CLO-002 Management And Technical Operations — 20 Questions

Question 1

An organization is migrating to a hybrid cloud model. They require a dedicated, private connection between their on-premises data center and the cloud provider to reduce latency. Which service should be provisioned?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Direct Connect. Direct Connect provides a dedicated, private network connection between an on-premises data center and a cloud provider, bypassing the public internet. This reduces latency, increases bandwidth, and provides more consistent network performance. It is the appropriate service for hybrid cloud models requiring private connectivity.

Answer

Software-Defined Networking

Answer

Content Delivery Network

Answer

Site-to-Site VPN

Question 2

You need to restrict outgoing network traffic from a private subnet to only specific API endpoints. Which security component should be configured?

Accepted Answer

Security Group. Security groups act as stateful virtual firewalls at the instance/ENI level and are the correct component for restricting which destinations and ports an instance can reach outbound. You configure an outbound rule that permits traffic only to the specific API endpoint IPs or security groups, and deny everything else by default. This gives granular, per-resource egress control without affecting routing.

Answer

Route Table

Answer

VPC Peering

Answer

Internet Gateway

Question 3

Your organization requires that a specific cloud environment be isolated from the internet, yet it must access a private service hosted on another cloud provider. Which networking configuration is most appropriate?

Accepted Answer

Private Link / Private Endpoint. Private Link / Private Endpoint (Option D) is correct because it enables private connectivity to a service hosted on another cloud provider without exposing traffic to the public internet. It uses provider-side endpoints and consumer-side endpoints to establish a one-way, private connection over the cloud backbone. This satisfies the isolation requirement while still allowing access to the external private service.

Answer

NAT Gateway

Answer

Public IP address assignment

Answer

Internet Gateway

Question 4

You are responsible for managing access keys for service accounts. You suspect a key has been compromised. What is the immediate operational step to take?

Accepted Answer

Deactivate/Rotate the key. When an access key is suspected compromised, the immediate action is to deactivate or rotate it to prevent further unauthorized use. Deactivating the key immediately blocks its use, while rotation replaces it with a new key, invalidating the old one. This is the fastest way to mitigate the risk and is a standard incident response step for compromised credentials.

Answer

Change the password of the user

Answer

Increase logging levels

Answer

Monitor CloudTrail logs

Question 5

You are troubleshooting a connectivity issue where an application cannot reach a database. Which tool allows you to trace the network path and identify the specific point of failure?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information to and from network interfaces in a VPC, including source/destination IP, ports, protocol, and whether the traffic was accepted or rejected. By analyzing flow logs, you can trace the network path and identify where traffic is being blocked, such as at a security group or network ACL. This makes it the appropriate tool for troubleshooting connectivity issues at the network level.

Answer

Instance health checks

Answer

IAM Policy simulator

Answer

CloudWatch Metrics

Question 6

An administrator wants to ensure that a storage bucket is not accidentally deleted. Which feature should be enabled?

Accepted Answer

Bucket versioning. Soft delete or bucket versioning ensures that data can be recovered if accidentally deleted.

Answer

Public access block

Answer

Storage encryption

Answer

Cross-region replication

Question 7

Which TWO of the following are valid strategies for cloud data migration?

Accepted Answer

Network-based migration. Network-based migration (B) is a valid strategy because it moves data to the cloud over the network using secure transfer mechanisms such as HTTPS/TLS, SFTP, or AWS DataSync, which is the standard approach for datasets that fit within available bandwidth and transfer windows. Physical transfer devices (E) are also valid, since services like AWS Snowball or Azure Data Box let you ship large volumes of data on encrypted appliances when network transfer would be too slow or costly. The remaining options are not migration strategies: printing data as paper records (A) does not transfer data into cloud storage in a usable digital form, hard-coding database rows (C) is an application anti-pattern rather than a migration method, and deleting all local hardware (D) is a decommissioning action, not a way to move data to the cloud.

Answer

Printing all data as paper records

Answer

Hard-coding all database rows

Answer

Deleting all local hardware

Question 8

Which THREE services allow you to restrict network access in a cloud VPC?

Accepted Answer

Web Application Firewalls (WAF). Web Application Firewalls (WAF) (C) are correct because they filter and monitor HTTP/HTTPS traffic at the application layer, allowing you to block requests based on rules such as IP reputation, SQL injection, or cross-site scripting patterns, thereby restricting access to web resources in the VPC. Network ACLs (D) are correct because they are stateless, subnet-level packet filters that evaluate inbound and outbound traffic against numbered allow/deny rules, giving you explicit control over which CIDR ranges and ports can reach subnets. Security Groups (E) are correct because they are stateful, instance-level virtual firewalls that permit only the traffic explicitly allowed by their inbound and outbound rules, effectively restricting access to resources such as EC2 instances. Auto Scaling Groups (B) are not access-control mechanisms; they only adjust the number of running instances based on demand or health policies. Content Delivery Network (A) is a caching and edge-distribution service that improves latency and offloads origin traffic, but it does not itself restrict network access within a VPC.

Answer

Content Delivery Network

Answer

Auto Scaling Groups

Question 9

Which TWO are common types of cloud backups?

Accepted Answer

File-level backups. Backups can be performed at the volume level (snapshots) or the file level.

Answer

Buying a new laptop

Answer

Deleting old logs

Answer

Physical disk copying

Answer

Renaming a file

Question 10

A company wants to reduce the risk of a single cloud provider outage affecting its customer-facing web application. The application currently runs entirely in one region of a single provider. Which approach BEST addresses this availability concern while keeping operational complexity manageable?

Accepted Answer

Deploy the application across multiple availability zones within the same region. Deploying across multiple availability zones within a region is the most practical way to improve availability without excessive complexity. It isolates the application from a single datacenter failure and is a foundational cloud resilience pattern. Other options either concentrate risk, protect only data, or provide support rather than architectural redundancy.

Answer

Migrate the application to a single larger virtual machine with more memory and CPU

Answer

Enable automatic backups of the application database every hour

Answer

Purchase a higher-tier support plan from the cloud provider

Question 11

A company runs a production web application on Amazon EC2 instances behind an Application Load Balancer. The operations team must deploy a new version of the application with zero downtime and the ability to roll back immediately if the new version fails health checks. Which deployment strategy should the team implement?

Accepted Answer

Rolling deployment that updates instances in batches while keeping the rest in service. A rolling deployment updates instances in controlled batches while the load balancer continues routing traffic to healthy instances, so users experience no outage. Health checks automatically stop the rollout if the new version misbehaves, and the previous version can be redeployed to the affected batch. This satisfies both zero downtime and rapid rollback using the existing EC2 and load balancer infrastructure.

Answer

All-at-once deployment that replaces all instances simultaneously

Answer

Blue/green deployment that maintains two identical environments and shifts traffic after validation

Answer

Canary deployment that sends a small percentage of traffic to the new version and waits for manual approval

Question 12

A media company stores millions of video files in a public cloud object storage bucket. A small subset of files is accessed frequently for the first week after upload, then rarely accessed again, but must remain immediately retrievable for seven years for legal reasons. The storage team wants to minimize cost without adding retrieval delays. Which storage strategy should the team implement?

Accepted Answer

Apply a lifecycle policy that transitions objects to an infrequent access class after 30 days, then to an archive class after 90 days.. The workload has a predictable access pattern: hot for one week, then cold for years, with a requirement for immediate retrievability during the hot phase. A lifecycle policy that transitions objects from standard to infrequent access and then to archive matches storage cost to access frequency automatically. Keeping everything hot overspends, immediate archival breaks early reads, and versioning with replication increases cost.

Answer

Move all objects to an archive storage class immediately after upload.

Answer

Keep all objects in the standard hot storage class for the full seven years.

Answer

Enable versioning and cross-region replication on the bucket to reduce storage costs.

Question 13

A cloud architect is designing a disaster recovery strategy for a critical application. The business requires an RTO of 15 minutes and an RPO of 5 minutes. The application runs on virtual machines with a database. Which approach best meets these objectives at the lowest cost?

Accepted Answer

Pilot light with asynchronous database replication. The business needs an RTO of 15 minutes and an RPO of 5 minutes. A pilot light with asynchronous database replication keeps a minimal environment ready and replicates data continuously, allowing recovery within the RTO while keeping costs lower than active-active or synchronous warm standby. Backup and restore cannot meet the tight RPO, and active-active or synchronous replication exceeds the cost necessary for the stated objectives.

Answer

Backup and restore from nightly snapshots

Answer

Multi-site active-active deployment

Answer

Warm standby with synchronous replication

Question 14

A platform team manages a Kubernetes cluster on Google Cloud. They need a managed, cluster-level observability service that captures metrics, logs, and traces from workloads, provides dashboards with minimal configuration, and integrates with Cloud Monitoring for alerting. Which Google Cloud service should they enable?

Accepted Answer

Google Cloud Managed Service for Prometheus with Google Cloud Observability.. Google Cloud Managed Service for Prometheus is the managed, cluster-level metrics service for GKE and integrates with Cloud Monitoring for dashboards and alerts, while Cloud Logging and Cloud Trace cover logs and traces. Together they form an integrated observability stack with minimal operational overhead. The other choices either cover only one signal type or require self-managed collectors and sidecars that increase maintenance burden.

Answer

Cloud Monitoring with a Prometheus sidecar per node.

Answer

Cloud Logging with log-based metrics and custom sinks.

Answer

Cloud Trace with OpenTelemetry collectors deployed as a DaemonSet.

Question 15

A financial services company runs a payment processing application on Amazon EC2 instances behind an Application Load Balancer. The compliance team requires that all data in transit between clients and the load balancer, and between the load balancer and the EC2 instances, be encrypted. The company has a valid public certificate for the external domain but wants to minimize administrative overhead for internal encryption. Which combination of configurations should the cloud operations team implement to meet these requirements?

Accepted Answer

Configure an HTTPS listener on the ALB using the public certificate, and configure the target group to use HTTPS with a certificate issued by AWS Certificate Manager (ACM) for the internal domain, ensuring the ALB validates the backend certificate.. The requirement is for encryption in transit both externally and internally. An HTTPS listener on the ALB with the public certificate secures external traffic. For internal traffic, using ACM to issue a private certificate for the backend instances allows the ALB to validate the instances' certificates, ensuring secure and trusted communication. This approach leverages managed certificate services to reduce administrative burden while satisfying compliance.

Answer

Configure an HTTPS listener on the ALB using the public certificate, and configure the target group to use HTTP for backend traffic.

Answer

Configure an HTTPS listener on the ALB using the public certificate, and configure the target group to use HTTPS with a self-signed certificate on the instances, disabling certificate validation on the ALB.

Answer

Configure a TCP listener on the ALB using the public certificate, and rely on the instances to handle TLS termination for both client and backend connections.

Question 16

A healthcare organization is migrating its patient records system to Microsoft Azure. The system uses a SQL Server database on an Azure Virtual Machine. The compliance officer insists that all data at rest be encrypted with customer-managed keys stored in a hardware security module (HSM). The IT team needs to implement this without modifying the application. Which Azure feature should they use?

Accepted Answer

Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault Managed HSM. The requirement is to encrypt data at rest for a SQL Server database on an Azure VM using customer-managed keys in an HSM without application changes. Azure SQL Database TDE with customer-managed keys in Azure Key Vault Managed HSM provides transparent encryption and meets HSM compliance. It operates at the database level, requiring no application modifications, and supports bring-your-own-key scenarios with HSM-backed keys.

Answer

Azure Disk Encryption with BitLocker and Key Vault

Answer

Always Encrypted with secure enclaves

Answer

Azure Storage Service Encryption with customer-managed keys in Key Vault

Question 17

You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?

Accepted Answer

DynamoDB table. DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Answer

S3 Versioning

Answer

Terraform Cloud Workspaces

Answer

IAM Policy

Question 18

A system administrator needs to automatically replace unhealthy EC2 instances in an AWS Auto Scaling group. Which component must be configured?

Accepted Answer

Auto Scaling Health Checks. Auto Scaling Health Checks are the component that automatically detects and replaces unhealthy EC2 instances in an Auto Scaling group. When health checks are enabled, the group terminates instances that fail and launches replacements to maintain desired capacity.

Answer

CloudWatch Alarms

Answer

Elastic Load Balancer

Answer

IAM Role

Question 19

A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical CloudWatch metrics (CPU, memory if the agent is installed, network, disk) and applies machine-learning models to generate specific rightsizing recommendations for EC2 instances, including over-provisioned and under-provisioned findings. It is purpose-built for this task and integrates with Cost Explorer and Trusted Advisor.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 20

A developer needs to monitor real-time CPU utilization across a fleet of virtual machines in Azure. Which service should be used to capture and visualize these metrics?

Accepted Answer

Azure Monitor. Azure Monitor is the platform service that collects, analyzes, and visualizes metrics and logs from Azure resources including VMs. It captures real-time CPU utilization via the Azure Monitor agent or diagnostic extension and surfaces it through Metrics Explorer, workbooks, and alerts. This makes it the correct choice for monitoring performance metrics across a VM fleet.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Graph