CLO-002 Management And Technical Operations Practice Test 2 — 15 Questions

Question 1

A healthcare organization is migrating its patient records system to Microsoft Azure. The system uses a SQL Server database on an Azure Virtual Machine. The compliance officer insists that all data at rest be encrypted with customer-managed keys stored in a hardware security module (HSM). The IT team needs to implement this without modifying the application. Which Azure feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault Managed HSM. The requirement is to encrypt data at rest for a SQL Server database on an Azure VM using customer-managed keys in an HSM without application changes. Azure SQL Database TDE with customer-managed keys in Azure Key Vault Managed HSM provides transparent encryption and meets HSM compliance. It operates at the database level, requiring no application modifications, and supports bring-your-own-key scenarios with HSM-backed keys.

Answer

Azure Disk Encryption with BitLocker and Key Vault

Answer

Always Encrypted with secure enclaves

Answer

Azure Storage Service Encryption with customer-managed keys in Key Vault

Question 2

You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?

Accepted Answer

DynamoDB table. DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Answer

S3 Versioning

Answer

Terraform Cloud Workspaces

Answer

IAM Policy

Question 3

A system administrator needs to automatically replace unhealthy EC2 instances in an AWS Auto Scaling group. Which component must be configured?

Accepted Answer

Auto Scaling Health Checks. Auto Scaling Health Checks are the component that automatically detects and replaces unhealthy EC2 instances in an Auto Scaling group. When health checks are enabled, the group terminates instances that fail and launches replacements to maintain desired capacity.

Answer

CloudWatch Alarms

Answer

Elastic Load Balancer

Answer

IAM Role

Question 4

A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical CloudWatch metrics (CPU, memory if the agent is installed, network, disk) and applies machine-learning models to generate specific rightsizing recommendations for EC2 instances, including over-provisioned and under-provisioned findings. It is purpose-built for this task and integrates with Cost Explorer and Trusted Advisor.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 5

A developer needs to monitor real-time CPU utilization across a fleet of virtual machines in Azure. Which service should be used to capture and visualize these metrics?

Accepted Answer

Azure Monitor. Azure Monitor is the platform service that collects, analyzes, and visualizes metrics and logs from Azure resources including VMs. It captures real-time CPU utilization via the Azure Monitor agent or diagnostic extension and surfaces it through Metrics Explorer, workbooks, and alerts. This makes it the correct choice for monitoring performance metrics across a VM fleet.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Graph

Question 6

Which cloud operation task is primarily responsible for ensuring that the cloud environment adheres to corporate security and regulatory standards?

Accepted Answer

Compliance management. Compliance management is the cloud operations task specifically focused on ensuring the cloud environment adheres to corporate security policies and regulatory standards. It involves continuous monitoring, auditing, and enforcement of controls to maintain alignment with frameworks such as ISO 27001, SOC 2, HIPAA, and GDPR. Unlike other operational tasks, compliance management directly addresses governance and regulatory adherence.

Answer

Cost optimization

Answer

Load balancing

Answer

Capacity planning

Question 7

You are implementing a disaster recovery strategy. You need to ensure that database backups are stored in a different geographic region than the primary production database. What is this concept known as in cloud management?

Accepted Answer

Geo-redundancy. Geo-redundancy refers to the practice of replicating data and services across multiple geographic regions to ensure availability and disaster recovery. In the context of database backups, storing them in a different geographic region than the primary production database is a form of geo-redundancy, which protects against regional failures and meets compliance requirements for data durability.

Answer

Horizontal scaling

Answer

Availability Zone failover

Answer

Local data caching

Question 8

You are utilizing Infrastructure as Code (IaC) templates. You notice that a specific resource update is causing service downtime. Which deployment pattern should you adopt to verify updates in a controlled environment before rolling out to production?

Accepted Answer

Blue/Green deployment. Blue/Green deployment is the correct pattern because it maintains two identical environments (blue = current production, green = new version) and allows you to verify the update in the green environment before switching traffic over. This provides a controlled, low-risk way to test changes and enables instant rollback by switching traffic back to blue if issues arise. It directly addresses the requirement to verify updates in a controlled environment before production rollout.

Answer

Canary release

Answer

In-place upgrade

Answer

Rolling update

Question 9

Which of the following is an example of 'Infrastructure as Code'?

Accepted Answer

Using Terraform files. Terraform files are declarative configuration code that defines infrastructure resources (VMs, networks, storage) in a version-controlled, repeatable format — the textbook definition of Infrastructure as Code. Terraform's HCL files are executed by the Terraform engine to provision and manage cloud resources idempotently, enabling automation, peer review, and reproducibility.

Answer

Manual console configuration

Answer

Cloud provider dashboard

Answer

Automatic scaling alerts

Question 10

A company requires that all cloud logs be retained for seven years for legal compliance. Which service should they configure to ensure logs are moved to the cheapest storage class long-term?

Accepted Answer

S3 Lifecycle Policies. S3 Lifecycle Policies allow you to define rules that automatically transition objects (including logs) to cheaper storage classes like S3 Glacier or S3 Glacier Deep Archive after a specified period, and eventually expire them. This directly addresses the requirement to move logs to the cheapest long-term storage for seven-year retention. CloudWatch Logs retention and CloudTrail do not provide automated cost-optimized storage tiering; IAM policies control access, not storage lifecycle.

Answer

CloudWatch Logs retention

Answer

IAM Policies

Answer

AWS CloudTrail

Question 11

You are managing a fleet of cloud servers and notice that CPU usage is consistently at 95% during peak hours. What operational action should you take to restore performance?

Accepted Answer

Scale out the application. Horizontal scaling (adding more instances) or vertical scaling (increasing instance size) are standard responses to high utilization.

Answer

Change the time zone

Answer

Reduce the logging level

Answer

Disable the firewall

Question 12

A developer needs to update a database schema without losing any existing data. Which concept is essential for this operational task?

Accepted Answer

Database migration scripts. Database migration scripts are the essential concept because they provide a versioned, repeatable, and reversible mechanism to apply schema changes (e.g., ALTER TABLE, ADD COLUMN) while preserving existing rows. Unlike raw DDL executed manually, migration scripts track state so the schema can be evolved incrementally without data loss. This is the standard operational practice in DevOps and application lifecycle management for schema evolution.

Answer

Database snapshots

Answer

Caching layer purge

Answer

Full database replication

Question 13

You are notified that an unused storage volume is incurring costs. What is the standard operational procedure to stop these charges?

Accepted Answer

Delete the volume. In cloud environments, storage volumes incur costs as long as they exist, regardless of whether they are attached or used. To stop charges for an unused volume, the standard procedure is to delete the volume. Once deleted, the volume no longer exists, and billing for that resource ceases.

Answer

Encrypt the volume

Answer

Rename the volume

Answer

Move to a different region

Question 14

Which metric should you monitor to determine if your application's load balancer is struggling with concurrent user connections?

Accepted Answer

Active connection count. The active connection count directly measures the number of concurrent connections currently handled by the load balancer. This metric reflects the load balancer's capacity to manage simultaneous user sessions, and a high or growing count indicates it may be struggling to keep up. Other metrics like disk I/O, database memory, or log errors are not directly tied to the load balancer's connection handling.

Answer

Disk I/O throughput

Answer

Memory usage of the DB

Answer

Log write errors

Question 15

A security audit requires that all database queries be logged and stored securely. Which feature should be enabled to meet this requirement in a relational database service?

Accepted Answer

Database auditing/Query logging. Database auditing/query logging captures all SQL statements executed against the database, including who ran them and when, and can store them securely for compliance. This directly satisfies the requirement to log and store all database queries. Storage encryption, backups, and connection pooling do not provide query-level logging.

Answer

Storage encryption

Answer

Automated backups

Answer

Connection pooling