Cloud Platforms Quiz

An IAM Role is like a temporary badge: it defines a set of permissions that someone can borrow for a while, rather than being tied permanently to one identity. That's exactly what an outside user (like someone in a mobile app) needs, so AWS STS issues the short-lived credentials, but it's the Role itself that's being granted and assumed.

Layer 7 load balancers operate at the application layer and can read the actual contents of an HTTP request, so they support content-based routing such as path-based or host-based rules to different target groups. Layer 4 load balancers only see IP, port, and TCP-level information, and route purely based on that, with no visibility into the HTTP path itself.

Least privilege means granting only the specific actions and resources a role actually needs, so the fix is narrowing the action list to the exact API calls used, like s3:PutObject for uploads, and scoping the resource to the specific bucket ARN and prefix, instead of a wildcard. Time-based restrictions don't address the excessive scope, omitting the resource field isn't valid policy syntax and wouldn't auto-scope anything, and even a 'read-only' wildcard still exposes every bucket in the account, which remains overly broad.

Vendor lock-in happens when your infrastructure only speaks one cloud's language. Using open, portable tools like Kubernetes, Terraform, and OpenTelemetry means the same setup can run on any cloud with minimal changes, so you're never stuck because rewriting everything to leave would be too painful.

A 'cold start' happens because Cloud Run shuts down idle containers to save cost, so the next request has to wait for a brand-new container to boot up before it can respond. Setting minimum instances to 1 keeps a container running and ready at all times, so there's simply no startup to wait for anymore.

For logs to be trustworthy as compliance evidence, it must be provably impossible to quietly edit or delete them. S3 Object Lock enforces that no one, not even an admin, can modify or delete the logs before the retention period ends, and copying them to a completely separate account means even a compromised primary account can't destroy the evidence.

A CDN caches static, and sometimes dynamic, content across a network of globally distributed edge servers, so requests get served from a location physically closer to the user, cutting latency while reducing load and bandwidth cost on the origin server. It doesn't replace load balancing or encrypt data at rest, and the application's actual compute still runs wherever it was originally deployed.

Data has two different places it needs protecting: sitting on disk, and traveling over the network. RDS's encryption-at-rest (backed by KMS) covers the first, and forcing your app to connect over SSL/TLS covers the second, together closing both gaps, which none of the other single options do alone.

Every time someone far away downloads a file straight from Blob Storage, you pay for that data leaving Azure's network, and popular files get downloaded over and over. A CDN caches copies of those files at locations physically close to users worldwide, so repeat downloads come from a nearby cache instead of your storage account, cutting the bandwidth cost dramatically.

A Resource Group is just a folder for your Azure resources, so a VM, its storage, and its network can all be deployed, managed, and deleted together as one unit. It has nothing to do with billing or network isolation, it's purely an organizational container.