Top 30 Intermediate Cloud Platforms Concepts Quiz
30 intermediate multiple-choice Cloud Platforms concept questions, the mechanics underneath the basics: how the pieces relate and where the usual mental model stops holding. They come from 30 bites in the Cloud Platforms library, the middle slice of the 167 Cloud Platforms concept questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
AWS, Azure, GCP, serverless, managed services
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
Which scenario best illustrates the primary financial advantage of adopting a cloud-based OpEx model compared to traditional CapEx?
Show the answer
Answer: c · A startup needing to quickly deploy a new service with fluctuating user demand without significant upfront hardware purchases.
Option C is correct because the OpEx model allows startups to avoid large upfront hardware purchases and enables rapid scaling for fluctuating demand, directly aligning with the financial advantages described. Option D is a tempting distractor, but the card explicitly states that pure OpEx can be more expensive for predictable, stable workloads over the long term, meaning it doesn't always guarantee overall cost reduction.
Read the full bite: CapEx vs. OpEx: The Cloud's Financial Shift
Question 2 of 30
Which cloud strategy combination best addresses predictable monthly user growth and unpredictable, short-duration traffic spikes?
Show the answer
Answer: b · Implement scalability for the monthly growth and elasticity for the celebrity-induced spikes.
Scalability is ideal for planned, long-term growth, while elasticity efficiently handles unpredictable, short-term demand fluctuations by automatically adjusting resources. Relying only on elasticity for steady growth is inefficient, as it would constantly make small adjustments instead of operating from a stable baseline.
Read the full bite: Cloud Scalability vs. Elasticity: Planned Growth vs. Real-Time Reaction
Question 3 of 30
Which principle is central to High Availability's ability to maintain continuous service during component failures?
Show the answer
Answer: a · Implementing redundant components with automatic failover mechanisms to handle detected outages.
The core of High Availability involves having redundant components and automatically rerouting traffic to a healthy standby when a primary component fails. Distractor B is incorrect because HA specifically emphasizes automatic failover, not manual intervention.
Read the full bite: High Availability: Designing Systems That Don't Go Down
Question 4 of 30
The cloud's Region/Availability Zone (AZ) model is primarily designed to address which of the following challenges?
Show the answer
Answer: b · The inherent risk of a single data center becoming a critical point of failure.
The card states that "A single data center is a massive single point of failure" and the Region/AZ model was created to allow applications to "survive the loss of an entire data center or more." This directly addresses the risk of single data center failures. While other options are general cloud benefits, they are not the primary design goal of the Region/AZ model's failure isolation.
Read the full bite: Cloud Regions and AZs: Infrastructure Built for Failure
Question 5 of 30
Under the Shared Responsibility Model, which security task is always the customer's responsibility, regardless of the cloud service model (IaaS, PaaS, or SaaS)?
Show the answer
Answer: b · Managing user access and data within the service
The card explicitly states that customers always retain responsibility for their data, accounts, and access management, which includes managing user access and data within the service. Patching the guest operating system (option A) is only the customer's responsibility in IaaS, with the provider handling it in PaaS and SaaS.
Question 6 of 30
When an application scales by adding new servers, how does a cloud load balancer ensure these new servers are utilized?
Show the answer
Answer: b · It detects the new servers via health checks and includes them in its traffic distribution.
The card states that the load balancer "automatically detects these new instances, passes its health checks, and begins routing a share of the incoming HTTP requests to them." This ensures new servers are utilized. Option C is incorrect because the load balancer manages the backend server pool internally, not by updating DNS for individual backend servers.
Read the full bite: Cloud Load Balancer: Your App's Traffic Cop
Question 7 of 30
Which of the following best describes the primary function of an Auto Scaling Group (ASG)?
Show the answer
Answer: d · To dynamically adjust the number of instances based on demand and automatically replace failed instances.
The card explicitly states ASGs automate both 'elasticity (matching capacity to demand)' and 'fault tolerance (recovering from instance failures),' which aligns with dynamically adjusting instance count and replacing failed instances. Option C describes the function of a load balancer, which works in conjunction with an ASG but is not the ASG's primary role.
Read the full bite: Auto Scaling Groups: Elasticity and Self-Healing
Question 8 of 30
When would an AWS customer most likely choose a Convertible Reserved Instance over a Standard Reserved Instance?
Show the answer
Answer: b · If they foresee potential changes in their instance family or operating system requirements.
Convertible RIs offer flexibility to change instance families or operating systems later, making them suitable when future requirements are uncertain. Standard RIs, while offering the highest discount, lack this flexibility, making option A incorrect.
Read the full bite: AWS Reserved Instances: Commit to Compute, Save Big
Question 9 of 30
Which task is an ideal use case for a user data script?
Show the answer
Answer: a · Automating the initial installation of a web server and application code on a new instance.
User data scripts are designed for "Day One" instance configuration, such as installing software and pulling application code on first boot. They are not suitable for ongoing updates, creating AMIs with baked-in configurations, or complex multi-service orchestration.
Read the full bite: User Data Scripts: Day-One Instance Configuration
Question 10 of 30
A cloud storage service advertises 99.999999999% durability but only 99.9% availability. What does this primarily indicate?
Show the answer
Answer: b · While your data is extremely unlikely to be permanently lost, it may experience periods where it cannot be accessed.
High durability (11 nines) means the data is extremely unlikely to be permanently lost or corrupted. However, 99.9% availability implies that the data might be temporarily unreachable, as availability refers to reachability, not data preservation. Option C is incorrect because 99.9% availability does not guarantee accessibility at all times.
Read the full bite: Data Durability vs. Availability: Lost vs. Unreachable
Question 11 of 30
What is the primary drawback of storing data that requires frequent, low-latency access in a cold or archive storage tier?
Show the answer
Answer: d · It will incur significant retrieval costs and access delays.
The card states that retrieving cold data unexpectedly is slow and costly, and that retrieval fees and time delays will quickly make it more expensive than keeping it in a standard tier. Cold storage is for long-term retention, not automatic deletion.
Read the full bite: Cloud Storage Tiers: Match Cost to Access Frequency
Question 12 of 30
Which statement accurately describes the storage behavior of block storage snapshots?
Show the answer
Answer: a · Subsequent snapshots only store the data blocks that have changed since the previous snapshot, referencing older data.
The card states that subsequent snapshots only store changed data blocks and reference older data from previous snapshots, making them incremental. This also means deleting an older snapshot does not necessarily free up all its space if newer snapshots still depend on its data, making option D incorrect.
Read the full bite: Block Storage Snapshots Are Incremental Backups
Question 13 of 30
A developer configures Cross-Region Replication (CRR) for an existing S3 bucket. What is a critical behavior they should be aware of regarding the replication process?
Show the answer
Answer: b · Objects already present in the source bucket before CRR activation will not be replicated.
The card explicitly states that CRR "does not replicate objects that were present before replication was configured." It only applies to new objects or updates made after CRR is enabled. Option A is incorrect because the card describes CRR as an "asynchronous" feature.
Read the full bite: Cross-Region Replication (CRR): Geographic Data Copying
Question 14 of 30
Which scenario highlights a key limitation of encryption at rest?
Show the answer
Answer: d · An authorized application, compromised by an attacker, reads sensitive data from storage.
The card explicitly states that encryption at rest "doesn't stop a compromised app with valid keys from reading" and advises "Do not rely on it to protect data from a compromised application with valid credentials." While encryption can have performance implications, the card notes that "performance overhead on modern systems is negligible."
Read the full bite: Encryption at Rest: Securing Your Data When It's Not Moving
Question 15 of 30
Which of the following best describes the primary advantage of using Managed Cloud DNS over self-hosting DNS servers?
Show the answer
Answer: c · It abstracts away the operational complexities of server management, scaling, and security.
Managed Cloud DNS's core purpose is to abstract away the operational burden of managing DNS servers, including patching, scaling, and protecting against DDoS attacks. The card explicitly states it is not a general-purpose database and lacks complex query or transactional guarantees.
Read the full bite: Managed Cloud DNS: Offload Your DNS Server Management
Question 16 of 30
For which use case would you typically deploy an AWS NAT Gateway?
Show the answer
Answer: b · To allow instances in a private subnet to initiate outbound connections to the internet for updates.
A NAT Gateway's primary purpose is to enable instances in private subnets to initiate outbound internet traffic, such as downloading updates, without allowing unsolicited inbound connections. Option A is incorrect because NAT Gateways do not permit inbound traffic from the internet. Option D is incorrect as NAT Gateways do not provide direct public IP addresses to private instances for inbound access.
Read the full bite: NAT Gateway: Your VPC's Outbound-Only Internet Door
Question 17 of 30
Which statement accurately describes a critical configuration requirement for a Network ACL (NACL) to allow a web server in its associated subnet to successfully respond to incoming HTTP requests?
Show the answer
Answer: d · Both an inbound rule allowing HTTP traffic on port 80 and an outbound rule allowing traffic on ephemeral ports (1024-65535) must be explicitly defined.
NACLs are stateless, meaning they do not remember previous connections. Therefore, to allow a web server to respond to an inbound HTTP request, explicit outbound rules for the return traffic on ephemeral ports must be configured in addition to the inbound HTTP rule. Option C describes the behavior of stateful firewalls like Security Groups, not NACLs.
Read the full bite: Network ACLs: A Stateless Firewall for Subnets
Question 18 of 30
Which statement accurately describes a fundamental limitation of VPC peering?
Show the answer
Answer: c · It does not support transitive routing, meaning communication cannot pass through an intermediate peered VPC.
The card explicitly states that VPC peering connections are not transitive, meaning communication cannot pass through an intermediate VPC. This is a critical limitation for complex network designs. The other options contradict the card's description of VPC peering's security, reliability, and cross-account/region capabilities.
Read the full bite: VPC Peering: Connect Private Networks Securely
Question 19 of 30
What is the primary benefit of configuring health checks on a load balancer in a production environment?
Show the answer
Answer: c · To automatically prevent user requests from being routed to unresponsive or crashed servers.
Health checks are designed to detect when a backend server is unresponsive or has crashed and automatically remove it from the pool of servers receiving traffic, preventing user-facing errors. While load balancers distribute traffic, the core benefit of health checks is fault tolerance by excluding unhealthy servers, not just even distribution among all servers.
Read the full bite: Load Balancer Health Checks: Don't Route to Dead Servers
Question 20 of 30
According to the provided mental model, what best describes the relationship between an "Application Object" and a "Service Principal"?
Show the answer
Answer: a · The Application Object is a global blueprint, and the Service Principal is a concrete instance of that blueprint in a specific directory.
The card explicitly states that the Application Object is the global blueprint (class), and the Service Principal is a concrete instance (object) of that application within a specific environment. Option D describes a common use-case distinction, but not the fundamental object-instance relationship between the two.
Question 21 of 30
What is the fundamental security principle behind using a Key Management Service (KMS) for cryptographic operations?
Show the answer
Answer: a · It ensures that the raw cryptographic key material never leaves its secure boundary.
The core security principle of KMS is that the cryptographic key material remains within its secure boundary, never exposed to the application. The card explicitly states, "The raw key material is never sent over the network or exposed to your application's memory." Option C is incorrect because KMS is not for general configuration secrets; a dedicated Secret Manager is recommended for those.
Read the full bite: Key Management Service (KMS): Don't Roll Your Own Crypto
Question 22 of 30
What is the primary function that distinguishes a Web Application Firewall (WAF) from a traditional network firewall?
Show the answer
Answer: d · Analyzing the application-layer content of HTTP requests for attack signatures.
A WAF's distinguishing feature is its ability to inspect the actual content of HTTP requests at the application layer for malicious patterns, unlike traditional firewalls that primarily filter based on network-level details like IP addresses and ports. Option B describes the function of a traditional firewall, which a WAF is designed to complement by providing deeper inspection.
Read the full bite: Web Application Firewall (WAF): Your App's HTTP Bodyguard
Question 23 of 30
What is the primary function of the Identity Provider (IdP) within a Single Sign-On (SSO) architecture?
Show the answer
Answer: c · To authenticate the user once and then issue a cryptographically signed assertion that Service Providers trust.
The card states the IdP verifies identity and issues an authentication token or cryptographically signed assertion that Service Providers trust. Option A is a tempting distractor, but the IdP's role is authentication and assertion, not acting as a network proxy for routing requests.
Read the full bite: Single Sign-On (SSO): One Login, Many Apps
Question 24 of 30
Which task is a cloud audit trail LEAST suited for?
Show the answer
Answer: c · Monitoring an application's CPU and memory usage over time.
The card explicitly states that an audit trail is not a replacement for real-time application performance monitoring (APM) or metrics, which covers CPU and memory usage. The other options are all primary use cases for audit trails as described in the card.
Read the full bite: Cloud Audit Trail: The 'Who Did What' Record
Question 25 of 30
What is the primary way Identity Federation enables a single login for multiple services?
Show the answer
Answer: b · It allows services to delegate user authentication to a trusted central provider.
Identity federation works by allowing Service Providers (applications) to delegate the task of authenticating a user to a trusted Identity Provider. The IdP verifies the user and sends a signed assertion back to the SP, which then grants access. Option A describes user directory synchronization, which federation aims to avoid by not replicating credentials to each service.
Read the full bite: Identity Federation: One Login for Many Services
Question 26 of 30
Which type of attack is standard DDoS mitigation least effective at preventing on its own?
Show the answer
Answer: a · Credential stuffing attacks
Standard DDoS mitigation is designed to protect against network (L3) and transport (L4) layer attacks like SYN or UDP floods that aim to exhaust resources. It is not effective against application-layer (L7) attacks such as credential stuffing, which require a Web Application Firewall (WAF) for protection.
Read the full bite: DDoS Mitigation: Surviving Traffic Floods
Question 27 of 30
When considering Multi-AZ for a critical database, which statement is true about its read scaling capabilities?
Show the answer
Answer: d · Only Multi-AZ DB clusters can distribute read traffic across multiple instances.
The card specifies that 'Multi-AZ DB cluster' deployments include reader instances that can serve read traffic, enabling read scaling. In contrast, 'Multi-AZ DB instance' deployments have an idle standby that does not serve reads, making option C incorrect.
Read the full bite: Database Multi-AZ: High Availability vs. Read Scaling
Question 28 of 30
What is the primary operational advantage of using a managed key-value database for high-traffic applications?
Show the answer
Answer: c · It automatically handles server provisioning, scaling, and replication, reducing operational overhead.
The primary advantage is offloading server management and scaling to the cloud provider, allowing developers to focus on application logic for simple, high-volume lookups. Options A, C, and D describe capabilities that managed key-value databases are explicitly stated as not being suitable for.
Read the full bite: Managed Key-Value Databases: Scaling Without Server Chores
Question 29 of 30
Which of the following best describes the primary benefit of using a managed document database for a new cloud application?
Show the answer
Answer: d · It allows development teams to focus on application features by offloading database operational tasks.
Managed document databases primarily aim to abstract away the operational complexity of database management, allowing development teams to prioritize building application features. While convenient, they do not guarantee lower costs, offer less control over infrastructure than self-hosting, and still require developers to understand data modeling and query optimization.
Read the full bite: Managed Document Databases: Your Data, Their Ops
Question 30 of 30
What is the primary reason to implement a managed in-memory data store in an application architecture?
Show the answer
Answer: c · To accelerate data retrieval for frequently accessed information by leveraging RAM-based storage.
The card highlights that in-memory stores exist to provide a "fast, intermediate data layer" and "microsecond latency" for frequently accessed data by storing it in RAM. Option A describes features of a traditional database, which the card explicitly advises against using an in-memory store for, as it's not designed for strong transactional guarantees or permanent persistence.
Read the full bite: Managed In-Memory Data Store: Speed Without the Sysadmin
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.