CLO-002 Practice Exam 2 — 20 Questions

Question 1

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

Accepted Answer

Service Level Agreement (SLA). A Service Level Agreement (SLA) is the contractual document in which a cloud provider commits to specific uptime, availability, and performance metrics, along with remedies (service credits) if those commitments are missed. It is the authoritative source for assessing the impact of a provider outage on the customer's operations.

Answer

Cloud Security Alliance (CSA) report

Answer

Acceptable Use Policy

Answer

Privacy Policy

Question 2

A company is adopting a public cloud model and needs to ensure that its data is stored only in specific geographic regions to comply with local data protection laws. Which cloud governance practice should the company implement?

Accepted Answer

Data residency policies that restrict resource deployment to approved regions.. Data residency requirements are met by implementing governance policies that restrict where resources can be deployed. By defining approved regions and enforcing those restrictions through policy, the company ensures that data remains within the required geographic boundaries. Other options either do not address residency or actively conflict with it by distributing data globally.

Answer

Use of a content delivery network (CDN) to cache data globally.

Answer

Enabling automatic scaling across all available regions.

Answer

Implementing a multi-region disaster recovery strategy.

Question 3

A company runs a three-tier application in AWS. During peak hours, users report slow page loads. CloudWatch metrics show the application load balancer is healthy, the web tier CPU is at 40 percent, and the database read replica latency is 20 ms, but the application tier shows high request queue depth and steady CPU near 95 percent. The team wants the fastest operational fix that preserves availability. What should they do?

Accepted Answer

Scale out the application tier using an Auto Scaling group policy based on CPU utilization.. High sustained CPU on the application tier combined with growing queue depth indicates the tier lacks compute capacity, so horizontal scaling is the fastest way to add capacity without downtime. A target tracking Auto Scaling policy on CPU utilization adds instances automatically during peaks and removes them afterward. The database and web tiers show healthy metrics, so changes there would not address the actual bottleneck.

Answer

Increase the database instance size to reduce query latency.

Answer

Configure an Application Load Balancer health check with a shorter interval.

Answer

Enable a larger instance type for the web tier to handle more concurrent connections.

Question 4

What is the primary difference between a 'Reserved Instance' and a 'Spot Instance'?

Accepted Answer

Spot instances can be reclaimed by the provider. Spot Instances use spare AWS capacity and can be interrupted with a two-minute warning whenever AWS needs the capacity back, making them unsuitable for workloads that cannot tolerate interruption. Reserved Instances, by contrast, are a billing commitment (1 or 3 years) that provides a capacity discount with no interruption risk. The defining difference is therefore that Spot instances can be reclaimed by the provider.

Answer

Reserved instances are for short-term use

Answer

Reserved instances are more expensive

Answer

Spot instances provide better security

Question 5

What is the purpose of a VPC Endpoint?

Accepted Answer

To access cloud services privately. A VPC Endpoint is correct because it enables private connectivity from a VPC to supported cloud services (like S3, DynamoDB, or KMS) without traversing the public internet, keeping traffic on the provider's private network. This improves security by removing exposure to the internet and can reduce NAT gateway data-processing costs. It is the standard mechanism for private service access from within a VPC.

Answer

To connect two VPCs

Answer

To encrypt data transit

Answer

To provide public access

Question 6

You are utilizing Infrastructure as Code (IaC) templates. You notice that a specific resource update is causing service downtime. Which deployment pattern should you adopt to verify updates in a controlled environment before rolling out to production?

Accepted Answer

Blue/Green deployment. Blue/Green deployment is the correct pattern because it maintains two identical environments (blue = current production, green = new version) and allows you to verify the update in the green environment before switching traffic over. This provides a controlled, low-risk way to test changes and enables instant rollback by switching traffic back to blue if issues arise. It directly addresses the requirement to verify updates in a controlled environment before production rollout.

Answer

Canary release

Answer

In-place upgrade

Answer

Rolling update

Question 7

You are troubleshooting a connectivity issue where an application in a private subnet cannot reach the internet to download updates. Which component is missing?

Accepted Answer

NAT Gateway. A NAT Gateway is required because resources in a private subnet have no route to the internet and cannot hold public IP addresses. The NAT Gateway resides in a public subnet and performs source NAT, allowing outbound-only traffic from private instances to reach the internet while blocking inbound connections. An Internet Gateway alone cannot serve private subnets because those subnets lack a route to it and their instances have no public IPs.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Route Table

Question 8

A small marketing agency is considering moving its project management software to a SaaS solution. The agency's IT manager wants to understand the financial implications. Which of the following best describes a key financial benefit of adopting SaaS compared to maintaining on-premises software?

Accepted Answer

Conversion of capital expenses to operational expenses. Moving to SaaS shifts costs from capital expenditures to operational expenditures. Instead of purchasing servers and licenses upfront, the agency pays a recurring subscription fee. This improves cash flow and allows for more predictable budgeting. It also reduces the need for IT staff to maintain hardware and software, freeing resources for other tasks.

Answer

Complete transfer of data security responsibility to the vendor

Answer

Elimination of all software licensing costs

Answer

Guaranteed reduction in total cost of ownership

Question 9

You need to allow temporary access to a file stored in a private bucket for a third party. What is the most secure method?

Accepted Answer

Create a Pre-signed URL. A pre-signed URL embeds the signer's credentials and an expiry timestamp into a time-limited URL, granting temporary, scoped access to a single object without changing bucket permissions or creating identities. This is the most secure method because access automatically expires, is limited to the specific object and HTTP method, and can be revoked by rotating the signing key or deleting the object.

Answer

Create an IAM user for them

Answer

Email the file

Answer

Make the bucket public

Question 10

A company requires a highly available database that replicates data synchronously across availability zones. Which setting should be chosen?

Accepted Answer

Multi-AZ deployment. A Multi-AZ deployment is correct because it maintains a synchronous standby replica in a different availability zone, and the database endpoint automatically fails over to that standby if the primary fails. Synchronous replication guarantees zero data loss (RPO of zero) because the standby must acknowledge each write before the primary commits. This is the standard managed-database pattern for high availability with automatic failover in cloud platforms like AWS RDS.

Answer

Auto Scaling

Answer

Read replica

Answer

Database snapshot

Question 11

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

Accepted Answer

Deploy the database and its backups in the region corresponding to each customer's country and disable cross-region replication.. Data residency is enforced by controlling the physical location of storage, including replicas and backups. Deploying the database and its backups in the country of collection and disabling cross-region replication keeps every copy of the record within the required jurisdiction, which is the only configuration among the choices that directly enforces the requirement.

Answer

Use a cloud access security broker to inspect data in transit between regions.

Answer

Enable geo-restriction at the content delivery network edge for all customer traffic.

Answer

Apply resource tags indicating the customer's country and use them in cost allocation reports.

Question 12

Which THREE of the following are necessary to manage multi-cloud deployments effectively?

Accepted Answer

Unified monitoring tools. Unified monitoring tools (B) are necessary because multi-cloud deployments span AWS, Azure, and GCP, so a single pane of glass aggregating metrics, logs, and traces across providers is required to detect issues and maintain consistent observability. Infrastructure as Code (D) is essential because declarative templates (e.g., Terraform, CloudFormation, ARM/Bicep) let you provision and version identical, repeatable environments across heterogeneous clouds, avoiding manual drift. Centralized identity management (E) is required to federate authentication and authorization across providers using standards like SAML 2.0 or OIDC, so users and service accounts have one consistent identity and RBAC policy set rather than per-cloud silos. Ignoring one cloud provider (A) is wrong because it defeats the purpose of multi-cloud management and leaves resources ungoverned, while printing physical logs (C) is neither scalable nor a real management practice compared with centralized log aggregation.

Answer

Ignoring one cloud provider

Answer

Printing physical logs

Question 13

Which cloud service model would best suit a company that needs complete control over the network configuration and operating system but wants to avoid physical server maintenance?

Accepted Answer

IaaS. IaaS provides virtualized computing resources over the internet, giving the customer control over the operating system, storage, and network configuration while the provider manages the physical infrastructure. This matches the requirement for complete control over network and OS without physical server maintenance.

Answer

PaaS

Answer

SaaS

Answer

Serverless

Question 14

You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?

Accepted Answer

DynamoDB table. DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Answer

S3 Versioning

Answer

Terraform Cloud Workspaces

Answer

IAM Policy

Question 15

A cloud operations team wants to automatically remediate an EC2 instance that has been running with CPU utilization below 5% for 14 consecutive days. The team needs the remediation to trigger without manual intervention and to notify a Slack channel. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

AWS Systems Manager Automation. The requirement is an event-driven, multi-step remediation that stops an underutilized instance and notifies a channel without human action. Systems Manager Automation provides runbooks that can be triggered by CloudWatch alarms or EventBridge rules, execute API calls, and integrate with notification services. The other services either only assess compliance, only provision infrastructure, or only give recommendations, so none can orchestrate the full workflow autonomously.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudFormation

Question 16

You need to store audit logs that are immutable and cannot be deleted for a set period. Which feature should you enable?

Accepted Answer

Object Lock. S3 Object Lock enforces WORM (Write Once, Read Many) semantics, preventing objects from being deleted or overwritten for a specified retention period. It is the correct feature for immutable audit logs that must be preserved for compliance. Object Lock requires S3 Versioning to be enabled on the bucket and is configured in Governance or Compliance mode.

Answer

Access Logs

Answer

Versioning

Answer

Encryption

Question 17

A company uses a hybrid cloud. They need to move a database workload to the cloud that has strict regulatory requirements. Which deployment model is most appropriate?

Accepted Answer

Private cloud deployment. Private cloud deployment is correct because strict regulatory requirements (e.g., PCI-DSS, HIPAA, GDPR data residency, FedRAMP) often mandate dedicated infrastructure, full control over data location, and isolation from other tenants. A private cloud provides single-tenant hardware and network, enabling the organization to meet compliance controls around data sovereignty, access, and auditing that multi-tenant public clouds may not satisfy without extensive additional controls.

Answer

Public cloud multi-tenant

Answer

Community cloud

Answer

Serverless functions

Question 18

A retail company is using a public cloud provider. The IT manager wants to understand how the cloud provider's use of shared physical resources affects the company's data. Which cloud characteristic ensures that the provider's other customers cannot access the retail company's data?

Accepted Answer

Multi-tenancy with logical isolation. Multi-tenancy with logical isolation is the cloud characteristic that allows multiple customers to share physical resources while keeping their data separate. The provider uses virtualization, network segmentation, and access controls to ensure that one tenant cannot access another's data. Elasticity, measured service, and on-demand self-service are important cloud traits but do not provide the security isolation required.

Answer

Measured service

Answer

On-demand self-service

Answer

Elasticity

Question 19

A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical CloudWatch metrics (CPU, memory if the agent is installed, network, disk) and applies machine-learning models to generate specific rightsizing recommendations for EC2 instances, including over-provisioned and under-provisioned findings. It is purpose-built for this task and integrates with Cost Explorer and Trusted Advisor.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 20

Which technology is primarily used to isolate applications while sharing the same OS kernel?

Accepted Answer

Containers. Containers share the host OS kernel and use Linux primitives like namespaces (for isolation of process, network, mount, PID views) and cgroups (for resource limits) to isolate applications from each other. Because they do not bundle a full OS, containers are lightweight and start in milliseconds, unlike VMs which each run their own kernel. This kernel-sharing model is the defining characteristic that distinguishes containers from virtual machines.

Answer

Bare Metal

Answer

Virtual Machines

Answer

Hypervisors