8.4 Knowledge Check - Best-Practice Architecture

1.

A FinCorp tier must scale out automatically under variable load. An architect configures a VM Auto Scaling group with a scale-out threshold at 70% CPU and a scale-in threshold at 50% CPU, expecting the 20-point band to hold the group steady. The platform rejects the policy. Which rule has been violated, and what is the correct design principle?

A VM Auto Scaling requires the scale-in and scale-out thresholds to be separated by at least 40 percentage points; the 20-point band is rejected because too narrow a dead band lets a single noisy metric reading trigger a scale-out and an immediate scale-in. B The thresholds must be identical so the group scales symmetrically; any gap at all is rejected as ambiguous. C The scale-in threshold must be higher than the scale-out threshold, so 50% and 70% are the wrong way round. D A single metric policy may only use network bytes, not CPU utilisation, so the policy is rejected on the metric rather than the thresholds.

2.

An architect has produced a functionally complete design for FinCorp's regulated containerised processing, running it on Managed Kubernetes, and now applies the sovereignty and attestation filter. The workload contractually requires BSI C5 coverage. What does the filter reveal, and what is the correct conclusion?

A Managed Kubernetes is not in the C5 attestation scope, so although the choice is functionally sound it fails the scope filter; the C5-required workload must be placed on a C5-covered service such as Compute Engine instead. B Managed Kubernetes carries C5 because IONOS holds the C5 attestation, so the platform-wide credential covers every managed service and the design passes unchanged. C The filter is applied first, so the design should have started from C5 scope; because it did not, the whole architecture must be discarded and rebuilt from scratch. D C5 and IT-Grundschutz cover the same set of services, so since Managed Kubernetes sits under IT-Grundschutz it automatically satisfies the C5 requirement too.

3.

In the reference architecture, the request path is deliberately layered: a public balancer at the edge and a private balancer in front of the data tier. An engineer proposes a single Layer 4 NLB at both positions to standardise, and proposes wrapping each managed balancer in a Network Security Group for filtering. Why does the reference design reject both proposals?

A A single Layer 7 ALB should sit at both positions instead, because Layer 7 content routing is needed equally at the edge and on the internal east-west path to the database. B The proposals are sound; the two-altitude split and the choice of balancer layer are interchangeable, and an NSG attached to a managed balancer is the correct place for filtering. C Layer 7 belongs at the public edge for content-aware routing and TLS termination, while Layer 4 belongs internally for fast TCP pass-through with the backend keeping its certificate; and neither managed balancer accepts an NSG or an IP allowlist, so filtering must live on the targets behind them. D Both balancers should be replaced by Cloud DNS health-check routing, since DNS performs load balancing and applies Network Security Group rules at the resolver.

4.

The capstone build stitches the per-module pieces into one VDC. A team provisions resources in this order: they create the private Layer 4 NLB, then the data-tier servers it should serve, then a NAT Gateway, and they expect private workloads to reach the internet as soon as the NAT Gateway exists. Which assessment of their sequence is correct?

A The sequence is correct, because the platform reorders the work automatically and a balancer can be created before its targets without consequence. B Only the NAT step is wrong; the NLB can safely be created before its targets because it discovers them automatically once they appear. C Both steps are fine as long as the NAT Gateway has a reserved public IP, because the default route is configured by the platform whenever a gateway is attached. D Both steps are wrong: a balancer needs its targets first, so the data-tier servers must exist before the NLB that serves them, and a NAT Gateway provides no egress until the private LAN's default route is repointed at it, because the platform does not make that routing change for you.

5.

FinCorp's auditor asks the architect to show, service by service, which BSI recognition covers each component of the deployed design. The architect must answer precisely rather than claiming the platform is certified. Which statement reflects the correct service-by-service compliance mapping?

A Both BSI recognitions are platform-wide, so every managed service in a German data center is covered by both C5 and IT-Grundschutz, and the auditor can be told the platform is certified. B C5 covers Managed Kubernetes and Backup, while IT-Grundschutz covers Cloud Cubes, so the two recognitions never overlap on any service. C C5 covers exactly Compute Engine, Cloud Cubes, and Object Storage; IT-Grundschutz covers exactly Compute Engine, Object Storage, Backup, and Managed Kubernetes; the scopes diverge, so Cubes sit under C5 but not IT-Grundschutz, while Managed Kubernetes and Backup sit under IT-Grundschutz but not C5. D Compliance is the same for every service, so naming a credential, a service, and a data-center location adds nothing the auditor needs.