CLO-002 Practice Test 11 — 15 Questions

Question 1

A system administrator needs to automatically replace unhealthy EC2 instances in an AWS Auto Scaling group. Which component must be configured?

Accepted Answer

Auto Scaling Health Checks. Auto Scaling Health Checks are the component that automatically detects and replaces unhealthy EC2 instances in an Auto Scaling group. When health checks are enabled, the group terminates instances that fail and launches replacements to maintain desired capacity.

Answer

CloudWatch Alarms

Answer

Elastic Load Balancer

Answer

IAM Role

Question 2

A company is adopting a cloud governance framework to manage risk and compliance. Which TWO of the following are primary objectives of a cloud governance framework? (Choose two.)

Accepted Answer

Ensuring that cloud resources are used in accordance with business policies and regulatory requirements. A cloud governance framework primarily aims to ensure compliant and policy-aligned use of cloud resources and to provide decision-making and accountability structures. Maximizing services, eliminating all risks, and automatically shutting down resources are not primary objectives. The two correct options reflect the core purposes of governance: compliance and accountability.

Answer

Reducing cloud costs by automatically shutting down all non-production resources

Answer

Eliminating all security risks associated with cloud computing

Answer

Maximizing the number of cloud services used to increase flexibility

Question 3

Which TWO of the following are key steps in a Cloud Incident Response process?

Accepted Answer

Conducting a post-incident review. Incident response requires structured preparation, containment, and post-incident analysis.

Answer

Purchasing new hardware for the data center

Answer

Notifying the cloud provider's sales team

Answer

Updating the company's social media

Question 4

Which TWO factors contribute to the risk of 'Vendor Lock-in'?

Accepted Answer

Usage of proprietary APIs. Vendor lock-in risk rises when a solution depends on technology that is proprietary and cannot be easily replicated or migrated elsewhere. Option B is correct because proprietary APIs are vendor-controlled interfaces: once an application is built against them, moving to another provider requires rewriting integration code, since those APIs are not standardized or portable. Option D is correct because custom, vendor-specific database formats store data in a schema or engine unique to that vendor, so migration demands costly conversion, export tooling, or re-architecture, making it hard to leave the vendor. By contrast, option A (standard HTTP protocols) reduces lock-in because HTTP is an open, widely implemented standard that any provider supports. Option C (open-source software) also lowers lock-in risk since the source code is available and can be run or modified elsewhere. Option E (hiring many employees) is unrelated to vendor lock-in; headcount does not create dependency on a specific vendor's technology.

Answer

Using standard HTTP protocols

Answer

Using open-source software

Answer

Hiring many employees

Question 5

A database is experiencing high I/O wait times. Which resource change is most appropriate?

Accepted Answer

Upgrade to a higher-performance storage volume. High I/O wait usually indicates slow storage; upgrading to a higher-performance storage tier (e.g., SSD) resolves this.

Answer

Increase CPU cores

Answer

Enable encryption

Answer

Reduce the number of users

Question 6

Which THREE factors should a cloud architect consider when designing for high availability?

Accepted Answer

Multi-region deployment. Multi-region deployment (C) is correct because distributing workloads across geographically separate regions protects against region-wide failures and satisfies disaster-recovery and latency requirements for high availability. Automated health checks and failover (D) are correct because continuous monitoring of instance or service health, combined with automatic failover (for example, via Route 53 health checks, Auto Scaling, or RDS Multi-AZ failover), removes single points of failure and minimizes downtime without manual intervention. Load balancing across availability zones (E) is correct because an elastic load balancer spreading traffic over multiple AZs ensures that the loss of one data center does not take the application offline. Centralizing all resources in a single region (A) is not appropriate because it concentrates risk and creates a single point of failure, and fixed-capacity hardware provisioning (B) is not appropriate because it prevents the elastic scaling and rapid replacement of failed capacity that high availability designs require.

Answer

Centralizing all resources in a single region

Answer

Fixed-capacity hardware provisioning

Question 7

Which THREE of the following are characteristics of a 'Defense in Depth' security strategy?

Accepted Answer

Multiple layers of security controls. Option A is correct because Defense in Depth is fundamentally built on layering multiple, overlapping security controls so that if one control fails, others still provide protection. Option D is correct because an effective Defense in Depth strategy combines physical controls (e.g., locks, guards), technical controls (e.g., firewalls, IDS/IPS, encryption), and administrative controls (e.g., policies, training, procedures) rather than relying on a single control category. Option E is correct because Defense in Depth applies controls at multiple tiers of the stack — application, network, and data levels — so that threats must be defeated at several points before reaching critical assets. Option B is incorrect because depending on a single firewall creates a single point of failure, which is the opposite of a layered defense. Option C is incorrect because focusing only on the network perimeter ignores internal threats, lateral movement, and endpoint/application/data protections that Defense in Depth requires.

Answer

Relying on a single firewall for all protection

Answer

Focusing only on the network perimeter

Question 8

Which TWO of the following are benefits of using a Content Delivery Network (CDN)?

Accepted Answer

Decreased load on origin servers. Option A is correct because a CDN caches static and dynamic content at edge locations, so a large share of user requests are served by the CDN's points of presence instead of the origin, directly decreasing the request volume and load on the origin servers. Option B is correct because CDN edge nodes are geographically distributed and terminate requests close to the end user, shortening the network round-trip and reducing latency (and often improving throughput) compared with fetching everything from a single distant origin. Option C is not a CDN benefit: CDNs serve cached or proxied HTTP(S) content and do not provide direct database access to end users. Option D is not inherent to a CDN: encryption of data at rest is a storage-layer control (e.g., disk or object-store encryption), whereas a CDN typically handles TLS in transit. Option E is not a CDN function: automated server patching is an OS/configuration-management task (e.g., via patch management tooling), not something a content delivery network performs on your servers.

Answer

Direct database access

Answer

Encryption of data at rest

Answer

Automated server patching

Question 9

You are designing a high-availability architecture. Which configuration ensures that your application is resilient to the failure of an entire physical data center?

Accepted Answer

Multi-AZ deployment. Deploying across multiple Availability Zones (AZs) ensures that the application remains online even if one data center fails.

Answer

Vertical scaling

Answer

Single AZ deployment

Answer

Local caching

Question 10

Which THREE items should be included in a disaster recovery plan?

Accepted Answer

Backup strategy. A Backup strategy is correct because a DR plan must define how data and systems are backed up (full/incremental/differential, frequency, retention, and offsite/cloud copies) so that restoration is actually possible after a disaster. C Recovery Time Objective (RTO) is correct because it specifies the maximum acceptable downtime — the target time within which systems and services must be restored — and drives the choice of recovery site, hardware, and procedures. D Recovery Point Objective (RPO) is correct because it defines the maximum tolerable data loss measured in time, which dictates backup frequency and replication method (for example, a 15-minute RPO requires near-continuous replication rather than nightly backups). B Customer marketing materials and E Physical access badges are not core DR plan components: marketing collateral is irrelevant to restoring IT services, and while physical security may appear in a broader business continuity plan, access badges themselves are not a required DR planning item.

Answer

Customer marketing materials

Answer

Physical access badges

Question 11

Which THREE actions are best practices for securing a cloud virtual machine?

Accepted Answer

Applying the principle of least privilege. Option B is correct because applying the principle of least privilege means granting only the minimum permissions and network access required, which reduces the attack surface of a cloud VM by limiting what compromised credentials or services can reach. Option D is correct because keeping the OS and software updated ensures known vulnerabilities are patched, preventing attackers from exploiting unpatched flaws in the guest operating system or installed applications. Option E is correct because strong key-based authentication, such as SSH public-key authentication instead of passwords, resists brute-force and credential-stuffing attacks and is a standard hardening practice for cloud instances. Option A is incorrect because allowing all ports in Security Groups exposes every service to the internet, violating least privilege and dramatically increasing risk. Option C is incorrect because assigning public IPs to all services unnecessarily exposes management and internal interfaces to the internet; private IPs with bastion hosts or VPN access are preferred.

Answer

Allowing all ports in Security Groups

Answer

Using public IPs for all services

Question 12

An enterprise is planning a multi-cloud strategy. What is the primary management risk associated with this approach?

Accepted Answer

Increased operational complexity. The primary management risk of a multi-cloud strategy is increased operational complexity. Managing multiple cloud providers means dealing with different interfaces, APIs, security models, billing, and support structures, which can strain IT teams and require additional training or tools. This complexity can lead to inefficiencies, misconfigurations, and higher operational costs if not properly managed.

Answer

Lower data redundancy

Answer

Simplified security auditing

Answer

Decreased network latency

Question 13

Which THREE items are generally included in a cloud provider's 'Service Level Agreement' (SLA)?

Accepted Answer

Financial service credits for outages. Option B is correct because cloud SLAs typically specify financial service credits (often a percentage of the monthly bill) that the provider grants when availability falls below the guaranteed threshold. Option C is correct because an SLA defines the uptime percentage guarantee, such as 99.9% or 99.99% availability, which is the core measurable commitment. Option E is correct because the SLA must define which services are 'covered' (for example, compute, storage, or database services) and the scope of the guarantee. Option A is not included because a CEO's performance review is an internal HR matter, not a contractual service commitment. Option D is not included because the customer's office address is a billing/contact detail, not a service-level term.

Answer

The provider's CEO's performance review

Answer

The office address of the customer

Question 14

You are notified that an unused storage volume is incurring costs. What is the standard operational procedure to stop these charges?

Accepted Answer

Delete the volume. In cloud environments, storage volumes incur costs as long as they exist, regardless of whether they are attached or used. To stop charges for an unused volume, the standard procedure is to delete the volume. Once deleted, the volume no longer exists, and billing for that resource ceases.

Answer

Encrypt the volume

Answer

Rename the volume

Answer

Move to a different region

Question 15

Which THREE services are typically involved in cloud infrastructure automation?

Accepted Answer

CloudFormation. CloudFormation (C) is correct because it is AWS's native Infrastructure as Code service that lets you model and provision cloud resources declaratively via JSON/YAML templates and stacks. Terraform (D) is correct because it is a widely used infrastructure-as-code tool that automates provisioning across multiple cloud providers through declarative HCL configurations and a state file. Ansible (E) is correct because it is a configuration-management and automation engine that uses agentless SSH/WinRM and YAML playbooks to configure servers and orchestrate cloud deployments. Microsoft Word (A) and Adobe Photoshop (B) are document and image-editing applications, respectively, and provide no infrastructure provisioning, configuration management, or cloud automation capabilities.

Answer

Microsoft Word

Answer

Adobe Photoshop