IBM Cloud Platform Operations and Architecture
IBM Cloud Platform Operations and Architecture
This domain tests account structure, network design, and managed-service placement on IBM Cloud.
Core rules
- An IBM Cloud account contains resource groups; IAM policies grant access at account, resource group, or resource scope. Use service IDs for automation, not personal API keys.
- Regions contain zones. Design for at least three zones for production HA where the service supports it.
- VPC provides subnets, security groups, and load balancers. Transit Gateway connects VPCs and classic infrastructure; Direct Link provides private connectivity to on-premises.
- IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud run containers; Code Engine runs serverless containers and jobs. Managed databases and Object Storage reduce operational burden.
- Check quotas and regional service availability before design. Use Cloud Internet Services for DNS, DDoS, and WAF.
Worked example
A regulated workload needs private connectivity from an on-premises data center and high availability. The architect places the app in a three-zone VPC, uses a private load balancer, connects via Direct Link to Transit Gateway, and keeps worker nodes in private subnets with a public gateway only for controlled egress. Reasoning: private paths reduce exposure, and three zones remove a single-zone failure domain.
Traps
Confusing resource groups with Cloud Foundry orgs and spaces leads to wrong IAM scope. A single-zone cluster is not production HA. Public-only endpoints increase attack surface. Assuming every service is available in every region causes late redesign. Ignoring quotas blocks scale-out during incidents.