CLO-002 Hard Questions — 25 Difficult Questions

Question 1

Which THREE cloud management tools should be utilized to control costs?

Accepted Answer

Cost Explorer or similar visualization tool. Cost tools, budgeting alerts, and resource tagging are the trio for effective cost governance.

Answer

A physical server monitoring camera

Answer

The company's external marketing agency

Question 2

When evaluating cloud providers, what is the significance of the 'Region' concept?

Accepted Answer

Meeting data residency and sovereignty requirements. Regions are geographically distinct areas that allow for data sovereignty compliance and lower latency for global users.

Answer

Increasing the number of available users

Answer

Automating security updates

Answer

Reducing service cost

Question 3

A business is analyzing the TCO for a cloud migration. Which item is considered a recurring 'OpEx' cost?

Accepted Answer

Monthly service consumption charges. Monthly cloud subscription and consumption-based utility costs are classic examples of OpEx.

Answer

Data center construction

Answer

Hardware purchase price

Answer

Initial software licensing perpetual fee

Question 4

Which cloud architectural practice helps minimize the impact of a total regional outage?

Accepted Answer

Multi-region deployment. Multi-region deployment allows for failover to a different geographical region, ensuring business continuity.

Answer

Single-zone deployment

Answer

Vertical scaling

Answer

Private connection via Direct Connect

Question 5

Which tool provides a 'Right-sizing' recommendation for an underutilized virtual machine?

Accepted Answer

Compute Optimizer. Cloud providers' cost management tools (e.g., AWS Compute Optimizer) analyze usage metrics to suggest smaller, cheaper instances.

Answer

IAM Policy Generator

Answer

CloudFront

Answer

Network ACLs

Question 6

You need to store audit logs that are immutable and cannot be deleted for a set period. Which feature should you enable?

Accepted Answer

Object Lock. Object locking (or WORM) prevents objects from being deleted or overwritten.

Answer

Access Logs

Answer

Versioning

Answer

Encryption

Question 7

Which THREE items are generally included in a cloud provider's 'Service Level Agreement' (SLA)?

Accepted Answer

Financial service credits for outages. SLAs include uptime percentages, financial credits, and service scope definitions.

Answer

The provider's CEO's performance review

Answer

The office address of the customer

Question 8

Which THREE components are typically included in the cloud provider's 'Shared Responsibility Model' as the CUSTOMER'S responsibility?

Accepted Answer

Identity and access management (IAM) policies. The customer is responsible for everything they put 'in' the cloud, including data, apps, and OS configurations.

Answer

Global network physical cabling

Answer

Physical data center security

Question 9

Which THREE factors must be considered when estimating cloud costs?

Accepted Answer

Resource type (instance size). Usage, region, and resource type are primary cost drivers.

Answer

Data center color

Answer

Number of end users

Question 10

Which THREE risks are associated with a 'Lift and Shift' (re-hosting) migration strategy?

Accepted Answer

Lower performance than on-premises. Lifting and shifting fails to take advantage of cloud-native benefits and often results in higher costs.

Answer

Lower security

Answer

Increased hardware maintenance

Question 11

A security auditor requests a solution to ensure that all data stored in the cloud is encrypted at rest. What should the administrator implement?

Accepted Answer

Server-side encryption. Server-side encryption ensures data is encrypted before being stored on disk.

Answer

VPC Security Groups

Answer

SSL/TLS

Answer

Multi-factor authentication

Question 12

Which THREE factors should a cloud architect consider when designing for high availability?

Accepted Answer

Multi-region deployment. High availability requires redundancy at multiple layers, geographical distribution, and automated failure detection.

Answer

Centralizing all resources in a single region

Answer

Fixed-capacity hardware provisioning

Question 13

When evaluating a cloud service provider (CSP), which TWO of the following business-focused documentation should be requested to verify the vendor's reliability and security posture?

Accepted Answer

SOC 2 Type II reports. To assess risk and reliability, organizations must review the CSP's audit reports (like SOC2) and their documented Service Level Agreements.

Answer

The provider's quarterly stock earnings report

Answer

Employee payroll records

Answer

Internal office floor plans

Question 14

What is the purpose of a VPC Endpoint?

Accepted Answer

To access cloud services privately. It allows private communication between a VPC and cloud services, avoiding the public internet.

Answer

To connect two VPCs

Answer

To encrypt data transit

Answer

To provide public access

Question 15

Which THREE are key characteristics of cloud computing?

Accepted Answer

Measured service. Broad network access, elasticity, and measured service are foundational characteristics.

Answer

Static hardware provisioning

Answer

Physical media access

Question 16

An administrator needs to securely manage access to cloud resources. Which service should be used to create groups, users, and roles?

Accepted Answer

Identity and Access Management. Identity and Access Management (IAM) is the central service for user and access control.

Answer

Key Management Service

Answer

Security Groups

Answer

Active Directory

Question 17

Which THREE items should be included in a disaster recovery plan?

Accepted Answer

Backup strategy. RTO, RPO, and backup procedures are critical for recovery plans.

Answer

Customer marketing materials

Answer

Physical access badges

Question 18

Which TWO of the following scenarios represent a breach of the Shared Responsibility Model?

Accepted Answer

Customer leaves a database port open to the public. Shared responsibility requires the customer to manage what is in their control; failing to do so creates security gaps.

Answer

Provider has a data center power outage

Answer

Customer deploys code in a private VPC

Answer

Provider fails to patch their physical hardware firmware

Question 19

An application is suffering from high latency for users across the globe. Which service can help cache content closer to the users?

Accepted Answer

Content Delivery Network. A Content Delivery Network (CDN) caches content at edge locations globally.

Answer

Auto Scaling Group

Answer

VPC Peering

Answer

Load Balancer

Question 20

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Accepted Answer

Regional Resource Placement. Selecting the appropriate cloud region ensures that data remains within the physical infrastructure of a specific legal jurisdiction.

Answer

Content Delivery Network (CDN)

Answer

Global Accelerator

Answer

VPC Peering