More in Cloud Platforms — page 5
Data warehouse versus OLTP database
WHAT IT TESTS: OLAP versus OLTP design. OUTLINE: warehouses use columnar storage for analytical scans, OLTP uses row storage for fast transactions, each fits a different workload. RED FLAG: a warehouse for high-volume single-row writes, or vice versa.
Strong versus eventual consistency in NoSQL
WHAT IT TESTS: consistency tradeoffs. OUTLINE: strong reads see the latest write at higher latency and cost, eventual reads may be stale but are cheaper and faster, match the choice to stakes. RED FLAG: calling eventual consistency simply broken.
RDS Multi-AZ versus Read Replicas
WHAT IT TESTS: availability versus scalability. OUTLINE: Multi-AZ is a synchronous standby for failover, replicas are async for read scaling, combine both when needed. RED FLAG: claiming the standby serves reads or that replicas auto-failover.
How does caching reduce database load?
WHAT IT TESTS: caching as a read-offload layer. OUTLINE: cache-aside reads, RAM-speed lookups, TTL plus invalidation. RED FLAG: treating the cache as durable source of truth or ignoring stale-data and invalidation.
Read replicas in managed relational databases
WHAT IT TESTS: scaling reads and replication basics. OUTLINE: a read replica is an async copy of the primary that serves read-only queries, offloading the primary and scaling read-heavy workloads; expect replication lag.
Choosing relational vs NoSQL managed databases
WHAT IT TESTS: data model and access pattern fit. OUTLINE: choose relational for complex relationships, joins, flexible queries, and strong transactions; choose NoSQL for known access patterns needing massive horizontal scale.
Architecting for HIPAA or PCI DSS compliance
WHAT IT TESTS: building auditable, compliant data handling. OUTLINE: isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs.
Centralized logging and threat detection across accounts
WHAT IT TESTS: multi-account security architecture. OUTLINE: organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege…
Dynamic database credential rotation for microservices
WHAT IT TESTS: dynamic secrets and zero-downtime rotation. OUTLINE: a secrets manager issues short-lived per-service credentials, services authenticate by workload identity and fetch or refresh secrets without restart, leases expire and rotate automatically.
Shared responsibility model across service tiers
WHAT IT TESTS: who secures what at each service tier. OUTLINE: provider secures the cloud infrastructure; you secure what you put in it; the line shifts with abstraction. For OS patching, you patch IaaS VMs but the provider patches a managed database OS.
Automating a no-public-IP governance rule
WHAT IT TESTS: preventive policy-as-code governance. OUTLINE: use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts.
Service-managed vs customer-managed vs BYOK keys
WHAT IT TESTS: key management control versus burden. OUTLINE: service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance.
Granting a VM scoped storage access without static keys
WHAT IT TESTS: workload identity over static secrets. OUTLINE: attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket. RED FLAG: storing access keys in config or environment variables.
Security Groups vs NACLs
WHAT IT TESTS: layered network access controls. OUTLINE: a security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet. RED FLAG: thinking NACLs are stateful or that security groups support explicit deny rules.
IAM Role vs IAM User
WHAT IT TESTS: identity model and credential hygiene. OUTLINE: a user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access.
Accelerating uncacheable dynamic traffic globally
WHAT IT TESTS: accelerating non-cacheable traffic. OUTLINE: terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
Stable egress IPs for multi-region outbound traffic
WHAT IT TESTS: controlling egress IPs at scale. OUTLINE: route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Site-to-Site VPN vs dedicated interconnect
WHAT IT TESTS: hybrid connectivity tradeoffs. OUTLINE: VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
CDN caching for static and dynamic content
WHAT IT TESTS: CDN cache behavior and invalidation. OUTLINE: cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges.
DNS routing policies for active-passive failover
WHAT IT TESTS: applying DNS policies to failover. OUTLINE: a failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy.