CLO-002 Management And Technical Operations Practice Test 3 — 15 Questions

Question 1

You have a microservices architecture. How can you effectively manage the deployment of configuration changes across hundreds of containers without manual intervention?

Accepted Answer

Centralized configuration management. Centralized configuration management (e.g., Consul, etcd, AWS AppConfig, Spring Cloud Config, or Kubernetes ConfigMaps/Secrets) lets you define configuration in one authoritative place and push or inject it into hundreds of containers automatically. Containers can watch for changes and reload without manual SSH or redeployment, which is essential for consistency and auditability at scale. This eliminates configuration drift and human error across the fleet.

Answer

Rebooting the instances

Answer

Manual SSH access

Answer

Hard-coding values

Question 2

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. A cloud provider's public status dashboard (e.g., status.cloud.google.com, status.aws.amazon.com) is the authoritative, real-time source for current service health and ongoing incidents. It shows per-region, per-service status and incident timelines. This is the correct place to verify whether an outage is provider-side and its scope.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc

Question 3

What is the primary benefit of using a Managed Service (like RDS) over a self-managed database on a virtual machine?

Accepted Answer

Reduced operational overhead. Managed services handle operational tasks like patching, backups, and maintenance, reducing the operational burden on the user.

Answer

Access to underlying OS

Answer

Lower cost

Answer

Unlimited performance

Question 4

Your organization uses a 'Shared Responsibility Model'. Which of the following is typically the customer's responsibility in the cloud?

Accepted Answer

Configuration of security groups. In most cloud models, the provider manages the physical hardware, while the customer manages data, patches, and configurations.

Answer

Maintenance of the host OS kernel

Answer

Redundancy of the physical power grid

Answer

Physical security of the data center

Question 5

You are tasked with automating a script that runs every night at 2 AM to clean up temporary files. Which service is most appropriate for triggering this task?

Accepted Answer

AWS Lambda + EventBridge. AWS Lambda combined with Amazon EventBridge is the canonical serverless pattern for scheduled tasks. EventBridge (formerly CloudWatch Events) supports cron and rate expressions, so a rule like 'cron(0 2 * * ? *)' triggers the Lambda function nightly at 2 AM. Lambda executes the cleanup code without requiring a persistent EC2 instance, making it cost-effective and operationally simple.

Answer

AWS SNS

Answer

AWS IAM

Answer

AWS SQS

Question 6

You notice that the latency of your web application is increasing. You have determined the database is the bottleneck. What is the most effective way to improve read performance?

Accepted Answer

Create read replicas. Adding read replicas distributes query load, reducing the pressure on the primary database instance.

Answer

Delete old indexes

Answer

Enable multi-AZ failover

Answer

Increase primary instance size

Question 7

Which document is essential to review to understand the scope and limitations of a cloud provider's commitment to service uptime?

Accepted Answer

Service Level Agreement (SLA). A Service Level Agreement (SLA) is the contract that defines the provider's committed uptime percentage, the measurement window, exclusions (e.g., scheduled maintenance), and the remedies (service credits) if the commitment is missed. It is the authoritative document for understanding both the scope and the limitations of the provider's uptime commitment. Reviewing it is essential before designing for availability or making claims about resilience.

Answer

Pricing sheet

Answer

Support contact list

Answer

Architecture diagram

Question 8

You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?

Accepted Answer

Re-platforming. Re-platforming (lift, tinker, and shift) involves making targeted changes to the application or its runtime to take advantage of cloud capabilities — including moving to a supported OS or managed service. Since the legacy OS is unsupported, re-platforming lets you migrate while modernizing the OS/runtime, avoiding the security and support risks of re-hosting an unsupported platform.

Answer

Re-hosting (Lift and Shift)

Answer

Retaining

Answer

Retiring

Question 9

You need to ensure that all virtual machines follow a consistent naming convention and have specific tags for cost tracking. What service should you use to enforce this?

Accepted Answer

Azure Policy. Azure Policy is the governance service that enforces organizational standards by evaluating resources against rules and effects, including naming conventions and required tags. It can deny non-compliant resource creation or remediate existing resources via deployIfNotExists and modify effects. This directly satisfies the requirement to enforce consistent naming and tagging for cost tracking.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Advisor

Question 10

You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom budgets for cost, usage, or reservations, and configure alerts when actual or forecasted spending exceeds a defined threshold. You can specify a monthly cost budget of $500 and attach an email notification to be triggered when actual spend surpasses that amount. This is the native AWS service designed for proactive cost monitoring and alerting, making it the correct choice for receiving an email alert on monthly spending.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 11

Which protocol is most commonly used for secure, encrypted remote management of Linux-based virtual machines in the cloud?

Accepted Answer

SSH. SSH (Secure Shell) is the de facto standard for encrypted remote administration of Linux VMs, operating over TCP port 22 and providing strong cryptographic authentication and confidentiality. Cloud providers such as AWS, Azure, and GCP all issue SSH key pairs by default for Linux instance access, making it the canonical answer. It replaces insecure legacy tools like Telnet for shell access.

Answer

FTP

Answer

HTTP

Answer

Telnet

Question 12

You have a fleet of instances that need to automatically update their software patches. What is the best cloud-native approach to manage this?

Accepted Answer

Automated patch management. Automated patch management is the best cloud-native approach because it leverages tools like AWS Systems Manager Patch Manager to define patch baselines, schedule maintenance windows, and automatically apply OS and software patches across a fleet of instances without manual intervention. This ensures consistency, reduces human error, and maintains security compliance at scale. Cloud-native services integrate with instance metadata and tagging, allowing dynamic targeting of instances by environment, OS, or tags. This approach aligns with the shared responsibility model, where the customer automates patching of their guest OS and applications.

Answer

Disabling updates

Answer

Re-deploying instances

Answer

Manual login and update

Question 13

An administrator is setting up a new cloud account. What is the first security best practice they should implement?

Accepted Answer

Enable MFA on the root account. Enabling MFA is the most critical first step to secure any account access.

Answer

Increase instance capacity

Answer

Create a support ticket

Answer

Upload a custom logo

Question 14

Which TWO of the following are benefits of using a Content Delivery Network (CDN)?

Accepted Answer

Decreased load on origin servers. Option A is correct because a CDN caches static and dynamic content at edge locations, so a large share of user requests are served by the CDN's points of presence instead of the origin, directly decreasing the request volume and load on the origin servers. Option B is correct because CDN edge nodes are geographically distributed and terminate requests close to the end user, shortening the network round-trip and reducing latency (and often improving throughput) compared with fetching everything from a single distant origin. Option C is not a CDN benefit: CDNs serve cached or proxied HTTP(S) content and do not provide direct database access to end users. Option D is not inherent to a CDN: encryption of data at rest is a storage-layer control (e.g., disk or object-store encryption), whereas a CDN typically handles TLS in transit. Option E is not a CDN function: automated server patching is an OS/configuration-management task (e.g., via patch management tooling), not something a content delivery network performs on your servers.

Answer

Direct database access

Answer

Encryption of data at rest

Answer

Automated server patching

Question 15

Which THREE actions are best practices for securing a cloud virtual machine?

Accepted Answer

Applying the principle of least privilege. Option B is correct because applying the principle of least privilege means granting only the minimum permissions and network access required, which reduces the attack surface of a cloud VM by limiting what compromised credentials or services can reach. Option D is correct because keeping the OS and software updated ensures known vulnerabilities are patched, preventing attackers from exploiting unpatched flaws in the guest operating system or installed applications. Option E is correct because strong key-based authentication, such as SSH public-key authentication instead of passwords, resists brute-force and credential-stuffing attacks and is a standard hardening practice for cloud instances. Option A is incorrect because allowing all ports in Security Groups exposes every service to the internet, violating least privilege and dramatically increasing risk. Option C is incorrect because assigning public IPs to all services unnecessarily exposes management and internal interfaces to the internet; private IPs with bastion hosts or VPN access are preferred.

Answer

Allowing all ports in Security Groups

Answer

Using public IPs for all services