Cloud
189 bites tagged Cloud — interview questions with model answers, and 60-second explainers.
Designing a multi-account cloud chargeback model
Account-per-team or mandatory cost-allocation tags enforced by SCPs and tag policies, plus a pipeline over the cost and usage report grouped by tag/account. cost allocation architecture. relying on voluntary tagging.
Savings Plans vs Reserved Instances for mixed compute
Compute Savings Plans cover EC2, Fargate, and Lambda flexibly; EC2 Instance Plans and RIs trade flexibility for slightly deeper discounts. commitment-discount strategy. over-committing or ignoring usage variability.
Reducing cross-region data transfer costs
Identify cross-region, cross-AZ, and internet egress; co-locate chatty components; add VPC endpoints, CDN caching, and compression. data egress cost awareness. assuming all transfer is free or ignoring NAT gateway egress.
Lifecycle storage tiering for compliance logs
Hot tier for 7-day query window, lifecycle rules transitioning to infrequent-access then archive, expiration at one year. object storage lifecycle design.
Rightsizing an underutilized VM fleet safely
Gather multi-week percentile metrics across CPU, memory, network and disk; pick smaller or right-family types; roll out gradually with monitoring. data-driven cost optimization. resizing on average CPU alone.
On-Demand vs Reserved vs Spot pricing models
On-Demand is flexible but priciest, Reserved trades a 1-3 year commitment for discounts, Spot is cheapest but interruptible. cloud cost fluency. putting stateful or latency-critical work on Spot.
Attribute cloud costs to teams
Tag resources with team and project metadata, activate them as cost-allocation tags, group the cost report by that tag, and enforce tagging with policy. cost allocation fundamentals. attribution with no tagging.
Design automated cloud cost optimization
Target idle resources, oversized instances, orphaned storage, and commitment gaps; act via rightsizing and cleanup; safeguard with tagging, scoping, and approvals. FinOps automation with guardrails.
The cloud shared responsibility model
The provider secures the cloud (hardware, OS, runtime), you secure what runs in it (code, data, config, access). the security boundary in PaaS. assuming the provider secures your code, data, or IAM.
Read replicas in managed relational databases
A read replica is an async copy of the primary that serves read-only queries, offloading the primary and scaling read-heavy workloads; expect replication lag. scaling reads and replication basics.
Choosing relational vs NoSQL managed databases
Choose relational for complex relationships, joins, flexible queries, and strong transactions; choose NoSQL for known access patterns needing massive horizontal scale. data model and access pattern fit.
Centralized logging and threat detection across accounts
Organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege… multi-account security architecture.
Shared responsibility model across service tiers
Provider secures the cloud infrastructure; you secure what you put in it; the line shifts with abstraction. For OS patching, you patch IaaS VMs but the provider patches a managed database OS. who secures what at each service tier.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts. preventive policy-as-code governance.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance. key management control versus burden.
Granting a VM scoped storage access without static keys
Attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket. workload identity over static secrets. storing access keys in config or environment variables.
Security Groups vs NACLs
A security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet. layered network access controls. thinking NACLs are stateful or that security groups support explicit deny rules.
IAM Role vs IAM User
A user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access. identity model and credential hygiene.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region. accelerating non-cacheable traffic.
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist. controlling egress IPs at scale.
CDN caching for static and dynamic content
Cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges. CDN cache behavior and invalidation.
DNS routing policies for active-passive failover
A failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy. applying DNS policies to failover.
Process running but load balancer says unhealthy
The probe path, port, protocol, or expected status may mismatch; a security group may block the probe; the app may be up but not ready. debugging health checks systematically.
Connecting two VPCs privately
VPC peering is simple but non-transitive and full-mesh; a Transit Gateway scales hub-and-spoke; PrivateLink exposes one service narrowly. VPC connectivity options and their scaling tradeoffs.
Get Cloud bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.