CTO Cloud Strategy & Architecture 5 — Questions and Answers
Question 1: A CTO is tasked with reducing the blast radius of a potential cloud security breach. Which architectural control is most effective?
- Deploying a Web Application Firewall at the perimeter
- Account-level isolation with separate cloud accounts per environment and workload classification (Correct answer)
- Encrypting all data at rest with cloud-provider managed keys
- Implementing multi-factor authentication for all developers
Correct answer: Account-level isolation with separate cloud accounts per environment and workload classification
Separate cloud accounts per environment and workload create hard security boundaries that limit the blast radius of a compromise to a single account.
Question 2: Which cloud cost optimization lever typically yields the highest savings for predictable, steady-state production workloads?
- Rightsizing compute instances based on utilization data
- Purchasing Reserved Instances or Savings Plans for 1-3 year commitments (Correct answer)
- Migrating workloads to spot or preemptible instances
- Implementing auto-scaling to reduce idle capacity
Correct answer: Purchasing Reserved Instances or Savings Plans for 1-3 year commitments
Reserved Instances and Savings Plans typically offer 40-72% discounts over on-demand pricing for steady-state workloads that run continuously.
Question 3: What is the primary architectural consideration when implementing a CQRS (Command Query Responsibility Segregation) pattern in a cloud application?
- CQRS requires a single database to maintain data consistency
- Commands and queries use separate models and potentially separate data stores, introducing eventual consistency (Correct answer)
- CQRS eliminates the need for event sourcing
- CQRS is only applicable to relational databases
Correct answer: Commands and queries use separate models and potentially separate data stores, introducing eventual consistency
CQRS separates write (command) and read (query) models, often using different optimized data stores, which inherently introduces eventual consistency between them.
Question 4: A CTO is designing for a 99.99% SLA (four nines). Which deployment architecture is required?
- Single availability zone with redundant hardware
- Multi-availability zone active-active with automated failover under 52 minutes of downtime per year (Correct answer)
- Multi-region deployment with manual failover procedures
- Single region with daily backups and a 4-hour RTO
Correct answer: Multi-availability zone active-active with automated failover under 52 minutes of downtime per year
99.99% availability allows only ~52 minutes of downtime per year, requiring multi-AZ active-active deployment with automated failover to eliminate single points of failure.
Question 5: Which approach best enables a CTO to make evidence-based cloud architecture decisions about performance?
- Rely on cloud provider benchmark documentation and whitepapers
- Implement distributed tracing, metrics, and SLO-based alerting as part of the architecture from day one (Correct answer)
- Conduct architecture reviews quarterly with external consultants
- Monitor CPU and memory utilization as primary performance indicators
Correct answer: Implement distributed tracing, metrics, and SLO-based alerting as part of the architecture from day one
Distributed tracing, metrics collection, and SLO-based observability built into the architecture from the start provide the evidence base needed for data-driven performance decisions.
Question 6: A CTO must choose between cloud-native CI/CD (e.g., AWS CodePipeline) and a cloud-agnostic CI/CD platform (e.g., GitHub Actions, Jenkins). What is the key strategic tradeoff?
- Cloud-native CI/CD is always faster; cloud-agnostic is always cheaper
- Cloud-native CI/CD offers tighter integration and less operational overhead but increases vendor lock-in for the delivery pipeline (Correct answer)
- Cloud-agnostic CI/CD cannot deploy to managed cloud services
- Cloud-native CI/CD does not support container-based workloads
Correct answer: Cloud-native CI/CD offers tighter integration and less operational overhead but increases vendor lock-in for the delivery pipeline
Cloud-native CI/CD tools integrate seamlessly with the provider's IAM and services but couple your delivery pipeline to that provider, increasing switching costs.
Question 7: What is the primary purpose of a cloud architecture review board (ARB) in a large enterprise?
- To approve every code commit before it is merged to main
- To evaluate proposed architectures against standards, identify risks, and ensure alignment with enterprise strategy before significant investment (Correct answer)
- To replace agile planning ceremonies for cloud projects
- To negotiate cloud contracts with vendors on behalf of product teams
Correct answer: To evaluate proposed architectures against standards, identify risks, and ensure alignment with enterprise strategy before significant investment
An Architecture Review Board provides governance by evaluating proposed designs against standards and strategic alignment, catching risk early before significant engineering effort is committed.
CTO Cloud Strategy & Architecture 5
A CTO is tasked with reducing the blast radius of a potential cloud security breach.
Which architectural control is most effective?