CLO-002 Management And Technical Operations — Timed 10 Questions

Question 1

An organization is migrating to a hybrid cloud model. They require a dedicated, private connection between their on-premises data center and the cloud provider to reduce latency. Which service should be provisioned?

10 minute time limit — choose an answer to begin.

Accepted Answer

Direct Connect. Direct Connect provides a dedicated, private network connection between an on-premises data center and a cloud provider, bypassing the public internet. This reduces latency, increases bandwidth, and provides more consistent network performance. It is the appropriate service for hybrid cloud models requiring private connectivity.

Answer

Software-Defined Networking

Answer

Content Delivery Network

Answer

Site-to-Site VPN

Question 2

You need to restrict outgoing network traffic from a private subnet to only specific API endpoints. Which security component should be configured?

Accepted Answer

Security Group. Security groups act as stateful virtual firewalls at the instance/ENI level and are the correct component for restricting which destinations and ports an instance can reach outbound. You configure an outbound rule that permits traffic only to the specific API endpoint IPs or security groups, and deny everything else by default. This gives granular, per-resource egress control without affecting routing.

Answer

Route Table

Answer

VPC Peering

Answer

Internet Gateway

Question 3

Your organization requires that a specific cloud environment be isolated from the internet, yet it must access a private service hosted on another cloud provider. Which networking configuration is most appropriate?

Accepted Answer

Private Link / Private Endpoint. Private Link / Private Endpoint (Option D) is correct because it enables private connectivity to a service hosted on another cloud provider without exposing traffic to the public internet. It uses provider-side endpoints and consumer-side endpoints to establish a one-way, private connection over the cloud backbone. This satisfies the isolation requirement while still allowing access to the external private service.

Answer

NAT Gateway

Answer

Public IP address assignment

Answer

Internet Gateway

Question 4

You are responsible for managing access keys for service accounts. You suspect a key has been compromised. What is the immediate operational step to take?

Accepted Answer

Deactivate/Rotate the key. When an access key is suspected compromised, the immediate action is to deactivate or rotate it to prevent further unauthorized use. Deactivating the key immediately blocks its use, while rotation replaces it with a new key, invalidating the old one. This is the fastest way to mitigate the risk and is a standard incident response step for compromised credentials.

Answer

Change the password of the user

Answer

Increase logging levels

Answer

Monitor CloudTrail logs

Question 5

You are troubleshooting a connectivity issue where an application cannot reach a database. Which tool allows you to trace the network path and identify the specific point of failure?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information to and from network interfaces in a VPC, including source/destination IP, ports, protocol, and whether the traffic was accepted or rejected. By analyzing flow logs, you can trace the network path and identify where traffic is being blocked, such as at a security group or network ACL. This makes it the appropriate tool for troubleshooting connectivity issues at the network level.

Answer

Instance health checks

Answer

IAM Policy simulator

Answer

CloudWatch Metrics

Question 6

An administrator wants to ensure that a storage bucket is not accidentally deleted. Which feature should be enabled?

Accepted Answer

Bucket versioning. Soft delete or bucket versioning ensures that data can be recovered if accidentally deleted.

Answer

Public access block

Answer

Storage encryption

Answer

Cross-region replication

Question 7

Which TWO of the following are valid strategies for cloud data migration?

Accepted Answer

Network-based migration. Network-based migration (B) is a valid strategy because it moves data to the cloud over the network using secure transfer mechanisms such as HTTPS/TLS, SFTP, or AWS DataSync, which is the standard approach for datasets that fit within available bandwidth and transfer windows. Physical transfer devices (E) are also valid, since services like AWS Snowball or Azure Data Box let you ship large volumes of data on encrypted appliances when network transfer would be too slow or costly. The remaining options are not migration strategies: printing data as paper records (A) does not transfer data into cloud storage in a usable digital form, hard-coding database rows (C) is an application anti-pattern rather than a migration method, and deleting all local hardware (D) is a decommissioning action, not a way to move data to the cloud.

Answer

Printing all data as paper records

Answer

Hard-coding all database rows

Answer

Deleting all local hardware

Question 8

Which THREE services allow you to restrict network access in a cloud VPC?

Accepted Answer

Web Application Firewalls (WAF). Web Application Firewalls (WAF) (C) are correct because they filter and monitor HTTP/HTTPS traffic at the application layer, allowing you to block requests based on rules such as IP reputation, SQL injection, or cross-site scripting patterns, thereby restricting access to web resources in the VPC. Network ACLs (D) are correct because they are stateless, subnet-level packet filters that evaluate inbound and outbound traffic against numbered allow/deny rules, giving you explicit control over which CIDR ranges and ports can reach subnets. Security Groups (E) are correct because they are stateful, instance-level virtual firewalls that permit only the traffic explicitly allowed by their inbound and outbound rules, effectively restricting access to resources such as EC2 instances. Auto Scaling Groups (B) are not access-control mechanisms; they only adjust the number of running instances based on demand or health policies. Content Delivery Network (A) is a caching and edge-distribution service that improves latency and offloads origin traffic, but it does not itself restrict network access within a VPC.

Answer

Content Delivery Network

Answer

Auto Scaling Groups

Question 9

Which TWO are common types of cloud backups?

Accepted Answer

File-level backups. Backups can be performed at the volume level (snapshots) or the file level.

Answer

Buying a new laptop

Answer

Deleting old logs

Answer

Physical disk copying

Answer

Renaming a file

Question 10

A company wants to reduce the risk of a single cloud provider outage affecting its customer-facing web application. The application currently runs entirely in one region of a single provider. Which approach BEST addresses this availability concern while keeping operational complexity manageable?

Accepted Answer

Deploy the application across multiple availability zones within the same region. Deploying across multiple availability zones within a region is the most practical way to improve availability without excessive complexity. It isolates the application from a single datacenter failure and is a foundational cloud resilience pattern. Other options either concentrate risk, protect only data, or provide support rather than architectural redundancy.

Answer

Migrate the application to a single larger virtual machine with more memory and CPU

Answer

Enable automatic backups of the application database every hour

Answer

Purchase a higher-tier support plan from the cloud provider