Cloud Infrastructure Diagram Language
Practice describing AWS, Azure, and GCP architecture diagrams in English.
0 / 24 completed
1 / 24
An AWS diagram shows an EC2 instance inside a private subnet inside a VPC. How would you describe this?
Private subnets within a VPC isolate resources from the internet. EC2 instances in private subnets require a NAT gateway for outbound traffic.
2 / 24
A diagram shows an Application Load Balancer distributing traffic to an Auto Scaling Group. What does this describe?
ALB + Auto Scaling Group is the standard pattern for horizontally scalable, highly available web application deployments on AWS.
3 / 24
A GCP diagram shows Cloud Armor in front of a Cloud Load Balancer. What is Cloud Armor's role?
Cloud Armor is GCP's web application firewall and DDoS protection service, positioned at the network edge.
4 / 24
An Azure diagram shows a Resource Group containing a VNET, an App Service Plan, and Azure SQL. What does this imply?
Azure Resource Groups are logical containers for organizing related resources with shared lifecycle, billing, and access policies.
5 / 24
A diagram shows a multi-region deployment with Route 53 latency-based routing. What problem does this solve?
Latency-based routing directs traffic to the closest region. Multi-region deployments provide both low latency and disaster recovery capability.
6 / 24
Reviewer: 'I'm seeing this Azure diagram. We have a Function App deployed to a Consumption plan, and it's fronted by an Application Gateway. The diagram labels the Function App as having 'managed identities'. What does that mean in the context of this deployment?'Managed identities are a key feature for simplifying security. They allow Azure resources, like your Function App, to automatically authenticate with other Azure services (like storage accounts) without needing to store or manage credentials manually. This significantly reduces the risk of exposing secrets and streamlines the deployment process. Option A is incorrect because Consumption plans *are* billed per execution; option D describes a different architecture altogether.
7 / 24
Reviewer: 'Hey team, I've reviewed this diagram of the new microservice architecture. We're using a Kubernetes cluster managed by EKS, and one of the services is deployed to a separate node group with a specific security policy applied via Network Policies. The diagram labels this node group as having 'Pod Security Admission'. Can someone explain what Pod Security Admission does here?', (Slack message)Pod Security Admission (PSA) is a critical component for securing Kubernetes deployments. Incorrectly assuming it's a load balancer or scaling tool misunderstands its core function. PSA defines and enforces policies that restrict what containers can do—specifically preventing insecure practices like running privileged containers or exposing the host network, which are common vulnerabilities. This ensures your microservices operate safely within the cluster.
8 / 24
PR Description: 'Reviewers, I've updated the deployment diagram to reflect our new architecture. We're using a CloudFront distribution for static assets and an API Gateway to handle all incoming requests. The diagram labels the API Gateway as having 'origin shield' enabled. Can someone explain what origin shield does in this context and why it was chosen? It seems like a lot of overhead, but I want to ensure we're optimizing performance for our user base. The correct answer, Origin Shield, provides DDoS protection by filtering malicious traffic *before* it reaches the API Gateway. This is its primary function and why it's beneficial in this scenario – mitigating potential attacks. The other options misrepresent Origin Shield's role; caching (option 1) isn't its core purpose, and geographic routing (option 3) is handled by other services like CloudFront or API Gateways themselves. It's important to understand that origin shield adds a layer of security without significantly impacting performance due to its efficient filtering mechanism.
9 / 24
Reviewer: 'I'm looking at this diagram of our new data pipeline. We're using Azure Data Factory to orchestrate the flow from Blob Storage to a Synapse Analytics workspace. The diagram labels the Synapse Analytics workspace as having 'serverless SQL pools'. What is the primary benefit of using serverless SQL pools in this scenario, and how does it relate to the overall architecture?', The key benefit of serverless SQL pools in this context is their 'pay-per-query' pricing model. This means you only pay for the actual queries executed against the data, unlike traditional provisioned SQL pools where you pay a fixed cost regardless of usage – this dramatically reduces operational costs and simplifies scaling. Misconception: Option A incorrectly describes a fully managed SQL Server, while option C is incorrect because serverless SQL pools are designed to handle variable workloads efficiently. Option D is wrong as serverless SQL pools don't offer direct infrastructure control.
10 / 24
Reviewer: 'I'm seeing this Azure diagram. We have a Function App deployed to a Consumption plan, and it's fronted by an Application Gateway. The diagram labels the Function App as having 'managed identities'. What does that mean in the context of this deployment?'Managed identities are a key feature for simplifying security. They allow Azure resources, like your Function App, to automatically authenticate with other Azure services (like storage accounts) without needing to store or manage credentials manually. This significantly reduces the risk of exposing secrets and streamlines the deployment process. Option A is incorrect because Consumption plans *are* billed per execution; option D describes a different architecture altogether.
11 / 24
Reviewer: 'Hey team, I've reviewed this diagram of the new microservice architecture. We're using a Kubernetes cluster managed by EKS, and one of the services is deployed to a separate node group with a specific security policy applied via Network Policies. The diagram labels this node group as having 'Pod Security Admission'. Can someone explain what Pod Security Admission does here?', (Slack message)Pod Security Admission (PSA) is a critical component for securing Kubernetes deployments. Incorrectly assuming it's a load balancer or scaling tool misunderstands its core function. PSA defines and enforces policies that restrict what containers can do—specifically preventing insecure practices like running privileged containers or exposing the host network, which are common vulnerabilities. This ensures your microservices operate safely within the cluster.
12 / 24
PR Description: 'Reviewers, I've updated the deployment diagram to reflect our new architecture. We're using a CloudFront distribution for static assets and an API Gateway to handle all incoming requests. The diagram labels the API Gateway as having 'origin shield' enabled. Can someone explain what origin shield does in this context and why it was chosen? It seems like a lot of overhead, but I want to ensure we're optimizing performance for our user base. The correct answer, Origin Shield, provides DDoS protection by filtering malicious traffic *before* it reaches the API Gateway. This is its primary function and why it's beneficial in this scenario – mitigating potential attacks. The other options misrepresent Origin Shield's role; caching (option 1) isn't its core purpose, and geographic routing (option 3) is handled by other services like CloudFront or API Gateways themselves. It's important to understand that origin shield adds a layer of security without significantly impacting performance due to its efficient filtering mechanism.
13 / 24
Reviewer: 'I'm looking at this diagram of our new data pipeline. We're using Azure Data Factory to orchestrate the flow from Blob Storage to a Synapse Analytics workspace. The diagram labels the Synapse Analytics workspace as having 'serverless SQL pools'. What is the primary benefit of using serverless SQL pools in this scenario, and how does it relate to the overall architecture?', The key benefit of serverless SQL pools in this context is their 'pay-per-query' pricing model. This means you only pay for the actual queries executed against the data, unlike traditional provisioned SQL pools where you pay a fixed cost regardless of usage – this dramatically reduces operational costs and simplifies scaling. Misconception: Option A incorrectly describes a fully managed SQL Server, while option C is incorrect because serverless SQL pools are designed to handle variable workloads efficiently. Option D is wrong as serverless SQL pools don't offer direct infrastructure control.
14 / 24
Reviewer: 'I'm seeing this Azure diagram. We have a Function App deployed to a Consumption plan, and it's fronted by an Application Gateway. The diagram labels the Function App as having 'managed identities'. What does that mean in the context of this deployment?'Managed identities are a key feature for simplifying security. They allow Azure resources, like your Function App, to automatically authenticate with other Azure services (like storage accounts) without needing to store or manage credentials manually. This significantly reduces the risk of exposing secrets and streamlines the deployment process. Option A is incorrect because Consumption plans *are* billed per execution; option D describes a different architecture altogether.
15 / 24
Reviewer: 'Hey team, I've reviewed this diagram of the new microservice architecture. We're using a Kubernetes cluster managed by EKS, and one of the services is deployed to a separate node group with a specific security policy applied via Network Policies. The diagram labels this node group as having 'Pod Security Admission'. Can someone explain what Pod Security Admission does here?', (Slack message)Pod Security Admission (PSA) is a critical component for securing Kubernetes deployments. Incorrectly assuming it's a load balancer or scaling tool misunderstands its core function. PSA defines and enforces policies that restrict what containers can do—specifically preventing insecure practices like running privileged containers or exposing the host network, which are common vulnerabilities. This ensures your microservices operate safely within the cluster.
16 / 24
PR Description: 'Reviewers, I've updated the deployment diagram to reflect our new architecture. We're using a CloudFront distribution for static assets and an API Gateway to handle all incoming requests. The diagram labels the API Gateway as having 'origin shield' enabled. Can someone explain what origin shield does in this context and why it was chosen? It seems like a lot of overhead, but I want to ensure we're optimizing performance for our user base. The correct answer, Origin Shield, provides DDoS protection by filtering malicious traffic *before* it reaches the API Gateway. This is its primary function and why it's beneficial in this scenario – mitigating potential attacks. The other options misrepresent Origin Shield's role; caching (option 1) isn't its core purpose, and geographic routing (option 3) is handled by other services like CloudFront or API Gateways themselves. It's important to understand that origin shield adds a layer of security without significantly impacting performance due to its efficient filtering mechanism.
17 / 24
Reviewer: 'I'm looking at this diagram of our new data pipeline. We're using Azure Data Factory to orchestrate the flow from Blob Storage to a Synapse Analytics workspace. The diagram labels the Synapse Analytics workspace as having 'serverless SQL pools'. What is the primary benefit of using serverless SQL pools in this scenario, and how does it relate to the overall architecture?', The key benefit of serverless SQL pools in this context is their 'pay-per-query' pricing model. This means you only pay for the actual queries executed against the data, unlike traditional provisioned SQL pools where you pay a fixed cost regardless of usage – this dramatically reduces operational costs and simplifies scaling. Misconception: Option A incorrectly describes a fully managed SQL Server, while option C is incorrect because serverless SQL pools are designed to handle variable workloads efficiently. Option D is wrong as serverless SQL pools don't offer direct infrastructure control.
18 / 24
Reviewer: 'I'm seeing this Azure diagram. We have a Function App deployed to a Consumption plan, and it's fronted by an Application Gateway. The diagram labels the Function App as having 'managed identities'. What does that mean in the context of this deployment?'Managed identities are a key feature for simplifying security. They allow Azure resources, like your Function App, to automatically authenticate with other Azure services (like storage accounts) without needing to store or manage credentials manually. This significantly reduces the risk of exposing secrets and streamlines the deployment process. Option A is incorrect because Consumption plans *are* billed per execution; option D describes a different architecture altogether.
19 / 24
Reviewer: 'Hey team, I've reviewed this diagram of the new microservice architecture. We're using a Kubernetes cluster managed by EKS, and one of the services is deployed to a separate node group with a specific security policy applied via Network Policies. The diagram labels this node group as having 'Pod Security Admission'. Can someone explain what Pod Security Admission does here?', (Slack message)Pod Security Admission (PSA) is a critical component for securing Kubernetes deployments. Incorrectly assuming it's a load balancer or scaling tool misunderstands its core function. PSA defines and enforces policies that restrict what containers can do—specifically preventing insecure practices like running privileged containers or exposing the host network, which are common vulnerabilities. This ensures your microservices operate safely within the cluster.
20 / 24
PR Description: 'Reviewers, I've updated the deployment diagram to reflect our new architecture. We're using a CloudFront distribution for static assets and an API Gateway to handle all incoming requests. The diagram labels the API Gateway as having 'origin shield' enabled. Can someone explain what origin shield does in this context and why it was chosen? It seems like a lot of overhead, but I want to ensure we're optimizing performance for our user base. The correct answer, Origin Shield, provides DDoS protection by filtering malicious traffic *before* it reaches the API Gateway. This is its primary function and why it's beneficial in this scenario – mitigating potential attacks. The other options misrepresent Origin Shield's role; caching (option 1) isn't its core purpose, and geographic routing (option 3) is handled by other services like CloudFront or API Gateways themselves. It's important to understand that origin shield adds a layer of security without significantly impacting performance due to its efficient filtering mechanism.
21 / 24
Reviewer: 'I'm looking at this diagram of our new data pipeline. We're using Azure Data Factory to orchestrate the flow from Blob Storage to a Synapse Analytics workspace. The diagram labels the Synapse Analytics workspace as having 'serverless SQL pools'. What is the primary benefit of using serverless SQL pools in this scenario, and how does it relate to the overall architecture?', The key benefit of serverless SQL pools in this context is their 'pay-per-query' pricing model. This means you only pay for the actual queries executed against the data, unlike traditional provisioned SQL pools where you pay a fixed cost regardless of usage – this dramatically reduces operational costs and simplifies scaling. Misconception: Option A incorrectly describes a fully managed SQL Server, while option C is incorrect because serverless SQL pools are designed to handle variable workloads efficiently. Option D is wrong as serverless SQL pools don't offer direct infrastructure control.
22 / 24
Dev Alex sends this Slack message: 'Just noticed the deployment diagram shows a separate API Gateway instance for each microservice. Is that standard practice or are we over-engineering? 🤔' What is Alex *most* likely asking about?
Alex's question centers on the *functionality* of having separate API Gateways. While cost and scaling are potential concerns, the core issue is about how these gateways manage traffic between microservices – specifically regional clusters and routing. The other options represent secondary considerations related to gateway management.
23 / 24
Dev Sarah sends this Slack message: 'The deployment diagram shows our front-end application is deployed behind an Application Load Balancer. What's the primary benefit of using an ALB over a simple HTTP load balancer?'. What is Sarah *most* likely asking about?
Application Load Balancers (ALBs) are designed for more sophisticated routing scenarios. They support path-based routing and host header affinity—allowing you to direct traffic based on URL paths or the domain name requested. This is a key difference from basic HTTP load balancers, which primarily focus on distributing traffic across servers.
24 / 24
Dev Ben sends this Slack message: 'The diagram shows our containerized application using a service mesh. It's routing all traffic through Istio. What's the primary benefit of utilizing a service mesh in this scenario?'. What is Ben *most* likely referring to?
Service meshes (like Istio) provide a dedicated infrastructure layer for managing communication between microservices. They offer features such as traffic management, security policies, and observability—allowing you to control how services interact without modifying the applications themselves.
Frequently Asked Questions
What will I practice in "Cloud Infrastructure Diagram Language"?
This is an Architecture Diagrams exercise set. It walks through 24 scenario-based multiple-choice questions built around real usage of Architecture Diagrams terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 24 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the Architecture Diagrams vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Architecture Diagrams exercises?
See the Architecture Diagrams exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — Architecture Diagrams vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.