CLO-002 Practice Test 16 — 15 Questions

Question 1

Which TWO items are typically included in a cloud 'Cloud Adoption Strategy' document?

Accepted Answer

Migration roadmap and timeline. A cloud Cloud Adoption Strategy document typically includes a migration roadmap and timeline (A), because it must sequence workloads, define phases (assess, mobilize, migrate, modernize), and set milestones for moving to the cloud. It also includes business goals and success criteria (D), since the strategy must tie cloud adoption to measurable outcomes such as cost reduction, agility, or compliance targets. Options B, C, and E are irrelevant to cloud adoption planning: telephone history, office coffee brands, and employees' personal email addresses have no bearing on migration approach, governance, or success metrics.

Answer

The history of the telephone

Answer

List of office coffee brands

Answer

The personal email addresses of all employees

Question 2

When using an Auto Scaling group, what metric is most commonly used to trigger an increase in server instances?

Accepted Answer

CPU utilization. Auto Scaling groups most commonly use CPU utilization (Option A) as the trigger metric because it directly reflects compute load and is available natively from hypervisors and CloudWatch. When average CPU exceeds a target threshold (e.g., 70%), the scaling policy adds instances. It is simple, reliable, and correlates well with demand for many workloads.

Answer

Total cost

Answer

Network latency

Answer

Number of concurrent users

Question 3

A developer needs to update a database schema without losing any existing data. Which concept is essential for this operational task?

Accepted Answer

Database migration scripts. Database migration scripts are the essential concept because they provide a versioned, repeatable, and reversible mechanism to apply schema changes (e.g., ALTER TABLE, ADD COLUMN) while preserving existing rows. Unlike raw DDL executed manually, migration scripts track state so the schema can be evolved incrementally without data loss. This is the standard operational practice in DevOps and application lifecycle management for schema evolution.

Answer

Database snapshots

Answer

Caching layer purge

Answer

Full database replication

Question 4

Which protocol is most commonly used for secure, encrypted remote management of Linux-based virtual machines in the cloud?

Accepted Answer

SSH. SSH (Secure Shell) is the de facto standard for encrypted remote administration of Linux VMs, operating over TCP port 22 and providing strong cryptographic authentication and confidentiality. Cloud providers such as AWS, Azure, and GCP all issue SSH key pairs by default for Linux instance access, making it the canonical answer. It replaces insecure legacy tools like Telnet for shell access.

Answer

FTP

Answer

HTTP

Answer

Telnet

Question 5

You need to ensure that all virtual machines follow a consistent naming convention and have specific tags for cost tracking. What service should you use to enforce this?

Accepted Answer

Azure Policy. Azure Policy is the governance service that enforces organizational standards by evaluating resources against rules and effects, including naming conventions and required tags. It can deny non-compliant resource creation or remediate existing resources via deployIfNotExists and modify effects. This directly satisfies the requirement to enforce consistent naming and tagging for cost tracking.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Advisor

Question 6

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

Accepted Answer

AWS Security Hub with Cross-Account Aggregation. AWS Security Hub with cross-account aggregation lets a designated security (administrator) account collect and view findings from multiple member accounts in one place, using AWS Organizations integration and the Security Hub administrator-member relationship. It normalizes findings from services like GuardDuty, Inspector, and Macie into a common ASFF format, giving centralized visibility. This is the purpose-built service for aggregating security logs/findings across accounts into a single security account.

Answer

AWS CloudTrail in individual accounts

Answer

AWS Transit Gateway

Answer

AWS Systems Manager OpsCenter

Question 7

Which TWO of the following are common threats to cloud-based data integrity?

Accepted Answer

Unauthorized data modification. Option B (Unauthorized data modification) is correct because any tampering with stored data by an attacker or rogue insider directly violates data integrity, altering values without authorization and potentially corrupting records or transactions. Option C (Code injection attacks) is correct because techniques such as SQL injection or cross-site scripting let attackers execute malicious code that inserts, updates, or deletes data, which is a classic integrity threat in cloud-hosted applications. Option A (Network latency increases) affects availability and performance, not the correctness of data, so it is not an integrity threat. Option D (Database snapshot frequency) is a backup/recovery design choice that influences RPO, not a threat to integrity. Option E (System-wide power failure) primarily threatens availability and can cause corruption, but it is an environmental/availability risk rather than a common cloud data-integrity threat in the sense of malicious or unauthorized alteration.

Answer

Network latency increases

Answer

Database snapshot frequency

Answer

System-wide power failure

Question 8

An organization is migrating to the cloud and decides to use 'Reserved Instances'. What is the main business benefit?

Accepted Answer

Significant cost savings over long-term usage. Reserved Instances commit to a specific instance family and region for a 1- or 3-year term in exchange for a significant discount (up to ~72% off on-demand). The main business benefit is predictable, long-term cost savings for steady-state workloads. They are not designed for spiky scalability or portability.

Answer

Instant scalability for spikes

Answer

Elimination of identity management

Answer

Ability to move between cloud providers

Question 9

Which cloud characteristic allows a startup to automatically increase their compute resources during a marketing campaign and decrease them afterward without manual intervention?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to be automatically scaled up or down based on demand. In this scenario, the startup can automatically increase compute resources during a marketing campaign and decrease them afterward without manual intervention, which is the definition of elasticity. Therefore, elasticity is correct.

Answer

Resource pooling

Answer

Measured service

Answer

Broad network access

Question 10

Which TWO benefits are associated with cloud storage object versioning?

Accepted Answer

Protects against accidental deletion. Option D is correct because object versioning retains prior and deleted object versions in the bucket, so an accidental overwrite or delete does not permanently destroy data—the object can be restored by referencing its version ID. Option E is correct because versioning keeps each prior revision of an object as a distinct version, allowing you to retrieve or restore an earlier file version when needed. These two benefits stem directly from the versioning mechanism itself, which preserves multiple iterations of an object rather than replacing it. Option A is not a versioning benefit, since encryption is provided by separate features such as SSE-S3, SSE-KMS, or client-side encryption. Option B is not correct because versioning typically increases storage consumption and therefore cost, as all retained versions are billed. Option C is not correct because versioning does not improve read throughput or latency; performance is governed by factors like request patterns, transfer acceleration, and storage class.

Answer

Provides data encryption

Answer

Reduces storage costs

Answer

Increases read performance

Question 11

Which THREE security controls are the responsibility of the cloud user under the Shared Responsibility Model?

Accepted Answer

Data encryption. Under the Shared Responsibility Model, the cloud user is responsible for securing what they put in and how they configure the cloud: option A (Data encryption) is correct because protecting data at rest and in transit—choosing algorithms, managing keys via KMS, and enabling TLS—remains the customer's duty even though the provider secures the underlying storage and network. Option B (Identity and Access Management) is correct because the customer must manage their own users, groups, roles, policies, MFA, and least-privilege permissions within services like AWS IAM or Azure Entra ID; the provider only secures the IAM service itself. Option D (Firewall configuration) is correct because the customer defines security groups, NACLs, WAF rules, and host-based firewalls to control traffic to their workloads, while the provider only supplies the virtual network fabric. Option C (Hypervisor patching) is not the user's responsibility—the provider patches the hypervisor and virtualization layer. Option E (Physical data center security) is also the provider's responsibility, covering facilities, biometric access, and hardware protection.

Answer

Hypervisor patching

Answer

Physical data center security

Question 12

An architect is designing a system that must survive a complete data center failure. What should be utilized?

Accepted Answer

Multi-AZ deployment. A Multi-AZ deployment distributes resources across multiple Availability Zones within a region, providing high availability and fault tolerance. If one data center (AZ) fails, the application can continue running in another AZ, thus surviving a complete data center failure. Therefore, Multi-AZ is the correct choice.

Answer

Local SSD storage

Answer

Auto Scaling

Answer

Single AZ deployment

Question 13

A business is analyzing cloud provider pricing. What is 'Metering' in this context?

Accepted Answer

Measurement of resource consumption. In cloud computing, metering refers to the measurement of resource consumption by a customer. Cloud providers use metering to track usage of compute, storage, network, and other services, which is then used for billing and reporting. This allows for pay-as-you-go pricing models. Therefore, metering is the measurement of resource consumption.

Answer

Limiting the speed of a network connection

Answer

Allocating dedicated physical hardware

Answer

Creating security firewall rules

Question 14

A startup needs to rapidly deploy a web application. Which cloud service model allows developers to deploy code without managing the underlying servers?

Accepted Answer

PaaS. PaaS (Platform as a Service) provides a managed runtime where developers deploy code without provisioning or managing servers, operating systems, or middleware. The provider handles the underlying infrastructure, patching, and scaling, letting the startup focus purely on application code — ideal for rapid web app deployment.

Answer

IaaS

Answer

On-premises

Answer

SaaS

Answer

None of the above

Question 15

Which TWO advantages does a public cloud provide for a small business?

Accepted Answer

Ability to scale instantly. Option A is correct because public cloud providers offer elastic, on-demand resource provisioning (e.g., AWS EC2 Auto Scaling, Azure VM Scale Sets), letting a small business scale compute, storage, or bandwidth up or down instantly without buying hardware. Option E is correct because the pay-as-you-go, OPEX-based model (e.g., AWS Free Tier, Azure pay-as-you-go pricing) removes the large upfront capital expenditure of servers, licensing, and datacenter space, so a small business can start with minimal investment. Option B is not correct because public cloud customers share the provider's infrastructure and do not control the underlying physical hardware, hypervisors, or datacenter. Option C is not correct because public cloud is multi-tenant by design and does not guarantee absolute data privacy; privacy depends on the customer's configuration, encryption, and compliance controls under the shared responsibility model. Option D is not correct because public cloud services are accessed over the internet, so reliable internet connectivity is required.

Answer

Total control over hardware

Answer

Guaranteed data privacy

Answer

No internet connectivity needed