Test yourself

Answer before you check. The explanation matters most on the ones you get wrong, so read it when that happens.

Mixed set

0 of 10 answered

1. A new analytics consumer needs to see every event from the past week. Which shape allows that?

   A stream, which keeps an ordered log for a retention period and lets each consumer read from any position.A queue, if the messages have not been deleted.A topic, if the consumer subscribes with a start date.None. Messages are gone once delivered.
2. A worker reads a message, charges a card, and crashes before deleting the message. What happens next?

   The message reappears after a timeout and another worker charges the card again, unless the consumer checks for work already done.The message is lost with the worker.The queue detects the crash and marks the message done.The card charge is rolled back automatically.
3. Why do most teams run their databases outside the Kubernetes cluster?

   Storage that follows a pod between nodes is slower and more fragile than storage fixed to one machine, and managed databases already solve failover and backups.Kubernetes cannot attach persistent storage to a pod.Databases need more memory than a node can offer.The cluster's network cannot reach a database.
4. You pay to keep a number of function containers warm so users never see a cold start. What have you given up?

   The part of the pricing where idle time is free. You are paying for a server again.The ability to scale beyond the warm count.The function's access to its trigger.Nothing. Warm containers are included.
5. A function reads one queue. What permission should its identity have?

   Read on that one queue, and nothing else.Read on all queues, so it keeps working if the queue is renamed.Administrator access, so nothing blocks it in production.The same permissions as the engineer who deployed it.
6. An application keeps orders, customers, and products in three separate key-value stores and joins them in code. What has it built?

   A relational database, badly. The data is relational and belongs in one.A correct microservice design.A cache layer.An event-driven system.
7. A product owner asks for five nines. What should you ask before agreeing?

   How long the service can be down and how much data it can lose, because five nines is about five minutes a year and needs multi-region active-active that most systems do not need.Which provider has the best SLA, since the provider's promise sets your availability.Whether the load balancer supports it.Nothing. Five nines is the default for managed services.
8. What does a dead-letter queue prevent?

   One bad message being retried forever and blocking the messages behind it.Messages being delivered twice.Messages being delivered out of order.The queue filling up during a burst.
9. Why do stateless services run active-active across zones while databases usually run active-passive?

   Stateless copies can all serve at once with nothing to reconcile. A database needs one place that takes writes, so a second copy waits to be promoted.Databases cannot be copied to another zone.Active-active is more expensive, and databases are already the most expensive tier.Load balancers cannot route to databases.
10. Which of these can a relational database not solve by adding read replicas?

    Writes outgrowing what one primary can take.Reports slowing down checkout.A dashboard running heavy queries every minute.A read-heavy workload in a second region.

Every explanation names the page that teaches the answer. If a question uses a term you have not met yet, the glossary has it.

By section

Compute

0 of 8 answered

1. A new HTTP service does not fit a function's run-time limit and the team has never run Kubernetes. Where should it start?

   A managed container runtime, which runs the image and scales it with traffic with no cluster to own.A Kubernetes cluster, because containers need one.A function, because the run-time limit can be raised.A virtual machine, because everything else is too new.
2. A pod's address changes when Kubernetes moves it to another node. How do other services keep reaching it?

   They call a service, which is a stable address that finds whichever pods are alive.They look up the new address from the node.Kubernetes keeps the address the same by reserving it on every node.They retry until the pod comes back on the original node.
3. Why do most teams run their databases outside the Kubernetes cluster?

   Storage that follows a pod between nodes is slower and more fragile than storage fixed to one machine, and managed databases already solve failover and backups.Kubernetes cannot attach persistent storage to a pod.Databases need more memory than a node can offer.The cluster's network cannot reach a database.
4. What is the difference between a block storage volume and a machine's local disk?

   The volume is network-attached and outlives the machine. The local disk is faster and lost when the machine stops.The volume is faster and the local disk is more durable.They are the same thing sold under two names.The local disk can be shared between machines and the volume cannot.
5. A pod works for a while under load and then restarts, over and over. What is the first thing to check?

   Whether it exceeded its memory limit and was killed.Whether the image tag was overwritten.Whether the ingress rule matches the hostname.Whether the node pool is in the right zone.
6. An autoscaling group replaces a machine, and the new one serves errors until someone logs in and copies a config file. What was missing?

   An image with the software and configuration already installed, so a new machine needs no manual step.A bigger machine size.A second availability zone.A longer health-check grace period.
7. What is a cold start?

   The delay when a function runs after a quiet period and the provider has to start a container first.A function that fails because its dependencies were not installed.The first deployment of a new function.A function called with an empty event.
8. Why is a tag that can be overwritten a deployment you cannot reproduce?

   The deployment names the tag, so if the tag now points at a different image, the same deployment gives a different result.Overwritten tags are deleted from the registry.Kubernetes refuses to pull a tag it has seen before.Tags are case-sensitive and easy to mistype.

Data and messaging

0 of 8 answered

1. A time-series table uses the timestamp as its partition key. What goes wrong?

   Every write in a given second lands on one partition, which becomes hot while the rest sit idle.The timestamps collide and overwrite each other.Queries by time range become impossible.Nothing, because timestamps have many distinct values.
2. Which read must not be eventually consistent?

   A balance check immediately before taking a payment.The number of likes shown on a post.A product description on a catalogue page.A user's display name in a comment thread.
3. What does a lifecycle rule on a bucket do?

   Moves objects to a colder tier or deletes them by age, on a schedule.Backs up the bucket to another region.Replaces the signed links when they expire.Compresses objects that are rarely read.
4. What does a dead-letter queue prevent?

   One bad message being retried forever and blocking the messages behind it.Messages being delivered twice.Messages being delivered out of order.The queue filling up during a burst.
5. A dashboard scans an entire NoSQL table every minute. Why is that expensive, and what is the fix?

   The store bills per record read, so a scan pays for every record every minute. Query by the key instead.Scans lock the table. Run them at night.The store bills per machine, and scans need more machines. Add a cache.It is not expensive, because idle tables are free.
6. A new analytics consumer needs to see every event from the past week. Which shape allows that?

   A stream, which keeps an ordered log for a retention period and lets each consumer read from any position.A queue, if the messages have not been deleted.A topic, if the consumer subscribes with a start date.None. Messages are gone once delivered.
7. A customer needs to download one report from a private bucket. What is the right way to give it to them?

   A signed link to that one object, with an expiry.Make the bucket public for an hour, then make it private again.Make only that object public.Email the file, since the bucket cannot be shared.
8. An order-placed event must reach the warehouse, the email service, and analytics. Which shape carries it?

   A topic, which delivers each message to every subscriber.A queue, which each service reads in turn.Three direct calls from the order service.A shared database table that each service polls.

Network and identity

0 of 8 answered

1. What is the advantage of a security group rule that names another security group as its source, rather than an address range?

   A new machine that joins the source group can reach the resource, and nothing else can, however its address is chosen.It is faster to evaluate.It allows traffic from the internet as well.It does not need a port.
2. What does a private endpoint for object storage change?

   Calls to the bucket get an address inside your network, so they never leave it and are not billed as NAT traffic.The bucket becomes public.The bucket is copied into your network.The bucket can be mounted as a disk.
3. Where should a service get its database password from?

   A secrets manager, fetched at start-up over the service's own identity and held in memory.An environment variable set in the deployment file in source control.A config file on the machine's disk.Hard-coded, since the database is in a private subnet anyway.
4. An engineer's personal access key was pasted into a deployment two years ago. The engineer left last month. What is the risk?

   The key still works, so a person whose access should have ended still has it, and the deployment will break when someone finally revokes it.None, because leaving the company disables all keys automatically.The deployment already stopped working when they left.The key can only be used from the engineer's laptop.
5. Why is a workload identity safer than an access key stored on the machine?

   The provider issues short-lived credentials automatically, so there is nothing to store and nothing to leak.Workload identities have more permissions.Access keys expire too quickly to be useful.Workload identities are encrypted and access keys are not.
6. A function reads one queue. What permission should its identity have?

   Read on that one queue, and nothing else.Read on all queues, so it keeps working if the queue is renamed.Administrator access, so nothing blocks it in production.The same permissions as the engineer who deployed it.
7. Two teams each built a private network on 10.0.0.0/16. What happens when they need to connect them?

   They cannot be peered, because the address ranges overlap. One of them has to re-address.Peering works, and the provider translates the addresses.Peering works as long as the subnets do not overlap.They are already connected, because they share a range.
8. Where should a database sit, and why?

   In a private subnet, so it can be reached only from inside the network and has no route to the internet.In a public subnet, so administrators can connect from home.In a public subnet with a strong password.Outside the private network, so it can be shared with other teams.

Operations

0 of 5 answered

1. A service runs on three machines in one availability zone behind a load balancer. What is the largest failure it survives?

   One machine failing.The zone failing.The region failing.Any failure, because there are three copies.
2. Why do stateless services run active-active across zones while databases usually run active-passive?

   Stateless copies can all serve at once with nothing to reconcile. A database needs one place that takes writes, so a second copy waits to be promoted.Databases cannot be copied to another zone.Active-active is more expensive, and databases are already the most expensive tier.Load balancers cannot route to databases.
3. A product owner asks for five nines. What should you ask before agreeing?

   How long the service can be down and how much data it can lose, because five nines is about five minutes a year and needs multi-region active-active that most systems do not need.Which provider has the best SLA, since the provider's promise sets your availability.Whether the load balancer supports it.Nothing. Five nines is the default for managed services.
4. Why is a cross-region database copy asynchronous, and what does that cost you?

   Waiting for a copy hundreds of kilometres away would slow every write, so the copy lags, and the writes in flight are lost on failover.Providers do not allow synchronous copies between regions.Asynchronous copies are cheaper per gigabyte.Nothing. The copy is always up to date.
5. A standby region has been running for two years and has never taken production traffic. What is wrong with that?

   It is only worth its cost if it is failed over to on purpose, on a schedule, because an unexercised copy has stale configuration or a missing secret.It is ready, because the replication has been running the whole time.It should be shut down, because a region has never failed.It should be made active-active to save money.

By topic

Start here

Cloud platforms

0 of 5 answered

1. You run a managed database. Whose job is it to decide which identities can read the data?

   Yours. Data and access rules stay your responsibility on every rung.The provider's, because the database is managed.Shared, with the provider deciding defaults and you approving exceptions.Nobody's until the database is exposed to the internet.
2. What does putting a database's second copy in another availability zone protect against?

   The loss of one data centre, from a fire, flood, or power failure.The loss of a whole region.A bad deployment corrupting the data.Latency for users in another country.
3. A team of three engineers must run a new HTTP service. Which rung should they start on, and why?

   As high as the workload allows, because their scarce resource is people rather than compute.Virtual machines, because they are the cheapest per unit.Virtual machines, because the higher rungs hide too much.Whatever the other teams use, to keep the bill on one line.
4. A design copies a large dataset from one region to another every night. Which line on the bill grows because of it?

   Egress, because data leaving a region is charged per gigabyte.Compute, because the copy runs on a machine.Nothing, because traffic between a provider's own regions is free.Storage, because the data now exists twice.
5. Why treat the console as a way to look and infrastructure as code as the way to change?

   A resource described in a file can be reviewed, reverted, and recreated in another region. A clicked one cannot.The console is slower than the API.Changes made in the console are not billed correctly.The console cannot create every kind of resource.

Virtual machines

Virtual machines

0 of 4 answered

1. You stop a virtual machine but do not delete it. What keeps billing?

   The attached disks.Nothing. Stopping a machine stops all charges.The compute, at a reduced idle rate.The public IP address only.
2. What is the difference between a block storage volume and a machine's local disk?

   The volume is network-attached and outlives the machine. The local disk is faster and lost when the machine stops.The volume is faster and the local disk is more durable.They are the same thing sold under two names.The local disk can be shared between machines and the volume cannot.
3. Which workload suits spot capacity?

   A batch job that can be interrupted and restarted from a checkpoint.The primary of a relational database.A licensed product that checks the hardware it runs on.A machine that holds session state for a web application.
4. An autoscaling group replaces a machine, and the new one serves errors until someone logs in and copies a config file. What was missing?

   An image with the software and configuration already installed, so a new machine needs no manual step.A bigger machine size.A second availability zone.A longer health-check grace period.

Containers and Kubernetes

Containers and Kubernetes

0 of 5 answered

1. In Kubernetes, what keeps the right number of copies of an application running?

   The deployment.The pod.The service.The ingress.
2. A pod's address changes when Kubernetes moves it to another node. How do other services keep reaching it?

   They call a service, which is a stable address that finds whichever pods are alive.They look up the new address from the node.Kubernetes keeps the address the same by reserving it on every node.They retry until the pod comes back on the original node.
3. Why do most teams run their databases outside the Kubernetes cluster?

   Storage that follows a pod between nodes is slower and more fragile than storage fixed to one machine, and managed databases already solve failover and backups.Kubernetes cannot attach persistent storage to a pod.Databases need more memory than a node can offer.The cluster's network cannot reach a database.
4. A pod works for a while under load and then restarts, over and over. What is the first thing to check?

   Whether it exceeded its memory limit and was killed.Whether the image tag was overwritten.Whether the ingress rule matches the hostname.Whether the node pool is in the right zone.
5. Why is a tag that can be overwritten a deployment you cannot reproduce?

   The deployment names the tag, so if the tag now points at a different image, the same deployment gives a different result.Overwritten tags are deleted from the registry.Kubernetes refuses to pull a tag it has seen before.Tags are case-sensitive and easy to mistype.

Serverless

Serverless

0 of 4 answered

1. What is a cold start?

   The delay when a function runs after a quiet period and the provider has to start a container first.A function that fails because its dependencies were not installed.The first deployment of a new function.A function called with an empty event.
2. You pay to keep a number of function containers warm so users never see a cold start. What have you given up?

   The part of the pricing where idle time is free. You are paying for a server again.The ability to scale beyond the warm count.The function's access to its trigger.Nothing. Warm containers are included.
3. A function scales to a thousand copies in a second. What is the most likely thing to break?

   The database behind it, which now has a thousand connections it did not have before.The function's memory limit.The trigger, which cannot deliver that many events.Nothing, because serverless removes the bottleneck.
4. A new HTTP service does not fit a function's run-time limit and the team has never run Kubernetes. Where should it start?

   A managed container runtime, which runs the image and scales it with traffic with no cluster to own.A Kubernetes cluster, because containers need one.A function, because the run-time limit can be raised.A virtual machine, because everything else is too new.

Storage

Storage

0 of 4 answered

1. Which kind of storage needs no machine running for the data to exist and be readable?

   Object storage.Block storage.File storage.A machine's local disk.
2. What does a lifecycle rule on a bucket do?

   Moves objects to a colder tier or deletes them by age, on a schedule.Backs up the bucket to another region.Replaces the signed links when they expire.Compresses objects that are rarely read.
3. Why is object storage the wrong place for a database's live files and the right place for its backups?

   An object cannot be changed in part, only rewritten whole. A live database changes bytes constantly; a backup is written once.Object storage is too slow to read.Object storage cannot hold files larger than a backup.Backups are encrypted and live files are not.
4. A customer needs to download one report from a private bucket. What is the right way to give it to them?

   A signed link to that one object, with an expiry.Make the bucket public for an hour, then make it private again.Make only that object public.Email the file, since the bucket cannot be shared.

SQL databases

SQL databases

0 of 4 answered

1. A migration at 14:07 dropped the wrong column. What does point-in-time recovery let you do?

   Restore the database to how it was at 14:06.Undo the one statement while keeping later writes.Recover the column from the read replica.Fail over to the standby, which has the old schema.
2. Which of these can a relational database not solve by adding read replicas?

   Writes outgrowing what one primary can take.Reports slowing down checkout.A dashboard running heavy queries every minute.A read-heavy workload in a second region.
3. What is the difference between a standby replica and a read replica?

   The standby exists to take over when the primary fails and usually cannot be read. The read replica serves reads and lags slightly.They are the same copy, named differently by different providers.The read replica is in another zone; the standby is in the same zone.The standby is cheaper because it holds only the schema.
4. Twenty copies of a service each hold a pool of twenty database connections. What is the problem, and what fixes it?

   Four hundred connections can exhaust the database's limit. A connection pooler between the services and the database holds a fixed number and lends them out.The pools will conflict on the same rows. Turn off pooling in the application.The connections are unencrypted. Move them to a private endpoint.Nothing, because managed databases have no connection limit.

NoSQL databases

NoSQL databases

0 of 5 answered

1. Why can a partitioned NoSQL store take more writes than a relational database?

   Data is split by key across machines, so writes to different keys go to different machines and never contend.It skips the disk and writes only to memory.It does not check the data before writing it.It compresses each write.
2. A time-series table uses the timestamp as its partition key. What goes wrong?

   Every write in a given second lands on one partition, which becomes hot while the rest sit idle.The timestamps collide and overwrite each other.Queries by time range become impossible.Nothing, because timestamps have many distinct values.
3. An application keeps orders, customers, and products in three separate key-value stores and joins them in code. What has it built?

   A relational database, badly. The data is relational and belongs in one.A correct microservice design.A cache layer.An event-driven system.
4. Which read must not be eventually consistent?

   A balance check immediately before taking a payment.The number of likes shown on a post.A product description on a catalogue page.A user's display name in a comment thread.
5. A dashboard scans an entire NoSQL table every minute. Why is that expensive, and what is the fix?

   The store bills per record read, so a scan pays for every record every minute. Query by the key instead.Scans lock the table. Run them at night.The store bills per machine, and scans need more machines. Add a cache.It is not expensive, because idle tables are free.

Messaging and streaming

Messaging and streaming

0 of 4 answered

1. A worker reads a message, charges a card, and crashes before deleting the message. What happens next?

   The message reappears after a timeout and another worker charges the card again, unless the consumer checks for work already done.The message is lost with the worker.The queue detects the crash and marks the message done.The card charge is rolled back automatically.
2. A new analytics consumer needs to see every event from the past week. Which shape allows that?

   A stream, which keeps an ordered log for a retention period and lets each consumer read from any position.A queue, if the messages have not been deleted.A topic, if the consumer subscribes with a start date.None. Messages are gone once delivered.
3. An order-placed event must reach the warehouse, the email service, and analytics. Which shape carries it?

   A topic, which delivers each message to every subscriber.A queue, which each service reads in turn.Three direct calls from the order service.A shared database table that each service polls.
4. What does a dead-letter queue prevent?

   One bad message being retried forever and blocking the messages behind it.Messages being delivered twice.Messages being delivered out of order.The queue filling up during a burst.

Networking

Networking

0 of 5 answered

1. Where should a database sit, and why?

   In a private subnet, so it can be reached only from inside the network and has no route to the internet.In a public subnet, so administrators can connect from home.In a public subnet with a strong password.Outside the private network, so it can be shared with other teams.
2. What is the advantage of a security group rule that names another security group as its source, rather than an address range?

   A new machine that joins the source group can reach the resource, and nothing else can, however its address is chosen.It is faster to evaluate.It allows traffic from the internet as well.It does not need a port.
3. Two teams each built a private network on 10.0.0.0/16. What happens when they need to connect them?

   They cannot be peered, because the address ranges overlap. One of them has to re-address.Peering works, and the provider translates the addresses.Peering works as long as the subnets do not overlap.They are already connected, because they share a range.
4. A machine in a private subnet needs to download packages from the internet. How does the traffic get out?

   Through a NAT gateway in a public subnet, which lets traffic out and replies back and nothing else in.It cannot. Private subnets have no internet access in either direction.By giving the machine a public address.Through the load balancer.
5. What does a private endpoint for object storage change?

   Calls to the bucket get an address inside your network, so they never leave it and are not billed as NAT traffic.The bucket becomes public.The bucket is copied into your network.The bucket can be mounted as a disk.

Identity, access, and secrets

Identity, access, and secrets

0 of 5 answered

1. A function reads one queue. What permission should its identity have?

   Read on that one queue, and nothing else.Read on all queues, so it keeps working if the queue is renamed.Administrator access, so nothing blocks it in production.The same permissions as the engineer who deployed it.
2. Why is a workload identity safer than an access key stored on the machine?

   The provider issues short-lived credentials automatically, so there is nothing to store and nothing to leak.Workload identities have more permissions.Access keys expire too quickly to be useful.Workload identities are encrypted and access keys are not.
3. A bucket is encrypted with a key you manage rather than the provider's default key. What does that add?

   A second gate. An identity with read access to the bucket also needs permission to use the key.Nothing, because data at rest is encrypted by default anyway.Faster reads, because the key is closer.Protection against the provider reading the data in transit.
4. Where should a service get its database password from?

   A secrets manager, fetched at start-up over the service's own identity and held in memory.An environment variable set in the deployment file in source control.A config file on the machine's disk.Hard-coded, since the database is in a private subnet anyway.
5. An engineer's personal access key was pasted into a deployment two years ago. The engineer left last month. What is the risk?

   The key still works, so a person whose access should have ended still has it, and the deployment will break when someone finally revokes it.None, because leaving the company disables all keys automatically.The deployment already stopped working when they left.The key can only be used from the engineer's laptop.

High availability

High availability

0 of 5 answered

1. A service runs on three machines in one availability zone behind a load balancer. What is the largest failure it survives?

   One machine failing.The zone failing.The region failing.Any failure, because there are three copies.
2. Why do stateless services run active-active across zones while databases usually run active-passive?

   Stateless copies can all serve at once with nothing to reconcile. A database needs one place that takes writes, so a second copy waits to be promoted.Databases cannot be copied to another zone.Active-active is more expensive, and databases are already the most expensive tier.Load balancers cannot route to databases.
3. A product owner asks for five nines. What should you ask before agreeing?

   How long the service can be down and how much data it can lose, because five nines is about five minutes a year and needs multi-region active-active that most systems do not need.Which provider has the best SLA, since the provider's promise sets your availability.Whether the load balancer supports it.Nothing. Five nines is the default for managed services.
4. Why is a cross-region database copy asynchronous, and what does that cost you?

   Waiting for a copy hundreds of kilometres away would slow every write, so the copy lags, and the writes in flight are lost on failover.Providers do not allow synchronous copies between regions.Asynchronous copies are cheaper per gigabyte.Nothing. The copy is always up to date.
5. A standby region has been running for two years and has never taken production traffic. What is wrong with that?

   It is only worth its cost if it is failed over to on purpose, on a schedule, because an unexercised copy has stale configuration or a missing secret.It is ready, because the replication has been running the whole time.It should be shut down, because a region has never failed.It should be made active-active to save money.