CLO-002 Management And Technical Operations Practice Test 5 — 15 Questions

Question 1

Which THREE of the following are necessary to manage multi-cloud deployments effectively?

Accepted Answer

Unified monitoring tools. Unified monitoring tools (B) are necessary because multi-cloud deployments span AWS, Azure, and GCP, so a single pane of glass aggregating metrics, logs, and traces across providers is required to detect issues and maintain consistent observability. Infrastructure as Code (D) is essential because declarative templates (e.g., Terraform, CloudFormation, ARM/Bicep) let you provision and version identical, repeatable environments across heterogeneous clouds, avoiding manual drift. Centralized identity management (E) is required to federate authentication and authorization across providers using standards like SAML 2.0 or OIDC, so users and service accounts have one consistent identity and RBAC policy set rather than per-cloud silos. Ignoring one cloud provider (A) is wrong because it defeats the purpose of multi-cloud management and leaves resources ungoverned, while printing physical logs (C) is neither scalable nor a real management practice compared with centralized log aggregation.

Answer

Ignoring one cloud provider

Answer

Printing physical logs

Question 2

A company runs a stateless web application on a fleet of cloud virtual machines behind a load balancer in a single region. The operations team wants to survive the loss of an entire availability zone with minimal manual intervention, while keeping the recovery time objective as low as possible. Which approach best meets these requirements?

Accepted Answer

Deploy the fleet across multiple availability zones and configure the load balancer to distribute traffic across all of them.. Because the application is stateless, the most effective resilience measure is to distribute identical instances across multiple availability zones and let the load balancer route around failures. This removes the single point of failure at the zone level, keeps recovery automatic, and preserves a low recovery time objective without manual rebuild steps.

Answer

Take scheduled snapshots of the instance volumes every hour and restore them into a new availability zone during an outage.

Answer

Increase the instance size so fewer, larger virtual machines can absorb the full production workload if one host fails.

Answer

Enable termination protection on each instance and configure the load balancer health checks to restart failed instances automatically.

Question 3

A cloud operations team needs to ensure that the production environment can be rebuilt identically after a region-wide failure. The team already stores nightly database backups in an object storage bucket in a second region. Which additional artifact is MOST critical to include in the recovery plan to guarantee the application tier can be redeployed consistently?

Accepted Answer

Infrastructure as Code templates that define the virtual network, compute instances, and load balancer configuration. Rebuilding an application tier consistently after a regional failure requires a machine-readable definition of the environment. Infrastructure as Code templates provide that definition, allowing automated, repeatable deployment of networks, compute, and load balancing. Backups alone restore data but not the surrounding infrastructure, so the IaC artifacts are the critical missing piece for full recovery.

Answer

A screenshot archive of the current cloud management console showing all running resources

Answer

The billing invoice from the previous month detailing all consumed services

Answer

A copy of the service level agreement signed with the cloud provider

Question 4

A cloud operations team wants to automatically remediate an EC2 instance that has been running with CPU utilization below 5% for 14 consecutive days. The team needs the remediation to trigger without manual intervention and to notify a Slack channel. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

AWS Systems Manager Automation. The requirement is an event-driven, multi-step remediation that stops an underutilized instance and notifies a channel without human action. Systems Manager Automation provides runbooks that can be triggered by CloudWatch alarms or EventBridge rules, execute API calls, and integrate with notification services. The other services either only assess compliance, only provision infrastructure, or only give recommendations, so none can orchestrate the full workflow autonomously.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudFormation

Question 5

A company's cloud administrator needs to reduce the cost of a fleet of Amazon EC2 instances that run a stateless web application. The workload can tolerate interruptions but must be highly available. Which AWS purchasing option should the administrator select to achieve the LOWEST cost while meeting these requirements?

Accepted Answer

Spot Instances. Spot Instances are the correct choice because they offer the deepest discounts on AWS compute and are designed for fault-tolerant, stateless workloads. The application can be distributed across multiple Spot pools to maintain availability despite interruptions, meeting both the cost and high-availability requirements without long-term commitments.

Answer

Dedicated Hosts

Answer

Reserved Instances

Answer

On-Demand Instances

Question 6

A financial services firm runs a regulated workload in a public cloud. Compliance requires that data at rest be encrypted with keys the firm controls and can rotate independently of the provider, and that an audit trail record every key usage. The firm wants to minimize operational overhead while retaining exclusive control of key material. Which approach best satisfies these requirements?

Accepted Answer

Use a cloud key management service with customer-managed keys and integrated audit logging.. The requirement is for customer-controlled key material with independent rotation and a complete audit trail, while minimizing operational burden. A cloud key management service with customer-managed keys provides exactly this balance: the customer owns and controls the keys, rotation can be scheduled or performed on demand, and every cryptographic operation is logged. It avoids the heavy lift of self-managed client-side key infrastructure.

Answer

Implement client-side encryption where the application encrypts data before upload and manages its own keys.

Answer

Use provider-managed encryption keys with automatic annual rotation.

Answer

Store encryption keys in a version-controlled repository and have applications retrieve them at runtime.

Question 7

A company runs a production workload on Azure Kubernetes Service (AKS). The operations team must reduce the blast radius of a node failure and ensure that pod disruption budgets are respected during voluntary disruptions. Which two actions should the team take? (Choose two.)

Accepted Answer

Define a PodDisruptionBudget for each critical deployment.. Reducing blast radius requires spreading replicas across failure domains, which topology spread constraints across node pools and availability zones accomplish. Respecting pod disruption budgets during voluntary disruptions requires defining a PodDisruptionBudget for each critical deployment, because that object instructs the eviction API to maintain a minimum available count. The other actions address capacity, cost advice, or scheduling priority, none of which directly limit failure impact or enforce disruption limits.

Answer

Set the pod priority class to a higher value for all production pods.

Answer

Configure cluster autoscaler to add nodes when pods are pending.

Answer

Enable Azure Advisor cost recommendations for the AKS cluster.

Question 8

A cloud engineer is designing a solution on Microsoft Azure that must distribute incoming HTTP traffic across a set of virtual machines in a single region, provide URL-based routing, and support TLS termination. Which Azure service should the engineer use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct service because it provides layer 7 load balancing with URL path-based routing and TLS termination for HTTP/HTTPS workloads within a region. The other services either operate at a different layer or are designed for global distribution, making them unsuitable for this specific requirement.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 9

A cloud engineer is configuring a lifecycle policy for an object storage bucket that holds compliance audit logs. Regulations require that logs be retained for seven years and that they cannot be altered or deleted during that period. Which combination of lifecycle actions should the engineer implement?

Accepted Answer

Transition objects to an archive storage class after 90 days and enable object lock in compliance mode for seven years. Regulatory retention with immutability requires an object lock in compliance mode, which prevents any user, including administrators, from deleting or altering objects for the specified period. Combining this with a lifecycle transition to an archive class after 90 days controls cost while preserving the seven-year retention. Other options lack a true lock mechanism or fail to meet the full retention duration.

Answer

Move objects to a cold storage tier immediately and set a bucket policy that denies delete actions

Answer

Enable versioning and configure a lifecycle rule to delete objects after seven years

Answer

Enable cross-region replication and apply a lifecycle rule to archive objects after one year

Question 10

A financial services company runs a regulated workload on a public cloud. The compliance team requires that all data stored in object storage be encrypted at rest using keys that the company generates and controls, and that key usage be independently auditable. The cloud provider's default encryption uses provider-managed keys. Which action should the cloud operations team take?

Accepted Answer

Configure customer-managed keys in the cloud provider's key management service and enable key usage logging.. Regulated workloads typically require that the customer, not the provider, own the encryption keys and that key operations be logged. Customer-managed keys in a cloud KMS give the organization full control over generation, rotation, and revocation, while key usage logging provides the independent audit trail. Provider-managed keys, network isolation, and client-side-only encryption do not meet both the control and auditability requirements in this scenario.

Answer

Encrypt the data on-premises before upload and disable all server-side encryption on the bucket.

Answer

Enable provider-managed encryption and request an audit log export from the provider's support team.

Answer

Store the data in a private subnet and rely on network isolation instead of encryption at rest.

Question 11

A startup is deploying a new web application on a public cloud. The team wants to minimize the attack surface of the web tier by allowing only HTTP and HTTPS traffic from the internet while blocking all other inbound ports. Which cloud construct should the team configure to enforce this network-level restriction?

Accepted Answer

A security group attached to the web servers that permits inbound TCP 80 and 443 from 0.0.0.0/0 and denies all other inbound traffic by default.. To restrict inbound traffic to only HTTP and HTTPS at the network level, a stateful security group is the appropriate construct. Its default-deny inbound posture means only explicitly allowed ports are reachable, and return traffic for established connections is automatically permitted. This provides centralized, cloud-native enforcement without relying on host-based firewalls.

Answer

A network ACL that allows all inbound traffic and relies on the operating system firewall for port filtering.

Answer

A route table entry that directs all inbound traffic to a NAT gateway for inspection.

Answer

An internet gateway with a policy that blocks non-web ports.

Question 12

A financial services company must store monthly compliance reports in Amazon S3 for seven years. The reports are accessed only during the first 30 days after creation and must be retained even if accidentally deleted. Which S3 feature should be enabled to prevent deletion during the retention period?

Accepted Answer

S3 Object Lock in compliance mode. The requirement is immutability for seven years, meaning no one can delete the reports during that period. S3 Object Lock in compliance mode enforces a retention period that cannot be shortened or bypassed, even by the root user. Versioning, lifecycle policies, and replication all offer some data protection but none prevent a determined or accidental deletion, so they cannot satisfy the regulatory retention mandate.

Answer

S3 Lifecycle policies

Answer

S3 Versioning

Answer

S3 Cross-Region Replication

Question 13

A cloud operations team wants to receive alerts before their monthly cloud spend exceeds the approved budget for the production subscription. They already use Azure Cost Management and want an automated notification when actual or forecasted costs cross a defined threshold. What should they configure?

Accepted Answer

An Azure Cost Management budget with an alert threshold and an action group.. Azure Cost Management budgets are purpose-built for tracking consumption against a monetary limit and can trigger alerts when actual or forecasted costs cross a threshold. Associating an action group converts that alert into an automated notification or remediation workflow. The other choices monitor technical metrics, enforce configuration compliance, or require custom log pipelines, none of which directly notify on budget overrun.

Answer

A Log Analytics workspace query scheduled with a daily alert rule.

Answer

An Azure Policy definition assigned to the subscription with a deny effect.

Answer

An Azure Monitor metric alert on the subscription's network egress bytes.

Question 14

A cloud operations team needs to ensure that a critical application running on Google Cloud can automatically recover from a zone failure without manual intervention. The application is deployed on Compute Engine instances managed by an instance group. Which feature should the team configure?

Accepted Answer

Managed instance group with health checks and autohealing. A regional managed instance group with health checks and autohealing is the correct configuration because it automatically detects unhealthy instances and recreates them, including in a different zone if one becomes unavailable. This provides the required automatic recovery from zone failure without manual intervention.

Answer

Managed instance group with autoscaling

Answer

Unmanaged instance group

Answer

Sole-tenant nodes

Question 15

A startup deploys a web application on a public cloud. The operations team wants to be notified automatically when average CPU utilization on the application servers exceeds 80 percent for five consecutive minutes, without manually checking dashboards. Which capability should the team configure?

Accepted Answer

A cloud monitoring alarm with a notification action tied to the metric threshold.. The team needs automatic notification when a metric crosses a threshold for a sustained period. Cloud monitoring alarms natively evaluate metric streams against thresholds over an evaluation window and invoke notification actions. Billing APIs, log text searches, and remediation runbooks do not provide threshold-based metric alerting, so they cannot deliver the timely notification this scenario requires.

Answer

A scheduled script that queries the provider's billing API every five minutes.

Answer

A configuration management runbook that restarts instances when CPU is high.

Answer

A log aggregation query that searches application logs for the word CPU.