▸case-20 We need to set up a Kubernetes cluster on Google Cloud Platform using Terraform. Provide the configuration for a GKE cluster. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are writing an AWS CloudFormation template to launch an RDS DBInstance. The template currently declares a parameter DBPassword with a default plaintext value string 'MySecretPass123!'. How should database credentials be handled securely in the CloudFormation template? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 A DevOps team of 5 engineers manages AWS infrastructure using Terraform. Every engineer keeps a copy of terraform.tfstate on their local laptop and syncs via Git commits. What remote state backend architecture should be used? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 Write a systemd unit file to run a background Python worker script at /opt/worker/app.py on a local Ubuntu Linux server. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 To manage backups across 50 Amazon EBS volumes and 10 Amazon RDS databases on AWS, an administrator setup individual cron jobs inside EC2 instances to call AWS CLI snapshot APIs. What centralized AWS service and pattern should replace these custom scripts? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 A custom AWS KMS key was created with a key policy statement setting Principal: {'AWS': '*'} without conditions, relying solely on IAM user policies for access control. Why is this key policy unsafe and how should key access be constrained? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 An IAM developer policy is needed for an S3-backed microservice. To save time during debugging, the developer proposed using Action: '*' and Resource: '*' in the policy document. Provide the recommended IAM policy JSON for granting object read access to bucket app-data-bucket. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 Create an Azure Bicep template to provision an Azure App Service with a virtual network integration. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 We are deploying a new S3 bucket named finance-audit-logs via Terraform. Someone suggested omitting bucket access block configurations because new S3 buckets default to private. Provide the Terraform code block for securing public access. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 We are setting up a 2-tier web application network on AWS using Terraform. The team suggested putting both the public ALB and the PostgreSQL database in the same public subnet (10.0.1.0/24) to simplify routing. Provide the network subnet architecture design. | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 An AWS Auto Scaling Group hosting a web application launches all EC2 instances into a single subnet in us-east-1a to minimize inter-instance latency. What design change is required to achieve high availability against data center failure? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 In an AWS CDK TypeScript application, Stack A creates an SQS queue and Stack B consumes it. A developer suggests hardcoding the queue URL string into Stack B's environment variables. Provide the recommended CDK pattern for sharing the queue instance between stacks. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 Deploy my AWS infrastructure code right now for my web app. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 An AWS Lambda function written in Python queries an Amazon Aurora MySQL database. The initial code opens a new database connection inside the handler function on every single invocation. How should connection handling be refactored? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 An application hosted on AWS EC2 instances across two regions uses Amazon Route 53 for DNS. The operations team mapped a single region's Elastic IP directly in the apex A record. How should Route 53 be configured to handle automated failover if the primary region experiences an outage? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 An existing Amazon RDS PostgreSQL database instance running in production was created without storage encryption enabled. The DBA wants to run an aws rds modify-db-instance command with --storage-encrypted on the running instance. How must encryption at rest be enabled for this database? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 An e-commerce system has five microservices running on AWS. Service A sends synchronous HTTP requests to Service B, C, D, and E whenever an order is placed, causing high latency and tight coupling. What AWS serverless architecture pattern should be used to decouple order events? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 A web application built on Amazon DynamoDB experiences sudden, unpredictable bursts of traffic throughout the day while remaining idle for long periods. The lead architect proposed provisioning a fixed 5,000 Read Capacity Units and 5,000 Write Capacity Units to prevent throttles. What capacity management strategy should be implemented? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 We want to deliver static assets from an Amazon S3 bucket via Amazon CloudFront. A developer wants to enable public read access on the S3 bucket policy so CloudFront can read objects. What pattern should be used to restrict origin access to CloudFront only? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 An Amazon ECS task running on AWS Fargate needs to upload user avatar files to an S3 bucket and pull a container image from Amazon ECR. The developer attached S3 write permissions to the ECS Task Execution Role. How should IAM roles be correctly split for this ECS task? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 During a production issue on AWS, an engineer directly modified an EC2 security group rule via the AWS Console to allow port 443 access. The change is now live, but the Terraform state file does not reflect it. What step should be taken to realign the infrastructure code? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 An Amazon API Gateway REST API invokes an AWS Lambda function directly. To handle high traffic, developers left the stage throttling limits disabled so backend Lambda concurrency can scale infinitely. What configuration should be added to prevent backend overload and denial of service? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |