Cloud Engineer Technology & Digital Applications 5 — Questions and Answers
Question 1: Which cloud design principle recommends distributing workloads across multiple Availability Zones to survive a datacenter-level failure?
- Vertical scaling
- Fault isolation using bulkheads
- High availability through multi-AZ deployment (Correct answer)
- Cost optimization through reserved instances
Correct answer: High availability through multi-AZ deployment
Deploying across multiple Availability Zones ensures the application remains operational even if an entire AZ goes offline.
Question 2: A cloud engineer uses Prometheus to collect metrics and wants to visualize them on dashboards. Which tool is the standard companion for this?
- Kibana
- Grafana (Correct answer)
- Datadog
- Splunk
Correct answer: Grafana
Grafana is the de-facto visualization layer for Prometheus metrics, providing rich dashboards and alerting on top of Prometheus data sources.
Question 3: What is the purpose of a cloud 'Landing Zone'?
- A CDN edge location for reduced latency
- A pre-configured, secure, multi-account cloud environment that enforces organizational standards (Correct answer)
- A disaster recovery site in a secondary region
- A dedicated bare-metal server cluster
Correct answer: A pre-configured, secure, multi-account cloud environment that enforces organizational standards
A Landing Zone is a well-architected, multi-account baseline environment with governance, security, and networking guardrails pre-configured.
Question 4: A developer accidentally commits an AWS secret key to a public GitHub repository. What is the FIRST action a cloud engineer should take?
- Delete the GitHub repository
- Immediately revoke or deactivate the exposed key in IAM (Correct answer)
- Rotate all keys in the account within 30 days
- Open a support ticket with AWS
Correct answer: Immediately revoke or deactivate the exposed key in IAM
The exposed key must be revoked immediately because bots scan public repos in seconds and the key is already compromised.
Question 5: Which service mesh feature enables automatic mTLS between microservices without changing application code?
- API Gateway authorization
- Sidecar proxy encryption (e.g., Istio/Envoy) (Correct answer)
- VPC security groups
- AWS WAF rules
Correct answer: Sidecar proxy encryption (e.g., Istio/Envoy)
Service meshes like Istio inject sidecar proxies that handle mutual TLS encryption between services transparently, without requiring code changes.
Question 6: A cloud engineer needs to run a batch job once a day at 2 AM UTC without maintaining always-on infrastructure. What is the most cost-efficient solution on AWS?
- A dedicated EC2 instance running 24/7 with a cron job
- AWS Lambda triggered by an Amazon EventBridge scheduled rule (Correct answer)
- An ECS cluster with a persistent task
- An EMR cluster with auto-scaling
Correct answer: AWS Lambda triggered by an Amazon EventBridge scheduled rule
Lambda with EventBridge (cron expression) runs serverlessly only when triggered, incurring charges only for the execution duration with no idle cost.
Question 7: In a Kubernetes cluster, what is the role of etcd?
- Container runtime for running pods
- Distributed key-value store that holds all cluster state and configuration (Correct answer)
- Ingress controller for external traffic routing
- Node-level kubelet agent
Correct answer: Distributed key-value store that holds all cluster state and configuration
etcd is the distributed key-value store that Kubernetes uses as its single source of truth for all cluster state, including pods, secrets, and configs.
Cloud Engineer Technology & Digital Applications 5
Which cloud design principle recommends distributing workloads across multiple Availability Zones to survive a datacenter-level failure?