Scenario practice questions

A cloud engineer is troubleshooting a performance issue with a web application that uses a cloud load balancer and multiple backend instances. Users report intermittent slow responses. The engineer reviews metrics and finds that CPU utilization on backend instances stays below 50% but network throughput is near the instance limit. Which THREE actions should the engineer take to improve performance?

Trap 1: Change the load balancing algorithm to least connections.

Algorithm change does not increase network capacity.

Trap 2: Increase the number of backend instances.

More instances distribute requests but each still has same bandwidth limit; overall throughput may still be constrained by bandwidth per instance if traffic is not evenly distributed.

A
Change the load balancing algorithm to least connections.
Why wrong: Algorithm change does not increase network capacity.
B
Distribute instances across multiple availability zones.
Multi-zone deployment can improve resilience and distribute load across network paths.
C
Upgrade to an instance type with higher network bandwidth.
Higher bandwidth directly addresses network throughput limit.
D
Increase the number of backend instances.
Why wrong: More instances distribute requests but each still has same bandwidth limit; overall throughput may still be constrained by bandwidth per instance if traffic is not evenly distributed.
E
Enable connection draining on the load balancer.
Connection draining helps manage traffic during scale-in or instance failures, improving user experience.

Question 2mediummultiple choice

A company is migrating a monolithic application to microservices on a cloud platform. The current application uses a single relational database. The migration plan involves decomposing the application into several services, each with its own database (polyglot persistence). One service handles high-volume time-series data, another handles user profiles, and a third handles transactions. The architect must ensure data consistency across services for user profile updates that affect other services. Which approach should be used to maintain data consistency without tight coupling?

Trap 1: Use distributed transactions (e.g., two-phase commit) across all…

Distributed transactions create tight coupling and can become performance bottlenecks.

Trap 2: Rely on eventual consistency with asynchronous messaging

Eventual consistency may not be sufficient if immediate consistency is required for user profile updates.

Trap 3: Keep a single shared database for all services

A shared database contradicts the microservices principle of decentralized data management.

A
Use distributed transactions (e.g., two-phase commit) across all services
Why wrong: Distributed transactions create tight coupling and can become performance bottlenecks.
B
Rely on eventual consistency with asynchronous messaging
Why wrong: Eventual consistency may not be sufficient if immediate consistency is required for user profile updates.
C
Keep a single shared database for all services
Why wrong: A shared database contradicts the microservices principle of decentralized data management.
D
Implement a saga pattern using choreography or orchestration
The saga pattern coordinates local transactions across services, ensuring consistency without tight coupling.

Question 3mediummultiple choice

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

Trap 1: Implement a periodic secret scanning tool that runs every 24 hours…

Periodic scanning introduces a delay; continuous monitoring via CASB is more effective for immediate detection.

Trap 2: Disable all public repositories and require all code to be stored…

This prevents future public exposure but does not detect existing leaks or cover all scenarios.

Trap 3: Require all developers to use a password manager to store secrets…

This relies on user compliance and manual review, which is error-prone and not automated.

A
Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.
Why wrong: Periodic scanning introduces a delay; continuous monitoring via CASB is more effective for immediate detection.
B
Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.
CASB can monitor SaaS applications like GitHub for policy violations, including exposed credentials, and provide real-time alerts.
C
Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.
Why wrong: This prevents future public exposure but does not detect existing leaks or cover all scenarios.
D
Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.
Why wrong: This relies on user compliance and manual review, which is error-prone and not automated.

Question 4easymultiple choice

A cloud engineer is reviewing a Terraform configuration for deploying a web server. The instance is created successfully, but the web server does not start. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t2.micro"
  subnet_id     = "subnet-abc123"
  vpc_security_group_ids = ["sg-12345678"]
  user_data     = <<-EOF
                  #!/bin/bash
                  yum install -y httpd
                  systemctl start httpd
                  EOF
}
```

Trap 1: The subnet is in a private zone without internet access.

Lack of internet would affect yum install, but the instance might still start httpd if package is already there.

Trap 2: The AMI ID is for a Windows instance, but the script uses yum.

The AMI ID pattern 'ami-0...' is typical for Linux, but could be Windows if not. However, the script assumes Linux, so this is possible but less likely than security group.

Trap 3: The user_data script lacks execute permissions.

User data is executed as a script by cloud-init, no permissions needed.

A
The subnet is in a private zone without internet access.
Why wrong: Lack of internet would affect yum install, but the instance might still start httpd if package is already there.
B
The security group does not allow inbound HTTP traffic.
The web server may be running but unreachable due to security group blocking HTTP.
C
The AMI ID is for a Windows instance, but the script uses yum.
Why wrong: The AMI ID pattern 'ami-0...' is typical for Linux, but could be Windows if not. However, the script assumes Linux, so this is possible but less likely than security group.
D
The user_data script lacks execute permissions.
Why wrong: User data is executed as a script by cloud-init, no permissions needed.

Question 5hardmultiple choice

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

Trap 1: Automates auditing of third-party access.

Auditing is a separate concern; JIT can record but its primary benefit is reducing standing privileges.

Trap 2: Allows for easier management of user identities.

Identity management is broader; JIT is specifically about privilege timing.

Trap 3: Eliminates the need for user authentication.

JIT still requires authentication; it just limits the duration of elevated privileges.

A
Automates auditing of third-party access.
Why wrong: Auditing is a separate concern; JIT can record but its primary benefit is reducing standing privileges.
B
Allows for easier management of user identities.
Why wrong: Identity management is broader; JIT is specifically about privilege timing.
C
Reduces the attack surface by minimizing persistent privileged access.
JIT ensures that elevated permissions are granted only for specific times and tasks, so compromised credentials have limited window of opportunity.
D
Eliminates the need for user authentication.
Why wrong: JIT still requires authentication; it just limits the duration of elevated privileges.