Course outline
Module 1
Module 1: Cloud Fundamentals and Core Concepts
Cloud Fundamentals and Core Concepts
Knowledge check
Q1. Which cloud service model provides users with virtual machines, storage, and networking while they manage the operating system and applications?
- A. Software as a Service (SaaS)
- B. Platform as a Service (PaaS)
- C. Infrastructure as a Service (IaaS) ✓
- D. Function as a Service (FaaS)
Why: IaaS provides the core computing infrastructure such as virtual machines, storage, and networking, while the customer is responsible for the operating system, middleware, and applications.
Q2. What is the main characteristic of the cloud feature known as elasticity?
- A. Data is stored in multiple geographic regions for backup
- B. Resources can scale up or down automatically based on demand ✓
- C. Users can access services from any device over the internet
- D. Costs are fixed regardless of how much a service is used
Why: Elasticity refers to the ability to automatically provision and de-provision resources to match changing workload demand, allowing systems to scale up during peaks and down during quiet periods.
Q3. Which deployment model makes cloud resources available to the general public and is owned and operated by a third-party provider?
- A. Private cloud
- B. Hybrid cloud
- C. Public cloud ✓
- D. Community cloud
Why: A public cloud is owned and operated by a third-party provider such as AWS, Azure, or Google Cloud, and its resources are shared among many customers over the internet.
Q4. In the shared responsibility model, which task is typically the responsibility of the cloud provider?
- A. Configuring user access permissions for applications
- B. Encrypting customer application data
- C. Maintaining the physical security of data center facilities ✓
- D. Patching the guest operating system on a virtual machine
Why: Cloud providers are responsible for security of the cloud, which includes physical data center security, hardware, and underlying infrastructure. Customers are responsible for security in the cloud, such as access permissions, data encryption choices, and OS patching.
Q5. What does the term 'region' refer to in major cloud platforms like AWS, Azure, and Google Cloud?
- A. A single server rack inside a data center
- B. A billing account used to group multiple subscriptions
- C. A geographic area containing multiple isolated data centers ✓
- D. A software license that covers a specific country
Why: A region is a geographic area, such as a city or country grouping, that contains multiple data centers, often called availability zones, which are isolated from each other for fault tolerance.
Module 2
Module 2: Compute Services: AWS EC2, Azure VMs, Google Compute Engine
Compute Services: AWS EC2, Azure VMs, Google Compute Engine
Knowledge check
Q1. Which AWS service provides resizable virtual servers in the cloud?
- A. Amazon S3
- B. Amazon EC2 ✓
- C. Amazon RDS
- D. Amazon CloudFront
Why: Amazon EC2 (Elastic Compute Cloud) provides resizable virtual server instances, making it AWS's core compute service. S3 is object storage, RDS is managed databases, and CloudFront is a content delivery network.
Q2. What is the Azure equivalent of AWS EC2 instances?
- A. Azure Functions
- B. Azure Blob Storage
- C. Azure Virtual Machines ✓
- D. Azure Kubernetes Service
Why: Azure Virtual Machines are Azure's equivalent of EC2, offering on-demand virtual servers with a choice of operating systems and sizes. Azure Functions is serverless compute, Blob Storage is object storage, and AKS is managed Kubernetes.
Q3. Which Google Cloud service offers virtual machines comparable to EC2 and Azure VMs?
- A. Cloud Storage
- B. Cloud Run
- C. Compute Engine ✓
- D. BigQuery
Why: Google Compute Engine provides customizable virtual machines running on Google's infrastructure. Cloud Storage is object storage, Cloud Run is serverless container hosting, and BigQuery is a data warehouse.
Q4. What does an EC2 instance type such as t3.micro primarily describe?
- A. The geographic region of the instance
- B. The billing currency for the instance
- C. The combination of vCPU, memory, and network capacity ✓
- D. The operating system installed on the instance
Why: An EC2 instance type defines the hardware profile, including vCPUs, memory, storage, and networking capacity. The region, billing currency, and operating system are configured separately.
Q5. Which pricing model lets you pay for compute capacity only while it is running, with no long-term commitment?
- A. Reserved pricing
- B. Dedicated hosting
- C. On-demand pricing ✓
- D. Spot-only pricing with a fixed contract
Why: On-demand pricing charges by the second or hour for compute used, with no upfront or long-term commitment. Reserved pricing requires a commitment for a term, and dedicated hosting is a separate offering for isolated hardware.
Module 3
Module 3: Cloud Storage and Databases Across Providers
Cloud Storage and Databases Across Providers
Knowledge check
Q1. Which AWS service is the primary object storage offering for storing files such as images, backups, and static website assets?
- A. Amazon EBS
- B. Amazon S3 ✓
- C. Amazon EFS
- D. Amazon Glacier Vault Lock
Why: Amazon Simple Storage Service (S3) is AWS's core object storage service, designed to store and retrieve any amount of data through a web interface or API. EBS provides block storage for EC2 instances, and EFS provides shared file storage, so neither is the primary object storage service.
Q2. What is the Azure equivalent of AWS S3 for storing unstructured data like blobs and files?
- A. Azure Files
- B. Azure Disk Storage
- C. Azure Blob Storage ✓
- D. Azure Queue Storage
Why: Azure Blob Storage is Microsoft's object storage solution for unstructured data such as documents, images, and backups, and it serves the same purpose as Amazon S3. Azure Files offers managed file shares, Azure Disk Storage provides block storage for VMs, and Azure Queue Storage handles messaging.
Q3. Which Google Cloud service is a fully managed, serverless NoSQL document database designed for mobile and web applications?
- A. Cloud SQL
- B. Cloud Spanner
- C. Firestore ✓
- D. BigQuery
Why: Firestore is Google Cloud's serverless NoSQL document database that supports real-time synchronization, making it well suited to mobile and web apps. Cloud SQL is a managed relational database, Cloud Spanner is a globally distributed relational database, and BigQuery is a data warehouse for analytics.
Q4. What type of database is Amazon RDS, and which engines does it support?
- A. A NoSQL key-value store supporting only DynamoDB
- B. A managed relational database service supporting engines such as MySQL, PostgreSQL, and SQL Server ✓
- C. A data warehouse for petabyte-scale analytics
- D. An in-memory cache only supporting Redis
Why: Amazon Relational Database Service (RDS) is a managed service that handles provisioning, patching, and backups for relational databases, supporting engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. DynamoDB is the NoSQL option, Redshift is the data warehouse, and ElastiCache is the caching service.
Q5. Which storage class is designed for data that is rarely accessed and can tolerate longer retrieval times in exchange for lower storage cost in AWS S3?
- A. S3 Standard
- B. S3 Glacier Deep Archive ✓
- C. S3 Intelligent-Tiering Frequent Access
- D. S3 Express One Zone
Why: S3 Glacier Deep Archive is the lowest-cost S3 storage class, intended for long-term archival data that is accessed very rarely, with retrieval typically taking hours. S3 Standard and Intelligent-Tiering Frequent Access are for frequently accessed data, and S3 Express One Zone is optimized for low-latency access rather than cost savings.
Module 4
Module 4: Networking and Security in the Cloud
Networking and Security in the Cloud
Knowledge check
Q1. Which cloud networking construct provides an isolated, private section of a public cloud where you can launch resources in a virtual network you define?
- A. Content Delivery Network
- B. Virtual Private Cloud (VPC) ✓
- C. Load Balancer
- D. Object Storage Bucket
Why: A Virtual Private Cloud (VPC in AWS and Google Cloud, or Virtual Network/VNet in Azure) is a logically isolated network in the cloud where you control IP addressing, subnets, and routing. CDNs cache content, load balancers distribute traffic, and object storage holds data, so none of those isolate a network.
Q2. What is the primary function of a security group in AWS?
- A. To encrypt data at rest in S3 buckets
- B. To act as a stateful virtual firewall controlling inbound and outbound traffic to instances ✓
- C. To assign IAM permissions to users
- D. To monitor billing anomalies
Why: Security groups are stateful virtual firewalls attached to resources such as EC2 instances. Return traffic for allowed inbound connections is automatically permitted. Encryption, IAM permissions, and billing monitoring are handled by other services.
Q3. Which term describes a subnet whose resources cannot be reached directly from the public internet?
- A. Public subnet
- B. Private subnet ✓
- C. Edge location
- D. Transit gateway
Why: A private subnet has no route to an internet gateway, so its resources cannot be accessed directly from the internet. Public subnets route traffic through an internet gateway, edge locations are CDN points of presence, and transit gateways connect multiple networks.
Q4. Which Azure service acts as a managed, stateful firewall that protects virtual network resources and can filter traffic at the network level?
- A. Azure Blob Storage
- B. Azure Firewall ✓
- C. Azure Monitor
- D. Azure Active Directory B2C
Why: Azure Firewall is a managed, cloud-native network security service that provides stateful inspection and filtering for virtual network traffic. Blob Storage holds unstructured data, Azure Monitor collects telemetry, and Azure AD B2C manages customer identities.
Q5. Why is the principle of least privilege important in cloud security?
- A. It maximizes the number of users who can access resources
- B. It reduces the potential damage from compromised credentials or misconfigurations by granting only necessary permissions ✓
- C. It eliminates the need for encryption
- D. It guarantees automatic backups of all data
Why: Least privilege limits each identity or service to only the permissions it needs. If credentials are stolen or a resource is misconfigured, the attacker's reach is restricted. It does not replace encryption or backups, and it is meant to reduce access, not expand it.
Module 5
Module 5: Serverless Computing and Functions
Serverless Computing and Functions
Knowledge check
Q1. What is the primary characteristic of serverless computing that distinguishes it from traditional virtual machine hosting?
- A. Developers must manually patch and maintain the operating system
- B. The cloud provider manages the underlying servers, so developers do not provision or maintain them ✓
- C. Applications can only run on physical on-premises hardware
- D. Code must run continuously even when no requests are being made
Why: In serverless computing, the cloud provider handles server provisioning, scaling, and maintenance, allowing developers to focus purely on writing code. Traditional VM hosting requires the customer to manage the operating system and server infrastructure.
Q2. Which AWS service is the serverless function offering that runs code in response to events without managing servers?
- A. Amazon EC2
- B. Amazon S3
- C. AWS Lambda ✓
- D. Amazon RDS
Why: AWS Lambda is AWS's function-as-a-service offering that executes code in response to triggers such as HTTP requests, file uploads, or database changes. EC2 provides virtual servers, S3 is object storage, and RDS is a managed relational database service.
Q3. Which of the following best describes the billing model commonly used by serverless functions?
- A. A fixed monthly fee regardless of usage
- B. Payment per hour for reserved server capacity
- C. Payment based on the number of invocations and the execution duration of the function ✓
- D. Payment only for the storage space the code occupies
Why: Serverless functions typically charge per invocation and for the compute time consumed during execution, often measured in milliseconds. This means you pay only when your code actually runs.
Q4. What is a common trigger for an Azure Functions app?
- A. A manual restart of the host operating system
- B. An HTTP request or a message arriving on a queue ✓
- C. A scheduled hardware firmware update
- D. A change in the physical location of the data center
Why: Azure Functions can be triggered by HTTP requests, timers, queue messages, blob storage changes, and many other events. HTTP and queue triggers are among the most frequently used.
Q5. What is a known limitation or consideration of serverless functions?
- A. They cannot respond to any kind of event
- B. They always run indefinitely without time limits
- C. Cold starts can add latency when a function has not been invoked recently ✓
- D. They require the developer to install a physical server in their office
Why: A cold start occurs when the platform must initialize a new execution environment for a function that has been idle, which can add noticeable latency to the first request. Serverless functions also typically have execution time limits, so option B is incorrect.
Module 6
Module 6: Containers and Kubernetes Orchestration
Containers and Kubernetes Orchestration
Knowledge check
Q1. What is the primary purpose of a container image?
- A. To store user data permanently across application restarts
- B. To package an application together with its dependencies so it runs consistently across environments ✓
- C. To provide a full virtual machine with its own operating system kernel
- D. To manage network traffic between cloud regions
Why: A container image bundles application code, runtime, libraries, and configuration into a single portable unit, so the application behaves the same whether it runs on a laptop, a test server, or in the cloud.
Q2. Which of the following best describes Kubernetes?
- A. A cloud provider's virtual machine service
- B. A relational database management system
- C. An open-source platform for automating deployment, scaling, and management of containerized applications ✓
- D. A serverless function runtime
Why: Kubernetes is an open-source container orchestration system originally developed by Google. It automates tasks such as deploying containers, scaling them up or down, and restarting failed workloads.
Q3. In Kubernetes, what is a Pod?
- A. A physical server in a data center
- B. A network firewall rule set
- C. The smallest deployable unit, containing one or more tightly coupled containers that share storage and network ✓
- D. A billing account for a Kubernetes cluster
Why: A Pod is the smallest object Kubernetes creates and manages. Containers within the same Pod share an IP address, port space, and can share storage volumes.
Q4. Which managed Kubernetes service is offered by Google Cloud?
- A. Amazon EKS
- B. Azure Kubernetes Service (AKS)
- C. Google Kubernetes Engine (GKE) ✓
- D. AWS Fargate
Why: Google Kubernetes Engine (GKE) is Google Cloud's managed Kubernetes service. Amazon EKS is AWS's equivalent, and AKS is Microsoft Azure's.
Q5. What does a Kubernetes Deployment primarily ensure?
- A. That containers are billed at the lowest hourly rate
- B. That a specified number of identical Pod replicas are running and can be updated in a controlled way ✓
- C. That all containers are stored in a single region
- D. That application source code is automatically compiled
Why: A Deployment declares the desired state for a set of Pod replicas. Kubernetes continuously works to match that state and supports rolling updates and rollbacks.
Module 7
Module 7: Cost Management and Multi-Cloud Strategy
Cost Management and Multi-Cloud Strategy
Knowledge check
Q1. Which AWS tool helps you visualize and analyze your cloud spending over time to identify trends?
- A. AWS CloudTrail
- B. AWS Cost Explorer ✓
- C. AWS Config
- D. AWS Trusted Advisor
Why: AWS Cost Explorer provides interactive charts and reports that let you view, filter, and forecast your AWS costs and usage over time. CloudTrail records API activity, Config tracks resource configurations, and Trusted Advisor offers best-practice recommendations, but none focus primarily on spending visualization.
Q2. What is the main benefit of using tags on cloud resources for cost management?
- A. Tags automatically reduce the price of resources
- B. Tags allow costs to be grouped and allocated to teams, projects, or environments ✓
- C. Tags encrypt billing data for security
- D. Tags are required to launch any virtual machine
Why: Resource tags are key-value labels such as project=marketing or environment=dev. They let you break down and allocate costs by business unit, project, or environment in billing reports, making chargeback and showback possible. Tags do not change prices, encrypt data, or act as launch requirements.
Q3. What is a key reason organizations adopt a multi-cloud strategy?
- A. To avoid all forms of cloud billing
- B. To reduce vendor lock-in and leverage the best services from different providers ✓
- C. To eliminate the need for any network connectivity
- D. To ensure that only one cloud provider has access to their data
Why: Multi-cloud strategies help reduce dependence on a single vendor (vendor lock-in), improve resilience, and allow teams to choose the best service from each provider for specific workloads, such as using one provider's AI tools and another's database offerings.
Q4. Which Azure feature lets you set a spending threshold and receive notifications when costs approach or exceed it?
- A. Azure Budgets ✓
- B. Azure Blueprints
- C. Azure Monitor Logs
- D. Azure Policy Initiatives
Why: Azure Budgets allow you to define a cost limit for a subscription or resource group and configure alerts at specified percentages of that budget. Blueprints and Policy deal with governance and compliance, and Monitor Logs collect telemetry, none of which are designed primarily for budget alerting.
Q5. Which pricing model is best suited for a workload that runs continuously for one to three years with predictable usage?
- A. On-demand pricing
- B. Spot or preemptible instances
- C. Reserved or committed use discounts ✓
- D. Pay-per-request serverless pricing
Why: Reserved Instances (AWS, Azure) and Committed Use Discounts (Google Cloud) offer significant savings in exchange for committing to a term of one or three years for predictable, steady workloads. On-demand pricing is more expensive for constant use, spot instances suit interruptible workloads, and serverless pricing suits variable, event-driven workloads.