Platform Engineering Leadership

Write a platform-engineering user story with testable acceptance criteria from a stakeholder requirement.

Organize epics, features, user stories, and tasks into a traceable hierarchy in Azure Boards.

Configure an Azure Boards sprint workflow that exposes ownership, progress, and blockers.

Configure Kanban columns, work-in-progress limits, and explicit policies for platform operations work.

Create Azure Boards queries and a dashboard that report throughput, cycle time, delivery progress, and impediments.

Configure a small Jira issue hierarchy and workflow equivalent to a given Azure Boards process, including an approval transition.

Distinguish JSON and YAML data types, mappings, sequences, and nesting in configuration files.

Author and validate a JSON document for a cloud-resource configuration.

Author and validate a YAML document while avoiding indentation and type-conversion errors.

Use Python variables, scalar types, and collections to represent infrastructure data.

Use Python conditionals and loops to process a collection of cloud resources.

Write and call Python functions with parameters, return values, and type hints.

Read a configuration file in Python and report malformed or missing values with clear errors.

Create an isolated Python project with a virtual environment and pinned dependencies.

Apply the Azure hierarchy of tenants, management groups, subscriptions, resource groups, and resources to an access-control scenario.

Distinguish Microsoft Entra ID authentication from Azure RBAC authorization.

Select an Azure built-in role and assignment scope that satisfies least-privilege requirements.

Create and validate an Azure role assignment at resource-group scope.

Define a custom Azure role from a set of permitted and excluded operations.

Choose among users, groups, service principals, managed identities, and workload identities for a platform scenario.

Configure an eligible privileged role assignment and activation controls with Microsoft Entra Privileged Identity Management.

Diagnose an Azure access failure by tracing identity, role definition, assignment, scope, and deny conditions.

Load non-secret automation parameters from YAML or JSON and load secrets from environment variables in Python.

Authenticate a Python automation script to Azure with DefaultAzureCredential.

List and filter Azure resources with the Azure SDK for Python.

Implement an idempotent Azure resource update in Python with explicit exception handling.

Initialize a Node.js project and use JavaScript variables, arrays, objects, and functions to represent resource data.

Write JavaScript functions that transform arrays and objects from an Azure resource response.

Use promises and async/await to handle an asynchronous operation in Node.js.

Authenticate a Node.js script and call an Azure management API without embedding credentials.

Decompose a cloud application into presentation, application, domain, integration, and data responsibilities.

Apply relevant Twelve-Factor App principles to the configuration and operation of a cloud-native service.

Choose between a modular monolith and microservices for a stated set of scaling and team constraints.

Define a microservice boundary from business capabilities and data-ownership requirements.

Design a REST API contract with resource-oriented URLs, methods, status codes, and idempotency behavior.

Build a Postman collection that validates authentication, responses, errors, and environment variables for an API.

Choose between queues and publish-subscribe events for an asynchronous integration scenario.

Select appropriate Azure application, API, and messaging services for a reference architecture.

Model a PostgreSQL schema using tables, primary keys, foreign keys, constraints, and indexes.

Write PostgreSQL queries using filters, joins, grouping, and aggregation.

Use a PostgreSQL transaction to preserve consistency during a multi-step update.

Explain how isolation levels and locking affect concurrent PostgreSQL operations.

Model a MongoDB document and select embedding or referencing for a given access pattern.

Write MongoDB queries and updates against a document collection.

Implement a Redis cache entry with an appropriate key design, expiration policy, and invalidation strategy.

Select Azure Database for PostgreSQL, Azure Cosmos DB for MongoDB, or Azure Managed Redis for a workload based on consistency, query, scale, and latency requirements.

Distinguish container images, running containers, registries, and persistent data.

Write a Dockerfile that packages a simple API with explicit dependencies and startup behavior.

Build, run, inspect, and view logs for a Docker container locally.

Configure container ports, environment variables, and bind mounts at runtime.

Persist application data with a named Docker volume.

Define a multi-container application with Docker Compose.

Harden a container image using a minimal base image, multi-stage build, and non-root user.

Tag and push a container image to Azure Container Registry and verify its stored metadata.

Explain how the Kubernetes control plane reconciles declared state through controllers and the scheduler.

Author Kubernetes manifests for a Deployment and a ClusterIP Service.

Externalize workload configuration with ConfigMaps and Secrets.

Configure readiness, liveness, and startup probes for a containerized service.

Set CPU and memory requests and limits for a Kubernetes workload.

Deploy an image from Azure Container Registry to Azure Kubernetes Service.

Expose an AKS workload through an ingress resource and ingress controller.

Troubleshoot a failed Kubernetes workload using kubectl get, describe, logs, and events.

Distinguish secrets, cryptographic keys, and certificates by purpose and lifecycle.

Design an Azure Key Vault deployment with appropriate RBAC, network access, and tenant boundaries.

Create versioned secrets and keys in Azure Key Vault and retrieve their identifiers.

Configure an AKS pod to retrieve a Key Vault secret without stored credentials by using AKS Workload Identity and the Secrets Store CSI Driver.

Configure rotation and expiration controls for a Key Vault secret or key.

Configure soft delete, purge protection, backup, and recovery for Azure Key Vault.

Enable and interpret Azure Key Vault diagnostic logs for access auditing.

Compare Azure Key Vault and HashiCorp Vault for static secrets, dynamic secrets, authentication, and operating responsibility.

Explain how Istio's control plane, Envoy proxies, and sidecar injection form the service-mesh data path.

Install Istio on a Kubernetes cluster and enable sidecar injection for a namespace.

Route inbound traffic with an Istio Gateway and VirtualService.

Split service traffic between versions with VirtualService weights and DestinationRule subsets.

Configure timeouts, retries, and circuit breaking for service-to-service calls.

Inject HTTP delay and abort faults with an Istio VirtualService to test application resilience.

Enforce strict mutual TLS between mesh services using Istio PeerAuthentication resources.

Define and apply Istio AuthorizationPolicy resources to restrict service-to-service access based on workload identities.

Design an Azure management-group and subscription hierarchy for policy inheritance and separation of duties.

Distinguish Azure Policy definitions, initiatives, assignments, exemptions, and remediation tasks.

Select audit, deny, modify, or deploy-if-not-exists effects for a governance requirement.

Author a parameterized Azure Policy definition for a resource-governance rule.

Write an Open Policy Agent Rego rule that evaluates structured deployment input.

Create automated positive and negative tests for a Rego policy.

Enforce a Kubernetes admission rule on AKS with OPA Gatekeeper constraint templates and constraints.

Design a versioned policy-as-code lifecycle that combines Azure Policy, OPA, review, testing, deployment, and exception handling.

Define release-readiness approval criteria and implement a stage-gate workflow in Azure Boards.

Create a context and container architecture diagram for an Azure-hosted platform workload.

Produce an architecture decision record comparing alternative Azure compute, messaging, and data services.

Create an identity and secret-access matrix for users, automation, and application workloads.

Build a credential-free Azure inventory script that reports resources against an architectural rule.

Deploy and expose the sample API on AKS with externalized configuration, health probes, and Istio Gateway and VirtualService routing.

Integrate Azure Key Vault with the AKS API deployment by using workload identity rather than stored credentials.

Evaluate the completed platform design against reliability, security, operability, governance, and delivery criteria.