211 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2An organization wants to use AWS Cost Explorer to identify cost-saving opportunities. Which filter should the administrator apply to find idle resources?
Usage Type Group allows you to aggregate costs for specific service components to identify idle or underutilized instances.
Why this answer
Cost Explorer allows filtering by usage type to identify services that are running without generating traffic.
A business is analyzing the TCO for a cloud migration. Which item is considered a recurring 'OpEx' cost?
Monthly utility bills for cloud usage are standard operational expenditures.
Why this answer
Monthly cloud subscription and consumption-based utility costs are classic examples of OpEx.
A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?
The SLA is the binding contract regarding service performance and uptime.
Why this answer
The Service Level Agreement (SLA) defines the expected service availability and compensation for downtime.
A firm is deploying a web application across two different cloud providers to ensure business continuity. What is the most critical challenge they must overcome regarding data consistency?
Ensuring data is identical and accessible across disparate vendor architectures is the most difficult technical challenge.
Why this answer
Synchronizing data across different cloud environments (Data Gravity/Interoperability) is the primary hurdle in multi-cloud architectures, often requiring expensive egress and complex replication logic.
You need to store audit logs that are immutable and cannot be deleted for a set period. Which feature should you enable?
Object lock provides immutability.
Why this answer
Object locking (or WORM) prevents objects from being deleted or overwritten.
A firm wants to avoid over-provisioning infrastructure. What feature should they enable to adjust resource counts based on demand?
Auto-scaling prevents over-provisioning by adding capacity only when needed.
Why this answer
Auto-scaling automatically adds or removes compute resources based on real-time traffic demand.
Which TWO items represent 'Cloud-native' architectural practices?
Automation is essential for cloud-native agility.
Why this answer
Microservices and automated CI/CD are key features of cloud-native design.
Which THREE services allow you to restrict network access in a cloud VPC?
Application-level traffic filtering.
Why this answer
Network security in the cloud is enforced through Security Groups, Network ACLs, and Firewalls.
A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?
Managed rule sets contain updated patterns to detect and block SQL injection.
Why this answer
WAFs use specific rules or managed rule sets to inspect web traffic and filter out malicious SQL injection patterns.
Which THREE factors must be considered when estimating cloud costs?
Hardware specs affect price.
Why this answer
Usage, region, and resource type are primary cost drivers.
You need to ensure that a web server can only accept traffic on port 443. Where should this rule be defined?
This defines inbound and outbound rules for an instance.
Why this answer
A security group acts as a firewall for instances, allowing port control.
What is the benefit of 'measured service' for a business?
This is the core benefit of measuring usage.
Why this answer
Businesses only pay for the actual resources consumed, ensuring cost transparency.
Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?
Elasticity allows for dynamic adjustment of capacity based on current load.
Why this answer
Elasticity is the defining characteristic of cloud computing that allows scaling based on demand.
A company requires that all cloud logs be retained for seven years for legal compliance. Which service should they configure to ensure logs are moved to the cheapest storage class long-term?
Lifecycle policies manage the movement of data between storage tiers automatically.
Why this answer
Lifecycle policies in object storage (like AWS S3) automatically transition objects to cheaper, colder storage tiers based on age.
Which technology is primarily used to isolate applications while sharing the same OS kernel?
Containers share the host kernel.
Why this answer
Containers provide lightweight isolation using the same host kernel.
An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?
The Risk Register is the standard governance tool for tracking and managing risk.
Why this answer
The Risk Register is the formal document where identified risks, their impact, and mitigation strategies are documented.
A company needs to store static website assets such as images and CSS files cheaply. Which service is appropriate?
Object storage is highly scalable and inexpensive for static file hosting.
Why this answer
Object storage (like S3 or Azure Blob) is designed for static assets and is very cost-effective.
What is the primary difference between a 'Reserved Instance' and a 'Spot Instance'?
Spot instances utilize unused capacity and carry the risk of termination on short notice.
Why this answer
Spot instances are cheap but can be terminated by the provider at any time, whereas reserved instances are guaranteed capacity.
To ensure that no single administrator has full control over the environment, which security practice should be implemented?
This ensures critical administrative functions are split across different roles.
Why this answer
Separation of duties ensures that critical tasks are divided between multiple people to prevent fraud or error.
What is the primary advantage of 'High Availability' in cloud architecture?
High availability designs include redundancy to ensure services stay online during localized failures.
Why this answer
High availability ensures that a service remains accessible even if a component (like a server or zone) fails.
A security administrator needs to ensure that all traffic between their on-premises data center and their cloud environment is encrypted and traverses a dedicated, private connection. What should they implement?
This combination ensures both privacy via the circuit and encryption via the VPN.
Why this answer
A dedicated connection like AWS Direct Connect or Azure ExpressRoute provides the private, non-internet-based link, while VPNs provide the encryption over that tunnel.
Which THREE security controls are the responsibility of the cloud user under the Shared Responsibility Model?
User responsibility.
Why this answer
Users are responsible for data, configurations, and identity/access management.
When evaluating cloud providers, what is the significance of the 'Region' concept?
Regions allow customers to anchor data in specific locations to comply with regional laws.
Why this answer
Regions are geographically distinct areas that allow for data sovereignty compliance and lower latency for global users.
Which document is essential for cloud vendor selection and outlines specific performance, security, and financial requirements?
The RFP details technical and business requirements to ensure the chosen vendor meets organizational goals.
Why this answer
A Request for Proposal (RFP) is the formal document used to solicit bids from vendors based on specific business needs.
Which THREE factors influence cloud resource scalability decisions?
Peak usage times drive scaling requirements.
Why this answer
Scaling decisions are driven by demand patterns, application performance, and cost constraints.
Which THREE cloud service models require different levels of operational management from the customer?
Requires full OS and app management.
Which TWO of the following are benefits of using tags on cloud resources?
Tags allow you to group costs by department or project.
Why this answer
Tags are critical for cost allocation (billing) and resource organization (management).
Which of the following is an example of 'Infrastructure as Code'?
Terraform is a primary tool for writing infrastructure definitions as code.
Why this answer
IaC uses machine-readable definition files to manage and provision data center infrastructure.
What is the benefit of moving from an on-premises data center to a cloud provider?
The provider handles hardware.
Why this answer
Cloud providers assume the physical maintenance, allowing users to focus on apps.
What is the primary difference between vertical and horizontal scaling?
Horizontal scaling is scaling out.
Why this answer
Vertical adds power to an existing node; horizontal adds more nodes.
Which THREE items should be included in an incident response plan?
Essential for detecting when an incident occurs.
Why this answer
An incident plan must define who does what (roles), how they identify the issue (monitoring), and how they communicate.
Your team needs to share a large, sensitive file with an external partner. What is the secure way to share this file in the cloud?
Pre-signed URLs allow temporary, secure access to private files.
Why this answer
Pre-signed URLs or temporary access links allow secure, limited-time access to specific objects in cloud storage.
A company needs to store backups for compliance purposes for seven years. Access is rarely required. What is the most cost-effective storage class?
This is the cheapest for long-term storage.
Why this answer
Archive storage classes offer the lowest price for long-term retention.
Which THREE components are typically included in the cloud provider's 'Shared Responsibility Model' as the CUSTOMER'S responsibility?
The customer manages users and their permissions.
Why this answer
The customer is responsible for everything they put 'in' the cloud, including data, apps, and OS configurations.
You are troubleshooting a connectivity issue where an application cannot reach a database. Which tool allows you to trace the network path and identify the specific point of failure?
Flow logs provide visibility into network traffic flows, helping identify if traffic is blocked by security groups.
Why this answer
Network tracing tools like Traceroute or cloud-native Flow Logs help diagnose where traffic is blocked.
To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?
Compliance mode prevents any user, including root, from deleting the object until the retention period expires.
Why this answer
Object locking or WORM (Write Once Read Many) policies are designed for regulatory compliance in storage.
What does 'Multi-tenancy' in a public cloud mean?
This is the definition of multi-tenancy.
Why this answer
Multiple customers share the same underlying hardware resources.
Which strategy minimizes 'vendor lock-in' when designing a cloud-native architecture?
Containers allow applications to run consistently across any environment, reducing cloud-specific dependencies.
Why this answer
Using containerization (e.g., Kubernetes) makes applications portable across different cloud providers, reducing dependency on a single vendor's proprietary APIs.
A security audit requires that all database queries be logged and stored securely. Which feature should be enabled to meet this requirement in a relational database service?
Auditing captures detailed activity for compliance.
Why this answer
Database auditing or query logging features track user access and query execution for security analysis.
An IT team is conducting a cost-benefit analysis. Which THREE of the following are considered 'hidden' or 'indirect' costs that must be accounted for when moving to the cloud?
Personnel need time and money to learn new cloud-native skill sets.
Why this answer
Cloud costs are not just the subscription; they include human capital (training), integration efforts, and connectivity requirements.
Which cloud principle refers to the ability to pay for only the compute power you consume?
This allows per-use billing.
Why this answer
Measured service/Pay-as-you-go allows for precise cost tracking based on consumption.
Which cloud characteristic allows an organization to rapidly increase resources during a spike in traffic and decrease them when traffic drops?
This is the definition of scaling.
Why this answer
Elasticity is the ability to scale resources up and down based on demand.
Which cloud architectural practice helps minimize the impact of a total regional outage?
Spreading resources across regions ensures that if one fails, the other remains operational.
Why this answer
Multi-region deployment allows for failover to a different geographical region, ensuring business continuity.
When performing a TCO analysis for migrating a legacy on-premises database to Azure SQL, which hidden cost is most likely to be overlooked?
Egress fees for transferring data out of the cloud provider to on-premises systems are often underestimated.
Why this answer
Data egress fees are often excluded from initial calculations but significantly impact the long-term TCO of cloud-based database systems.
A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?
CloudTrail logs every API request made in the AWS account.
Why this answer
CloudTrail captures API logs, providing a trail of who performed which action in the account.
When conducting a cloud readiness assessment, what is the most important stakeholder to involve early in the process?
Security and compliance are foundational and must be integrated into the architecture design from the start.
Why this answer
Security teams must be involved early to define governance and compliance standards, preventing costly redesigns later.
A company is comparing two cloud providers. Which contractual document should be reviewed to understand uptime guarantees and service credits?
SLAs outline the performance metrics and guarantees provided by the service provider.
Why this answer
The SLA defines the expected uptime (e.g., 99.99%) and the financial consequences for the provider if they fail to meet it.
Which THREE risks are associated with a 'Lift and Shift' (re-hosting) migration strategy?
Without refactoring, the app may not be optimized for cloud networking/storage.
Why this answer
Lifting and shifting fails to take advantage of cloud-native benefits and often results in higher costs.
A project manager is calculating the cloud adoption strategy using a 'Re-platform' approach. What is the expected outcome?
Re-platforming allows for leveraging managed services like RDS or Azure SQL while maintaining the original application architecture.
Why this answer
Re-platforming involves making minimal changes to the application to run it on a cloud-native platform (like managed SQL) without changing the core code.
A developer needs to monitor real-time CPU utilization across a fleet of virtual machines in Azure. Which service should be used to capture and visualize these metrics?
Azure Monitor provides the infrastructure to collect and visualize VM metrics.
Why this answer
Azure Monitor is the primary service for collecting, analyzing, and acting on telemetry data from Azure resources.
Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?
Testing identifies vulnerabilities before attackers do.
Why this answer
Risk mitigation includes regular audits, automated security controls, and strict identity management.
After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?
This feature provides a centralized control to prevent public access regardless of individual bucket policies.
Why this answer
S3 Block Public Access is a setting that overrides bucket-level permissions to prevent public exposure.
A company wants to move their legacy on-premises application to the cloud without refactoring the code. Which service model should they choose to minimize operational burden while maintaining application compatibility?
IaaS provides the compute, storage, and networking infrastructure needed to host legacy applications as-is.
Why this answer
IaaS allows the organization to migrate virtual machines or disk images directly to the cloud, maintaining the existing OS and application environment without code changes.
An organization is migrating to a public cloud but has a small amount of highly sensitive data that cannot reside in a public environment. Which strategy should they use?
Hybrid models allow organizations to balance security/compliance needs with public cloud scalability.
Why this answer
A hybrid cloud approach allows for keeping sensitive data on-premises while using the public cloud for other application components.
A healthcare company must comply with HIPAA. When selecting a cloud provider, which document provides the best assurance of compliance?
SOC 2 reports provide independent assurance regarding security, availability, and processing integrity.
Why this answer
The SOC 2 Type II report details the operational effectiveness of security controls over a period of time.
Which cloud service model would a company use if they want to manage their application code and data but leave the OS, runtime, and hardware management to the provider?
PaaS removes OS management responsibilities.
Why this answer
PaaS allows developers to focus on the code while the provider manages the stack.
A company is moving from a 'Buy' to a 'Rent' model for software. Which model are they adopting?
SaaS is a software delivery model where applications are licensed on a subscription basis.
Why this answer
SaaS (Software as a Service) is a subscription-based 'rent' model, replacing the need to purchase permanent licenses.
Which TWO components are essential for a robust cloud disaster recovery plan?
Knowing how to recover is as important as having backups.
Why this answer
Disaster recovery requires data redundancy and a well-defined process for failing over traffic.
Which THREE of the following are cloud security best practices?
Continuous audit is necessary in dynamic environments.
Why this answer
Best practices include least privilege, automation, and continuous monitoring of the environment.
Which TWO of the following are benefits of using a Content Delivery Network (CDN)?
Offloading requests to the edge reduces origin traffic.
Why this answer
CDNs improve performance by caching content closer to users and reduce the load on the origin server.
Which THREE factors should a cloud architect consider when designing for high availability?
Geographical distribution protects against regional outages.
Why this answer
High availability requires redundancy at multiple layers, geographical distribution, and automated failure detection.
Which THREE of the following are characteristics of a 'Defense in Depth' security strategy?
This is the core definition of defense in depth.
Why this answer
Defense in depth uses multiple overlapping layers of security so that if one fails, others provide protection.
An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?
This feature includes vulnerability assessments and threat detection specific to database security.
Why this answer
Azure SQL Advanced Data Security provides vulnerability assessment and advanced threat protection, essential for GDPR compliance.
An enterprise is planning a multi-cloud strategy. What is the primary management risk associated with this approach?
Operating in multiple clouds requires managing disparate interfaces, security models, and billing structures.
Why this answer
Managing multiple cloud platforms increases complexity in security policies, cost management, and operational workflows.
Which TWO of the following scenarios represent a breach of the Shared Responsibility Model?
Firewall configuration is the customer's responsibility.
Why this answer
Shared responsibility requires the customer to manage what is in their control; failing to do so creates security gaps.
A large enterprise is transitioning to a hybrid cloud architecture. The CIO mandates that the cloud adoption strategy must minimize vendor lock-in. Which architectural approach best achieves this requirement?
Containers abstract the application from the underlying infrastructure, facilitating portability.
Why this answer
Using containers and orchestrators like Kubernetes allows applications to be portable across different cloud providers, minimizing dependency on proprietary cloud services.
Which cloud operation task is primarily responsible for ensuring that the cloud environment adheres to corporate security and regulatory standards?
Compliance management specifically manages regulatory and policy adherence.
Why this answer
Compliance management involves auditing and enforcing rules to ensure the environment stays within defined regulatory boundaries.
A company is implementing a 'Cloud-First' strategy. During the migration assessment, they identify that several applications require low-latency communication with on-premises legacy systems. Which cloud deployment model should they select?
Hybrid cloud provides the necessary connectivity between private infrastructure and public cloud services.
Why this answer
A hybrid cloud model allows the business to keep latency-sensitive applications on-premises while leveraging the cloud for scalable services, balancing business needs and performance.
A firm wants to ensure its cloud spend is aligned with specific business units. Which feature should they implement?
Tags act as metadata that allows for cost allocation and reporting per department.
Why this answer
Tagging resources by department or cost center allows for granular billing reports.
Which TWO of the following are common cloud monitoring tasks?
Security auditing is essential for compliance monitoring.
Why this answer
Monitoring involves both resource performance tracking and security event auditing.
Which document is essential to review to understand the scope and limitations of a cloud provider's commitment to service uptime?
The SLA defines the expected uptime standards.
Why this answer
The Service Level Agreement (SLA) outlines the uptime guarantee and the remedies if that guarantee is not met.
An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?
Site-to-Site VPN creates an encrypted IPsec tunnel for secure hybrid traffic.
Why this answer
A VPN tunnel provides an encrypted connection over the public internet, essential for hybrid connectivity security.
A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?
These independent audit reports provide validation of the provider's security controls.
Why this answer
A SOC 2 report or an ISO certification document provided by the cloud provider is the standard for proving compliance to auditors.
What is the primary benefit of 'Elasticity' for an e-commerce company during a major sale?
Elasticity ensures the system handles spikes without manual intervention or over-provisioning.
Why this answer
Elasticity allows the company to automatically increase capacity during a traffic spike and scale down afterward, saving money.
Which cloud networking component allows an instance in a public subnet to communicate with the internet?
Required for public subnet access.
Why this answer
An Internet Gateway allows traffic between a VPC and the internet.
Page 1 of 3
Page 2Practice CLO-002 by domain
Target a specific domain to shore up weak areas.