Top 30 Advanced DevOps & Cloud Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   What is the primary reason a service provider's internal Service Level Objective (SLO) is typically set higher than its external Service Level Agreement (SLA)?

   • aTo provide a safety margin for the engineering team before contractual penalties are triggered.
   • bBecause SLOs are aspirational targets, whereas SLAs represent the absolute maximum achievable performance.
   • cTo allow for flexibility in defining service quality metrics based on customer-specific requirements.
   • dTo ensure customers receive a service quality that consistently exceeds their expectations.
   Show the answer

   Answer: a · To provide a safety margin for the engineering team before contractual penalties are triggered.

   The card explicitly states that "The buffer between the SLO and SLA gives engineering a margin for error before a failure costs the company money." This means the higher SLO acts as an internal target that, if met, ensures the external, contractually binding SLA is also met, thus avoiding financial penalties. Option D describes a potential positive outcome, but not the primary strategic reason for the buffer from the provider's perspective.

   Read the full bite: Service Level Agreement (SLA): The Contract Behind Uptime

2. Question 2 of 30

   What is the primary reason Union File Systems, like Docker's OverlayFS, can exhibit performance overhead for write-intensive applications?

   • aEach modification to an existing file from a lower layer triggers a copy-on-write operation.
   • bAll write operations are first buffered in memory before being committed to disk, causing delays.
   • cThey require frequent re-merging of all layers for every write operation.
   • dThe system must synchronize changes across all containers sharing the same base image.
   Show the answer

   Answer: a · Each modification to an existing file from a lower layer triggers a copy-on-write operation.

   The card states that "The copy-on-write mechanism adds performance overhead for every initial write to a file that exists in a lower layer." This means files from read-only layers must first be copied to the writable layer before they can be modified, which is an extra I/O operation. Distractor A is incorrect because lower layers are read-only and not re-merged on write; changes are isolated to the top writable layer.

   Read the full bite: Union File Systems: Docker's Layered Magic

3. Question 3 of 30

   Which is the primary advantage of Pipeline as Code over configuring CI/CD processes via a graphical user interface?

   • aIt enables version control, peer review, and auditability of the build and deployment logic.
   • bIt significantly reduces the execution time of CI/CD pipelines for large projects.
   • cIt allows for easier integration with various third-party security scanning tools.
   • dIt eliminates the need for any scripting or coding within the CI/CD pipeline.
   Show the answer

   Answer: a · It enables version control, peer review, and auditability of the build and deployment logic.

   The core benefit of Pipeline as Code is treating the pipeline definition as a version-controlled file, which allows for reviewable changes and a complete audit history. Option D is incorrect because Pipeline as Code explicitly involves defining the pipeline through code, such as a Jenkinsfile.

   Read the full bite: Pipeline as Code: Versioning Your Build Process

4. Question 4 of 30

   The OCI Runtime Spec primarily standardizes container execution by defining:

   • aHigh-level APIs for container orchestration systems like Kubernetes.
   • bA universal container image format for distribution.
   • cA set of user-facing commands for managing container lifecycles directly.
   • dThe structure of a filesystem bundle and a config.json for runtime instructions.
   Show the answer

   Answer: d · The structure of a filesystem bundle and a config.json for runtime instructions.

   The OCI Runtime Spec defines the 'filesystem bundle' (a directory containing the root filesystem and a config.json) and the config.json file itself, which specifies how a low-level runtime should execute the container. Option B describes the OCI Image Spec, while options C and D refer to higher-level abstractions or user-facing tools, which the Runtime Spec is explicitly not.

   Read the full bite: OCI Runtime Spec: The 'How to Run' Standard for Containers

5. Question 5 of 30

   According to the 'cattle, not pets' mental model for immutable infrastructure, which action is characteristic?

   • aBuilding a new server image with all necessary updates and replacing existing instances.
   • bApplying critical security updates by directly accessing live production servers.
   • cManually diagnosing and repairing issues on a specific server to restore its functionality.
   • dUsing a configuration management system to update software on running instances.
   Show the answer

   Answer: a · Building a new server image with all necessary updates and replacing existing instances.

   The 'cattle, not pets' model dictates that servers are replaced, not modified. This means building a new image with updates and deploying new instances from it, then decommissioning the old ones. Modifying running instances, even with configuration management, is characteristic of mutable infrastructure.

   Read the full bite: Immutable Infrastructure: Treat Servers Like Cattle, Not Pets

6. Question 6 of 30

   Which scenario best illustrates the primary benefit of a container runtime shim?

   • aMultiple containers share the same shim process to reduce system resource consumption.
   • bThe container's filesystem and configuration are prepared by the shim before execution.
   • cA container daemon crashes, but all running containers continue to operate unaffected.
   • dA developer can run a container directly using runc without involving a higher-level daemon.
   Show the answer

   Answer: c · A container daemon crashes, but all running containers continue to operate unaffected.

   The primary benefit of a runtime shim is to decouple the container daemon from the container's lifecycle, allowing the daemon to restart or crash without terminating running containers. Option B is incorrect because the daemon (e.g., containerd) prepares the container's filesystem and configuration, not the shim.

   Read the full bite: Container Runtime Shim: Decoupling the Container Lifecycle

7. Question 7 of 30

   To achieve the highest leverage and scale SRE's impact across numerous product teams, which engagement model is most effective?

   • aSRE Platform, which provides validated, reliable infrastructure for product teams to build upon.
   • bPRR-Driven Onboarding, as it ensures services meet strict reliability standards before SRE involvement.
   • cReactive Fire-fighting, as it allows SREs to address critical issues across all services as they arise.
   • dEarly Engagement, by embedding SREs in development teams to proactively design for reliability.
   Show the answer

   Answer: a · SRE Platform, which provides validated, reliable infrastructure for product teams to build upon.

   The SRE Platform model is described as 'the most scalable model' where SREs build reliable infrastructure for product teams to use, allowing them to inherit reliability by default. While Early Engagement is proactive, it still involves direct SRE consultation per team, which offers less leverage and scalability than a shared platform.

   Read the full bite: SRE Engagement Models: From Gatekeeper to Platform Builder

8. Question 8 of 30

   Which of the following is the primary security benefit of adopting a pull-based GitOps deployment model?

   • aIt prevents the exposure of production cluster credentials to external CI/CD pipelines or systems.
   • bIt eliminates the need for any external CI/CD system to interact with the production cluster.
   • cIt allows for easier rollback of changes by simply reverting a commit in the Git repository.
   • dIt ensures that all infrastructure changes are thoroughly reviewed via pull requests before deployment.
   Show the answer

   Answer: a · It prevents the exposure of production cluster credentials to external CI/CD pipelines or systems.

   The card states that the pull-based model is more secure as it "avoids exposing cluster credentials externally," contrasting it with the push-based model that "requires giving your CI system powerful, high-risk credentials." Option D describes a general benefit of using Git for configuration, not a specific security advantage of the pull-based model.

   Read the full bite: GitOps: Your Git Repo is the Single Source of Truth

9. Question 9 of 30

   What is the immediate consequence when a process, protected by an active seccomp profile, attempts to execute a forbidden system call?

   • aThe system call is re-routed to a secure, isolated sandbox for execution.
   • bThe system call is logged as a security event and allowed to proceed.
   • cThe process's user ID is automatically changed to a less privileged one.
   • dThe kernel immediately terminates the offending process.
   Show the answer

   Answer: d · The kernel immediately terminates the offending process.

   The card states that any attempt by a process to use a syscall not on the allowlist causes the kernel to terminate the process. Seccomp is an enforcement mechanism, not merely an audit tool that logs events.

   Read the full bite: seccomp: A Kernel-Level Allowlist for Syscalls

10. Question 10 of 30

    Which operation is LEAST suited for an idempotent design in an automation script?

    • aRecording each attempt of a user login into an audit trail.
    • bProvisioning a cloud resource only if it doesn't already exist.
    • cUpdating a database schema to a desired state.
    • dVerifying a specific software package is installed on a server.
    Show the answer

    Answer: a · Recording each attempt of a user login into an audit trail.

    The card states that "appending a log entry" is an example of an operation where idempotency is the "wrong goal" because you want "each execution to have a distinct effect." The other options describe tasks (package installation, resource provisioning, schema migration) that are explicitly mentioned as scenarios where idempotency is vital for reliable, repeatable automation.

    Read the full bite: Idempotency: Safe to Retry Automation

11. Question 11 of 30

    Which strategic objective is the most compelling reason for an organization to adopt a multi-cloud strategy, despite its inherent operational complexities?

    • aTo gain negotiating power with providers and enhance resilience against outages or service deprecation.
    • bTo ensure all applications are deployed using the exact same technology stack and deployment pipelines.
    • cTo simplify IT operations by leveraging a single, unified management plane across all providers.
    • dTo significantly reduce overall cloud infrastructure costs through provider competition.
    Show the answer

    Answer: a · To gain negotiating power with providers and enhance resilience against outages or service deprecation.

    The card states multi-cloud's purpose is to 'mitigate these risks by distributing workloads... providing leverage and resilience,' and lists 'avoid vendor lock-in' and 'increase resilience' as key reasons. While cost savings can be a factor, the card warns that 'the added engineering complexity might erase any gains from better pricing,' making it less compelling than resilience and vendor lock-in avoidance.

    Read the full bite: Multi-cloud: Spreading Bets Across Cloud Providers

12. Question 12 of 30

    Which application characteristic would make a FaaS solution generally less cost-effective or suitable compared to traditional server-based hosting?

    • aThe application processes infrequent, event-driven tasks.
    • bThe application is a long-running, stateful service with consistent, high throughput.
    • cThe application requires automatic scaling from zero to handle spiky traffic.
    • dThe application needs to integrate with other cloud services via "glue code".
    Show the answer

    Answer: b · The application is a long-running, stateful service with consistent, high throughput.

    The card explicitly states to "Avoid FaaS for long-running, stateful applications or tasks with constant, high-throughput workloads" because the pay-per-invocation model can become more expensive than a dedicated server for sustained traffic. The other options describe scenarios where FaaS is highly suitable due to its event-driven nature and automatic scaling capabilities.

    Read the full bite: FaaS: Run Code, Not Servers

13. Question 13 of 30

    When designing metrics for a time-series monitoring system, what is the most critical concern associated with adding a label that has a very large number of unique values (high cardinality)?

    • aIt prevents the system from accurately calculating average values for the metric.
    • bIt forces the monitoring system to store all metric data in a distributed file system instead of local storage.
    • cIt causes the monitoring system's in-memory index to bloat, leading to increased resource consumption and slower queries.
    • dIt automatically triggers a data sampling mechanism, reducing the granularity of collected data.
    Show the answer

    Answer: c · It causes the monitoring system's in-memory index to bloat, leading to increased resource consumption and slower queries.

    The card explicitly states that high cardinality "bloats this index, consuming RAM and slowing down queries." The canonical example further illustrates how memory usage skyrockets and queries time out, making the system unusable. High cardinality affects performance and resource usage, not the mathematical accuracy of aggregations.

    Read the full bite: Cardinality: The Hidden Cost of Time-Series Metrics

14. Question 14 of 30

    In a high-traffic distributed system, which sampling strategy is most effective for ensuring that traces containing critical errors or high latency are reliably captured, despite increased infrastructure overhead?

    • aTail-based sampling, as it analyzes the complete trace before deciding to keep it.
    • bHead-based sampling, because it makes decisions early, reducing processing load.
    • cImplementing a fixed-rate sampling approach at the service entry point.
    • dDisabling sampling entirely, to guarantee 100% visibility of all events.
    Show the answer

    Answer: a · Tail-based sampling, as it analyzes the complete trace before deciding to keep it.

    Tail-based sampling evaluates the entire trace, including its outcome (errors, latency), before deciding to keep it, thus guaranteeing capture of interesting failures. Head-based sampling decides upfront and might discard traces that later become critical, making it unsuitable for reliably capturing all errors in high-traffic systems.

    Read the full bite: Sampling: Tracing Everything Without Storing Everything

15. Question 15 of 30

    What problem do Docker multi-stage builds primarily solve for application deployment?

    • aThe performance overhead of running applications within a containerized environment.
    • bThe excessive size of Docker images due to included build-time dependencies.
    • cThe difficulty of integrating continuous integration/continuous deployment pipelines.
    • dThe complexity of managing multiple Dockerfiles for different environments.
    Show the answer

    Answer: b · The excessive size of Docker images due to included build-time dependencies.

    The card clearly states that multi-stage builds exist because "creating small Docker images was clumsy" and they "keeps images small by excluding build-time dependencies," dramatically reducing the final image size. While consolidating Dockerfile logic (D) is a side benefit, the primary problem addressed is image bloat.

    Read the full bite: Docker Multi-stage Builds: Slimmer, Faster Images

16. Question 16 of 30

    What is the primary benefit of integrating Docker image scanning into a CI/CD pipeline?

    • aIt encrypts sensitive configuration data within the image for enhanced security.
    • bIt verifies the functional correctness and performance of the application code.
    • cIt acts as a gate to prevent images with known security flaws from reaching deployment.
    • dIt automatically patches identified vulnerabilities in base images and libraries.
    Show the answer

    Answer: c · It acts as a gate to prevent images with known security flaws from reaching deployment.

    The card states that in a CI/CD pipeline, scanning acts as a gate to automatically fail builds containing critical vulnerabilities, preventing them from being deployed. Option D is incorrect because scanning identifies vulnerabilities; it does not automatically remediate or patch them.

    Read the full bite: Docker Image Scanning: A Background Check for Your Code

17. Question 17 of 30

    For which project characteristic is GitFlow explicitly recommended?

    • aRapid prototyping efforts where unversioned features are frequently merged
    • bTeams prioritizing a single, always-deployable main branch for all development
    • cProjects requiring continuous deployment to production multiple times daily
    • dSoftware products that are distributed as distinct, versioned releases
    Show the answer

    Answer: d · Software products that are distributed as distinct, versioned releases

    GitFlow is designed for projects that produce distinct, versioned releases, such as libraries or desktop applications, to manage the lifecycle of specific versions. It is explicitly advised against for continuously delivered software due to its inherent overhead.

    Read the full bite: GitFlow: A Branching Model for Versioned Releases

18. Question 18 of 30

    Which type of workload is generally LEAST appropriate for AWS Spot Instances?

    • aLarge-scale data analysis that can resume from interruption
    • bContinuous integration and deployment pipelines
    • cBatch processing for video transcoding
    • dA primary, stateful production database
    Show the answer

    Answer: d · A primary, stateful production database

    Spot Instances are explicitly advised against for critical production databases or stateful applications due to their potential for sudden interruption. The other options (batch processing, data analysis, CI/CD) are all cited as suitable use cases because they are fault-tolerant and can handle interruptions.

    Read the full bite: Spot Instances: Trade Reliability for Huge Cost Savings

19. Question 19 of 30

    When is git cherry-pick the most appropriate Git command to use?

    • aTo reorder and consolidate multiple commits on a local branch before pushing them.
    • bTo permanently remove a commit from a branch's history after it has been pushed.
    • cTo combine all new features from a completed feature branch into the main development line.
    • dTo apply a specific bug fix from a development branch to a stable release branch without including other changes.
    Show the answer

    Answer: d · To apply a specific bug fix from a development branch to a stable release branch without including other changes.

    The card states that cherry-pick is for "backporting a bug fix without merging an entire feature branch" and for applying "a single bug fix... without all the other new, unstable features." Option C describes a standard git merge operation, not cherry-pick.

    Read the full bite: Git Cherry-Pick: Copy a Commit to Another Branch

20. Question 20 of 30

    When is a bare metal instance the most appropriate choice over a virtual machine?

    • aTo provide a cost-effective environment for general-purpose development and testing workloads.
    • bTo host a high-frequency trading platform requiring consistent, ultra-low latency and direct hardware access.
    • cTo deploy a new microservice where minimizing infrastructure management is the top priority.
    • dTo run a stateless web application that needs to rapidly auto-scale to handle unpredictable traffic spikes.
    Show the answer

    Answer: b · To host a high-frequency trading platform requiring consistent, ultra-low latency and direct hardware access.

    Bare metal instances are ideal for performance-critical workloads like high-frequency trading that require consistent low latency and direct hardware access, bypassing virtualization overhead. Virtual machines, on the other hand, are better suited for rapid auto-scaling to handle unpredictable traffic spikes, which bare metal instances lack.

    Read the full bite: Bare Metal Instances: Your Own Dedicated Cloud Server

21. Question 21 of 30

    Which scenario would most strongly favor adopting a monorepo strategy over a polyrepo?

    • aA startup with limited engineering resources aiming for the simplest possible initial repository setup.
    • bA development team needing to perform a single, coordinated update across several interdependent services.
    • cA company with many unrelated projects, each managed by independent teams.
    • dAn organization prioritizing maximum autonomy for individual project teams regarding tooling.
    Show the answer

    Answer: b · A development team needing to perform a single, coordinated update across several interdependent services.

    A monorepo excels when dealing with tightly coupled projects and requiring large-scale atomic refactors, as a single commit can update multiple interdependent services. The other options describe scenarios where a polyrepo's autonomy and simpler default setup would be more advantageous.

    Read the full bite: Monorepo vs. Polyrepo: One Repository or Many?

22. Question 22 of 30

    Which AWS Placement Group strategy is best for a large distributed database to minimize correlated hardware failures?

    • aDedicated Host, to provide exclusive physical servers for the database instances.
    • bCluster, to ensure all nodes are in the same rack for fastest communication.
    • cSpread, to place each instance on entirely distinct hardware for maximum isolation.
    • dPartition, to distribute instances across logical hardware segments, reducing single point of failure impact.
    Show the answer

    Answer: d · Partition, to distribute instances across logical hardware segments, reducing single point of failure impact.

    Partition placement groups are designed for large distributed systems like Kafka or Cassandra, allowing instances to be spread across logical hardware partitions to reduce the chance of multiple nodes failing from a single hardware issue. While Spread groups also offer isolation, they are typically recommended for a small number of critical instances, not large distributed databases, due to the potential to exhaust distinct hardware.

    Read the full bite: AWS Placement Groups: Control Where Your Instances Run

23. Question 23 of 30

    To ensure Git LFS manages large files that were already committed to a repository's history, what is the necessary action?

    • aManually remove the large files from the repository's history and then add them back after configuring LFS.
    • bUse git lfs migrate to convert the existing large files in the repository's history.
    • cUpdate the .gitattributes file to include the large file types and push the changes.
    • dRun git lfs track for the file types and then re-commit the files.
    Show the answer

    Answer: b · Use git lfs migrate to convert the existing large files in the repository's history.

    The card explicitly states that 'git lfs track does not apply retroactively' and that users 'must use git lfs migrate to convert large files already committed to the repository's history'. Other options either only affect new files or are not the specific LFS tool for this task.

    Read the full bite: Git LFS: Versioning Large Files Without Bloating Your Repo

24. Question 24 of 30

    What unique capability does an AWS Dedicated Host offer that is essential for specific software licensing and strict regulatory compliance?

    • aAutomated migration of instances to a new host if the original one fails.
    • bExclusive use of an entire physical server, with visibility into its underlying hardware.
    • cInstance-level isolation from other customers on a shared physical server.
    • dCost-effective scaling of general-purpose workloads.
    Show the answer

    Answer: b · Exclusive use of an entire physical server, with visibility into its underlying hardware.

    Dedicated Hosts provide exclusive use of a physical server and visibility into its hardware, which is critical for 'bring your own license' (BYOL) software tied to physical cores and for meeting compliance requiring physical isolation. Option C describes EC2 Dedicated Instances, which offer isolation but lack the full server control and hardware visibility for per-core licensing.

    Read the full bite: AWS Dedicated Hosts: Your Own Physical Server in the Cloud

25. Question 25 of 30

    What is the primary benefit of using Docker Compose profiles?

    • aTo manage configurations for fundamentally different application stacks within a single compose.yaml file.
    • bTo apply major configuration changes, like resource limits or network settings, uniformly across the majority of services in a project.
    • cTo define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.
    • dTo ensure that all services defined in the compose.yaml file are always launched together, simplifying deployment.
    Show the answer

    Answer: c · To define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.

    Profiles are designed to enable or disable subsets of services (e.g., debugging tools, dev-specific setups) within a single compose.yaml file, reducing complexity. Option A describes a scenario where separate compose.yaml files are explicitly recommended instead of profiles.

    Read the full bite: Docker Compose Profiles: Activate Service Groups

26. Question 26 of 30

    What is the primary benefit of using extended Docker Compose files for different environments?

    • aTo automatically deploy and manage container orchestration on platforms like Kubernetes.
    • bTo define entirely distinct applications that share no common services.
    • cTo manage environment-specific configuration variations for a single application efficiently.
    • dTo enforce identical resource limits and network settings across all development and production services.
    Show the answer

    Answer: c · To manage environment-specific configuration variations for a single application efficiently.

    The card states that extending Compose files provides a "clean, DRY (Don't Repeat Yourself) way to manage these variations" for a single application across different environments. Option B is incorrect because the card advises against using this for entirely separate applications. Option A is incorrect as Compose is not an orchestrator like Kubernetes, but can be outgrown by it. Option D is incorrect because the purpose is to manage variations, not to enforce identical settings.

    Read the full bite: Extending Compose Files for Different Environments

27. Question 27 of 30

    When using Docker Compose Secrets, how does an application inside a service typically retrieve the sensitive information?

    • aIt reads the secret value from an environment variable automatically set by Compose.
    • bIt accesses a file mounted by Compose into a specific directory within the container.
    • cIt fetches the secret from a dedicated Compose secrets API endpoint.
    • dIt retrieves the secret directly from the docker-compose.yml file at runtime.
    Show the answer

    Answer: b · It accesses a file mounted by Compose into a specific directory within the container.

    Docker Compose Secrets are mounted as files into the container's filesystem at /run/secrets/<secret_name>, which the application then reads. Option A is a common misconception; applications must read secrets from these files, not directly from environment variables, to maintain security.

    Read the full bite: Docker Compose Secrets: Keep Credentials Out of Your Code

28. Question 28 of 30

    With Object Versioning enabled, what is the immediate effect of a PUT request that would normally overwrite an existing file?

    • aA new version of the file is created, and the previous version remains accessible.
    • bThe file is temporarily locked, preventing further modifications until a new version ID is assigned.
    • cA delete marker is automatically placed on the old file, making it inaccessible.
    • dThe original file is permanently deleted and replaced by the new file.
    Show the answer

    Answer: a · A new version of the file is created, and the previous version remains accessible.

    The card explicitly states that when versioning is enabled, a PUT request 'you're not replacing it; you're creating a new version' while the old version is retained. Option D describes the behavior of storage without versioning, which is precisely what versioning aims to prevent.

    Read the full bite: Object Versioning: A Safety Net for Cloud Files

29. Question 29 of 30

    Which scenario presents the most significant challenge or risk for adopting an incremental build model?

    • aThere's a high demand for early user feedback and continuous course correction throughout development.
    • bThe project scope is small and straightforward, making a single development cycle more efficient.
    • cThe core architectural foundation is highly unstable, potentially leading to expensive redesigns in later stages.
    • dThe project requires a phased delivery of usable features to manage risk and demonstrate progress.
    Show the answer

    Answer: c · The core architectural foundation is highly unstable, potentially leading to expensive redesigns in later stages.

    The card states that incremental builds are a "poor fit if the core architecture is highly uncertain, as early increments might be built on flawed assumptions that require costly rework later." This highlights the significant risk of an unstable architectural foundation. Options B and D describe key benefits and purposes of the incremental build model, not its challenges.

    Read the full bite: Incremental Build: Develop and Ship Software in Pieces

30. Question 30 of 30

    Why would an application use a presigned URL instead of proxying a private file download through its own server?

    • aTo provide permanent, unrestricted access to the file.
    • bTo enable complex, multi-file access control for different user roles.
    • cTo allow the client to authenticate directly with the cloud provider.
    • dTo reduce server load and improve efficiency by offloading file transfer.
    Show the answer

    Answer: d · To reduce server load and improve efficiency by offloading file transfer.

    The card states that proxying large files through the server is "inefficient and costly" and that presigned URLs allow the browser to download "directly from cloud storage," meaning the server doesn't handle the file stream, thus reducing server load. Option C is incorrect because the client doesn't authenticate with the cloud provider; the presigned URL itself contains the necessary authentication for that specific request.

    Read the full bite: Presigned URLs: Temporary Access to Private Files