4.7.1: Review Questions

Review Questions

Multiple Choice

1. In the AWS shared responsibility model, which of the following is the CUSTOMER'S responsibility?
   • a) Physical security of data centers
   • b) Patching the hypervisor
   • c) Configuring security groups and IAM policies
   • d) Maintaining the global network infrastructure
2. Which approach best describes "immutable infrastructure"?
   • a) Logging into servers to apply patches and configuration changes
   • b) Never updating servers; replacing them with new instances built from updated images
   • c) Making servers resistant to all types of attacks
   • d) Using read-only file systems on all servers
3. What is the primary advantage of Infrastructure as Code (IaC) over manual infrastructure provisioning?
   • a) It eliminates the need for cloud provider accounts
   • b) It is always cheaper than manual provisioning
   • c) It enables repeatable, version-controlled, and automated infrastructure deployments
   • d) It removes the need for security controls

Short Answer

4. Compare how user identity and access are managed in a traditional IT environment (using Active Directory) versus a cloud environment (using AWS IAM or GCP IAM). What are the key differences in scope, granularity, and approach?
5. Explain the concept of FinOps. Why has cost management become a direct responsibility of cloud administrators, whereas it was typically handled by procurement in traditional IT?
6. Describe three ways that cloud administration tools (web consoles, CLIs, APIs) differ from traditional IT administration tools (RDP, SSH, physical console access). What new security considerations do cloud tools introduce?
7. What is a Cloud Center of Excellence (CCoE)? What is its purpose, and what types of professionals typically participate in it?

True/False

8. True or False: In cloud environments, the "perimeter defense" security model is sufficient because cloud providers secure the network boundaries.
9. True or False: Cloud administrators should use the root account for daily operations to ensure they have all necessary permissions.
10. True or False: The shift from traditional IT to cloud administration often merges previously separate roles (network admin, storage admin, server admin) into a single cloud engineer role.

Answer Key:

1. c
2. b
3. c
4. AD: manages on-prem Windows domain users/groups, permissions tied to specific systems (file shares, databases). Cloud IAM: unified across all cloud services, more fine-grained (resource-level policies), API-centric, supports temporary credentials. Cloud IAM is centralized across all services; AD permissions are often siloed by system.
5. FinOps is collaborative cloud cost management. In cloud, every resource incurs ongoing costs (OpEx); no fixed CapEx. Admins can directly control spend by right-sizing, scheduling, and choosing pricing models. Traditional IT costs were mostly fixed after procurement.
6. Cloud tools: (1) web-accessible from anywhere (vs. on-site/VPN), (2) unified interface for all services (vs. separate tools), (3) API-driven/scriptable (vs. often manual). New security concerns: API keys must be protected, MFA is critical since access is over public internet, centralized credentials can control all infrastructure.
7. CCoE is a cross-functional team (cloud admins, architects, security, finance) that sets cloud standards, governance policies, and best practices organization-wide. Purpose: prevent sprawl, ensure security, standardize usage, manage costs.
8. False
9. False
10. True