Security
What to know
Security questions test the shared responsibility model and identity-first thinking. RAM (Resource Access Management) is central: users, groups, roles, and policies govern who can do what. Apply least privilege, prefer roles over long-term access keys, and enable MFA. ActionTrail records API activity for audit; Cloud Config tracks resource configuration compliance; Security Center surfaces threats and vulnerabilities. WAF protects web apps from injection and DDoS-adjacent attacks; Anti-DDoS absorbs volumetric floods. KMS manages encryption keys; encrypt data at rest and in transit. Network controls: security groups, network ACLs, and VPC isolation.
Traps
"The provider secures my data" is false - you own data, identities, and configuration. Confuse RAM policy with security group and you lose the point: one is authorization, the other is network filtering. Audit trails (ActionTrail) are not the same as threat detection (Security Center). Encryption keys in KMS are not stored by the customer in plaintext.
Rule of thumb
For any scenario, ask: who is the principal, what resource, what action, and is it logged and encrypted? Least privilege plus logging plus encryption covers most answers.
Worked example
An ECS instance must read OSS objects without embedding keys. Answer: attach a RAM role to the instance granting scoped OSS read permissions - no static keys on disk, and ActionTrail logs the access.
Billing and Support
What to know
Billing questions test how charges accrue and how to control spend. Understand pay-as-you-go (metered, flexible, higher unit price) versus subscription (prepaid term, discounted), plus savings plans/reserved capacity for predictable workloads. Know that OSS charges for storage, requests, and data transfer; ECS charges for instance, disk, and bandwidth; data transfer out to the internet is typically billable while inbound is generally free. Auto Scaling can reduce cost by matching capacity to demand.
Support tiers differ in response time, channels, and technical account coverage. Know that billing alerts and budgets, resource tagging, and cost analysis reports let you attribute and cap spend. Free-tier and trial quotas have limits and expiry.
Traps
Questions imply all data transfer is billed - usually outbound is the charge. Mixing up subscription discount with pay-as-you-go flexibility loses points. Tags do not reduce cost by themselves; they enable attribution. A support plan does not change the price of resources.
Rule of thumb
Steady, predictable load → subscription or savings plan. Spiky or experimental load → pay-as-you-go plus Auto Scaling. Always tag resources and set budget alerts.
Worked example
A batch job runs four hours nightly. Answer: pay-as-you-go instances with scheduled Auto Scaling - subscription for 24/7 capacity would waste money on idle hours.
Exam Strategy and Cross-Domain Integration
What to know
Many questions span domains, so practise integrating them. A typical scenario asks you to design a resilient, secure, cost-aware solution: choose ECS with SLB across zones (fundamentals + core products), store objects in OSS with lifecycle rules (cost), protect access with RAM roles and KMS (security), and monitor spend with budgets (billing). Read the requirement words carefully - must, minimal cost, least privilege, high availability, disaster recovery each point to a specific answer.
Eliminate answers that violate a hard constraint first: if the scenario says no static credentials, any option embedding access keys is wrong regardless of elegance. If it says minimal cost, options adding a second region are usually wrong. If it says least privilege, wildcard policies are wrong. Then compare the survivors on the stated priority.
Traps
Over-engineering is a common trap: adding DR when HA was requested. Under-engineering is another: single-zone when the scenario demands zone-failure tolerance. Watch for answers that solve the wrong layer (network control when authorization was asked).
Rule of thumb
Restate the requirement in one sentence, cross out options that break a hard constraint, then pick the simplest option that fully satisfies the stated priority.
Worked example
"A web app must survive a zone outage, keep credentials off disk, and minimize cost." Cross out single-zone options (fails HA), cross out options with embedded keys (fails security), then choose multi-zone ECS behind SLB with a RAM role - the cheapest option meeting both constraints.