CLO-002 Practice Questions 2 — 50 Questions

Question 1

Which of the following represents a major benefit of cloud computing where resources are shared among multiple customers?

Accepted Answer

Resource pooling. Resource pooling is the multi-tenant cloud characteristic where compute, storage, and network resources are shared among many customers from a pooled infrastructure, with dynamic assignment based on demand. This sharing drives economies of scale and cost efficiency, which is the benefit described in the question.

Answer

Local area networking

Answer

Static provisioning

Answer

Dedicated hosting

Question 2

You are tasked with automating a script that runs every night at 2 AM to clean up temporary files. Which service is most appropriate for triggering this task?

Accepted Answer

AWS Lambda + EventBridge. AWS Lambda combined with Amazon EventBridge is the canonical serverless pattern for scheduled tasks. EventBridge (formerly CloudWatch Events) supports cron and rate expressions, so a rule like 'cron(0 2 * * ? *)' triggers the Lambda function nightly at 2 AM. Lambda executes the cleanup code without requiring a persistent EC2 instance, making it cost-effective and operationally simple.

Answer

AWS SNS

Answer

AWS IAM

Answer

AWS SQS

Question 3

A software development team is using a cloud-based platform that provides a runtime environment, middleware, and database services. The team can deploy their code without managing the underlying operating system or servers. However, they are responsible for configuring the application and its data. Which cloud service model is the team using?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a complete development and deployment environment in the cloud, including runtime, middleware, and database services. The team can deploy code without managing the OS or servers, and they remain responsible for their application and data. This aligns with the PaaS model, where the provider manages the platform and the customer manages the application.

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 4

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the account, including the identity of the caller (IAM user, role, or federated identity), the action taken, the resource affected, source IP, and timestamp. Analyzing CloudTrail event history lets the analyst pinpoint exactly which IAM user made unauthorized infrastructure changes. This is the authoritative audit log for 'who did what' in AWS.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudWatch

Answer

AWS Security Hub

Question 5

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

Accepted Answer

Classifying data based on sensitivity and regulatory requirements. Under the shared responsibility model, the customer is responsible for data classification and IAM configuration, as these are directly related to how data is handled and accessed. The provider is responsible for physical security and hypervisor patching. Key management can be shared, but the two clear customer responsibilities are data classification and IAM policies.

Answer

Patching the hypervisor that hosts virtual machines

Answer

Managing the lifecycle of encryption keys stored in a hardware security module (HSM)

Answer

Ensuring physical security of data center facilities

Question 6

You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom budgets for cost, usage, or reservations, and configure alerts when actual or forecasted spending exceeds a defined threshold. You can specify a monthly cost budget of $500 and attach an email notification to be triggered when actual spend surpasses that amount. This is the native AWS service designed for proactive cost monitoring and alerting, making it the correct choice for receiving an email alert on monthly spending.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 7

A company is moving from a capital expenditure model to an operational expenditure model. What is the primary benefit?

Accepted Answer

Removal of upfront capital costs. The primary benefit of moving from CapEx to OpEx is the elimination of large upfront capital investments. In a CapEx model, a company must purchase hardware and infrastructure outright, which requires significant capital outlay and depreciates over time. In an OpEx model, such as with cloud services, the company pays for what it uses on a subscription or pay-as-you-go basis, converting that large upfront cost into smaller, recurring operational expenses. This improves cash flow and allows the company to scale resources up or down as needed without being locked into a long-term asset.

Answer

Increased control over hardware

Answer

Predictable monthly billing

Answer

No hardware maintenance

Question 8

A small marketing agency wants to move its client project files to a cloud storage solution. The agency has unpredictable storage needs, wants to avoid purchasing hardware, and requires access from Windows, macOS, and mobile devices. Which cloud characteristic best describes the agency's ability to provision storage on demand without human intervention from the provider?

Accepted Answer

On-demand self-service. On-demand self-service is the cloud characteristic that lets a consumer provision resources such as storage automatically, without human interaction with the provider. The agency can use a portal or API to allocate storage immediately, which suits unpredictable needs and avoids hardware purchases. Broad network access, rapid elasticity, and resource pooling are separate characteristics that do not directly address unassisted provisioning.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Question 9

Which document is essential for cloud vendor selection and outlines specific performance, security, and financial requirements?

Accepted Answer

Request for Proposal (RFP). A Request for Proposal (RFP) is a formal document issued to potential vendors that specifies the organization's performance, security, financial, and functional requirements, and asks vendors to respond with proposed solutions and pricing. It is the standard procurement artifact used to evaluate and select a cloud vendor against defined criteria. This makes it essential for vendor selection.

Answer

Service Level Agreement (SLA)

Answer

Public cloud price list

Answer

Marketing brochure

Question 10

A project manager is calculating the cloud adoption strategy using a 'Re-platform' approach. What is the expected outcome?

Accepted Answer

Optimize application performance by migrating to managed services. Re-platform (often called 'lift, tinker, and shift') involves making a few cloud optimizations to the existing application without changing its core architecture. The most common form is migrating from self-managed infrastructure to managed cloud services — for example, moving a self-hosted MySQL database to Amazon RDS or a self-managed message broker to Amazon MQ. This preserves the application's functionality while gaining managed-service benefits like automated backups, patching, and scaling.

Answer

Moving VMs without any changes

Answer

Replacing the application with a third-party service

Answer

Complete rewrite of the application code

Question 11

An organization is migrating to a public cloud but has a small amount of highly sensitive data that cannot reside in a public environment. Which strategy should they use?

Accepted Answer

Hybrid cloud strategy. A hybrid cloud strategy keeps highly sensitive data on-premises or in a private environment while leveraging the public cloud for less sensitive workloads. This satisfies the constraint that sensitive data cannot reside in a public environment while still enabling cloud benefits for the rest of the organization.

Answer

Full public cloud migration

Answer

Multi-tenant public cloud

Answer

Edge computing

Question 12

An company is performing a cloud migration. What is the primary purpose of a 'Cloud Center of Excellence' (CCoE)?

Accepted Answer

Establishing best practices and governance. A Cloud Center of Excellence is a cross-functional team that establishes cloud best practices, governance, standards, and reusable patterns to guide an organization's cloud adoption. Its primary purpose is to provide centralized expertise and guardrails rather than to perform day-to-day operational tasks. This enables consistent, secure, and cost-effective cloud migration across business units.

Answer

Managing physical server repairs

Answer

Executing code deployments

Answer

Directly handling all customer support tickets

Question 13

Which tool provides a 'Right-sizing' recommendation for an underutilized virtual machine?

Accepted Answer

Compute Optimizer. AWS Compute Optimizer analyzes CloudWatch metrics (CPU, memory, network, disk) over a lookback period and generates right-sizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It flags over-provisioned resources so you can downsize instance types and reduce cost. This is exactly the 'right-sizing' capability described in the question.

Answer

IAM Policy Generator

Answer

CloudFront

Answer

Network ACLs

Question 14

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a dedicated account- and bucket-level setting that overrides any ACL or bucket policy granting public access, providing a hard guardrail against accidental public exposure. Enabling it at the account level ensures that even if someone later attaches a permissive bucket policy or ACL, public access remains blocked. This is the AWS-recommended control specifically designed to prevent the incident described.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 15

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. A cloud provider's public status dashboard (e.g., status.cloud.google.com, status.aws.amazon.com) is the authoritative, real-time source for current service health and ongoing incidents. It shows per-region, per-service status and incident timelines. This is the correct place to verify whether an outage is provider-side and its scope.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc

Question 16

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. An IAM Role is designed for delegation: it has no long-term credentials and instead issues temporary security credentials via STS when assumed. A third-party service provider can be granted permission to assume a role in your account using a trust policy, giving them time-limited access without ever sharing your access keys. This is the AWS best practice for cross-account and third-party access.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 17

Which TWO scenarios are appropriate for using a load balancer?

Accepted Answer

To distribute traffic across multiple instances. Option C is correct because a load balancer's primary function is to distribute incoming traffic across multiple backend instances, preventing any single instance from being overwhelmed and enabling horizontal scaling. Option D is correct because by spreading requests across multiple instances and performing health checks, a load balancer can route traffic away from unhealthy instances, thereby improving fault tolerance and availability. Option A is incorrect because persistent data storage is the role of databases or storage services, not load balancers. Option B is incorrect because reducing internet latency is achieved through CDNs or edge caching, not load balancing. Option E is incorrect because encryption of data at rest is handled by storage-level encryption mechanisms, not load balancers.

Answer

To store persistent data

Answer

To reduce network latency to the internet

Answer

To encrypt data at rest

Question 18

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Accepted Answer

Allow TCP 443 from 0.0.0.0/0. To allow only standard HTTPS traffic, the inbound rule must permit TCP port 443. Option A specifies TCP 443 from 0.0.0.0/0, which allows HTTPS from any source — this is the correct port and protocol for HTTPS. While 0.0.0.0/0 is broad, the question asks which rule allows only standard HTTPS traffic, and TCP 443 is the defining characteristic of HTTPS.

Answer

Allow TCP 80 from 0.0.0.0/0

Answer

Allow all TCP from 0.0.0.0/0

Answer

Allow UDP 443 from 0.0.0.0/0

Question 19

A healthcare company is migrating a patient records system to the cloud. The system must comply with strict data residency regulations that require all patient data to remain within the country. The company also wants to minimize latency for local users. Which cloud deployment model is MOST appropriate?

Accepted Answer

Private cloud hosted within the country. A private cloud hosted within the country is the most appropriate because it guarantees that patient data remains within national borders, directly meeting data residency regulations. It also gives the healthcare company control over the infrastructure, which helps with compliance audits and local latency optimization. The other models either risk cross-border data movement or do not inherently ensure in-country data location.

Answer

Community cloud shared with other healthcare providers globally

Answer

Hybrid cloud using a public cloud for primary storage and an on-premises private cloud for backup

Answer

Public cloud with resources in multiple global regions

Question 20

Which TWO criteria are essential when selecting a cloud vendor for an enterprise?

Accepted Answer

Compliance and regulatory certifications. Option D is correct because compliance and regulatory certifications (for example ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, or GDPR alignment) are essential to verify that the vendor meets the legal, industry, and data-protection obligations the enterprise must satisfy. Option E is correct because the Service Level Agreement defines measurable guarantees such as uptime percentage, latency, RTO/RPO, and remediation or credits, which directly determine whether the cloud service can meet the enterprise's availability and performance requirements. Options A, B, and C are not essential selection criteria: free trial gifts have no bearing on production suitability, the number of employees does not indicate service quality or compliance, and the headquarters location alone does not establish where data is stored or processed, which is what actually matters for regulatory and latency concerns.

Answer

Availability of free trial gifts

Answer

The number of employees at the cloud company

Answer

The physical location of the cloud company's headquarters