CCNA Management And Technical Operations Questions — Page 2 of 2

MCQmedium

A DevOps team manages a Google Cloud environment with many projects. They need a centralized view of all audit logs and the ability to create log-based metrics that alert on suspicious IAM changes across all projects. Which Google Cloud service should they use?

A.Cloud Logging

B.Cloud Asset Inventory

C.Cloud Monitoring

D.Security Command Center

AnswerA

Cloud Logging provides a centralized log management interface where logs from all projects can be aggregated into a log bucket or viewed via a log router. It supports log-based metrics that can be created from audit logs and then used for alerting. This directly meets the need for a single view and metric creation across projects.

Why this answer

Centralizing audit logs from multiple projects and building log-based metrics points to Cloud Logging. It can route logs from all projects into a single log bucket, and its log-based metrics can be used with Cloud Monitoring for alerts. Cloud Monitoring, Cloud Asset Inventory, and Security Command Center serve different purposes and do not provide the combined log aggregation and metric creation capability required.

Exam trap

The trap here is confusing a security posture tool like Security Command Center with a log aggregation service, assuming it can centralize and create custom metrics from audit logs.

Practice this question →

MCQeasy

You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?

A.AWS Cost Explorer

B.AWS Budgets

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerB

AWS Budgets lets you define a cost budget with a threshold and configure email notifications when actual or forecast spend exceeds it. That directly satisfies the $500 monthly alert requirement without needing custom billing API polling.

Why this answer

AWS Budgets allows you to set custom budgets for cost, usage, or reservations, and configure alerts when actual or forecasted spending exceeds a defined threshold. You can specify a monthly cost budget of $500 and attach an email notification to be triggered when actual spend surpasses that amount. This is the native AWS service designed for proactive cost monitoring and alerting, making it the correct choice for receiving an email alert on monthly spending.

Exam trap

CLO-002 often tests the distinction between cost monitoring tools, and candidates frequently confuse AWS Cost Explorer's analytical capabilities with AWS Budgets' alerting functionality, leading them to select Cost Explorer for threshold-based notifications.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer is a tool for visualizing and analyzing historical cost and usage data, but it does not natively send automated email alerts when spending exceeds a threshold. Option C is wrong because AWS Trusted Advisor provides recommendations on cost optimization, security, fault tolerance, and performance, but it does not offer custom budget thresholds or email alerts for spending limits. Option D is wrong because AWS CloudTrail records API activity and audit logs for governance and compliance, not cost monitoring or budget alerts.

Practice this question →

MCQhard

A cloud engineer must ensure that an Amazon S3 bucket used for regulatory archives cannot have objects deleted or overwritten by any user, including the root account, for a fixed retention period of seven years. Which combination of settings should the engineer configure?

A.Configure an S3 Lifecycle rule transitioning objects to S3 Glacier Deep Archive

B.Enable S3 Versioning and attach a bucket policy denying s3:DeleteObject

C.Enable S3 Object Lock in governance mode with a seven-year retention period

D.Enable S3 Object Lock in compliance mode with a seven-year retention period

AnswerD

S3 Object Lock in compliance mode prevents any principal, including the root account, from deleting or overwriting protected object versions until the retention date passes. It directly enforces the seven-year immutable retention the regulation demands and cannot be shortened or bypassed, which is exactly the required guarantee.

Why this answer

S3 Object Lock in compliance mode enforces write-once-read-many protection that no user, including the root account, can override before the retention period ends. Combined with a seven-year retention period, it provides the immutable archive the regulation demands, unlike governance mode or policy-based controls that privileged users can bypass.

Exam trap

The trap here is treating governance mode as equivalent to compliance mode, when only compliance mode is truly irreversible by any principal, including the root account.

Practice this question →

MCQeasy

You are managing a fleet of cloud servers and notice that CPU usage is consistently at 95% during peak hours. What operational action should you take to restore performance?

A.Scale out the application

B.Change the time zone

C.Reduce the logging level

D.Disable the firewall

AnswerA

Adding more instances to the pool spreads the load, reducing the burden on individual servers.

Why this answer

Horizontal scaling (adding more instances) or vertical scaling (increasing instance size) are standard responses to high utilization.

Practice this question →

MCQmedium

You are implementing a disaster recovery strategy. You need to ensure that database backups are stored in a different geographic region than the primary production database. What is this concept known as in cloud management?

A.Geo-redundancy

B.Horizontal scaling

C.Availability Zone failover

D.Local data caching

AnswerA

Geo-redundancy replicates data to a secondary region, so backups survive a regional outage affecting the primary database. This directly satisfies the stem's requirement that backups reside in a different geographic region from production, distinguishing it from local redundancy, which keeps copies within a single region or availability zone.

Why this answer

Geo-redundancy refers to the practice of replicating data and services across multiple geographic regions to ensure availability and disaster recovery. In the context of database backups, storing them in a different geographic region than the primary production database is a form of geo-redundancy, which protects against regional failures and meets compliance requirements for data durability.

Exam trap

CLO-002 often tests the confusion between geo-redundancy (cross-region) and availability zone failover (within a region), so candidates must distinguish geographic scope.

How to eliminate wrong answers

Option B is wrong because horizontal scaling refers to adding more instances to handle increased load, not to geographic distribution of backups. Option C is wrong because Availability Zone failover involves redundancy within a single region across isolated AZs, not across geographic regions. Option D is wrong because local data caching is a performance optimization technique that stores data closer to the user, not a disaster recovery strategy for backups.

Practice this question →

MCQeasy

A financial services company must store monthly compliance reports in Amazon S3 for seven years. The reports are accessed only during the first 30 days after creation and must be retained even if accidentally deleted. Which S3 feature should be enabled to prevent deletion during the retention period?

A.S3 Object Lock in compliance mode

B.S3 Lifecycle policies

C.S3 Versioning

D.S3 Cross-Region Replication

AnswerA

S3 Object Lock in compliance mode prevents any user, including the root account, from deleting or overwriting an object version until the retention date passes. This provides immutable storage for the seven-year period and meets the regulatory requirement that reports cannot be removed even by accident or malicious action.

Why this answer

The requirement is immutability for seven years, meaning no one can delete the reports during that period. S3 Object Lock in compliance mode enforces a retention period that cannot be shortened or bypassed, even by the root user. Versioning, lifecycle policies, and replication all offer some data protection but none prevent a determined or accidental deletion, so they cannot satisfy the regulatory retention mandate.

Exam trap

The trap here is assuming that versioning alone prevents deletion, when in fact all versions can still be permanently removed without Object Lock.

Practice this question →