Platform Engineering Leadership

Write a platform-engineering user story with testable acceptance criteria from a stakeholder requirement.

Organize epics, features, user stories, and tasks into a traceable hierarchy in Azure Boards.

Configure an Azure Boards sprint workflow that exposes ownership, progress, and blockers.

Configure Kanban columns, work-in-progress limits, and explicit policies for platform operations work.

Create Azure Boards queries and a dashboard that report delivery progress and impediments.

Map Jira issue types and workflows to Azure Boards and define a release-readiness approval flow.

Author and validate a JSON document for a cloud-resource configuration.

Author and validate a YAML document while avoiding indentation and type-conversion errors.

Convert configuration data between JSON and YAML without changing its meaning.

Use Python variables, scalar types, and collections to represent infrastructure data.

Use Python conditionals and loops to process a collection of cloud resources.

Write and call Python functions with parameters, return values, and type hints.

Read a configuration file in Python and report malformed or missing values with clear errors.

Apply the Azure hierarchy of tenants, management groups, subscriptions, resource groups, and resources to an access-control scenario.

Distinguish Microsoft Entra ID authentication from Azure RBAC authorization.

Select an Azure built-in role and assignment scope that satisfies least-privilege requirements.

Create and validate an Azure role assignment at resource-group scope.

Define a custom Azure role from a set of permitted and excluded operations.

Choose among users, groups, service principals, managed identities, and workload identities for a platform scenario.

Configure an eligible privileged role assignment and activation controls with Microsoft Entra Privileged Identity Management.

Diagnose an Azure access failure by tracing identity, role definition, assignment, scope, and deny conditions.

Create an isolated Python project with a virtual environment and pinned dependencies.

Load automation parameters securely from YAML, JSON, and environment variables in Python.

Authenticate a Python automation script to Azure with DefaultAzureCredential.

List and filter Azure resources with the Azure SDK for Python.

Implement an idempotent Azure resource update in Python with explicit exception handling.

Write JavaScript functions that transform arrays and objects from an Azure resource response.

Use promises and async/await to handle an asynchronous operation in Node.js.

Authenticate a Node.js script and call an Azure management API without embedding credentials.

Distinguish secrets, cryptographic keys, and certificates by purpose and lifecycle.

Design an Azure Key Vault deployment with appropriate RBAC, network access, and tenant boundaries.

Create versioned secrets and keys in Azure Key Vault and retrieve their identifiers.

Retrieve a Key Vault secret from an application by using a managed identity.

Configure rotation and expiration controls for a Key Vault secret or key.

Configure soft delete, purge protection, backup, and recovery for Azure Key Vault.

Enable and interpret Azure Key Vault diagnostic logs for access auditing.

Compare Azure Key Vault and HashiCorp Vault for static secrets, dynamic secrets, authentication, and operating responsibility.

Decompose a cloud application into presentation, application, domain, integration, and data responsibilities.

Apply relevant Twelve-Factor App principles to the configuration and operation of a cloud-native service.

Choose between a modular monolith and microservices for a stated set of scaling and team constraints.

Define a microservice boundary from business capabilities and data-ownership requirements.

Design a REST API contract with resource-oriented URLs, methods, status codes, and idempotency behavior.

Build a Postman collection that validates authentication, responses, errors, and environment variables for an API.

Choose between queues and publish-subscribe events for an asynchronous integration scenario.

Select appropriate Azure application, API, and messaging services for a reference architecture.

Model a PostgreSQL schema using tables, primary keys, foreign keys, constraints, and indexes.

Write PostgreSQL queries using filters, joins, grouping, and aggregation.

Use a PostgreSQL transaction to preserve consistency during a multi-step update.

Explain how isolation levels and locking affect concurrent PostgreSQL operations.

Model a MongoDB document and select embedding or referencing for a given access pattern.

Write MongoDB queries and updates against a document collection.

Implement a Redis cache entry with an appropriate key design, expiration policy, and invalidation strategy.

Select PostgreSQL, MongoDB-compatible storage, or Redis for an Azure workload based on consistency, query, scale, and latency requirements.

Distinguish container images, running containers, registries, and persistent data.

Write a Dockerfile that packages a simple API with explicit dependencies and startup behavior.

Build, run, inspect, and view logs for a Docker container locally.

Configure container ports, environment variables, and bind mounts at runtime.

Persist application data with a named Docker volume.

Define a multi-container application with Docker Compose.

Harden a container image using a minimal base image, multi-stage build, and non-root user.

Tag and push a container image to Azure Container Registry and verify its stored metadata.

Explain how the Kubernetes control plane reconciles declared state through controllers and the scheduler.

Author Kubernetes manifests for a Deployment and a ClusterIP Service.

Externalize workload configuration with ConfigMaps and Secrets.

Configure readiness, liveness, and startup probes for a containerized service.

Set CPU and memory requests and limits for a Kubernetes workload.

Deploy an image from Azure Container Registry to Azure Kubernetes Service.

Expose an AKS workload through an ingress resource and ingress controller.

Troubleshoot a failed Kubernetes workload using kubectl status, describe, logs, and events.

Explain how Istio's control plane, Envoy proxies, and sidecar injection form the service-mesh data path.

Install Istio on a Kubernetes cluster and enable sidecar injection for a namespace.

Route inbound traffic with an Istio Gateway and VirtualService.

Split service traffic between versions with VirtualService weights and DestinationRule subsets.

Configure timeouts, retries, and circuit breaking for service-to-service calls.

Inject a controlled service failure to test application resilience.

Enforce mutual TLS and workload authorization for traffic between two services.

Trace a service request with Istio telemetry and determine whether a service mesh is justified for the workload.

Design an Azure management-group and subscription hierarchy for policy inheritance and separation of duties.

Distinguish Azure Policy definitions, initiatives, assignments, exemptions, and remediation tasks.

Select audit, deny, modify, or deploy-if-not-exists effects for a governance requirement.

Author a parameterized Azure Policy definition for a resource-governance rule.

Write an Open Policy Agent Rego rule that evaluates structured deployment input.

Create automated positive and negative tests for a Rego policy.

Enforce a Kubernetes admission rule on AKS with OPA Gatekeeper constraint templates and constraints.

Design a versioned policy-as-code lifecycle that combines Azure Policy, OPA, review, testing, deployment, and exception handling.

Translate a platform scenario into prioritized backlog items, acceptance criteria, and release-readiness checks.

Create a context and container architecture diagram for an Azure-hosted platform workload.

Produce an architecture decision record comparing alternative Azure compute, messaging, and data services.

Create an identity and secret-access matrix for users, automation, and application workloads.

Build a credential-free Azure inventory script that reports resources against an architectural rule.

Package a sample API as a hardened container and publish it to Azure Container Registry.

Deploy the sample API to AKS with external configuration, health probes, ingress, and Key Vault access.

Evaluate the completed platform design against reliability, security, operability, governance, and delivery criteria.