CLO-002 Practice Test 20 — 15 Questions

Question 1

When performing a TCO analysis for migrating a legacy on-premises database to Azure SQL, which hidden cost is most likely to be overlooked?

Accepted Answer

Data egress fees. Data egress fees are the classic hidden cost in cloud TCO analyses because organizations focus on compute, storage, and licensing while forgetting that moving data OUT of the cloud provider's network is metered and billed. In a database migration scenario, ongoing replication, backups to on-premises, or application traffic leaving Azure all incur egress charges that can accumulate significantly over time. Unlike power, cooling, or hardware maintenance — which are eliminated by moving to cloud — egress is a NEW cost that did not exist on-premises, making it the most commonly overlooked line item.

Answer

Power and cooling

Answer

Software licensing

Answer

Hardware maintenance

Question 2

A small business wants to move its customer relationship management system to a public cloud provider. The IT manager is concerned about the provider's ability to guarantee a specific level of uptime and to define remedies if that level is not met. Which document should the manager review to find the committed uptime percentage and any service credits?

Accepted Answer

The service level agreement (SLA) published by the cloud provider. The service level agreement is the formal contract that specifies measurable commitments such as uptime percentage, latency, or support response times, along with remedies like service credits when targets are missed. It is the only listed document that answers both parts of the manager's question: the guaranteed level of service and the consequence of failing to meet it.

Answer

The acceptable use policy (AUP) published by the cloud provider

Answer

The cloud provider's privacy policy and data processing addendum

Answer

The provider's public status dashboard and historical incident reports

Question 3

A company is evaluating cloud service providers for a new application. The IT director wants to understand the financial and operational benefits of the cloud's measured service and pay-as-you-go model. Which TWO of the following are direct benefits of these characteristics? (Choose two.)

Accepted Answer

The company can avoid paying for idle or unused capacity.. Measured service and pay-as-you-go directly enable shifting from capital to operational expenditure and avoiding payment for idle capacity. Automatic scaling is a benefit of rapid elasticity, physical security control is not provided to the customer, and operational costs are not eliminated but rather transformed and reduced.

Answer

The company can eliminate all IT operational costs.

Answer

The company gains complete control over the physical security of the data center.

Answer

The company can automatically scale resources based on demand without manual intervention.

Question 4

A media company stores years of video assets in a public cloud object storage bucket. Auditors require that no object can be deleted or overwritten for seven years, even by a user with full administrative rights, to satisfy a regulatory retention rule. Which capability should the company implement?

Accepted Answer

Configure an object lock with a retention mode and period that prevents deletion or overwrite. Object lock with a retention mode and period enforces immutability within the storage service itself, so protected objects cannot be deleted or overwritten until the retention window ends, even by privileged administrators. Setting a seven-year period maps directly to the regulatory retention rule and gives auditors verifiable, tamper-resistant protection rather than a configuration that could be changed.

Answer

Replicate the bucket to a second region and restrict delete permissions in the replica

Answer

Enable versioning on the bucket and require multi-factor authentication for delete operations

Answer

Apply a bucket policy that denies delete actions to all principals except the storage administrator

Question 5

A company runs a web application on virtual machines in a public cloud. The application must remain available even if an entire data center loses power. The cloud provider offers regions and availability zones. Which deployment approach should the company use?

Accepted Answer

Deploy virtual machines across multiple availability zones within a single region.. Spreading instances across multiple availability zones within a region is the correct high-availability design. Each zone has independent power and networking, so a failure in one data center does not affect the others. The application remains available without manual intervention, and latency between zones is low enough for most workloads.

Answer

Deploy all virtual machines in a single availability zone within one region.

Answer

Deploy virtual machines in two regions but keep all traffic routed to one region.

Answer

Deploy virtual machines in a single region and rely on the provider's backup service.

Question 6

Which cloud service model would a company use if they want to manage their application code and data but leave the OS, runtime, and hardware management to the provider?

Accepted Answer

PaaS. PaaS (Platform as a Service) provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure. The provider manages the OS, runtime, and hardware, while the customer manages the application code and data.

Answer

IaaS

Answer

SaaS

Answer

Serverless

Question 7

A company is evaluating the business value of moving its on-premises data center to a public cloud. Which TWO of the following are direct cloud economic benefits that the company should expect? (Choose two.)

Accepted Answer

Ability to scale resources up or down based on demand. The two direct economic benefits are converting capital expenditures to operational expenditures and gaining elastic scaling. Both change how the company pays for and consumes IT resources, aligning cost with demand. Eliminating security responsibilities, guaranteeing lower total cost for every workload, and removing all capacity planning are inaccurate overstatements that do not reflect the shared responsibility and planning realities of cloud adoption.

Answer

Elimination of all security responsibilities

Answer

Permanent removal of the need for capacity planning

Answer

Guaranteed lower total cost of ownership for every workload

Question 8

A company is moving from a 'Buy' to a 'Rent' model for software. Which model are they adopting?

Accepted Answer

SaaS. Moving from 'Buy' to 'Rent' for software means adopting a subscription-based consumption model where the provider hosts and manages the application — this is Software as a Service (SaaS). The customer rents access rather than purchasing a perpetual license and owning the infrastructure.

Answer

IaaS

Answer

PaaS

Answer

On-premises

Question 9

Which TWO components are essential for a robust cloud disaster recovery plan?

Accepted Answer

A defined failover procedure. Option B, a defined failover procedure, is essential because disaster recovery requires a documented, tested process for redirecting workloads to the recovery environment (for example, promoting a standby region, updating DNS, or switching to a secondary availability zone) so that recovery is deterministic rather than improvised. Option C, regular data backups, is essential because it provides the recoverable copy of data needed to meet RPO targets; without backups, failover alone cannot restore lost or corrupted data. In cloud DR, backups are typically implemented with snapshots, object storage versioning, or cross-region replication, and they must be validated through restore tests. The remaining options do not belong: a dedicated office space (A) is a workplace-continuity concern, not a cloud DR component; hardware procurement contracts (D) are largely irrelevant in cloud environments where capacity is provisioned on demand; and an increased marketing budget (E) has no bearing on technical recovery capability.

Answer

A dedicated office space

Answer

Hardware procurement contracts

Answer

Increased marketing budget

Question 10

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

Accepted Answer

Azure SQL Advanced Data Security. Azure SQL Advanced Data Security (now Microsoft Defender for SQL) includes Vulnerability Assessment and Advanced Threat Protection, which identify potential database vulnerabilities and detect anomalous activities such as SQL injection, brute-force attempts, and unusual access patterns. It is purpose-built for Azure SQL Database and surfaces findings directly in the Azure portal. This directly satisfies the GDPR requirement to protect personal data against unauthorized access by detecting and alerting on threats.

Answer

Azure Information Protection

Answer

Azure AD Conditional Access

Answer

Azure Firewall

Question 11

A company runs a production workload on Azure Kubernetes Service (AKS). The operations team must reduce the blast radius of a node failure and ensure that pod disruption budgets are respected during voluntary disruptions. Which two actions should the team take? (Choose two.)

Accepted Answer

Define a PodDisruptionBudget for each critical deployment.. Reducing blast radius requires spreading replicas across failure domains, which topology spread constraints across node pools and availability zones accomplish. Respecting pod disruption budgets during voluntary disruptions requires defining a PodDisruptionBudget for each critical deployment, because that object instructs the eviction API to maintain a minimum available count. The other actions address capacity, cost advice, or scheduling priority, none of which directly limit failure impact or enforce disruption limits.

Answer

Set the pod priority class to a higher value for all production pods.

Answer

Configure cluster autoscaler to add nodes when pods are pending.

Answer

Enable Azure Advisor cost recommendations for the AKS cluster.

Question 12

An organization's security team wants to detect and respond to suspicious activities in its cloud environment, such as unusual API calls or unauthorized configuration changes. Which cloud-native capability should the team use to meet this requirement?

Accepted Answer

Enable cloud audit logging and configure alerts for anomalous API activity and configuration changes.. Detecting suspicious API calls and unauthorized configuration changes requires visibility into control plane activity. Cloud audit logging captures these events, and alerting on anomalous patterns enables timely detection and response. Application-layer controls, network tunnels, and performance services do not provide the necessary monitoring of administrative and API-level actions.

Answer

Implement a virtual private network for all remote administrative access.

Answer

Configure a content delivery network to accelerate access to cloud management consoles.

Answer

Deploy a web application firewall in front of all public-facing applications.

Question 13

Which cloud operation task is primarily responsible for ensuring that the cloud environment adheres to corporate security and regulatory standards?

Accepted Answer

Compliance management. Compliance management is the cloud operations task specifically focused on ensuring the cloud environment adheres to corporate security policies and regulatory standards. It involves continuous monitoring, auditing, and enforcement of controls to maintain alignment with frameworks such as ISO 27001, SOC 2, HIPAA, and GDPR. Unlike other operational tasks, compliance management directly addresses governance and regulatory adherence.

Answer

Cost optimization

Answer

Load balancing

Answer

Capacity planning

Question 14

A company is implementing a 'Cloud-First' strategy. During the migration assessment, they identify that several applications require low-latency communication with on-premises legacy systems. Which cloud deployment model should they select?

Accepted Answer

Hybrid Cloud. Hybrid cloud is the correct choice because it combines on-premises infrastructure with public cloud resources, allowing the legacy systems to remain on-premises while new cloud-native applications run in the public cloud. This model directly addresses the low-latency requirement by keeping latency-sensitive communication local to the on-premises network, while still enabling cloud benefits for other workloads. The other models either lack on-premises integration (public, multi-cloud) or are entirely on-premises (private), failing the 'Cloud-First' strategy.

Answer

Public Cloud

Answer

Private Cloud

Answer

Multi-Cloud

Question 15

Which TWO of the following are common cloud monitoring tasks?

Accepted Answer

Auditing API access logs. Option A (Auditing API access logs) is a common cloud monitoring task because cloud providers expose control-plane and data-plane activity through services like AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs, which are reviewed to detect unauthorized access and compliance violations. Option D (Tracking CPU and RAM utilization) is also a core monitoring task, typically performed with metrics services such as Amazon CloudWatch, Azure Monitor, or Google Cloud Monitoring to observe resource performance and trigger scaling or alerts. The remaining options are not monitoring activities: purchasing new hardware (B) is procurement, automating user salary payments (C) is payroll processing, and designing marketing collateral (E) is a creative/marketing function, none of which involve observing or analyzing cloud resources.

Answer

Purchasing new hardware

Answer

Automating user salary payments

Answer

Designing marketing collateral