Practice Questions with Worked Solutions

On-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.

On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

Scalability is can it get bigger. Elasticity is can it get bigger and then smaller again, automatically. The test: what does it cost when nobody is using it?

Compute billed as a metered utility, like electricity. The cloud is utility computing that finally worked, because virtualization made the meter fine-grained.

A grid shares work; a cloud sells capacity.

Infrastructure, Platform, Software as a Service. The boundary is where "you manage it" stops — IaaS at the OS, PaaS at the runtime, SaaS at the application.

PaaS. Your code targets their runtime, build system and scaling semantics. Moving a VM is a disk image; moving a PaaS app is a rewrite.

Type 1 runs on the hardware (ESXi, KVM, Nitro — the cloud). Type 2 runs on a host OS (VirtualBox, VMware Workstation).

A VM virtualizes hardware and has its own kernel; a container virtualizes the OS and shares the host kernel.

CPU is time-sliced and degrades gracefully; a memory page is either resident or on disk, so memory overcommit fails as a cliff.

Server, storage, network, desktop, application, data.

Network virtualization — a private network over shared physical switches. It is what makes multi-tenancy safe.

Public, private, community, hybrid.

No. It means single-tenant. AWS Outposts and dedicated hosts are private clouds in someone else's building.

Block (EBS), file (EFS), object (S3).

Object storage. raw/2026/sales.csv is one key with two slashes; the folder tree is common prefixes computed at list time.

The key is the identity. A rename is a copy plus a delete — a full read and a full write.

180 days. Delete after 10 and you are billed for 180.

Egress. Ingress is free.

$92.16 — as much as storing that terabyte for 3.9 months.

Writes a delete marker. The data is still there and still billed.

RPO — how much data you can afford to lose. RTO — how long you can afford to be down.

No query by value without a secondary index — any query not beginning with the partition key is a full scan.

Columnar, indexless, and billed on bytes scanned rather than on the box.

Bytes scanned — $6.25 per TB on demand.

No. It limits rows returned, not bytes scanned.

Warehouse compute got cheap and elastic. Landing raw data means a bug is fixed by re-running SQL, not by re-extracting from a source that may have changed.

1. An explicit deny anywhere wins. 2. Otherwise an allow grants.
2. Otherwise implicit deny.

No. Verified: still denied. There is no "more specific allow wins" rule.

No. Unlike a firewall list, it is not first-match — every statement is evaluated, then the three rules decide.

A user has long-lived credentials; a role provides temporary, auto-rotated ones and is assumed by a service.

It has an execution role attached, so no credential is ever written to disk.

SaaS for a model and IaaS for a GPU. They are not new service models.

One definition of a feature, served to training and serving — it prevents training/serving skew.

Fits many models, cross-validates each, and ranks them. It is a search.

Notice that your target leaks; choose a threshold fitting the business cost of an error. (Also: decide the target, explain a prediction, notice unfairness.)

Up = a bigger machine, no code changes, near-perfect efficiency. Out = more machines, distributed code, sub-linear returns.

Run the model. A health check doing real inference kills healthy containers whenever the model is merely slow.

Measured: twenty latencies with one 900 ms outlier gave a mean of 85 ms and a p99 of 737.5 ms. The mean never fires.

Invocations == 0 for an hour. Every performance metric looks perfect and it still bills.

Data drift — the input distribution changed. Concept drift — the relationship between input and output changed.

Real-time (the full instance), serverless (zero), batch (zero).

About $70/month.

5xx means your service is broken and should page someone. Returning 500 for malformed input poisons your error alarm.

37× — 181.85 ms for 100 single-row requests against 4.90 ms for one batched request.

Use them as a test, which is what they are for. A virtualized datacentre where developers raise a ticket and wait two days has resource pooling and nothing else. It is a virtualized datacentre, which is useful, and calling it a private cloud is marketing.

And elasticity is the one most often misread: it includes scaling in. A system that scales out and never back in has scalability without elasticity, and it costs you the peak at 3 a.m.

Read the table by finding where "you" stops. IaaS gives a machine and you patch it; PaaS gives a runtime and you deploy code; SaaS gives an application.

And the counter-intuitive part: lock-in is worst at PaaS, the middle option — because your code targets their runtime, their build and their scaling model. Moving a VM is a disk image; moving a PaaS application is a rewrite.

Overcommit is allocating more virtual resource than the host physically has, betting that guests will not all use their allocation at once.

Measured, on a 32 GB / 8 vCPU host with four guests:

allocated RAM  : 48 GB  (1.50x)      allocated vCPU : 20 on 8  (2.50x)
RAM actually touched : 22.8 GB       swapping : 0.0 GB

Then one guest goes from 20% to 95% active:

RAM actually touched : 34.8 GB       swapping : 2.8 GB

And now every guest is slow, not just the greedy one.

The asymmetry: a vCPU is a scheduling entity, so 4:1 means everyone runs at a quarter speed — linear and graceful. A memory page is either resident or on disk, and a swapped page costs roughly 100,000× a resident one — a cliff.

That is the "noisy neighbour" problem, and it is why cloud instance types quote dedicated memory and only burstable CPU.

Measured, per terabyte per month: EFS $307.20, EBS $81.92, S3 $23.55. EFS costs 13× S3 — worth it precisely when several instances must share a POSIX filesystem, and a mistake for a dataset one job reads once.

And provisioned against consumed: a 1 TB EBS volume holding 200 GB bills $81.92 against S3's $4.60 — a factor of 18, because EBS bills the volume you asked for.

1 TB for a year, retrieved once:

Read the two ratios separately. Deep Archive storage is 23× cheaper; add one retrieval and the all-in saving is 8.7×, because the retrieval fee ($20.48) exceeds a year of its storage ($12.17). The headline discount is not the discount.

And the reversal — the same TB retrieved twice a month:

Standard is now cheapest. "We moved everything to IA to save money" is how a bill goes up.

Plus the minimum durations: delete a Deep Archive object after 10 days and you are billed for 180. A storage class is a bet on your access pattern, and the penalties are what make it a bet.

Three rules, in order:

1. An explicit Deny anywhere wins. Always, unconditionally.
2. Otherwise, a matching Allow grants access.
3. Otherwise, deny — the implicit deny, which is why a new principal can do nothing.

Verified against a realistic policy set:

Rows 2 and 3 together are the lesson: a Deny scoped to one prefix beats an Allow scoped to the bucket. That is how a data lake keeps a raw zone immutable.

And the demonstration that matters: attach a policy granting s3:* on *, and s3:PutObject on raw/ is still denied. There is no "more specific allow wins" rule; to lift a Deny you must remove it.

Policy order is irrelevant — reversed, the answer is identical. IAM is not first-match.

"Late data is normal" is the row that changes the design. A streaming aggregate for 09:00 is not final at 10:00, so either you accept eventual correctness or you keep a watermark and re-emit.

The batch leg has no such problem, which is exactly why Lambda keeps both — and why Kappa removes the batch layer by making the stream replayable. Lambda's real cost is the same rule living in two codebases and drifting.

And the failure with no error message: training on batch and serving on streaming produces training/serving skew — the model sees a feature distribution it never trained on, and every metric stays green. A feature store exists for exactly this.

Measured, over a day with peak 1,000 req/s and instances serving 150:

The third row costs 12% MORE than fixed capacity while dropping nothing.

The mechanism: a scaling decision takes effect one observation late, so the group overshoots on the way up and, with a short scale-in cooldown, oscillates rather than settling. You buy more than the peak, plus every extra instance's boot time.

"Autoscaling saves money" is a claim about a tuned autoscaler. The fix is a higher scale-out threshold, a longer scale-in cooldown, a capped maximum — and measuring, because the curve is specific to your traffic.

The three types, by access unit:

Per terabyte per month: EFS $307.20, EBS $81.92, S3 $23.55. EFS is 13× S3 and earns it only when several instances share a POSIX filesystem. And a 1 TB EBS volume holding 200 GB bills $81.92 against S3's $4.60 — because EBS bills what you asked for.

Object storage has no directories. raw/2026/01/sales.csv is one key with three slashes; a listing with a delimiter returns common prefixes computed at list time. A prefix scan is the only query it supports — no WHERE, no index.

And no rename. Measured: a rename read 1,024 bytes, wrote 1,024 and made 2 API calls. At 5 TB that is 10 TB moved for a tidier folder name.

Storage classes are a bet on access frequency:

Standard wins outright at two retrievals a month, because the "cheap" tiers charge per GB retrieved. And Deep Archive's 23× storage discount becomes 8.7× all-in after one retrieval, with a 180-day minimum and a 12-hour restore.

Egress is the line nobody predicts: 1 TB in is free; 1 TB out is $92.16, or 3.9 months of storing it. That asymmetry is the mechanism behind lock-in — your data is not held hostage, it is simply expensive to move — and it is why "move the compute to the data" survived into the cloud.

Use cases follow from the arithmetic: backup → IA with a lifecycle to Glacier; archive → Deep Archive; DR → cross-region replication with a tested restore; content delivery → CDN, where cheaper egress, not latency, is the real saving.

The six steps, and what goes wrong at each.

1. Identify the data. Find where it already lives — moving data is the expensive part. Check freshness, access (an IAM role, not keys), and legality. And ask whether a label exists: many "ML projects" are really "label 50,000 examples first" projects, and finding that out in week six is expensive.

2. Feature engineering. Compute features where the data is — a GROUP BY in the warehouse beats exporting a terabyte. Use a feature store, because the alternative is training/serving skew. And this is where leakage happens: a feature computed from a table already containing the outcome scores brilliantly and fails in production, with no error message.

3. Training. The job is declarative. Three conventions are the whole interface: hyperparameters as arguments, channels as environment variables, and the model written to SM_MODEL_DIR — get the last wrong and the job "succeeds" with no artefact. Spot training is up to 70% cheaper, and without checkpoint_s3_uri an interruption restarts from zero.

And instance choice is answered by the algorithm:

171× — and gradient boosting on tabular data has no GPU code path.

4. Validation. Everything from Machine Learning. Quote the dummy:

94.67% is 10.3 points over a dummy, and the F1 is what shows anything was learned.

5. Deployment. The artefact — 138,945 bytes here — is the deliverable. The endpoint's predictions must be identical to the model in-process, and that equality is the test worth writing. /ping must not run the model. Malformed input must be 4xx, not 5xx, or your error alarm fires for other people's bugs.

Choose the shape from the duty cycle:

And measured: 100 single-row requests took 37× one batched request, none of it the model. Scoring a file through an endpoint is the expensive way to do arithmetic.

6. Monitoring. Alarm on p99, not the mean — twenty latencies with one 900 ms outlier gave a mean of 85 ms and a p99 of 737.5 ms. Alarm on 5xx, on spend, and on Invocations == 0, because a dead endpoint looks perfect and bills the same.

Then retrain, triggered by schedule, drift or performance — as a pipeline, not a person, promoted through a champion/challenger gate and a canary.

The last row is what is new. BigQuery at $6.25/TB scanned:

The same question, 500× the price — column projection and partition pruning, which are Big Data Technologies' techniques saving money instead of time. That is why SELECT * is a billing incident on serverless and merely rude on a server you own. And LIMIT 10 does not help: it limits rows returned, not bytes scanned.

Redshift at $1.086/node-hour: 2 nodes is $1,585.56/month.

$$\text{break-even} = \frac{1585.56}{6.25} \approx \textbf{254 TB scanned per month}$$

Below it, on-demand is cheaper and costs nothing when idle. Above it, the cluster is cheaper and an extra query is free at the margin.

And four non-price reasons for provisioned: predictable spend; no per-query blast radius; sustained concurrent dashboard load; data locality with the rest of the estate. The counter: a spiky workload pays nothing during quiet weeks on serverless and the full rate every hour on a cluster.

ELT replaced ETL because warehouse compute got cheap and elastic — a transformation bug is then fixed by re-running SQL on raw data rather than re-extracting from a source that may no longer hold the old rows, exactly the DELETE problem Big Data Technologies found in Sqoop.

Identity, first.

1. MFA on root, then never use root. Create IAM users, or better, federate with the college's identity provider.

2. Roles, not keys. Notebooks get an execution role; nothing writes an access key to disk. git history is where access keys go to be found.

3. Least privilege, scoped by prefix. The measured comparison: a *:* policy and a two-statement scoped policy both let the training job run, but only one also permits iam:CreateUser and ec2:TerminateInstances.

4. A Deny on the raw zone, which cannot be defeated by any later Allow — demonstrated: adding full S3 admin left s3:PutObject on raw/ still denied.

Cost control, second, and on day one.

1. A budget alarm at 50%, 80%, 100%.

2. EstimatedCharges alarm — remembering it lives only in us-east-1 and lags about six hours.

3. Invocations == 0 on every endpoint — a dead endpoint bills $70/month and looks perfect on every performance metric.

4. Idle-shutdown lifecycle policies on notebooks. An m5.xlarge left running is ~$140/month.

5. Lifecycle rules on every versioned bucket, including AbortIncompleteMultipartUpload — abandoned parts are invisible in s3 ls and billed for ever.

6. Tag everything by student and project, so Cost Explorer can attribute spend.

Storage, third.

• Raw data → S3, partitioned, Parquet, with a lifecycle to IA at 30 days.

• Not EFS, unless several instances genuinely share a POSIX filesystem — 13× S3 for a feature nobody is using.

• One region, so nothing bills invisibly elsewhere and no cross-region egress appears.

Compute, fourth.

• Spot for training with checkpoints; on-demand for anything interactive.

• Instance chosen by the algorithm, not ambition — 171× for the same speed is the figure to quote.

• A weekly sweep: describe-instances, s3 ls, list-endpoints. Nothing else in the course saves as much money.

And the operational rule that matters most: nothing you forget to switch off will switch itself off.

Virtualization is what makes the cloud possible, because you cannot hand back half a physical server. A hypervisor gives three properties:

• Partitioning — one machine, many isolated guests → multi-tenancy

• Isolation — a breach in one does not reach another → you can sell to strangers

• Encapsulation — a whole machine is a file → snapshots, cloning, live migration, images

Encapsulation is the underrated one. An AMI is a file, which is why an EC2 instance starts in forty seconds.

Type 1 (ESXi, KVM, Nitro) runs on the hardware and is what the cloud uses; type 2 (VirtualBox) runs on a host OS. Containers are a third thing: they virtualize the OS, share the kernel, start in milliseconds and isolate less. Providers run containers inside VMs to get both.

Overcommit, measured: 48 GB allocated on a 32 GB host ran with zero swapping at 22.8 GB touched, and began swapping 2.8 GB when one guest went from 20% to 95% active — slowing every guest, not just the greedy one. CPU degrades gracefully; memory falls off a cliff.

The four deployment models:

Private means single-tenant, not on-premises.

Recommendations:

• A bank — hybrid. Identifiable customer data and the core ledger stay private, for residency and audit; analytics and development run public. The hard part is data gravity: a design that moves terabytes across the boundary daily is expensive in a way the diagram hides.

• A university — public, plus a community cloud where one exists for research data with shared compliance requirements. Teaching workloads are bursty and seasonal, which is exactly the elasticity argument.

• A startup — public, entirely. There is no capital to spend, no operations team, and the requirement is to move fast and stop paying for what fails. A private cloud for a startup is a capital purchase in place of a product.