Appendix C. Exam day guide

Time management strategy. You have 60 minutes to answer 35 questions, which gives you an average of roughly 1 minute and 40 seconds per question. On your first pass through the paper, answer 2-point conceptual questions and clear-cut boundary questions within 60 to 80 seconds. If a complex 3-point ordering or multi-constraint scenario question takes longer than 90 seconds, flag it and keep moving to the end of the paper first—saving your final 15 minutes to tackle flagged analytical questions methodically.

Underline the bold constraints in every scenario. On infrastructure questions, a single constraint in the prompt determines which option is right:

• "With zero downtime and without dropping active sessions": Immediately eliminate any option that overwrites a single secret key in place, runs RENAME COLUMN or DROP COLUMN directly, or lowers DNS TTL on migration day and shuts down the old server immediately. Look for Dual-Key rotation, Expand-Contract migrations, and advance TTL reduction.
• "Inside a private corporate network where no inbound firewall ports may be opened": Eliminate port forwarding and public IP security group rules; select an outbound-only cloudflared (Cloudflare Tunnel) connector or a mesh VPN Subnet Router.
• "In a high-concurrency serverless runtime (such as Vercel)": Eliminate direct or Session Mode connections on port 5432 for runtime queries; select Supavisor Transaction Mode on port 6543 and colocate the function region (icn1) with the primary database.
• "Preventing client bundle exposure and enforcing least privilege": Immediately eliminate options that prefix secrets with NEXT_PUBLIC_, call Supabase with the service_role key from client or general user routes, or set NODE_TLS_REJECT_UNAUTHORIZED=0.

Five golden rules for spotting wrong-answer traps.

1. Workarounds that turn off security controls are always wrong. Disabling RLS, turning off Deployment Protection globally, switching Cloudflare SSL to Flexible, passing -lock=false to Terraform, or setting NODE_TLS_REJECT_UNAUTHORIZED=0 is never the correct answer on the exam or in production.
2. Distinguish UI masking from actual encryption and access control. Setting sensitive = true in Terraform only hides terminal output and does not encrypt terraform.tfstate. Turning on the Cloudflare orange cloud only changes DNS responses and does not block direct-to-IP attacks if the origin firewall is left open to 0.0.0.0/0.
3. Watch out for reversed evaluation timing or direction. In PostgreSQL RLS, USING filters existing rows while WITH CHECK validates new or updated rows. In DNS migrations, lowering the TTL must happen at least one full old-TTL window before cutover day, never at the moment of cutover.
4. Never mix shared edge caching with personalized or streaming responses. Applying Cache Everything to /api/* user routes, responses carrying Set-Cookie, or SSE streams (text/event-stream) causes cache poisoning data leaks and broken streams.
5. The first step in any live incident is always mitigation (rollback, isolation, or emergency revocation). Stopping customer impact via an instant rollback, kill switch, or key revocation always comes before root-cause debugging or writing postmortem documents.