Cloud Platforms and Provisioning
What this domain tests
Cloud Platforms and Provisioning tests provider-agnostic cloud literacy: service models, regions and availability zones, identity and access, network segmentation, landing zones, tagging, and cost-aware design.
Core rules and concepts
- IaaS gives virtual machines and networks; PaaS manages the runtime; FaaS runs event-driven functions. Choose managed services when they reduce undifferentiated operational work.
- Design across availability zones within a region for resilience. A single-AZ design is not highly available, even if each server is.
- Apply least privilege in IAM: scoped roles, short-lived credentials, no wildcard actions or resources, and separate roles per workload.
- Segment networks with VPCs, public and private subnets, routing, and security groups. Put data stores in private subnets.
- Provision cloud resources through IaC, not console clicks, so environments are reproducible and reviewable.
- Tag resources for owner, environment, and cost center; untagged resources defeat cost allocation and ownership.
Worked example
An application runs two web servers in one AZ and a managed database in the same AZ. Reasoning: the design has redundancy at the server tier but a shared failure domain. The database and both servers fail together if the AZ fails. Correct the architecture by spreading web instances across at least two AZs and enabling the managed database's multi-AZ option, then test failover. Adding a third server in the same AZ does not remove the single point of failure.
Traps that cost marks
- Equating cloud with someone else's data center and lifting servers unchanged.
- Using administrator or wildcard IAM policies for convenience.
- Forgetting egress costs and idle managed resources.
- Treating regions and availability zones as interchangeable.
- Leaving resources untagged, so ownership and cost cannot be traced.