CLO-002 Practice Exam 4 — 20 Questions

Question 1

An organization is migrating to a public cloud but has a small amount of highly sensitive data that cannot reside in a public environment. Which strategy should they use?

Accepted Answer

Hybrid cloud strategy. A hybrid cloud strategy keeps highly sensitive data on-premises or in a private environment while leveraging the public cloud for less sensitive workloads. This satisfies the constraint that sensitive data cannot reside in a public environment while still enabling cloud benefits for the rest of the organization.

Answer

Full public cloud migration

Answer

Multi-tenant public cloud

Answer

Edge computing

Question 2

An company is performing a cloud migration. What is the primary purpose of a 'Cloud Center of Excellence' (CCoE)?

Accepted Answer

Establishing best practices and governance. A Cloud Center of Excellence is a cross-functional team that establishes cloud best practices, governance, standards, and reusable patterns to guide an organization's cloud adoption. Its primary purpose is to provide centralized expertise and guardrails rather than to perform day-to-day operational tasks. This enables consistent, secure, and cost-effective cloud migration across business units.

Answer

Managing physical server repairs

Answer

Executing code deployments

Answer

Directly handling all customer support tickets

Question 3

Which tool provides a 'Right-sizing' recommendation for an underutilized virtual machine?

Accepted Answer

Compute Optimizer. AWS Compute Optimizer analyzes CloudWatch metrics (CPU, memory, network, disk) over a lookback period and generates right-sizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It flags over-provisioned resources so you can downsize instance types and reduce cost. This is exactly the 'right-sizing' capability described in the question.

Answer

IAM Policy Generator

Answer

CloudFront

Answer

Network ACLs

Question 4

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a dedicated account- and bucket-level setting that overrides any ACL or bucket policy granting public access, providing a hard guardrail against accidental public exposure. Enabling it at the account level ensures that even if someone later attaches a permissive bucket policy or ACL, public access remains blocked. This is the AWS-recommended control specifically designed to prevent the incident described.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 5

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. A cloud provider's public status dashboard (e.g., status.cloud.google.com, status.aws.amazon.com) is the authoritative, real-time source for current service health and ongoing incidents. It shows per-region, per-service status and incident timelines. This is the correct place to verify whether an outage is provider-side and its scope.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc

Question 6

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. An IAM Role is designed for delegation: it has no long-term credentials and instead issues temporary security credentials via STS when assumed. A third-party service provider can be granted permission to assume a role in your account using a trust policy, giving them time-limited access without ever sharing your access keys. This is the AWS best practice for cross-account and third-party access.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 7

Which TWO scenarios are appropriate for using a load balancer?

Accepted Answer

To distribute traffic across multiple instances. Option C is correct because a load balancer's primary function is to distribute incoming traffic across multiple backend instances, preventing any single instance from being overwhelmed and enabling horizontal scaling. Option D is correct because by spreading requests across multiple instances and performing health checks, a load balancer can route traffic away from unhealthy instances, thereby improving fault tolerance and availability. Option A is incorrect because persistent data storage is the role of databases or storage services, not load balancers. Option B is incorrect because reducing internet latency is achieved through CDNs or edge caching, not load balancing. Option E is incorrect because encryption of data at rest is handled by storage-level encryption mechanisms, not load balancers.

Answer

To store persistent data

Answer

To reduce network latency to the internet

Answer

To encrypt data at rest

Question 8

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Accepted Answer

Allow TCP 443 from 0.0.0.0/0. To allow only standard HTTPS traffic, the inbound rule must permit TCP port 443. Option A specifies TCP 443 from 0.0.0.0/0, which allows HTTPS from any source — this is the correct port and protocol for HTTPS. While 0.0.0.0/0 is broad, the question asks which rule allows only standard HTTPS traffic, and TCP 443 is the defining characteristic of HTTPS.

Answer

Allow TCP 80 from 0.0.0.0/0

Answer

Allow all TCP from 0.0.0.0/0

Answer

Allow UDP 443 from 0.0.0.0/0

Question 9

A healthcare company is migrating a patient records system to the cloud. The system must comply with strict data residency regulations that require all patient data to remain within the country. The company also wants to minimize latency for local users. Which cloud deployment model is MOST appropriate?

Accepted Answer

Private cloud hosted within the country. A private cloud hosted within the country is the most appropriate because it guarantees that patient data remains within national borders, directly meeting data residency regulations. It also gives the healthcare company control over the infrastructure, which helps with compliance audits and local latency optimization. The other models either risk cross-border data movement or do not inherently ensure in-country data location.

Answer

Community cloud shared with other healthcare providers globally

Answer

Hybrid cloud using a public cloud for primary storage and an on-premises private cloud for backup

Answer

Public cloud with resources in multiple global regions

Question 10

Which TWO criteria are essential when selecting a cloud vendor for an enterprise?

Accepted Answer

Compliance and regulatory certifications. Option D is correct because compliance and regulatory certifications (for example ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, or GDPR alignment) are essential to verify that the vendor meets the legal, industry, and data-protection obligations the enterprise must satisfy. Option E is correct because the Service Level Agreement defines measurable guarantees such as uptime percentage, latency, RTO/RPO, and remediation or credits, which directly determine whether the cloud service can meet the enterprise's availability and performance requirements. Options A, B, and C are not essential selection criteria: free trial gifts have no bearing on production suitability, the number of employees does not indicate service quality or compliance, and the headquarters location alone does not establish where data is stored or processed, which is what actually matters for regulatory and latency concerns.

Answer

Availability of free trial gifts

Answer

The number of employees at the cloud company

Answer

The physical location of the cloud company's headquarters

Question 11

Which cloud service model provides a platform for developers to deploy applications without managing the underlying infrastructure?

Accepted Answer

PaaS. PaaS (Platform as a Service) provides a complete development and deployment environment with managed infrastructure, allowing developers to deploy applications without managing servers, OS, or runtime. The provider handles the underlying infrastructure, and the consumer focuses on code and configuration. This matches the question's requirement exactly.

Answer

SaaS

Answer

IaaS

Answer

DaaS

Question 12

A developer needs to monitor real-time CPU utilization across a fleet of virtual machines in Azure. Which service should be used to capture and visualize these metrics?

Accepted Answer

Azure Monitor. Azure Monitor is the platform service that collects, analyzes, and visualizes metrics and logs from Azure resources including VMs. It captures real-time CPU utilization via the Azure Monitor agent or diagnostic extension and surfaces it through Metrics Explorer, workbooks, and alerts. This makes it the correct choice for monitoring performance metrics across a VM fleet.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Graph

Question 13

A firm wants to ensure its cloud spend is aligned with specific business units. Which feature should they implement?

Accepted Answer

Resource tagging. Resource tagging lets organizations attach key-value metadata (e.g., CostCenter, BusinessUnit, Project) to cloud resources so that billing and cost-management tools can aggregate spend by those dimensions. This is the standard mechanism in AWS, Azure, and GCP for allocating cloud costs to specific business units, enabling chargeback and showback reporting.

Answer

Instance types

Answer

User permissions

Answer

Virtual private clouds

Question 14

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

Accepted Answer

Azure Policy. Azure Policy is a service that allows administrators to define and enforce rules (policies) that govern resource configurations. It can automatically remediate non-compliant resources and ensure that virtual machines adhere to corporate security standards, such as specific OS versions, by evaluating and enforcing policies at scale.

Answer

Azure Backup

Answer

Azure Resource Manager templates

Answer

Azure Monitor

Question 15

An organization is evaluating the 'Total Cost of Ownership' of a cloud migration. What is a 'Hidden' administrative cost?

Accepted Answer

Employee retraining and upskilling. Hidden administrative costs in cloud TCO often include training and upskilling of staff to manage new cloud technologies, which is not always obvious in initial cost estimates. These costs are considered 'hidden' because they are indirect and often overlooked.

Answer

Cloud service provider fees

Answer

Internet bandwidth cost

Answer

Cloud storage costs

Question 16

An application is suffering from high latency for users across the globe. Which service can help cache content closer to the users?

Accepted Answer

Content Delivery Network. A Content Delivery Network (CDN) caches content at edge locations geographically closer to users, reducing latency by serving requests from the nearest cache. This is the primary purpose of a CDN, making it the correct choice for improving global application performance.

Answer

Auto Scaling Group

Answer

VPC Peering

Answer

Load Balancer

Question 17

What is the primary difference between vertical and horizontal scaling?

Accepted Answer

Horizontal adds nodes. Horizontal scaling (scale-out) adds more nodes or instances to a pool, distributing load across them, which is the defining difference from vertical scaling. Vertical scaling (scale-up) instead increases the size or power of a single existing node — more CPU, RAM, or storage on the same machine.

Answer

Vertical is always cheaper

Answer

Horizontal is limited by hardware

Answer

Vertical adds nodes

Question 18

What does 'Multi-tenancy' in a public cloud mean?

Accepted Answer

Multiple customers, shared hardware. Multi-tenancy in public cloud means a single physical infrastructure (servers, storage, network) is shared among multiple customers (tenants), with logical isolation enforced by the provider's hypervisor, networking, and IAM controls. Each tenant's workloads are isolated from others even though they run on the same underlying hardware.

Answer

One customer, multiple regions

Answer

Multiple clouds, one company

Answer

Multiple applications, one customer

Question 19

Which cloud characteristic allows an organization to rapidly increase resources during a spike in traffic and decrease them when traffic drops?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic, rapid scaling of resources up during demand spikes and down when demand subsides, ideally in near-real time. It is what allows an e-commerce site to absorb a flash sale and then release capacity afterward, paying only for what was used.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 20

When evaluating a cloud-based database service, which TWO of the following are key benefits compared to self-managed databases?

Accepted Answer

Automated patching and maintenance. Option A is correct because cloud-based database services (such as Amazon RDS, Azure SQL Database, or Google Cloud SQL) handle routine patching, version upgrades, and maintenance windows automatically, offloading operational overhead from the customer. Option D is correct because these managed services provide built-in, often automated backup, point-in-time restore, and cross-region replication capabilities that simplify disaster recovery compared to building and testing such mechanisms manually. Option B is not a benefit of managed services, since customers generally cannot modify the underlying database engine source code. Option C is not inherently true, as network latency depends on client location and architecture, and managed services can even add latency versus a locally hosted database. Option E is incorrect because managed services often impose constraints on schema, extensions, and configuration, reducing rather than increasing design control.

Answer

Ability to modify the database source code

Answer

Lower network latency

Answer

Unlimited database schema design control