CLO-002 Management And Technical Operations Practice Test 6 — 15 Questions

Question 1

A cloud architect is designing a solution that must provide a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours for a critical database. The database currently runs on a single virtual machine with nightly backups. Which change should the architect implement to meet these objectives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure continuous log shipping to a standby database in a second region with automated failover. To achieve a 15-minute RPO and 2-hour RTO, the architect needs near-continuous replication and automated failover. Continuous log shipping to a standby database in another region provides minimal data loss and rapid recovery. Other options rely on periodic backups or manual promotion, which cannot meet the tight objectives for a critical database.

Answer

Increase the frequency of nightly backups to every 12 hours

Answer

Take a snapshot of the database volume every hour and store it in a different availability zone

Answer

Enable database read replicas in the same region and promote one during a failure

Question 2

A DevOps team manages a Google Cloud environment with many projects. They need a centralized view of all audit logs and the ability to create log-based metrics that alert on suspicious IAM changes across all projects. Which Google Cloud service should they use?

Accepted Answer

Cloud Logging. Centralizing audit logs from multiple projects and building log-based metrics points to Cloud Logging. It can route logs from all projects into a single log bucket, and its log-based metrics can be used with Cloud Monitoring for alerts. Cloud Monitoring, Cloud Asset Inventory, and Security Command Center serve different purposes and do not provide the combined log aggregation and metric creation capability required.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring

Answer

Security Command Center

Question 3

A company runs a three-tier application in AWS. During peak hours, users report slow page loads. CloudWatch metrics show the application load balancer is healthy, the web tier CPU is at 40 percent, and the database read replica latency is 20 ms, but the application tier shows high request queue depth and steady CPU near 95 percent. The team wants the fastest operational fix that preserves availability. What should they do?

Accepted Answer

Scale out the application tier using an Auto Scaling group policy based on CPU utilization.. High sustained CPU on the application tier combined with growing queue depth indicates the tier lacks compute capacity, so horizontal scaling is the fastest way to add capacity without downtime. A target tracking Auto Scaling policy on CPU utilization adds instances automatically during peaks and removes them afterward. The database and web tiers show healthy metrics, so changes there would not address the actual bottleneck.

Answer

Increase the database instance size to reduce query latency.

Answer

Configure an Application Load Balancer health check with a shorter interval.

Answer

Enable a larger instance type for the web tier to handle more concurrent connections.

Question 4

A media company stores millions of video files in a public cloud object storage bucket. Legal hold requirements mandate that specific files be retained for seven years and that no user, including administrators, can delete or overwrite them during that period. The company wants to enforce this at the storage layer without relying on application logic. Which capability should be implemented?

Accepted Answer

Configure an object lock with a retention period in compliance mode.. Legal hold with a seven-year immutability requirement demands a storage-layer control that even privileged users cannot override. Object lock in compliance mode provides exactly that: protected object versions cannot be deleted or overwritten by any principal until the retention period expires. This makes it the correct choice over policy-based or replication-based approaches that remain mutable by administrators.

Answer

Apply a bucket policy that denies delete actions to all principals except a break-glass role.

Answer

Enable versioning on the bucket and require multi-factor authentication for delete operations.

Answer

Replicate the bucket to a second region and restrict delete permissions in the replica.

Question 5

A small business wants to move its customer relationship management system to a public cloud provider. The IT manager is concerned about the provider's ability to guarantee a specific level of uptime and to define remedies if that level is not met. Which document should the manager review to find the committed uptime percentage and any service credits?

Accepted Answer

The service level agreement (SLA) published by the cloud provider. The service level agreement is the formal contract that specifies measurable commitments such as uptime percentage, latency, or support response times, along with remedies like service credits when targets are missed. It is the only listed document that answers both parts of the manager's question: the guaranteed level of service and the consequence of failing to meet it.

Answer

The acceptable use policy (AUP) published by the cloud provider

Answer

The cloud provider's privacy policy and data processing addendum

Answer

The provider's public status dashboard and historical incident reports

Question 6

A cloud administrator is implementing a backup strategy for an Amazon RDS for MySQL database. The administrator must ensure point-in-time recovery and long-term retention beyond the maximum automated backup window. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a manual DB snapshot and copy it to another AWS Region.. Enabling automated backups with the maximum 35-day retention provides point-in-time recovery within that window, while creating manual snapshots and copying them to another Region ensures long-term retention beyond 35 days. Together, these actions meet both the point-in-time recovery and long-term retention requirements for the RDS for MySQL database.

Answer

Configure a read replica in a different Availability Zone.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Take an automated snapshot every hour using a Lambda function.

Question 7

A multinational enterprise is migrating a latency-sensitive trading application to a public cloud. The architecture team must select deployment characteristics that minimize network round-trip time for users in multiple regions while maintaining high availability. Which TWO characteristics should the team prioritize? (Choose two.)

Accepted Answer

Deploy the application in multiple regions close to major user concentrations.. Minimizing latency for a globally distributed user base requires bringing compute closer to users and steering each user to the nearest healthy endpoint. Deploying across multiple regions near user concentrations reduces physical distance, and latency-based or geolocation DNS routing ensures traffic reaches the optimal region while enabling failover. Together these deliver both low round-trip time and high availability.

Answer

Use a content delivery network to cache dynamic API responses at edge locations.

Answer

Increase the size of the database instance to handle more concurrent connections.

Answer

Consolidate all application instances into a single region with the lowest average latency to all users.

Question 8

A cloud engineer needs to deploy a set of resources on Microsoft Azure in a repeatable and consistent manner. The engineer wants to define the infrastructure as code and be able to deploy it multiple times without manual intervention. Which Azure service should the engineer use?

Accepted Answer

Azure Resource Manager (ARM) templates. ARM templates are the correct choice because they provide a declarative, code-based method to define and deploy Azure infrastructure consistently and repeatedly. They are the native infrastructure-as-code solution in Azure and can be version-controlled and automated, meeting the requirement for repeatable deployments without manual intervention.

Answer

Azure Blueprints

Answer

Azure Advisor

Answer

Azure Policy

Question 9

An organization runs a containerized e-commerce platform on a managed Kubernetes service. During a flash sale, response times degrade sharply. Metrics show the application pods are healthy and the database is not saturated, but the cluster reports that some nodes cannot schedule new pods because of resource pressure. The team must add capacity automatically when pod demand rises and remove it when demand falls. Which action should the team take?

Accepted Answer

Enable the cluster autoscaler so the node pool grows and shrinks with pending pod demand. The cluster autoscaler is designed for exactly this situation: it detects pods that are pending because no node has enough allocatable resources, then adds nodes to the pool, and later removes underutilized nodes when demand subsides. Because the workload pods are already healthy and the database is not the bottleneck, the missing piece is automatic node-level capacity, which this component supplies.

Answer

Configure a horizontal pod autoscaler to increase the replica count based on CPU utilization

Answer

Increase the CPU request and limit values on the existing application deployment

Answer

Create a pod disruption budget to guarantee minimum availability during scaling events

Question 10

A financial services firm is preparing to move a regulated workload to a public cloud. The compliance officer requires evidence that the provider's controls are independently assessed and that the firm can retrieve its data in a usable format if it leaves the provider. Which TWO provider artifacts should the firm obtain? (Choose two.)

Accepted Answer

Third-party audit reports and compliance certifications such as SOC 2 or ISO 27001. Independent audit reports and certifications provide the third-party assurance the compliance officer demands, showing that provider controls meet recognized standards. A documented data portability and export format description proves the firm can retrieve its information in a usable form if it exits. Together they address both the assurance and the exit-strategy concerns for a regulated workload.

Answer

The provider's internal employee training completion statistics

Answer

A list of the provider's other customers in the same industry vertical

Answer

The provider's internal marketing brochure describing the breadth of its global regions

Question 11

A cloud operations team is preparing to migrate a legacy three-tier application to a public cloud. The team must ensure the new environment supports operational visibility and controlled change management after cutover. Which two actions should the team take? (Choose two.)

Accepted Answer

Define infrastructure as code templates so environment changes are versioned and repeatable.. Operational visibility and controlled change management after migration depend on two foundations: centralized logging and metrics so the team can see what all tiers are doing, and infrastructure as code so changes are versioned, reviewed, and repeatable. Disabling auto-scaling, granting broad admin rights, and consolidating databases reduce control and resilience rather than supporting the migration goals.

Answer

Disable all auto-scaling groups so instance counts remain fixed and predictable.

Answer

Grant every engineer full administrator rights to speed up troubleshooting.

Answer

Migrate all databases to a single shared instance to simplify the architecture.

Question 12

A media company stores years of video assets in a public cloud object storage bucket. Auditors require that no object can be deleted or overwritten for seven years, even by a user with full administrative rights, to satisfy a regulatory retention rule. Which capability should the company implement?

Accepted Answer

Configure an object lock with a retention mode and period that prevents deletion or overwrite. Object lock with a retention mode and period enforces immutability within the storage service itself, so protected objects cannot be deleted or overwritten until the retention window ends, even by privileged administrators. Setting a seven-year period maps directly to the regulatory retention rule and gives auditors verifiable, tamper-resistant protection rather than a configuration that could be changed.

Answer

Replicate the bucket to a second region and restrict delete permissions in the replica

Answer

Enable versioning on the bucket and require multi-factor authentication for delete operations

Answer

Apply a bucket policy that denies delete actions to all principals except the storage administrator

Question 13

A financial services firm runs regulated workloads on AWS. An auditor requires proof that data stored in Amazon S3 is encrypted at rest with keys the firm controls, that key usage is logged, and that keys can be rotated on a defined schedule. Which combination of AWS services and features satisfies these requirements?

Accepted Answer

S3 default encryption with SSE-KMS using a customer managed key, key rotation enabled, and AWS CloudTrail logging of KMS API calls.. The requirements map to customer-controlled encryption keys, scheduled rotation, and auditable key usage. SSE-KMS with a customer managed key provides customer control over key policy and lifecycle, automatic rotation rotates key material on a schedule, and CloudTrail records KMS API activity for audit. AWS managed keys and SSE-S3 remove customer control, while Object Lock and access logging address different controls.

Answer

Client-side encryption with a key stored in AWS Secrets Manager and S3 access logging enabled.

Answer

S3 default encryption with SSE-S3 and S3 server access logging enabled on the bucket.

Answer

S3 default encryption with SSE-KMS using an AWS managed key and S3 Object Lock in compliance mode.

Question 14

A company runs a production workload across two public cloud providers. The security team requires that a single set of identity policies govern access to resources in both environments, and that a terminated employee lose access everywhere within minutes. Which approach should the company adopt?

Accepted Answer

Federate both cloud providers to a central identity provider using SAML or OpenID Connect.. Centralizing identity in one provider and federating both clouds to it using SAML or OpenID Connect gives a single source of truth for authentication and group membership. Disabling the central account immediately prevents new token issuance in both clouds, satisfying rapid revocation. Separate local accounts, shared credentials, and distributed long-lived keys all fragment control and delay revocation.

Answer

Issue long-lived API keys in each provider and distribute them to employees as needed.

Answer

Create separate local user accounts in each cloud provider and synchronize passwords manually.

Answer

Share a single administrator account between the two providers to reduce the number of credentials.

Question 15

A company is preparing a change management process for its cloud environment. The operations lead wants to ensure that changes to production workloads are traceable, reversible, and reviewed before deployment. Which TWO practices best support these goals? (Choose two.)

Accepted Answer

Maintain a documented rollback plan and test it in a staging environment before production changes.. Traceability, reversibility, and review are achieved by codifying changes in version control with peer-reviewed pipelines and by maintaining a tested rollback plan. Version history provides the audit trail and the mechanism for reverting, while pipeline review enforces approval before production. Direct console changes, verbal approvals, and disabled logging each weaken at least one of the three goals.

Answer

Disable change logging to reduce storage costs in the centralized logging platform.

Answer

Allow engineers to apply changes directly in the cloud console during incidents to reduce resolution time.

Answer

Require all changes to be approved verbally by the on-call manager during the change window.