CLO-002 Business Principles OF Cloud Environments — 50 Questions

Question 1

A healthcare company must comply with HIPAA. When selecting a cloud provider, which document provides the best assurance of compliance?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is an independent audit that evaluates a cloud provider's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6–12 months). For HIPAA compliance, it provides strong third-party assurance that the provider has implemented and consistently operated the controls necessary to protect ePHI. It is widely accepted by auditors and regulators as evidence of a mature compliance posture.

Answer

Vendor marketing brochure

Answer

Service Level Agreement (SLA)

Answer

Public pricing catalog

Question 2

An organization wants to use AWS Cost Explorer to identify cost-saving opportunities. Which filter should the administrator apply to find idle resources?

Accepted Answer

Usage Type Group. AWS Cost Explorer provides a 'Usage Type Group' filter that categorizes costs by specific usage types, such as 'EC2: Running Hours' or 'EC2: Data Transfer'. By filtering on usage type groups, administrators can isolate resources that are incurring charges but not actively used, such as stopped instances that still have attached EBS volumes or idle load balancers. This filter directly surfaces cost anomalies tied to resource utilization, making it the correct choice for identifying idle resources.

Answer

API Activity Log

Answer

Service Quotas

Answer

Resource Tagging

Question 3

A company is shifting from CapEx to OpEx for its infrastructure. Which financial metric should the CFO prioritize to justify this transition?

Accepted Answer

Return on Investment (ROI). When shifting from CapEx to OpEx, the CFO needs to justify the ongoing operational spend against the business value it delivers, and ROI is the metric that directly compares returns to costs. ROI expresses the financial benefit of the cloud investment as a percentage, making it the most relevant metric for evaluating whether the OpEx model pays off.

Answer

Debt-to-Equity Ratio

Answer

Internal Rate of Return (IRR)

Answer

Net Present Value (NPV)

Question 4

When assessing cloud readiness, what is a 'Legacy' application characteristic that might make migration difficult?

Accepted Answer

Hard-coded IP addresses. A 'Legacy' application characteristic that makes migration difficult is hard-coded IP addresses. Such applications have dependencies on specific IP addresses for communication, which can break when moved to the cloud where IP addresses are dynamic or change upon migration. This requires refactoring or workarounds like Elastic IPs, which may not be feasible for all components.

Answer

Written in Java

Answer

Used by a small team

Answer

Web-based interface

Question 5

Which THREE components are typically included in the cloud provider's 'Shared Responsibility Model' as the CUSTOMER'S responsibility?

Accepted Answer

Identity and access management (IAM) policies. In the cloud Shared Responsibility Model, the customer is always responsible for their own data, identities, and access controls, so option A (IAM policies) is correct because configuring users, roles, permissions, and least-privilege access is a customer task regardless of service model. Option B (client-side data encryption) is correct because encrypting data before it leaves the customer's environment, including key management choices, remains the customer's responsibility to protect data confidentiality. Option C (operating system patch management) is correct for IaaS deployments, where the customer manages the guest OS, including applying security patches, while the provider only patches the underlying hypervisor and infrastructure. Options D (global network physical cabling) and E (physical data center security) are not customer responsibilities because the cloud provider owns and secures the physical facilities, hardware, and network backbone under its control.

Answer

Global network physical cabling

Answer

Physical data center security

Question 6

Which THREE risks are associated with a 'Lift and Shift' (re-hosting) migration strategy?

Accepted Answer

Lower performance than on-premises. Option C is correct because a lift-and-shift re-host moves workloads to cloud VMs without refactoring, so the same CPU/RAM/IO profile is often paired with shared or throttled cloud resources and higher-latency storage/network paths, yielding lower performance than dedicated on-premises hardware. Option D is correct because re-hosting typically preserves the existing VM sizing and always-on provisioning, so organizations pay for idle capacity and miss rightsizing, reserved instances, savings plans, and autoscaling, failing to optimize cloud costs. Option E is correct because lift-and-shift does not redesign the application to use managed services such as serverless, containers, managed databases, or auto-scaling, so the organization misses out on cloud-native features and elasticity. Option A is not correct because re-hosting usually maintains or can improve the existing security posture through cloud provider controls, so lower security is not an inherent risk of the strategy. Option B is not correct because moving to cloud VMs shifts hardware maintenance to the cloud provider, reducing rather than increasing hardware maintenance burden.

Answer

Lower security

Answer

Increased hardware maintenance

Question 7

Which THREE activities are included in the 'Cloud Adoption Strategy' planning phase?

Accepted Answer

Identifying security and compliance requirements. In the Cloud Adoption Strategy planning phase, C (identifying security and compliance requirements) is correct because the strategy must define the regulatory, data-residency, and security controls (e.g., GDPR, HIPAA, ISO 27001) that constrain provider and architecture choices before any migration begins. D (selecting the cloud service provider) is correct because choosing among AWS, Azure, or GCP — and the specific services and regions — is a foundational strategic decision that shapes cost, capability, and lock-in. E (performing a TCO analysis) is correct because comparing on-premises capital and operational costs against cloud consumption pricing (compute, storage, egress, licensing) is a core planning activity used to justify and scope the adoption. Options A and B are incorrect because updating a break room menu and buying office chairs are facilities and office-management tasks unrelated to cloud adoption strategy, governance, or financial planning.

Answer

Updating the break room menu

Answer

Buying office chairs for the staff

Question 8

A company is preparing a cloud business case and must justify migrating an on-premises legacy application. The finance department requires a direct comparison of current hardware refresh costs versus cloud consumption models. Which metric should the cloud architect prioritize to demonstrate the financial benefit?

Accepted Answer

Capital Expenditure (CapEx) reduction. Capital Expenditure (CapEx) reduction is the metric that directly compares current hardware refresh costs (a CapEx model) with cloud consumption models (an OpEx model). By migrating to the cloud, the company avoids large upfront hardware purchases and instead pays for resources as operational expenses, which is the financial benefit the finance department needs to see. This metric highlights the shift from CapEx to OpEx and the associated cost savings.

Answer

Service Level Agreement (SLA) uptime

Answer

Return on Investment (ROI)

Answer

Mean Time to Repair (MTTR)

Question 9

A healthcare organization is migrating patient records to a public cloud. The compliance team requires that data remains within the country and that access is restricted to authorized personnel. Which two AWS features should be implemented to meet these requirements? (Choose two.)

Accepted Answer

AWS Identity and Access Management (IAM) policies. To meet data residency and access control requirements, the organization should use AWS Regions to keep data within the country and IAM policies to restrict access to authorized personnel. These features directly address the compliance needs.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Artifact

Answer

AWS Lambda functions

Question 10

A company is evaluating the total cost of ownership (TCO) for moving its on-premises data center to the cloud. Which two factors should be included in the TCO analysis? (Choose two.)

Accepted Answer

Cloud provider's monthly subscription fees. A TCO analysis for cloud migration should include costs that are directly attributable to the cloud model, such as monthly subscription fees and staff training. It should exclude on-premises costs that are eliminated, like hardware depreciation, cooling, power, and maintenance contracts. Including both would distort the comparison and lead to inaccurate financial decisions.

Answer

Cost of physical server hardware depreciation

Answer

Cost of data center cooling and power

Answer

Cost of hardware maintenance contracts

Question 11

A small marketing agency is considering moving its customer relationship management (CRM) system to the cloud. The agency has limited IT staff and wants to minimize the operational burden of managing servers, databases, and middleware. The CRM application is critical to their business, and they need to focus on customizing the application to meet their unique workflows rather than managing infrastructure. Which cloud service model should the agency choose?

Accepted Answer

Software as a Service (SaaS). The agency wants a ready-to-use application with minimal management overhead. SaaS provides a complete application managed by the provider, so the agency can focus on configuration and customization. IaaS and PaaS would require more operational effort, and FaaS is designed for custom code, not packaged applications.

Answer

Functions as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Question 12

A media company is planning to move its video rendering workloads to the cloud. The workloads are unpredictable and often require hundreds of instances for short periods. The finance team is concerned about cost variability. Which cloud financial practice should the company adopt to manage these unpredictable costs effectively?

Accepted Answer

Implementing tagging and cost allocation to track spending by project. Tagging and cost allocation give the media company the visibility needed to manage unpredictable cloud spending. By tracking costs per project, the finance team can set budgets, identify anomalies, and make informed decisions about workload placement. This practice supports accountability and is a key part of cloud financial management, especially for variable workloads.

Answer

Negotiating a fixed monthly fee with the cloud provider

Answer

Purchasing reserved instances for a three-year term

Answer

Using only spot instances for all rendering jobs

Question 13

A financial services company is evaluating a move to the public cloud for its high-frequency trading application. The application requires extremely low latency and high throughput, and the company has invested heavily in specialized network hardware on-premises. The CIO is concerned that moving to the cloud could introduce unacceptable latency. Which cloud deployment model should the company consider to meet its performance requirements while still leveraging cloud benefits?

Accepted Answer

Hybrid cloud. The company needs to maintain ultra-low latency for trading while gaining cloud benefits for other workloads. A hybrid cloud allows them to keep latency-sensitive operations on-premises and use public cloud for scalable, less critical tasks. Public cloud may not meet latency requirements, private cloud lacks cloud elasticity, and community cloud is not designed for specialized high-performance needs.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 14

A financial services company is moving to the cloud and must ensure that its data is stored in a way that meets regulatory requirements for data residency. The company operates only in the European Union. Which cloud deployment model should it choose to guarantee that data remains within the EU?

Accepted Answer

Private cloud. The company needs to guarantee that data remains within the EU. A private cloud, hosted within the EU, provides dedicated infrastructure and full control over data location, ensuring compliance with data residency regulations. Public, hybrid, and community clouds may not offer the same level of assurance without additional controls.

Answer

Community cloud

Answer

Hybrid cloud

Answer

Public cloud

Question 15

A multinational corporation is migrating its legacy ERP system to the cloud. The IT director is concerned about the total cost of ownership (TCO) and wants to ensure that the migration delivers financial benefits. The CFO asks for a comparison of the current on-premises costs versus the projected cloud costs. Which financial metric should be used to evaluate the long-term economic impact of this migration?

Accepted Answer

Total cost of ownership (TCO). TCO is the appropriate metric for comparing the total costs of on-premises and cloud solutions over their lifecycle. It includes all direct and indirect costs, providing a comprehensive view that addresses the CFO's request. ROI, NPV, and IRR are financial metrics that build on TCO but do not directly compare the cost structures of the two models.

Answer

Internal rate of return (IRR)

Answer

Net present value (NPV)

Answer

Return on investment (ROI)

Question 16

A financial services firm is migrating a high-frequency trading application to the cloud. The application requires extremely low latency and cannot tolerate any downtime during trading hours. Which cloud deployment model should the firm choose to meet these requirements?

Accepted Answer

Private cloud. High-frequency trading demands deterministic low latency and high availability, which are best achieved with dedicated infrastructure. A private cloud provides the control and isolation needed to optimize performance and avoid multi-tenant contention. Public, community, and hybrid models introduce shared resources or external dependencies that can compromise the strict latency and uptime requirements of this financial application.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Question 17

A large enterprise is conducting a cost-benefit analysis for migrating its on-premises data center to the cloud. The finance team wants to ensure that all relevant costs are considered, including both direct and indirect expenses. Which TWO factors should be included in the total cost of ownership (TCO) analysis for the cloud migration? (Choose two.)

Accepted Answer

Cost of data egress fees. A thorough TCO analysis for cloud migration must include direct cloud costs such as service subscriptions and data egress fees. These are ongoing expenses unique to the cloud model and can significantly impact the overall cost. Sunk costs like hardware depreciation, fixed salaries, and on-premises security are not incremental to the migration and should be excluded to avoid skewing the comparison.

Answer

Cost of physical data center security

Answer

Cost of existing hardware depreciation

Answer

Cost of employee salaries for the IT department

Question 18

When performing a TCO analysis for migrating a legacy on-premises database to Azure SQL, which hidden cost is most likely to be overlooked?

Accepted Answer

Data egress fees. Data egress fees are the classic hidden cost in cloud TCO analyses because organizations focus on compute, storage, and licensing while forgetting that moving data OUT of the cloud provider's network is metered and billed. In a database migration scenario, ongoing replication, backups to on-premises, or application traffic leaving Azure all incur egress charges that can accumulate significantly over time. Unlike power, cooling, or hardware maintenance — which are eliminated by moving to cloud — egress is a NEW cost that did not exist on-premises, making it the most commonly overlooked line item.

Answer

Power and cooling

Answer

Software licensing

Answer

Hardware maintenance

Question 19

Which cloud service model would best suit a company that needs complete control over the network configuration and operating system but wants to avoid physical server maintenance?

Accepted Answer

IaaS. IaaS provides virtualized computing resources over the internet, giving the customer control over the operating system, storage, and network configuration while the provider manages the physical infrastructure. This matches the requirement for complete control over network and OS without physical server maintenance.

Answer

PaaS

Answer

SaaS

Answer

Serverless

Question 20

A project manager is calculating the cloud adoption strategy using a 'Re-platform' approach. What is the expected outcome?

Accepted Answer

Optimize application performance by migrating to managed services. Re-platform (often called 'lift, tinker, and shift') involves making a few cloud optimizations to the existing application without changing its core architecture. The most common form is migrating from self-managed infrastructure to managed cloud services — for example, moving a self-hosted MySQL database to Amazon RDS or a self-managed message broker to Amazon MQ. This preserves the application's functionality while gaining managed-service benefits like automated backups, patching, and scaling.

Answer

Moving VMs without any changes

Answer

Replacing the application with a third-party service

Answer

Complete rewrite of the application code