More in DevOps & Cloud — page 16
Service-managed vs customer-managed vs BYOK keys
WHAT IT TESTS: key management control versus burden. OUTLINE: service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance.
Granting a VM scoped storage access without static keys
WHAT IT TESTS: workload identity over static secrets. OUTLINE: attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket. RED FLAG: storing access keys in config or environment variables.
Security Groups vs NACLs
WHAT IT TESTS: layered network access controls. OUTLINE: a security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet. RED FLAG: thinking NACLs are stateful or that security groups support explicit deny rules.
IAM Role vs IAM User
WHAT IT TESTS: identity model and credential hygiene. OUTLINE: a user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access.
Accelerating uncacheable dynamic traffic globally
WHAT IT TESTS: accelerating non-cacheable traffic. OUTLINE: terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
Stable egress IPs for multi-region outbound traffic
WHAT IT TESTS: controlling egress IPs at scale. OUTLINE: route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Site-to-Site VPN vs dedicated interconnect
WHAT IT TESTS: hybrid connectivity tradeoffs. OUTLINE: VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
CDN caching for static and dynamic content
WHAT IT TESTS: CDN cache behavior and invalidation. OUTLINE: cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges.
DNS routing policies for active-passive failover
WHAT IT TESTS: applying DNS policies to failover. OUTLINE: a failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy.
Process running but load balancer says unhealthy
WHAT IT TESTS: debugging health checks systematically. OUTLINE: the probe path, port, protocol, or expected status may mismatch; a security group may block the probe; the app may be up but not ready.
Connecting two VPCs privately
WHAT IT TESTS: VPC connectivity options and their scaling tradeoffs. OUTLINE: VPC peering is simple but non-transitive and full-mesh; a Transit Gateway scales hub-and-spoke; PrivateLink exposes one service narrowly.
How cloud DNS resolves a URL to an IP
WHAT IT TESTS: end-to-end DNS resolution flow. OUTLINE: recursive resolver queries root, then TLD, then your authoritative cloud DNS zone; the matching record returns an IP, cached per TTL. RED FLAG: skipping the recursive resolver or caching.
Layer 4 vs Layer 7 load balancers
WHAT IT TESTS: OSI model and load balancer routing knowledge. OUTLINE: L4 routes on IP and TCP/UDP ports fast and protocol-blind; L7 inspects HTTP for host, path, and headers. RED FLAG: claiming L7 is always better.
Public and private subnet VPC design
WHAT IT TESTS: core VPC networking. OUTLINE: web server in a public subnet routed to an internet gateway, database in a private subnet with no inbound from the internet, NAT for outbound. RED FLAG: placing the database in a public subnet or relying only on.
Block storage availability across AZ failure
WHAT IT TESTS: HA design and RTO/RPO trade-offs. OUTLINE: block volumes are AZ-bound, so use snapshots, synchronous replication, or app-level replication, trading cost for lower RTO/RPO.
Object store vs NFS consistency models
WHAT IT TESTS: distributed consistency depth. OUTLINE: S3 gives strong read-after-write per object with no partial updates; NFS offers close-to-open with shared mutable files.
Maximizing object-store throughput for small files
WHAT IT TESTS: object-store scaling internals. OUTLINE: spread keys across prefixes for partition parallelism, batch small files, parallelize and use multipart uploads.
Object storage tiers and lifecycle automation
WHAT IT TESTS: storage cost optimization. OUTLINE: tiers trade storage price for retrieval cost and latency; automate with lifecycle rules or intelligent tiering.
Protecting object storage from accidental loss
WHAT IT TESTS: data durability and recovery design. OUTLINE: enable versioning, MFA delete or object lock, cross-region replication, and least-privilege policies.
Shared file system access across many VMs
WHAT IT TESTS: managed file storage trade-offs. OUTLINE: use a managed NFS service like EFS or Filestore; watch per-operation latency, throughput modes, and metadata-heavy small-file workloads.