Cloud Architecture Design
Cloud Architecture Design is the domain where the exam tests whether you can turn requirements into an IBM Cloud architecture that is resilient, secure, and economically sound. Expect decisions about VPC topology, multizone regions, managed services, and integration across accounts.
Design around failure domains
An IBM Cloud multizone region (MZR) contains three zones. A VPC subnet is bound to one zone, so a resilient design uses one subnet per zone and places workloads in all three. Security groups are stateful; network ACLs are stateless and evaluated per subnet. Use VPC Load Balancer or a global load balancer for traffic distribution, and IBM Cloud Transit Gateway for VPC-to-VPC and on-premises connectivity via Direct Link or VPN.
Match service choice to operational burden
Prefer managed services when the team cannot staff 24x7 operations, but check limits, regional availability, and data residency. Object Storage bucket resiliency (cross-region, regional, single-site) is an architecture decision, not a checkbox.
Worked example
A three-tier web app must survive one zone outage with moderate cost. Reasoning: deploy web and app tiers across three subnets in one MZR, front them with a VPC load balancer, keep session state in a managed service, and use cross-region Object Storage for static assets. A single-zone pilot would be cheaper but fails the requirement.
Traps
Assuming an MZR alone makes an app highly available; putting all workers in one subnet; confusing ACLs and security groups; forgetting that cross-zone traffic and egress affect cost.