline. The MOST appropriate action is:
- Forge the compliance documentation to avoid contract penalties
- Report the risk immediately to the project manager and compliance team with a remediation timeline (Correct answer)
- Quietly extend the project scope without notifying stakeholders
- Reduce the security controls temporarily and restore them after the audit
Correct answer: Report the risk immediately to the project manager and compliance team with a remediation timeline
Early escalation allows stakeholders to make informed decisions; falsifying compliance documentation is fraud and a serious ethical violation.
Question 5: When designing a multi-tenant cloud architecture, a cloud engineer must PRIMARILY ensure:
- All tenants share the same encryption keys for operational simplicity
- Strict tenant isolation so one tenant's data and workloads cannot be accessed by another (Correct answer)
- Tenants are billed on a flat-rate model regardless of resource usage
- All tenants use identical virtual machine sizes for predictable performance
Correct answer: Strict tenant isolation so one tenant's data and workloads cannot be accessed by another
Tenant isolation is the foundational security requirement in multi-tenant systems, protecting both data confidentiality and workload integrity.
Question 6: A cloud engineer is asked to evaluate a new open-source tool for production use. Which professional criterion is MOST important to assess first?
- The number of GitHub stars the project has
- The tool's security posture, active maintenance status, and license compatibility (Correct answer)
- Whether the tool is mentioned in a recent industry blog post
- The tool's feature count compared to commercial alternatives
Correct answer: The tool's security posture, active maintenance status, and license compatibility
Security posture and maintenance activity determine whether an open-source tool is safe and sustainable for production use.
Question 7: A cloud engineer's manager instructs them to ignore a critical CVE affecting a production workload because patching will cause downtime. The engineer should:
- Ignore the CVE as instructed since management bears responsibility
- Document the manager's instruction, assess the risk formally, and escalate to security leadership if the risk is unacceptable (Correct answer)
- Patch the system without telling the manager to avoid confrontation
- Submit the CVE to a bug bounty program instead of patching
Correct answer: Document the manager's instruction, assess the risk formally, and escalate to security leadership if the risk is unacceptable
Engineers have a professional duty to formally document risk acceptance decisions and escalate when they believe unmitigated risk is unacceptable.
Cloud Engineer Professional Standards & Competencies 4
A cloud engineer is the only person with root access to a critical production environment and is about to take two weeks of vacation.
What should they do BEFORE leaving?