2.5 Knowledge Check - Governance, Identity, and Cost

1.

FinCorp wants to separate its non-production environment from production purely so each shows as its own line on the monthly bill, while keeping one governance and audit realm. The architect is asked whether this needs a second contract. What is the correct guidance?

A Yes; only a separate contract produces a separate billing line, so non-production must be its own contract. B No; a separate VDC already bills as its own line item within the same contract, so reserve a new contract for compliance, ownership, or legal-entity separation. C Yes; production and non-production must always be in different contracts for audit reasons. D It makes no difference, because billing is reported only at the contract level and cannot be broken down further.

2.

An architect pins FinCorp's first regulated VDC to a German region and later realises a different German region would have been preferable. What is the reality of changing it?

A The region can be changed at any time from the VDC settings, and reserved IPs migrate automatically. B The region can be changed, but only by the contract owner and only within the same country. C The region is permanent at VDC creation; because it locks reserved IPs and images (neither of which replicate across regions as a managed feature), correcting it means rebuilding the VDC. D The region is permanent, but reserved IPs and images can simply be moved to the new region on request.

3.

A FinCorp auditor needs to review activity but must not be able to change any infrastructure. The platform has no deny rule. How should the architect grant this access?

A Create a group with only the Access Activity Log right and Read-level grants on the relevant VDCs, and add the auditor to it; least privilege is achieved by granting narrowly, since there is no deny. B Make the auditor an Administrator and write a deny policy that blocks all write actions. C Grant the auditor Edit on every VDC and rely on a deny rule to remove the ability to provision. D Add the auditor to an existing operations group and tell them not to make changes.

4.

FinCorp runs a corporate identity provider and wants to federate IONOS access so that joiners are created and assigned groups automatically on first login. What must the architect tell the team?

A Federation with SAML or OIDC fully provisions accounts and maps IdP groups to IONOS groups, so no manual steps are needed. B Federation creates the IONOS account on first login but cannot assign groups, so only group assignment is manual. C Federation is authentication only: the user must already exist in IONOS, there is no just-in-time provisioning and no IdP-to-group mapping, so joiner/mover/leaver remains a manual IONOS-side runbook. D Federation requires the IONOS API token to be embedded in the IdP, after which provisioning is automatic.

5.

FinCorp will run a steady baseline of dedicated-core compute for at least three years but expects occasional bursts well above it. The architect is sizing a Savings Plan. Which approach is correct?

A Commit only the certain steady-state floor on a 3-year plan to capture the 40% discount, and let bursts above the committed quantity bill at the standard PAYG rate, because a plan cannot be edited after activation. B Commit to the expected peak usage so that bursts are also discounted, since the plan can be adjusted downward later if needed. C Avoid Savings Plans entirely, because any usage above the commitment is rejected rather than billed. D Buy a 1-year plan sized to peak, since the 1-year discount is larger than the 3-year discount.