CLO-002 Practice Exam 3 — 20 Questions

Question 1

You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?

Accepted Answer

Re-platforming. Re-platforming (lift, tinker, and shift) involves making targeted changes to the application or its runtime to take advantage of cloud capabilities — including moving to a supported OS or managed service. Since the legacy OS is unsupported, re-platforming lets you migrate while modernizing the OS/runtime, avoiding the security and support risks of re-hosting an unsupported platform.

Answer

Re-hosting (Lift and Shift)

Answer

Retaining

Answer

Retiring

Question 2

When evaluating a cloud service provider (CSP), which TWO of the following business-focused documentation should be requested to verify the vendor's reliability and security posture?

Accepted Answer

SOC 2 Type II reports. Option C, SOC 2 Type II reports, is correct because they are independent audit attestations covering the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) over a defined review period, giving direct evidence of the vendor's security controls and operational reliability. Option E, Service Level Agreement (SLA) documentation, is correct because it contractually defines measurable commitments such as uptime percentage, availability targets, performance metrics, and remedies or credits for failures, which is exactly what a business needs to assess vendor reliability. The unmarked options do not belong: A, the quarterly stock earnings report, reflects financial market performance rather than security posture or service reliability; B, employee payroll records, is confidential HR data irrelevant to security evaluation and would raise privacy concerns; and D, internal office floor plans, is physical layout information with no bearing on the CSP's security or reliability assurances.

Answer

The provider's quarterly stock earnings report

Answer

Employee payroll records

Answer

Internal office floor plans

Question 3

A global company needs to ensure compliance with GDPR. Which feature of a cloud provider is most critical for compliance?

Accepted Answer

Data residency controls. GDPR requires that personal data of EU residents be stored and processed under specific legal frameworks, and data residency controls let organizations pin data to specific geographic regions (e.g., EU-West) to satisfy these requirements. This is the most critical cloud feature for GDPR compliance because it directly addresses the regulation's data sovereignty and cross-border transfer rules. Without residency controls, data may be replicated or processed outside approved jurisdictions, creating legal exposure.

Answer

Auto-scaling groups

Answer

Multi-region replication

Answer

Public IP addresses

Question 4

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Accepted Answer

TLS 1.2/1.3. TLS 1.2/1.3 (A) is correct because it encrypts application-layer traffic such as HTTPS, securing data as it moves between clients and cloud services. Direct Connect with MACsec (B) is correct because MACsec provides IEEE 802.1AE link-layer encryption on dedicated AWS Direct Connect connections, protecting data in transit over the private network path. VPN Tunnels using IPsec (E) are correct because IPsec encrypts and authenticates IP packets across untrusted networks, securing site-to-site or client-to-cloud transit. Server-side encryption at rest (C) is incorrect because it protects stored data on disks, not data moving across a network. User access logs (D) are incorrect because they record activity for auditing and monitoring but do not encrypt or otherwise secure data in transit.

Answer

Server-side encryption at rest

Answer

User access logs

Question 5

An organization runs a containerized e-commerce platform on a managed Kubernetes service. During a flash sale, response times degrade sharply. Metrics show the application pods are healthy and the database is not saturated, but the cluster reports that some nodes cannot schedule new pods because of resource pressure. The team must add capacity automatically when pod demand rises and remove it when demand falls. Which action should the team take?

Accepted Answer

Enable the cluster autoscaler so the node pool grows and shrinks with pending pod demand. The cluster autoscaler is designed for exactly this situation: it detects pods that are pending because no node has enough allocatable resources, then adds nodes to the pool, and later removes underutilized nodes when demand subsides. Because the workload pods are already healthy and the database is not the bottleneck, the missing piece is automatic node-level capacity, which this component supplies.

Answer

Configure a horizontal pod autoscaler to increase the replica count based on CPU utilization

Answer

Increase the CPU request and limit values on the existing application deployment

Answer

Create a pod disruption budget to guarantee minimum availability during scaling events

Question 6

Which cloud service model is best suited for end-users who want to use software via a browser?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers fully managed applications to end-users over the internet, typically accessed through a browser without any installation or infrastructure management. Examples include Gmail, Salesforce, and Microsoft 365. This matches the question's description of end-users consuming software via a browser.

Answer

DaaS

Answer

IaaS

Answer

PaaS

Question 7

Which THREE are key characteristics of cloud computing?

Accepted Answer

Measured service. A. Measured service is correct because cloud providers meter resource usage (compute, storage, bandwidth) and bill customers based on consumption, enabling pay-as-you-go pricing. B. Broad network access is correct because cloud services are delivered over the network via standard mechanisms (e.g., HTTP/HTTPS, APIs) and accessible from diverse client devices such as laptops, phones, and tablets. E. Rapid elasticity is correct because cloud resources can scale out and in automatically or on demand to match workload changes, appearing nearly unlimited to the consumer. C. Static hardware provisioning is incorrect because cloud computing emphasizes dynamic, on-demand provisioning rather than fixed, pre-allocated hardware. D. Physical media access is incorrect because cloud services are accessed remotely over networks, not through physical media such as tapes, disks, or direct hardware connections.

Answer

Static hardware provisioning

Answer

Physical media access

Question 8

Which cloud principle refers to the ability to pay for only the compute power you consume?

Accepted Answer

Measured service. Measured service is the cloud principle that provides metering of resource usage, enabling pay-per-use billing. In this model, the cloud provider automatically monitors, controls, and reports resource consumption (e.g., compute hours, storage GB, data transfer), and customers are billed only for what they consume. This is distinct from on-demand self-service, which allows provisioning without human interaction, but does not inherently include metering. Thus, measured service directly supports the ability to pay only for the compute power used.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 9

A small marketing agency wants to move its customer relationship management (CRM) system to the cloud. The agency has limited IT staff and wants the provider to manage the operating system, middleware, and runtime, while the agency only manages its custom CRM application and data. Which cloud service model best fits this requirement?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a managed platform that includes the operating system, middleware, and runtime, leaving the customer responsible only for the application and data. This aligns with the agency's need to offload infrastructure management while retaining control over its custom CRM application. IaaS requires more customer management, SaaS removes application control, and FaaS is unsuitable for a full CRM system.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 10

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates and normalizes findings from services like AWS Config, Inspector, GuardDuty, and third-party tools, and it includes the AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark standards. Running the CIS standard in Security Hub produces a consolidated compliance view showing which resources are non-compliant, which is exactly what the compliance officer needs. This makes Security Hub the right reporting layer.

Answer

AWS Config

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 11

Which of the following represents a major benefit of cloud computing where resources are shared among multiple customers?

Accepted Answer

Resource pooling. Resource pooling is the multi-tenant cloud characteristic where compute, storage, and network resources are shared among many customers from a pooled infrastructure, with dynamic assignment based on demand. This sharing drives economies of scale and cost efficiency, which is the benefit described in the question.

Answer

Local area networking

Answer

Static provisioning

Answer

Dedicated hosting

Question 12

You are tasked with automating a script that runs every night at 2 AM to clean up temporary files. Which service is most appropriate for triggering this task?

Accepted Answer

AWS Lambda + EventBridge. AWS Lambda combined with Amazon EventBridge is the canonical serverless pattern for scheduled tasks. EventBridge (formerly CloudWatch Events) supports cron and rate expressions, so a rule like 'cron(0 2 * * ? *)' triggers the Lambda function nightly at 2 AM. Lambda executes the cleanup code without requiring a persistent EC2 instance, making it cost-effective and operationally simple.

Answer

AWS SNS

Answer

AWS IAM

Answer

AWS SQS

Question 13

A software development team is using a cloud-based platform that provides a runtime environment, middleware, and database services. The team can deploy their code without managing the underlying operating system or servers. However, they are responsible for configuring the application and its data. Which cloud service model is the team using?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a complete development and deployment environment in the cloud, including runtime, middleware, and database services. The team can deploy code without managing the OS or servers, and they remain responsible for their application and data. This aligns with the PaaS model, where the provider manages the platform and the customer manages the application.

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 14

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the account, including the identity of the caller (IAM user, role, or federated identity), the action taken, the resource affected, source IP, and timestamp. Analyzing CloudTrail event history lets the analyst pinpoint exactly which IAM user made unauthorized infrastructure changes. This is the authoritative audit log for 'who did what' in AWS.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudWatch

Answer

AWS Security Hub

Question 15

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

Accepted Answer

Classifying data based on sensitivity and regulatory requirements. Under the shared responsibility model, the customer is responsible for data classification and IAM configuration, as these are directly related to how data is handled and accessed. The provider is responsible for physical security and hypervisor patching. Key management can be shared, but the two clear customer responsibilities are data classification and IAM policies.

Answer

Patching the hypervisor that hosts virtual machines

Answer

Managing the lifecycle of encryption keys stored in a hardware security module (HSM)

Answer

Ensuring physical security of data center facilities

Question 16

You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom budgets for cost, usage, or reservations, and configure alerts when actual or forecasted spending exceeds a defined threshold. You can specify a monthly cost budget of $500 and attach an email notification to be triggered when actual spend surpasses that amount. This is the native AWS service designed for proactive cost monitoring and alerting, making it the correct choice for receiving an email alert on monthly spending.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 17

A company is moving from a capital expenditure model to an operational expenditure model. What is the primary benefit?

Accepted Answer

Removal of upfront capital costs. The primary benefit of moving from CapEx to OpEx is the elimination of large upfront capital investments. In a CapEx model, a company must purchase hardware and infrastructure outright, which requires significant capital outlay and depreciates over time. In an OpEx model, such as with cloud services, the company pays for what it uses on a subscription or pay-as-you-go basis, converting that large upfront cost into smaller, recurring operational expenses. This improves cash flow and allows the company to scale resources up or down as needed without being locked into a long-term asset.

Answer

Increased control over hardware

Answer

Predictable monthly billing

Answer

No hardware maintenance

Question 18

A small marketing agency wants to move its client project files to a cloud storage solution. The agency has unpredictable storage needs, wants to avoid purchasing hardware, and requires access from Windows, macOS, and mobile devices. Which cloud characteristic best describes the agency's ability to provision storage on demand without human intervention from the provider?

Accepted Answer

On-demand self-service. On-demand self-service is the cloud characteristic that lets a consumer provision resources such as storage automatically, without human interaction with the provider. The agency can use a portal or API to allocate storage immediately, which suits unpredictable needs and avoids hardware purchases. Broad network access, rapid elasticity, and resource pooling are separate characteristics that do not directly address unassisted provisioning.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Question 19

Which document is essential for cloud vendor selection and outlines specific performance, security, and financial requirements?

Accepted Answer

Request for Proposal (RFP). A Request for Proposal (RFP) is a formal document issued to potential vendors that specifies the organization's performance, security, financial, and functional requirements, and asks vendors to respond with proposed solutions and pricing. It is the standard procurement artifact used to evaluate and select a cloud vendor against defined criteria. This makes it essential for vendor selection.

Answer

Service Level Agreement (SLA)

Answer

Public cloud price list

Answer

Marketing brochure

Question 20

A project manager is calculating the cloud adoption strategy using a 'Re-platform' approach. What is the expected outcome?

Accepted Answer

Optimize application performance by migrating to managed services. Re-platform (often called 'lift, tinker, and shift') involves making a few cloud optimizations to the existing application without changing its core architecture. The most common form is migrating from self-managed infrastructure to managed cloud services — for example, moving a self-hosted MySQL database to Amazon RDS or a self-managed message broker to Amazon MQ. This preserves the application's functionality while gaining managed-service benefits like automated backups, patching, and scaling.

Answer

Moving VMs without any changes

Answer

Replacing the application with a third-party service

Answer

Complete rewrite of the application code