CLO-002 Practice Test 23 — 15 Questions

Question 1

A retail company is comparing the total cost of running its e-commerce platform on-premises versus on a public cloud. The finance team wants to ensure the comparison includes costs that are often overlooked when only hardware and software license fees are considered. Which cost category should be added to make the comparison accurate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Electricity, cooling, and data center facility costs. A complete TCO comparison for cloud versus on-premises must include facility-related costs like electricity, cooling, and physical space. These are frequently omitted because they are not part of a typical server purchase order. When they are added, the true cost of on-premises hosting becomes clearer and the cloud value proposition can be evaluated fairly.

Answer

Cloud provider's marketing and sales expenses

Answer

Employee salaries for the sales department

Answer

Cost of developing new application features

Question 2

A media company stores millions of video files in a public cloud object storage bucket. Legal hold requirements mandate that specific files be retained for seven years and that no user, including administrators, can delete or overwrite them during that period. The company wants to enforce this at the storage layer without relying on application logic. Which capability should be implemented?

Accepted Answer

Configure an object lock with a retention period in compliance mode.. Legal hold with a seven-year immutability requirement demands a storage-layer control that even privileged users cannot override. Object lock in compliance mode provides exactly that: protected object versions cannot be deleted or overwritten by any principal until the retention period expires. This makes it the correct choice over policy-based or replication-based approaches that remain mutable by administrators.

Answer

Apply a bucket policy that denies delete actions to all principals except a break-glass role.

Answer

Enable versioning on the bucket and require multi-factor authentication for delete operations.

Answer

Replicate the bucket to a second region and restrict delete permissions in the replica.

Question 3

A company requires a private cloud solution for strict regulatory data isolation. Which deployment model should they choose?

Accepted Answer

Private cloud. A private cloud is dedicated to a single organization, giving it exclusive control over the infrastructure and data, which satisfies strict regulatory data isolation requirements. It avoids the multi-tenancy of public and community clouds, making it the correct choice for isolation-driven compliance.

Answer

Community cloud

Answer

Public cloud

Answer

Hybrid cloud

Question 4

A healthcare startup stores patient records in a public cloud. The security team wants to ensure that data cannot be read if the underlying storage media is physically stolen from the provider's data center. Which control should they verify is enabled?

Accepted Answer

Encryption at rest using provider-managed keys. The scenario requires protection against physical theft of storage media. Encryption at rest ensures that data on disk is ciphertext and unusable without the key. While TLS, MFA, and RBAC are valuable security controls, they do not protect data when the physical media is in an attacker's hands. Only encryption at rest directly addresses the stated threat.

Answer

Multi-factor authentication for all administrative accounts

Answer

Role-based access control (RBAC) for storage bucket permissions

Answer

Transport Layer Security (TLS) for all API calls

Question 5

A startup wants to reduce the risk of losing data stored in a cloud object storage bucket. The team needs a governance control that protects against accidental deletion by an authorized user. Which action should the team take?

Accepted Answer

Enable versioning and object lock with a retention period on the bucket.. Versioning and object lock with retention protect stored objects from accidental or malicious deletion by retaining previous versions and enforcing immutability for a defined period. Lifecycle rules, encryption, and read-only policies address cost, confidentiality, or access, but none of them prevent an authorized user from removing data the way versioning plus object lock does.

Answer

Enable server-side encryption with a provider-managed key.

Answer

Configure a lifecycle rule to transition objects to a colder storage class after 30 days.

Answer

Create a read-only identity and access management policy for all users.

Question 6

A startup deploys a web application on a public cloud. The operations team wants to be notified automatically when average CPU utilization on the application servers exceeds 80 percent for five consecutive minutes, without manually checking dashboards. Which capability should the team configure?

Accepted Answer

A cloud monitoring alarm with a notification action tied to the metric threshold.. The team needs automatic notification when a metric crosses a threshold for a sustained period. Cloud monitoring alarms natively evaluate metric streams against thresholds over an evaluation window and invoke notification actions. Billing APIs, log text searches, and remediation runbooks do not provide threshold-based metric alerting, so they cannot deliver the timely notification this scenario requires.

Answer

A scheduled script that queries the provider's billing API every five minutes.

Answer

A configuration management runbook that restarts instances when CPU is high.

Answer

A log aggregation query that searches application logs for the word CPU.

Question 7

Which TWO of the following are common cloud deployment patterns?

Accepted Answer

Blue/Green deployment. Blue/Green deployment (A) is a common cloud deployment pattern in which two identical environments are maintained so that traffic can be switched from the old (blue) version to the new (green) version, enabling near-zero-downtime releases and instant rollback. Rolling update (C) is also a standard cloud deployment pattern where instances are replaced incrementally in batches, keeping the application available throughout the release while gradually shifting to the new version. Deleting the cloud account (B) is a destructive administrative action, not a deployment pattern. Manual copy-paste (D) is an ad hoc, error-prone method rather than a structured deployment strategy. Physical shipping (E) refers to transferring hardware or media, which is not a cloud deployment pattern.

Answer

Deleting the cloud account

Answer

Manual copy-paste

Answer

Physical shipping

Question 8

A company is preparing a change management process for its cloud environment. The operations lead wants to ensure that changes to production workloads are traceable, reversible, and reviewed before deployment. Which TWO practices best support these goals? (Choose two.)

Accepted Answer

Maintain a documented rollback plan and test it in a staging environment before production changes.. Traceability, reversibility, and review are achieved by codifying changes in version control with peer-reviewed pipelines and by maintaining a tested rollback plan. Version history provides the audit trail and the mechanism for reverting, while pipeline review enforces approval before production. Direct console changes, verbal approvals, and disabled logging each weaken at least one of the three goals.

Answer

Disable change logging to reduce storage costs in the centralized logging platform.

Answer

Allow engineers to apply changes directly in the cloud console during incidents to reduce resolution time.

Answer

Require all changes to be approved verbally by the on-call manager during the change window.

Question 9

A retail company runs its e-commerce platform on a public cloud. During a flash sale, traffic spikes from 500 to 20,000 concurrent users within minutes. The operations team wants the environment to automatically add and remove server instances based on CPU utilization without manual intervention. Which cloud characteristic should they rely on to meet this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity is the ability to automatically and quickly scale resources out and in as demand changes. For a flash sale with sudden traffic spikes, the platform needs to add instances when CPU utilization rises and remove them when it falls, without manual intervention. Measured service, resource pooling, and broad network access are separate characteristics that do not provide automatic scaling.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 10

A cloud operations team needs to ensure that the production environment can be rebuilt identically after a region-wide failure. The team already stores nightly database backups in an object storage bucket in a second region. Which additional artifact is MOST critical to include in the recovery plan to guarantee the application tier can be redeployed consistently?

Accepted Answer

Infrastructure as Code templates that define the virtual network, compute instances, and load balancer configuration. Rebuilding an application tier consistently after a regional failure requires a machine-readable definition of the environment. Infrastructure as Code templates provide that definition, allowing automated, repeatable deployment of networks, compute, and load balancing. Backups alone restore data but not the surrounding infrastructure, so the IaC artifacts are the critical missing piece for full recovery.

Answer

A screenshot archive of the current cloud management console showing all running resources

Answer

The billing invoice from the previous month detailing all consumed services

Answer

A copy of the service level agreement signed with the cloud provider

Question 11

Which THREE of the following are primary business drivers for adopting a cloud computing model?

Accepted Answer

Reduced time-to-market for new features. Option A is correct because cloud computing enables rapid provisioning of environments and services, allowing teams to develop, test, and release new features faster, thereby reducing time-to-market. Option D is correct because on-demand elasticity lets organizations scale compute, storage, and networking resources up or down automatically to match workload demand, which is a core business driver for cloud adoption. Option E is correct because cloud shifts spending from large upfront capital expenditures on data center hardware to operational expenditures paid as ongoing subscription or usage-based costs, improving cash flow and financial flexibility. Option B is not a driver because cloud computing typically reduces or eliminates mandatory hardware ownership rather than requiring it. Option C is not a driver because cloud adoption aims to reduce or convert fixed infrastructure costs, not increase them.

Answer

Mandatory hardware ownership

Answer

Increasing fixed infrastructure costs

Question 12

A healthcare organization is migrating patient records to a public cloud. The compliance officer insists that data must remain within the country and that the provider must undergo regular independent audits. Which cloud characteristic should the organization verify FIRST to meet these requirements?

Accepted Answer

The provider's compliance certifications and data residency options. For regulated data like patient records, compliance certifications prove independent audits, and data residency options ensure data stays within required geographic boundaries. These two provider characteristics directly satisfy the compliance officer's mandates. Other factors like SLAs, disaster recovery, and network performance are important but do not address the specific legal and regulatory requirements.

Answer

The provider's disaster recovery plan and recovery time objective (RTO)

Answer

The provider's service level agreement (SLA) for data durability

Answer

The provider's network latency and bandwidth guarantees

Question 13

A cloud governance team is drafting controls to reduce the risk of misconfiguration in a multi-account environment. Which two practices best support continuous compliance monitoring? (Choose two.)

Accepted Answer

Run automated configuration checks that evaluate resources against a benchmark and alert on drift.. Continuous compliance combines preventive and detective controls. Validating infrastructure as code against policy stops noncompliant resources before they exist, while automated configuration checks detect drift and violations after deployment. Together they create a feedback loop that scales across many accounts, unlike annual manual reviews, disabled logging, or overly broad permissions, which either miss changes or increase risk.

Answer

Perform a manual configuration review of all accounts once per year.

Answer

Grant every engineer administrator rights so they can fix issues quickly without tickets.

Answer

Disable all logging to reduce storage costs and simplify the environment.

Question 14

An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?

Accepted Answer

SAML. SAML 2.0 is the standard XML-based protocol used to federate corporate identity providers (like Active Directory Federation Services or Okta) with cloud service providers, enabling single sign-on with corporate credentials. The IdP issues a signed SAML assertion that the cloud provider trusts, authenticating the user without a separate cloud password. This is the canonical federation pattern for enterprise cloud logins.

Answer

SNMP

Answer

SSH

Answer

ICMP

Question 15

A cloud engineer is designing a solution on Microsoft Azure that must distribute incoming HTTP traffic across a set of virtual machines in a single region, provide URL-based routing, and support TLS termination. Which Azure service should the engineer use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct service because it provides layer 7 load balancing with URL path-based routing and TLS termination for HTTP/HTTPS workloads within a region. The other services either operate at a different layer or are designed for global distribution, making them unsuitable for this specific requirement.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure Load Balancer