20 câu hỏi AWS/Azure governance và operations

Repeatable identity, hierarchy, policy, logging, security, connectivity, billing and account/subscription vending; không tự vận hành workload tốt.

SCP giới hạn effective IAM permissions, không grant; Azure Policy evaluates/resource compliance/effects. Azure RBAC tương ứng authorization grant hơn.

Đều là strong billing/quota/governance boundaries nhưng hierarchy, identity/root/tenant semantics khác; không map tuyệt đối.

Separate emergency principals, strong protected credentials/MFA where supported, excluded narrowly from risky dependencies, monitored/tested/reviewed and never routine.

Quota là permitted maximum; regional physical/service capacity có thể vẫn unavailable. Forecast, request, reserve and test target region/account.

Consistent inspection/egress/DNS but routing/cost/latency/ownership and large blast radius; redundant design and bypass/emergency paths need governance.

Giảm public path nhưng identity/resource policy/DNS/route/exfiltration and endpoint policy still matter; costs and regional availability.

Missing diagnostic coverage, identity disable, cost/retention/data residency, shared compromise and deletion. Separate archive ownership/immutability and test retrieval.

Dependency groups, business criticality, downtime/data/change rate, complexity and rollback; pilot representative then factories, not random server list.

Data reconciliation, performance/SLO, identity/network/DNS, observability/backup, rollback window and source decommission criteria.

Preserve evidence, scope identities/resources/regions, revoke sessions/keys, quarantine network/resources and persisted trust without destroying logs; recover with clean credentials/config.

Highest blast radius across guardrails/accounts/subscriptions/SaaS; dedicated identities, no workloads, strong controls and external/immutable audit.

Zones address datacenter failures within region; regional DR needs replicated data/config/identity/network/quotas, routing and failback.

Restore drill proves RPO/RTO, keys/permissions/dependency order and post-restore reconciliation; copy existence alone insufficient.

Hierarchy/tags/categories and shared-cost model mapped to owners/products/unit metrics; enforce tagging but handle untaggable/shared resources.

Locks spend/usage assumptions; rightsizing and stable baseline first, model growth/modernization/region/license and coverage/utilization.

Per-hour/per-GB processing, cross-zone/region/egress and telemetry ingestion/retention; architecture path and sampling/lifecycle drive bill.

Inventory current compliance, audit/dry-run, sandbox/canary scopes, exemptions owner/expiry, remediation identity and break-glass, then progressive enforce.

Map requirement/control/data plane/failure/consistency/quota/cost and operational responsibility; names/features/regions differ.

Regulation/customer/merger/specific capability or quantified resilience; costs duplicated platform/skills/data/identity/operations, avoid checkbox portability.