Cloud Concepts, Architecture and Design practice questions

Measured service: usage is metered, monitored, controlled and reported, giving transparency to both provider and consumer.

Chargeback for actual use needs metering, and NIST SP 800-145 says metered usage is reported transparently to both provider and consumer. That matches the request for reports both sides can check. The other characteristics describe how resources are provisioned, shared or reached, not how use is measured.

1. Note the need: billing based on actual consumption.
2. Note the extra detail: both sides can check the figures.
3. Pick the characteristic that defines metering and transparent reporting.

Exam tip: Pay for what you used, with figures both sides can see: measured service.

Broad network access: capabilities are reached over the network through standard mechanisms from many kinds of client platform.

The scenario stresses many device types reaching one service through standard protocols. NIST SP 800-145's definition of broad network access describes exactly this: standard mechanisms that support many kinds of thin and thick client. Multi-tenancy is a tempting pick because the service is shared, but here only one customer's users are involved.

1. List the scenario facts: many device types, standard browser or app, over the internet.
2. Match them to the characteristic about network reach through standard mechanisms.
3. Discard characteristics about sharing, scaling or tenant isolation.

Exam tip: Any device, standard protocols, over the network: broad network access.

NIST SP 800-145 is the short NIST definition of cloud computing: five essential characteristics, three service models and four deployment models.

The 'five, three, four' structure is NIST SP 800-145. The tempting distractors are the two reference architectures, NIST SP 500-292 and ISO/IEC 17789, which define roles or actors and activities rather than the characteristics. ISO/IEC 27017 is a security controls code of practice.

1. Spot the structure being cited: five characteristics, three service models, four deployment models.
2. Recall that this structure is the NIST definition, not a reference architecture.
3. Separate definition documents from reference architectures and control standards.

Exam tip: Definition (5-3-4) is SP 800-145. Reference architectures are SP 500-292 and ISO/IEC 17789.

Rapid elasticity means provisioning and releasing capacity, often automatically, to scale outward and inward with demand.

The question asks about the shrink, not the growth. Releasing capacity as demand falls is what sets elasticity apart from plain scalability, which is only the ability to take on more load. Measured service tempts because the bill drops, but that is a result of the release, not the release itself.

1. Focus on what is asked: capacity returning to its baseline.
2. Recall that elasticity covers both provisioning and releasing with demand.
3. Separate it from scalability, which is only about handling growth.

Exam tip: Scaling out is scalability. Scaling back in automatically to match demand is elasticity.

Measured service gives the consumer metered usage data. A sudden departure from normal usage is a security signal as well as a billing figure.

Usage tripling with no authorised change shows up first in metered consumption, which the measured service characteristic reports to the customer. Self-service and elasticity are what an attacker exploits to launch and grow resources, so they are tempting but describe the cause, not the evidence.

1. Name the evidence: an unexplained jump in consumption.
2. Ask which characteristic produces consumption data for the customer.
3. Separate the characteristics the attacker exploited from the one that reveals the misuse.

Exam tip: Metering is a detection source: an unexplained usage spike is a security event until proven otherwise.

Resource pooling: shared resources are assigned dynamically, and the customer usually knows location only at a higher level of abstraction.

NIST builds location independence into the definition of resource pooling. The customer can usually pick a country, state or data centre, but not the physical host. Multi-tenancy is the near-twin, because both involve shared resources, but it is about isolating tenants, not about how much is known of location.

1. Note the facts: location can be chosen at country or region level, not at host level.
2. Recall which NIST definition includes 'location independence'.
3. Rule out multi-tenancy, which is about isolation rather than location.

Exam tip: Country or region yes, rack no: that location independence is part of resource pooling.