53 questions · Management And Technical Operations · All types, answers revealed
Which THREE services allow you to restrict network access in a cloud VPC?
Application-level traffic filtering.
Why this answer
Network security in the cloud is enforced through Security Groups, Network ACLs, and Firewalls.
A company requires that all cloud logs be retained for seven years for legal compliance. Which service should they configure to ensure logs are moved to the cheapest storage class long-term?
Lifecycle policies manage the movement of data between storage tiers automatically.
Why this answer
Lifecycle policies in object storage (like AWS S3) automatically transition objects to cheaper, colder storage tiers based on age.
Which THREE factors influence cloud resource scalability decisions?
Peak usage times drive scaling requirements.
Why this answer
Scaling decisions are driven by demand patterns, application performance, and cost constraints.
Which THREE cloud service models require different levels of operational management from the customer?
Requires full OS and app management.
Why this answer
IaaS, PaaS, and SaaS represent different levels of abstraction and customer responsibility.
Which TWO of the following are benefits of using tags on cloud resources?
Tags allow you to group costs by department or project.
Why this answer
Tags are critical for cost allocation (billing) and resource organization (management).
Which of the following is an example of 'Infrastructure as Code'?
Terraform is a primary tool for writing infrastructure definitions as code.
Why this answer
IaC uses machine-readable definition files to manage and provision data center infrastructure.
Which THREE items should be included in an incident response plan?
Essential for detecting when an incident occurs.
Why this answer
An incident plan must define who does what (roles), how they identify the issue (monitoring), and how they communicate.
Your team needs to share a large, sensitive file with an external partner. What is the secure way to share this file in the cloud?
Pre-signed URLs allow temporary, secure access to private files.
Why this answer
Pre-signed URLs or temporary access links allow secure, limited-time access to specific objects in cloud storage.
You are troubleshooting a connectivity issue where an application cannot reach a database. Which tool allows you to trace the network path and identify the specific point of failure?
Flow logs provide visibility into network traffic flows, helping identify if traffic is blocked by security groups.
Why this answer
Network tracing tools like Traceroute or cloud-native Flow Logs help diagnose where traffic is blocked.
A security audit requires that all database queries be logged and stored securely. Which feature should be enabled to meet this requirement in a relational database service?
Auditing captures detailed activity for compliance.
Why this answer
Database auditing or query logging features track user access and query execution for security analysis.
A developer needs to monitor real-time CPU utilization across a fleet of virtual machines in Azure. Which service should be used to capture and visualize these metrics?
Azure Monitor provides the infrastructure to collect and visualize VM metrics.
Why this answer
Azure Monitor is the primary service for collecting, analyzing, and acting on telemetry data from Azure resources.
Which TWO components are essential for a robust cloud disaster recovery plan?
Knowing how to recover is as important as having backups.
Why this answer
Disaster recovery requires data redundancy and a well-defined process for failing over traffic.
Which TWO of the following are benefits of using a Content Delivery Network (CDN)?
Offloading requests to the edge reduces origin traffic.
Why this answer
CDNs improve performance by caching content closer to users and reduce the load on the origin server.
Which cloud operation task is primarily responsible for ensuring that the cloud environment adheres to corporate security and regulatory standards?
Compliance management specifically manages regulatory and policy adherence.
Why this answer
Compliance management involves auditing and enforcing rules to ensure the environment stays within defined regulatory boundaries.
Which TWO of the following are common cloud monitoring tasks?
Security auditing is essential for compliance monitoring.
Why this answer
Monitoring involves both resource performance tracking and security event auditing.
Which document is essential to review to understand the scope and limitations of a cloud provider's commitment to service uptime?
The SLA defines the expected uptime standards.
Why this answer
The Service Level Agreement (SLA) outlines the uptime guarantee and the remedies if that guarantee is not met.
A database is experiencing high I/O wait times. Which resource change is most appropriate?
Higher IOPS volumes reduce I/O wait times.
Why this answer
High I/O wait usually indicates slow storage; upgrading to a higher-performance storage tier (e.g., SSD) resolves this.
Which THREE items are considered part of cloud resource maintenance?
Essential for security and stability.
Why this answer
Maintenance includes keeping resources patched, removing unused assets, and monitoring health.
Which THREE actions are best practices for securing a cloud virtual machine?
Restrict user/service permissions to only what is necessary.
Why this answer
Securing a VM involves minimizing attack surface, ensuring encryption, and managing access correctly.
You have a fleet of instances that need to automatically update their software patches. What is the best cloud-native approach to manage this?
Centralized patch management services automate the testing and deployment of updates.
Why this answer
Systems management tools like Systems Manager (AWS) or Azure Automation allow centralized, scheduled, and automated patching.
You notice that the latency of your web application is increasing. You have determined the database is the bottleneck. What is the most effective way to improve read performance?
Read replicas offload read operations from the primary instance.
Why this answer
Adding read replicas distributes query load, reducing the pressure on the primary database instance.
An administrator wants to ensure that a storage bucket is not accidentally deleted. Which feature should be enabled?
Versioning preserves previous states and allows recovery of deleted files.
Why this answer
Soft delete or bucket versioning ensures that data can be recovered if accidentally deleted.
A system administrator needs to automatically replace unhealthy EC2 instances in an AWS Auto Scaling group. Which component must be configured?
Auto Scaling monitors instance health and replaces those that fail checks.
Why this answer
Health checks in an Auto Scaling group allow the service to detect unhealthy instances and trigger a replacement process.
Which TWO of the following are key considerations for cloud operational compliance?
Ensuring rules are automatically applied.
Why this answer
Compliance requires regular auditing and ensuring that policies are enforced across all resources.
You are tasked with automating a script that runs every night at 2 AM to clean up temporary files. Which service is most appropriate for triggering this task?
EventBridge can trigger Lambda functions on a recurring time-based schedule.
Why this answer
Event-driven scheduling tools like EventBridge (AWS) or Azure Automation run tasks based on cron-like schedules.
Which TWO of the following are valid strategies for cloud data migration?
Moving data over the WAN/VPN.
Why this answer
Data migration can involve physical transfer of devices or network-based replication.
Which TWO of the following are common cloud deployment patterns?
Switching traffic between two identical environments.
Why this answer
Deployment patterns determine how updates are rolled out; Blue/Green and Rolling updates are standard industry practices.
A developer needs to update a database schema without losing any existing data. Which concept is essential for this operational task?
Version-controlled migration scripts manage schema changes safely.
Why this answer
Database migrations ensure that schema changes are applied safely across environments, preserving data integrity.
Which protocol is most commonly used for secure, encrypted remote management of Linux-based virtual machines in the cloud?
SSH provides encrypted communication for remote management.
Why this answer
SSH (Secure Shell) is the industry standard for secure remote access to Linux servers.
You are designing a high-availability architecture. Which configuration ensures that your application is resilient to the failure of an entire physical data center?
Multi-AZ provides redundancy across physically separate data centers.
Why this answer
Deploying across multiple Availability Zones (AZs) ensures that the application remains online even if one data center fails.
You have a microservices architecture. How can you effectively manage the deployment of configuration changes across hundreds of containers without manual intervention?
Tools like Kubernetes ConfigMaps or Consul manage configuration across distributed containers.
Why this answer
Configuration management tools or orchestration platforms (like Kubernetes) use templates to propagate changes.
You are notified that an unused storage volume is incurring costs. What is the standard operational procedure to stop these charges?
Deleting an unused resource stops the charges immediately.
Why this answer
Deleting or detaching and deleting the orphaned resource is the standard way to stop billing.
Which metric should you monitor to determine if your application's load balancer is struggling with concurrent user connections?
Monitoring the number of concurrent connections shows if the load balancer is reaching its limits.
Why this answer
Connection counts or active flow metrics are the primary indicators of load balancer capacity.
Which THREE services are typically involved in cloud infrastructure automation?
CloudFormation provides AWS-native infrastructure templates.
Why this answer
Infrastructure automation relies on scripting languages, configuration management tools, and service orchestration.
You need to restrict outgoing network traffic from a private subnet to only specific API endpoints. Which security component should be configured?
Security groups function as virtual firewalls to control inbound and outbound traffic.
Why this answer
Network Access Control Lists (NACLs) or Security Groups can manage traffic, but specifically for egress control, Security Groups are typically applied to individual instances or resources.
Your organization uses a 'Shared Responsibility Model'. Which of the following is typically the customer's responsibility in the cloud?
Customers are responsible for configuring their own network security and firewall rules.
Why this answer
In most cloud models, the provider manages the physical hardware, while the customer manages data, patches, and configurations.
You are responsible for managing access keys for service accounts. You suspect a key has been compromised. What is the immediate operational step to take?
Deactivating the key immediately halts unauthorized access.
Why this answer
The most effective and immediate way to stop unauthorized access is to rotate or deactivate the compromised credentials.
You need to ensure that all virtual machines follow a consistent naming convention and have specific tags for cost tracking. What service should you use to enforce this?
Azure Policy allows you to mandate tags and naming conventions on resources.
Why this answer
Policy enforcement services like Azure Policy or AWS Service Control Policies (SCPs) can mandate tags and naming patterns.
Which TWO things should be checked when a cloud service is exceeding its budget?
Identify exactly which resources are consuming the budget.
Why this answer
Budget overruns are typically caused by either runaway resource usage or inefficient resource selection.
Which THREE factors are primary drivers for cloud cost management?
Egress traffic is a major hidden cost.
Why this answer
Cloud costs are primarily driven by the resources provisioned, the performance tier chosen, and the geographic location of the data.
Your organization requires that a specific cloud environment be isolated from the internet, yet it must access a private service hosted on another cloud provider. Which networking configuration is most appropriate?
Private endpoints allow secure, internal-only communication to services.
Why this answer
A Private Link or a VPN/Direct Connect link allows connectivity without traversing the public internet.
When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?
The status dashboard is the authoritative source for service availability.
Why this answer
Cloud providers maintain a public Status Dashboard to track the real-time health of their services.
An administrator is setting up a new cloud account. What is the first security best practice they should implement?
MFA is the most critical security control for any administrative account.
Why this answer
Enabling MFA is the most critical first step to secure any account access.
Which THREE of the following are necessary to manage multi-cloud deployments effectively?
Seeing all metrics in one dashboard.
Why this answer
Multi-cloud management requires unified visibility, standardized IaC, and consistent identity management.
What is the primary benefit of using a Managed Service (like RDS) over a self-managed database on a virtual machine?
Managed services automate routine maintenance, updates, and backups.
Why this answer
Managed services handle operational tasks like patching, backups, and maintenance, reducing the operational burden on the user.
A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?
Compute Optimizer is the specific service designed for rightsizing recommendations.
Why this answer
AWS Compute Optimizer uses machine learning to analyze historical utilization metrics to provide rightsizing recommendations for EC2 instances.
You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?
Updating the application to a supported platform is a standard migration strategy.
Why this answer
Re-platforming or re-architecting is often necessary for legacy apps that can't run on modern cloud-native OS templates.
You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?
DynamoDB is the required service for state locking when using S3 as a Terraform backend.
Why this answer
In Terraform, state locking is handled by the backend. When using AWS S3, you must use a DynamoDB table to provide the state locking mechanism.
You are utilizing Infrastructure as Code (IaC) templates. You notice that a specific resource update is causing service downtime. Which deployment pattern should you adopt to verify updates in a controlled environment before rolling out to production?
This pattern allows testing and seamless switching, minimizing downtime.
Why this answer
Blue/Green deployment allows you to deploy the new version in a separate environment (Green) and switch traffic only after verification.
You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?
AWS Budgets allows setting cost thresholds and alert notifications.
Why this answer
Budgeting services allow you to set cost thresholds and trigger alerts via SNS or email.
You are managing a fleet of cloud servers and notice that CPU usage is consistently at 95% during peak hours. What operational action should you take to restore performance?
Adding more instances to the pool spreads the load, reducing the burden on individual servers.
Why this answer
Horizontal scaling (adding more instances) or vertical scaling (increasing instance size) are standard responses to high utilization.
You are implementing a disaster recovery strategy. You need to ensure that database backups are stored in a different geographic region than the primary production database. What is this concept known as in cloud management?
Storing data in a separate geographic region provides regional disaster protection.
Why this answer
Geographic redundancy or cross-region replication is the practice of storing data in a different physical location to survive regional disasters.
An organization is migrating to a hybrid cloud model. They require a dedicated, private connection between their on-premises data center and the cloud provider to reduce latency. Which service should be provisioned?
Direct Connect establishes a private, physical connection from the data center to the cloud.
Why this answer
Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated physical connection to the cloud, bypassing the public internet.
Ready to test yourself?
Try a timed practice session using only Management And Technical Operations questions.