CLO-002 Exam Questions and Answers

DynamoDB table

A DynamoDB table provides the state-locking mechanism Terraform requires when using the AWS S3 backend, acquiring a lock before any plan or apply and releasing it afterwards. This prevents concurrent CI/CD pipeline runs from modifying the same state file simultaneously, satisfying the stem's requirement to block parallel modifications.

Auto Scaling Health Checks

Auto Scaling health checks continuously probe instance and ELB status, then terminate and replace instances failing those checks, maintaining desired capacity automatically. This satisfies the requirement to replace unhealthy EC2 instances without manual intervention, unlike scaling policies that only react to demand metrics.

AWS Compute Optimizer

AWS Compute Optimizer analyses historical CloudWatch utilisation metrics for EC2 instances and returns rightsizing recommendations with over-provisioned and under-provisioned findings. This satisfies the stem's constraint of historical-utilisation-based rightsizing guidance, unlike CloudWatch alone, which only reports raw metrics without recommendations.

Azure Monitor

Azure Monitor collects platform metrics such as CPU utilisation from Azure virtual machines via the diagnostic pipeline, then visualises them in near real time through metrics explorer and dashboards, satisfying the requirement to capture and visualise fleet-wide CPU metrics.

Compliance management

Compliance management continuously audits, reports and remediates against corporate policies and regulatory frameworks, directly satisfying the stem's requirement to ensure the cloud environment adheres to security and regulatory standards rather than merely deploying or monitoring resources.

Geo-redundancy

Geo-redundancy replicates data to a secondary region, so backups survive a regional outage affecting the primary database. This directly satisfies the stem's requirement that backups reside in a different geographic region from production, distinguishing it from local redundancy, which keeps copies within a single region or availability zone.

Site-to-Site VPN

A Site-to-Site VPN creates an IPsec-encrypted tunnel between the on-premises gateway and the cloud virtual network, encrypting data in transit across the public internet. This directly satisfies the hybrid requirement that traffic between the data centre and provider stays encrypted.

AWS CloudTrail

AWS CloudTrail records every API call in the account, capturing the IAM user identity, timestamp, source IP and request parameters for each action. This event history directly satisfies the scenario's requirement to attribute unauthorised infrastructure changes to a specific IAM user, which CloudWatch metrics or configuration snapshots cannot provide.

Azure Policy

Azure Policy evaluates resources against defined rules and enforces configuration automatically, denying or remediating non-compliant VMs. It directly satisfies the requirement to enforce corporate security standards such as approved OS versions across all virtual machines without manual review.

AWS Cost Explorer

AWS Cost Explorer gives the most direct view of current resource costs and budget alerts, satisfying the budget governance constraint. It visualises spend by service and time period, and surfaces AWS Budgets alerts when thresholds are breached, unlike broader monitoring dashboards that track performance metrics rather than cost.

AWS Key Management Service (KMS)

AWS KMS stores and manages customer-managed keys, integrates with CloudTrail to log every key use for compliance auditing, and encrypts data at rest across AWS services. This satisfies both the customer-managed key and audit log requirements.

Azure SQL Advanced Data Security

Advanced Data Security bundles vulnerability assessment and Advanced Threat Protection, scanning Azure SQL Database for misconfigurations and anomalous access patterns. This satisfies the GDPR requirement to identify potential vulnerabilities and anomalies affecting stored personal data.

Data egress fees

Data egress fees are charged for outbound data leaving Azure regions or the cloud, so they rarely appear in initial migration estimates yet accumulate with ongoing query and replication traffic, making them the commonly overlooked TCO line item.

IaaS

IaaS provides virtualised compute, storage and networking where the customer controls the operating system and network configuration, while the provider handles physical hardware. PaaS and SaaS abstract away OS and network control, so they fail the control requirement.

Optimize application performance by migrating to managed services

Re-platform retains the application's core architecture while swapping components for managed cloud equivalents, such as moving to a managed database or container service. This lifts performance and reduces operational overhead without the code rewrite that re-architecting demands.

Reduced administrative overhead

SaaS removes the need for the organization to patch, scale, and maintain the CRM's underlying infrastructure; the vendor handles all of that. This directly satisfies the stem's requirement for the primary business advantage, cutting internal administrative overhead compared with managing IaaS components themselves.

Elasticity

Elasticity automatically provisions and de-provisions resources to match demand in real time, so capacity expands during seasonal peaks and contracts afterwards. This directly satisfies the requirement to scale for traffic spikes, unlike scalability, which only describes the capacity to grow without addressing dynamic, temporary demand.

Security/Compliance team

Security and compliance involvement early identifies data residency, encryption and regulatory constraints that shape the entire migration design. Addressing these before architecture is fixed prevents costly rework, since cloud readiness hinges on satisfying governance requirements that other stakeholders cannot override later.

Multi-Region deployment

Multi-Region deployment replicates workloads across geographically separate Azure regions, so a regional outage leaves another region serving traffic. This directly satisfies the stem's requirement for geographic separation to sustain availability during a regional disaster, unlike availability zones, which only span a single region.

Direct Connect

Direct Connect establishes a dedicated private fibre link between your on-premises data centre and the VPC, bypassing the public internet entirely. This satisfies the stem's core constraint of private connectivity, offering consistent latency and higher bandwidth than IPsec VPN tunnels, which route traffic over the public internet.

Public Cloud

Public cloud satisfies both constraints: multi-tenancy, where physical hardware is shared across customers, and consumption-based billing, where you pay only for resources used. It delivers these through provider-owned infrastructure, unlike private cloud (dedicated hardware) or hybrid models that combine on-premises and cloud resources.

NAT Gateway

A NAT Gateway performs source network address translation, letting instances in a private subnet initiate outbound connections to the internet while remaining unreachable inbound. This satisfies the stem's requirement: the application needs outbound access for updates, but no route to the internet exists without this component.

Removal of upfront capital costs

OpEx converts large upfront hardware and datacentre purchases into pay-as-you-go consumption charges, eliminating the initial capital outlay and its depreciation. This removal of upfront capital costs frees cash flow and shifts spending to ongoing operational budgets, which is the primary benefit of the model change.

Provisioned IOPS SSD

Provisioned IOPS SSD decouples performance from capacity, guaranteeing sustained IOPS and consistent low latency. General-purpose SSDs share throughput and can burst only briefly, so they cannot satisfy the database's demanding IOPS and latency constraint under continuous load.