CTO Cloud Strategy & Architecture 4 ā Questions and Answers
Question 1: A CTO is evaluating whether to use a public cloud, private cloud, or hybrid cloud for a defense contractor. What is the primary determinant?
- Total cost of ownership over five years
- Data classification requirements and government compliance mandates (e.g., FedRAMP, IL4/IL5) (Correct answer)
- Engineering team familiarity with cloud platforms
- Availability of SLAs from cloud providers
Correct answer: Data classification requirements and government compliance mandates (e.g., FedRAMP, IL4/IL5)
Defense contractors must comply with government data classification standards like FedRAMP or Impact Level requirements, which dictate permissible cloud environments.
Question 2: What is the purpose of a Landing Zone in an enterprise cloud adoption?
- A geographic region selected for primary cloud deployment
- A pre-configured, secure, multi-account cloud environment baseline that enforces governance from day one (Correct answer)
- A disaster recovery site in a secondary cloud region
- A staging environment for testing before production deployment
Correct answer: A pre-configured, secure, multi-account cloud environment baseline that enforces governance from day one
A Landing Zone is a pre-built, governed multi-account environment that enforces security, networking, and compliance baselines before any workloads are deployed.
Question 3: Which cloud networking architecture pattern is best suited for connecting hundreds of VPCs across multiple AWS accounts while minimizing complexity?
- VPC peering mesh between all accounts
- Transit Gateway acting as a central hub (Correct answer)
- Direct Connect with separate virtual interfaces per VPC
- VPN tunnels between each VPC pair
Correct answer: Transit Gateway acting as a central hub
AWS Transit Gateway serves as a centralized hub that simplifies connectivity, replacing the O(nĀ²) complexity of VPC peering meshes with a hub-and-spoke topology.
Question 4: A startup CTO is building a globally distributed application expecting users in 30 countries. Which database architecture best supports low-latency reads globally?
- Single-region relational database with connection pooling
- Multi-region active-active distributed database with local read replicas (Correct answer)
- Read replicas in each region with writes routed to one primary region
- CDN-cached database query results with 1-hour TTL
Correct answer: Multi-region active-active distributed database with local read replicas
Multi-region active-active distributed databases (like CockroachDB, Spanner, or DynamoDB Global Tables) provide low-latency reads and writes in each region with automatic replication.
Question 5: What is the correct definition of RTO and RPO in the context of cloud disaster recovery planning?
- RTO = maximum data loss acceptable; RPO = maximum downtime acceptable
- RTO = maximum downtime acceptable; RPO = maximum data loss acceptable (Correct answer)
- RTO = redundancy topology options; RPO = recovery point operations
- Both RTO and RPO measure the same thing: acceptable system unavailability
Correct answer: RTO = maximum downtime acceptable; RPO = maximum data loss acceptable
RTO (Recovery Time Objective) defines the maximum acceptable downtime after a disaster, while RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time.
Question 6: A CTO wants to implement a zero-trust security model in the cloud. Which principle is foundational to zero trust?
- Trust all internal network traffic by default
- Never trust, always verify ā authenticate and authorize every request regardless of network location (Correct answer)
- Perimeter firewalls are sufficient to protect cloud workloads
- Service accounts should have broad permissions to reduce engineering friction
Correct answer: Never trust, always verify ā authenticate and authorize every request regardless of network location
Zero trust assumes no implicit trust based on network location; every request must be authenticated, authorized, and continuously validated regardless of origin.
Question 7: When should a CTO recommend a serverless-first architecture over containerized microservices?
- For workloads requiring persistent long-running processes with consistent high throughput
- For event-driven, spiky, or infrequent workloads where operational overhead reduction outweighs cold-start costs (Correct answer)
- When the team requires full control over the underlying OS and runtime
- When the application requires stateful session management between invocations
Correct answer: For event-driven, spiky, or infrequent workloads where operational overhead reduction outweighs cold-start costs
Serverless architectures excel for event-driven and intermittent workloads where eliminating infrastructure management and paying only for execution time provides clear advantages.
CTO Cloud Strategy & Architecture 4
A CTO is evaluating whether to use a public cloud, private cloud, or hybrid cloud for a defense contractor.
What is the primary determinant?