211 questions total · 3pages · All types, answers revealed
When assessing cloud readiness, what is a 'Legacy' application characteristic that might make migration difficult?
Cloud environments rely on dynamic DNS and elastic IPs; hard-coded IPs lead to failure.
Why this answer
Hard-coded IP addresses break if the application is moved to a dynamic cloud environment.
Which TWO business benefits are primarily driven by cloud computing's 'Agility'?
Cloud's pay-as-you-go model makes failure cheap and experimentation easy.
Why this answer
Agility allows businesses to test ideas faster and deploy products to market quicker.
A database is experiencing high I/O wait times. Which resource change is most appropriate?
Higher IOPS volumes reduce I/O wait times.
Why this answer
High I/O wait usually indicates slow storage; upgrading to a higher-performance storage tier (e.g., SSD) resolves this.
Which TWO of the following are essential components of a Cloud Security Policy?
Defining data sensitivity is foundational to security policy.
Why this answer
Security policies must define both authorized access and the classification of data being protected.
When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?
The customer is responsible for patching the OS they deploy.
Why this answer
In IaaS, the customer manages the guest OS, applications, and security group configurations.
Your organization is experiencing high latency for end-users accessing a global web application. The static assets are currently stored in a single bucket in the US-East region. Which architectural change will most effectively reduce latency for international users?
CDNs serve content from geographically distributed locations, placing data closer to the user.
Why this answer
Implementing a Content Delivery Network (CDN) caches static content at Edge locations closer to the end-users, significantly reducing round-trip time.
An architect is designing a system that must survive a complete data center failure. What should be utilized?
This provides data center fault tolerance.
Why this answer
Multi-AZ deployment ensures that if one data center fails, the application remains available in another.
When evaluating a cloud service provider (CSP), which TWO of the following business-focused documentation should be requested to verify the vendor's reliability and security posture?
These reports provide independent verification of security and process controls.
Why this answer
To assess risk and reliability, organizations must review the CSP's audit reports (like SOC2) and their documented Service Level Agreements.
Which THREE regulatory or compliance frameworks might an enterprise need to audit a cloud provider for?
Mandatory for healthcare data handling.
Why this answer
Enterprises must ensure the provider meets strict, verified standards like HIPAA, SOC, and PCI-DSS.
To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?
Ensuring resources are only deployed in regions within the specific country satisfies sovereignty requirements.
Why this answer
Selecting the appropriate cloud region ensures that data remains within the physical infrastructure of a specific legal jurisdiction.
Which THREE items are considered part of cloud resource maintenance?
Essential for security and stability.
Why this answer
Maintenance includes keeping resources patched, removing unused assets, and monitoring health.
Which THREE items should be included in a disaster recovery plan?
Essential for restoration.
Why this answer
RTO, RPO, and backup procedures are critical for recovery plans.
An company is performing a cloud migration. What is the primary purpose of a 'Cloud Center of Excellence' (CCoE)?
A CCoE acts as a cross-functional team that provides leadership and standards for cloud adoption.
Why this answer
The CCoE defines standards, best practices, and governance to ensure cloud adoption is successful and consistent across the organization.
An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?
ACLs provide subnet-level traffic control.
Why this answer
Network ACLs act as a subnet-level firewall, providing the first layer of security for traffic entering or leaving a subnet.
An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?
Security Hub can aggregate findings from multiple accounts into a central location.
Why this answer
AWS Organizations and log shipping (using CloudWatch Logs or S3) allow for centralizing security data for auditing.
Which THREE actions are best practices for securing a cloud virtual machine?
Restrict user/service permissions to only what is necessary.
Why this answer
Securing a VM involves minimizing attack surface, ensuring encryption, and managing access correctly.
A security auditor requests a solution to ensure that all data stored in the cloud is encrypted at rest. What should the administrator implement?
This protects data at rest.
Why this answer
Server-side encryption ensures data is encrypted before being stored on disk.
What is the purpose of a VPC Endpoint?
VPC endpoints keep traffic in the cloud network.
Why this answer
It allows private communication between a VPC and cloud services, avoiding the public internet.
Which cloud characteristic allows a startup to automatically increase their compute resources during a marketing campaign and decrease them afterward without manual intervention?
Elasticity provides the automated resource adjustment capability requested.
Why this answer
Elasticity is the ability to automatically scale resources up or down based on current demand.
An administrator needs to ensure that cloud resources are geographically separated to maintain availability during a regional disaster. Which feature should they configure?
This ensures regional fault tolerance.
Why this answer
Multi-region deployment provides disaster recovery across geographic boundaries.
You have a fleet of instances that need to automatically update their software patches. What is the best cloud-native approach to manage this?
Centralized patch management services automate the testing and deployment of updates.
Why this answer
Systems management tools like Systems Manager (AWS) or Azure Automation allow centralized, scheduled, and automated patching.
You notice that the latency of your web application is increasing. You have determined the database is the bottleneck. What is the most effective way to improve read performance?
Read replicas offload read operations from the primary instance.
Why this answer
Adding read replicas distributes query load, reducing the pressure on the primary database instance.
Which cloud service model is best suited for end-users who want to use software via a browser?
SaaS is ready-to-use software.
Why this answer
SaaS delivers applications over the internet to end-users.
Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?
CCoE ensures consistency in security policy.
Why this answer
A CCoE helps standardize cloud best practices, fosters cross-team communication, and manages risk centrally.
A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?
Config Rules can be set to flag resources missing specific tags.
Why this answer
AWS Config provides rules to check for tags and can trigger automation to remediate non-compliance.
An administrator wants to ensure that a storage bucket is not accidentally deleted. Which feature should be enabled?
Versioning preserves previous states and allows recovery of deleted files.
Why this answer
Soft delete or bucket versioning ensures that data can be recovered if accidentally deleted.
Which TWO benefits are associated with cloud storage object versioning?
You can restore deleted files.
Why this answer
Versioning protects against accidental deletions and allows for recovery of older data versions.
A system administrator needs to automatically replace unhealthy EC2 instances in an AWS Auto Scaling group. Which component must be configured?
Auto Scaling monitors instance health and replaces those that fail checks.
Why this answer
Health checks in an Auto Scaling group allow the service to detect unhealthy instances and trigger a replacement process.
An organization is calculating the cost of cloud vs. on-premises. What is the benefit of 'economies of scale' provided by the cloud vendor?
Massive purchasing power allows providers to offer lower resource prices than an individual firm could achieve.
Why this answer
Cloud providers pass on savings to customers because they buy hardware and power at massive scales.
A firm needs to ensure they pay only for the compute cycles used by their batch processing job. Which pricing model is most cost-effective?
Pay-as-you-go billing ensures you are only charged for the time the process is actively executing.
Why this answer
Serverless or on-demand execution is ideal for intermittent batch processing where resources are only active when needed.
When a data breach occurs in a cloud environment, who is responsible for notifying the regulatory authorities?
The customer is the data controller and is legally liable.
Why this answer
The customer is generally the Data Controller and holds the legal responsibility for data breach notifications, even if the cloud provider is the data processor.
An organization is conducting a cost-benefit analysis for moving data storage to the cloud. They find that the cloud provider offers a 'Tiered Storage' model. What is the primary business benefit of this feature?
Tiering matches data value to storage cost, ensuring the business doesn't overpay for rarely accessed data.
Why this answer
Tiered storage allows businesses to place data on the most cost-effective storage class based on access frequency, directly impacting cloud spend efficiency.
An IT manager is reviewing the monthly cloud invoice and notices high costs associated with 'Egress'. What does this cost component represent in a business context?
Egress charges are levied when data is pulled out of the cloud environment.
Why this answer
Egress refers to data being transferred out of the cloud provider's network, which is often a billable event that impacts the overall TCO.
Which THREE of the following are common benefits of adopting a Cloud Governance framework?
Frameworks standardize how risks are identified and mitigated.
Why this answer
Governance frameworks improve accountability, compliance, and risk management across cloud operations.
A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?
Cost Explorer allows for detailed visualization and budget monitoring.
Why this answer
Cloud providers use budget services to track spending and send notifications when limits are approached.
Which THREE of the following tools or methods are used to secure data in transit in the cloud?
Industry standard for transport layer encryption.
Which THREE types of costs should be included in a thorough TCO analysis for cloud migration?
The effort to rewrite apps is a major migration expense.
Why this answer
A complete TCO involves hardware, software, and the human cost of management and transition.
Which TWO of the following are key considerations for cloud operational compliance?
Ensuring rules are automatically applied.
Why this answer
Compliance requires regular auditing and ensuring that policies are enforced across all resources.
An organization is migrating to the cloud and decides to use 'Reserved Instances'. What is the main business benefit?
Reserved instances offer deep discounts for committed capacity over 1-3 years.
Why this answer
Reserved instances provide a significant cost discount in exchange for a long-term commitment.
You are tasked with automating a script that runs every night at 2 AM to clean up temporary files. Which service is most appropriate for triggering this task?
EventBridge can trigger Lambda functions on a recurring time-based schedule.
Why this answer
Event-driven scheduling tools like EventBridge (AWS) or Azure Automation run tasks based on cron-like schedules.
A developer needs to host a static website on AWS S3. Which configuration is required to make the objects publicly accessible?
This allows S3 to serve content as a website.
Why this answer
Enabling static website hosting and updating the bucket policy is necessary for public access.
A company is preparing a cloud business case and must justify migrating an on-premises legacy application. The finance department requires a direct comparison of current hardware refresh costs versus cloud consumption models. Which metric should the cloud architect prioritize to demonstrate the financial benefit?
TCO analysis highlights how moving from CapEx to OpEx optimizes cash flow.
Why this answer
Total Cost of Ownership (TCO) analysis allows the organization to compare the full lifecycle costs of maintaining on-premises hardware against the operational expenditure of cloud services.
Which TWO of the following are key responsibilities of a Cloud Governance Committee?
Governance establishes the rules for security and compliance.
Why this answer
The committee manages the strategic alignment of cloud costs and security policies.
An administrator needs to securely manage access to cloud resources. Which service should be used to create groups, users, and roles?
IAM manages credentials and permissions.
Why this answer
Identity and Access Management (IAM) is the central service for user and access control.
A business is analyzing cloud provider pricing. What is 'Metering' in this context?
Cloud providers track usage of CPU, memory, and data to ensure accurate billing.
Why this answer
Metering is the process of measuring resource usage (time, bandwidth, storage) to determine the cost at the end of the billing cycle.
Which TWO factors should be considered when conducting a cost-benefit analysis for cloud adoption?
Labor for refactoring and data transfer is a significant upfront cost.
Why this answer
Hidden transition costs and long-term operational savings are critical for a realistic comparison.
A developer needs a storage solution for high-frequency trading logs that must be instantly accessible for analysis, with high IOPS, and low latency. Which storage type is most appropriate?
Block storage is designed for applications requiring high performance and low-latency access to data volumes.
Why this answer
Block storage provides the performance characteristics required for high-frequency applications that need low-latency, random I/O access.
Which TWO of the following are valid strategies for cloud data migration?
Moving data over the WAN/VPN.
Why this answer
Data migration can involve physical transfer of devices or network-based replication.
A company requires a private cloud solution for strict regulatory data isolation. Which deployment model should they choose?
Private clouds provide dedicated physical resources, which are essential for high-security regulatory requirements.
Why this answer
A private cloud model provides dedicated infrastructure for a single organization, ensuring isolation.
A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?
Security Hub provides a central compliance dashboard against industry standards.
Why this answer
AWS Security Hub aggregates findings from services like Inspector to report on compliance against benchmarks like CIS.
A company needs to ensure that only authorized devices can access internal cloud applications. Which mechanism verifies device posture before granting access?
These policies can check if a device is managed and compliant before granting access.
Why this answer
Endpoint management and Conditional Access policies look at device state (e.g., compliant, patched) before allowing access.
Which TWO of the following are common cloud deployment patterns?
Switching traffic between two identical environments.
Why this answer
Deployment patterns determine how updates are rolled out; Blue/Green and Rolling updates are standard industry practices.
A multinational corporation is evaluating cloud vendors for compliance with international data residency laws. Which selection criterion is most critical to ensure legal compliance during vendor selection?
This allows the business to choose regions that comply with specific data residency regulations.
Why this answer
Data sovereignty/residency laws dictate that data must stay within physical or jurisdictional borders. Verifying the cloud provider's regional data center footprint is essential.
An organization is evaluating cloud providers based on 'Shared Responsibility Model' documentation. What does the cloud provider typically remain responsible for?
The cloud provider manages the physical data centers, networking, and virtualization hosts.
Why this answer
The provider is responsible for the 'security of the cloud', which includes physical hardware and underlying virtualization layers.
To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?
Azure Policy is designed to enforce rules and effects over resources to ensure compliance.
Why this answer
Policy engines allow for the automated enforcement of configurations to ensure continuous compliance.
Which THREE of the following are primary business drivers for adopting a cloud computing model?
Cloud platforms provide rapid deployment capabilities.
Why this answer
Business drivers for cloud include operational flexibility, financial optimization, and rapid delivery of services to market.
Which cloud service model provides a platform for developers to deploy applications without managing the underlying infrastructure?
PaaS abstracts the infrastructure.
Why this answer
PaaS provides the development and runtime environment.
You are troubleshooting a connectivity issue where an application in a private subnet cannot reach the internet to download updates. Which component is missing?
NAT allows private instances to access the internet.
A developer needs to update a database schema without losing any existing data. Which concept is essential for this operational task?
Version-controlled migration scripts manage schema changes safely.
Why this answer
Database migrations ensure that schema changes are applied safely across environments, preserving data integrity.
Which protocol is most commonly used for secure, encrypted remote management of Linux-based virtual machines in the cloud?
SSH provides encrypted communication for remote management.
Why this answer
SSH (Secure Shell) is the industry standard for secure remote access to Linux servers.
An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?
SAML is the standard protocol for web-based SSO.
Why this answer
SAML (Security Assertion Markup Language) is the industry standard for federated identity management and Single Sign-On (SSO).
Which TWO advantages does a public cloud provide for a small business?
Elasticity benefit.
Why this answer
Public cloud offers lower upfront costs and operational flexibility (elasticity).
Your organization is reviewing the shared responsibility model. Which TWO of the following are typically the responsibility of the cloud service provider?
The hypervisor/host layer is managed by the provider.
Why this answer
The provider is responsible for the underlying infrastructure (physical hardware and data center security).
You need to allow temporary access to a file stored in a private bucket for a third party. What is the most secure method?
This is secure and temporary.
Why this answer
A pre-signed URL generates a temporary link with limited time-bound access.
What is the primary purpose of a cloud provider's region?
Regions keep data closer to the end-user.
Why this answer
A region is a geographic collection of data centers that provide low latency to users in that area.
Which TWO financial models are typical for cloud resource billing?
Standard usage-based billing model.
Why this answer
Cloud billing is almost exclusively based on consumption-based models (pay-as-you-go) and long-term commitment discounts (reserved).
Which TWO factors contribute to the risk of 'Vendor Lock-in'?
Proprietary interfaces are not compatible with other cloud providers.
Why this answer
Proprietary APIs and tightly coupled data formats prevent easy migration.
When using an Auto Scaling group, what metric is most commonly used to trigger an increase in server instances?
CPU is the most common scaling trigger.
Why this answer
CPU utilization is the standard metric for scaling compute capacity.
A developer needs a serverless environment to run event-driven code. What should they choose?
FaaS is the event-driven serverless choice.
Why this answer
Function-as-a-Service (FaaS) is the serverless model for event-driven code.
You are designing a high-availability architecture. Which configuration ensures that your application is resilient to the failure of an entire physical data center?
Multi-AZ provides redundancy across physically separate data centers.
Why this answer
Deploying across multiple Availability Zones (AZs) ensures that the application remains online even if one data center fails.
Which THREE items are generally included in a cloud provider's 'Service Level Agreement' (SLA)?
The remedy provided when the SLA is breached.
Why this answer
SLAs include uptime percentages, financial credits, and service scope definitions.
A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?
Agility enables rapid development and deployment.
Why this answer
Agility refers to the ability to provision resources quickly, allowing for faster experimentation and time-to-market.
Which TWO of the following are benefits of using Infrastructure as Code (IaC) for compliance?
IaC prevents 'configuration drift' by using templates.
Why this answer
IaC allows for version control and consistent, repeatable deployments that can be audited for compliance.
You have a microservices architecture. How can you effectively manage the deployment of configuration changes across hundreds of containers without manual intervention?
Tools like Kubernetes ConfigMaps or Consul manage configuration across distributed containers.
Why this answer
Configuration management tools or orchestration platforms (like Kubernetes) use templates to propagate changes.
You are notified that an unused storage volume is incurring costs. What is the standard operational procedure to stop these charges?
Deleting an unused resource stops the charges immediately.
Why this answer
Deleting or detaching and deleting the orphaned resource is the standard way to stop billing.
Practice CLO-002 by domain
Target a specific domain to shore up weak areas.