211 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which metric should you monitor to determine if your application's load balancer is struggling with concurrent user connections?
Monitoring the number of concurrent connections shows if the load balancer is reaching its limits.
Why this answer
Connection counts or active flow metrics are the primary indicators of load balancer capacity.
Which THREE services are typically involved in cloud infrastructure automation?
CloudFormation provides AWS-native infrastructure templates.
Why this answer
Infrastructure automation relies on scripting languages, configuration management tools, and service orchestration.
You need to restrict outgoing network traffic from a private subnet to only specific API endpoints. Which security component should be configured?
Security groups function as virtual firewalls to control inbound and outbound traffic.
Why this answer
Network Access Control Lists (NACLs) or Security Groups can manage traffic, but specifically for egress control, Security Groups are typically applied to individual instances or resources.
Your organization uses a 'Shared Responsibility Model'. Which of the following is typically the customer's responsibility in the cloud?
Customers are responsible for configuring their own network security and firewall rules.
Why this answer
In most cloud models, the provider manages the physical hardware, while the customer manages data, patches, and configurations.
A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?
KMS allows for the creation and management of customer-managed keys with integrated auditing.
Why this answer
AWS KMS is the standard service for managing cryptographic keys and provides audit logs through CloudTrail, satisfying compliance requirements for customer-managed keys.
Which TWO advantages does a 'Community Cloud' offer over a 'Public Cloud'?
Shared standards reduce the burden of individual compliance audits.
Why this answer
Community clouds provide shared, specialized environments that meet the specific needs of a set of organizations, often with enhanced security.
An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?
This is a private, dedicated network link.
Why this answer
A dedicated private connection like Direct Connect or ExpressRoute bypasses the public internet.
Which TWO cloud service models are most appropriate for a developer who wants to focus solely on code?
Provides a platform for code deployment without OS management.
Why this answer
PaaS and Serverless abstract the infrastructure, letting the developer push code directly.
SaaS provides a managed application environment where the vendor handles updates and security patching.
Why this answer
SaaS removes the burden of infrastructure management, allowing the business to focus on core operations.
You are responsible for managing access keys for service accounts. You suspect a key has been compromised. What is the immediate operational step to take?
Deactivating the key immediately halts unauthorized access.
Why this answer
The most effective and immediate way to stop unauthorized access is to rotate or deactivate the compromised credentials.
You need to ensure that all virtual machines follow a consistent naming convention and have specific tags for cost tracking. What service should you use to enforce this?
Azure Policy allows you to mandate tags and naming conventions on resources.
Why this answer
Policy enforcement services like Azure Policy or AWS Service Control Policies (SCPs) can mandate tags and naming patterns.
A startup needs to rapidly deploy a web application. Which cloud service model allows developers to deploy code without managing the underlying servers?
PaaS allows developers to focus on the application layer while the cloud provider manages the runtime and infrastructure.
Why this answer
PaaS (Platform as a Service) provides the environment for developers to deploy code while the provider manages the OS and hardware.
An application requires a database that can handle unstructured data and scale horizontally. Which database type is best?
NoSQL handles unstructured data well.
Why this answer
NoSQL databases are designed for unstructured data and horizontal scaling.
Which TWO of the following are key steps in a Cloud Incident Response process?
Lessons learned help prevent future recurrences.
Why this answer
Incident response requires structured preparation, containment, and post-incident analysis.
Which TWO of the following are common threats to cloud-based data integrity?
This directly impacts the integrity of the data.
Why this answer
Integrity threats include unauthorized modification of data and malicious code injection that alters application logic.
A company is migrating an on-premises database to a public cloud. The database requires low latency and high IOPS. Which storage type should the architect select?
This offers high IOPS for demanding databases.
Why this answer
Provisioned IOPS SSDs provide the consistent performance required for database workloads.
Which THREE of the following represent common compliance risks in a cloud environment?
Storing data in prohibited jurisdictions is a compliance risk.
Why this answer
Compliance risks involve misconfigurations, lack of data sovereignty, and unauthorized access to protected data.
What is the primary risk mitigation strategy when storing data in a single availability zone?
Multi-AZ provides redundancy against localized facility failures.
Why this answer
If an entire availability zone fails, data in that zone is lost; using multi-AZ deployments mitigates this risk.
A startup is calculating the ROI for a migration project. They have calculated the Total Cost of Ownership (TCO) savings. What secondary financial factor must be included to accurately determine the overall ROI of the cloud adoption?
ROI calculations require the total investment cost, which includes one-time migration and training expenses.
Why this answer
ROI is (Net Profit / Cost of Investment). To find the net benefit, you must factor in the migration costs (labor, refactoring, training) against the TCO savings.
Which THREE cloud management tools should be utilized to control costs?
Helps visualize and understand spending trends.
Why this answer
Cost tools, budgeting alerts, and resource tagging are the trio for effective cost governance.
Which TWO things should be checked when a cloud service is exceeding its budget?
Identify exactly which resources are consuming the budget.
Why this answer
Budget overruns are typically caused by either runaway resource usage or inefficient resource selection.
Which THREE factors are primary drivers for cloud cost management?
Egress traffic is a major hidden cost.
Why this answer
Cloud costs are primarily driven by the resources provisioned, the performance tier chosen, and the geographic location of the data.
Which tool provides a 'Right-sizing' recommendation for an underutilized virtual machine?
Compute Optimizer uses machine learning to identify instances that are too large for their actual workload.
Why this answer
Cloud providers' cost management tools (e.g., AWS Compute Optimizer) analyze usage metrics to suggest smaller, cheaper instances.
A company is migrating to the cloud to scale for seasonal traffic spikes. Which cloud characteristic best addresses this business need?
Elasticity is the core cloud feature that handles varying workloads by scaling resources dynamically.
Why this answer
Elasticity allows the system to automatically scale resources up or down based on current demand.
To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?
Encrypting before transit ensures that even the provider cannot read the plaintext.
Why this answer
Client-side encryption ensures that data is encrypted at the source, before it enters the cloud provider's network.
An organization is migrating to a cloud environment and needs to maintain strict control over its encryption keys. Which service should they utilize?
KMS allows customers to create and manage their own encryption keys for data protection.
Why this answer
Key Management Service (KMS) or a Hardware Security Module (HSM) allows the customer to manage their own keys, fulfilling compliance requirements.
Your organization requires that a specific cloud environment be isolated from the internet, yet it must access a private service hosted on another cloud provider. Which networking configuration is most appropriate?
Private endpoints allow secure, internal-only communication to services.
Why this answer
A Private Link or a VPN/Direct Connect link allows connectivity without traversing the public internet.
When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?
The status dashboard is the authoritative source for service availability.
Why this answer
Cloud providers maintain a public Status Dashboard to track the real-time health of their services.
An administrator is setting up a new cloud account. What is the first security best practice they should implement?
MFA is the most critical security control for any administrative account.
Why this answer
Enabling MFA is the most critical first step to secure any account access.
A company requires a highly available database that replicates data synchronously across availability zones. Which setting should be chosen?
This provides synchronous high availability.
Why this answer
Multi-AZ deployment ensures synchronous replication for high availability.
Which TWO items are typically included in a cloud 'Cloud Adoption Strategy' document?
The strategy must include the plan and phases of the transition.
Why this answer
A strategy document needs to define the business objectives and the roadmap for execution.
Which THREE of the following are necessary to manage multi-cloud deployments effectively?
Seeing all metrics in one dashboard.
Why this answer
Multi-cloud management requires unified visibility, standardized IaC, and consistent identity management.
Which cloud service model would best suit a company that needs complete control over the network configuration and operating system but wants to avoid physical server maintenance?
IaaS offers the most flexibility for network and OS control while abstracting physical hardware.
Why this answer
IaaS provides virtualized computing resources where the vendor manages the hardware, but the customer retains control over the OS and network.
Which TWO cloud deployment models allow for a hybrid cloud setup?
Public cloud is a core hybrid component.
Why this answer
Hybrid clouds connect on-premises data centers to either private or public cloud environments.
What is the primary benefit of using a Managed Service (like RDS) over a self-managed database on a virtual machine?
Managed services automate routine maintenance, updates, and backups.
Why this answer
Managed services handle operational tasks like patching, backups, and maintenance, reducing the operational burden on the user.
A company uses a hybrid cloud. They need to move a database workload to the cloud that has strict regulatory requirements. Which deployment model is most appropriate?
Private cloud offers the required isolation.
Why this answer
A private cloud or a dedicated host within a cloud is best for strict regulatory requirements.
A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?
Compute Optimizer is the specific service designed for rightsizing recommendations.
Why this answer
AWS Compute Optimizer uses machine learning to analyze historical utilization metrics to provide rightsizing recommendations for EC2 instances.
You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?
Updating the application to a supported platform is a standard migration strategy.
Why this answer
Re-platforming or re-architecting is often necessary for legacy apps that can't run on modern cloud-native OS templates.
You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?
DynamoDB is the required service for state locking when using S3 as a Terraform backend.
Why this answer
In Terraform, state locking is handled by the backend. When using AWS S3, you must use a DynamoDB table to provide the state locking mechanism.
A company is using a SaaS application for email. Which part of the security responsibility remains with the company?
The customer must manage who can access their data within the SaaS app.
Why this answer
In SaaS, the provider manages the application and infrastructure, but the customer retains responsibility for identity and data access.
A global company needs to ensure compliance with GDPR. Which feature of a cloud provider is most critical for compliance?
Selecting specific geographic regions ensures that personal data remains within the legal jurisdiction required by GDPR.
Why this answer
Region/Data Residency controls allow organizations to specify exactly where their data is stored, which is a requirement for GDPR.
You are utilizing Infrastructure as Code (IaC) templates. You notice that a specific resource update is causing service downtime. Which deployment pattern should you adopt to verify updates in a controlled environment before rolling out to production?
This pattern allows testing and seamless switching, minimizing downtime.
Why this answer
Blue/Green deployment allows you to deploy the new version in a separate environment (Green) and switch traffic only after verification.
Which THREE are key characteristics of cloud computing?
Usage-based billing.
Why this answer
Broad network access, elasticity, and measured service are foundational characteristics.
A developer is writing code that accesses an API key. Instead of hardcoding the key, which service should they use to retrieve it securely at runtime?
Secrets Manager provides secure storage and dynamic retrieval for credentials.
Why this answer
Secrets Manager is specifically designed to store and retrieve API keys, database credentials, and secrets securely.
Which THREE activities are included in the 'Cloud Adoption Strategy' planning phase?
Crucial to define guardrails for the environment.
Why this answer
Planning requires assessing the current state, defining the target, and analyzing the business case.
Which of the following represents a major benefit of cloud computing where resources are shared among multiple customers?
This is the core of multi-tenancy.
Why this answer
Resource pooling allows providers to serve multiple customers efficiently using the same physical hardware.
Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?
Roles allow for temporary access, ideal for third-party delegation.
Why this answer
IAM Roles are designed for temporary, cross-account, or service-based access via tokenized credentials.
You want to receive an email alert whenever your monthly cloud spending exceeds $500. Which service should you configure?
AWS Budgets allows setting cost thresholds and alert notifications.
Why this answer
Budgeting services allow you to set cost thresholds and trigger alerts via SNS or email.
A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?
Allowing only port 443 ensures secure traffic access.
Which THREE factors can lead to 'Cloud Sprawl' (unmanaged resource accumulation)?
Business units creating resources outside of IT governance.
Why this answer
Lack of tagging, shadow IT, and poor automated cleanup lead to uncontrolled resource growth.
Which TWO scenarios are appropriate for using a load balancer?
Core function of an LB.
Why this answer
Load balancers distribute traffic for high availability and to prevent server overload.
A company is moving from a capital expenditure model to an operational expenditure model. What is the primary benefit?
OpEx removes the need for hardware procurement capital.
Why this answer
OpEx allows for pay-as-you-go billing, which avoids large upfront costs.
An organization is evaluating the 'Total Cost of Ownership' of a cloud migration. What is a 'Hidden' administrative cost?
Staff must learn new platforms, tools, and security processes, which incurs significant time and cost.
Why this answer
The cost of training existing staff to manage new cloud-native tools is a significant but often overlooked TCO factor.
You are managing a fleet of cloud servers and notice that CPU usage is consistently at 95% during peak hours. What operational action should you take to restore performance?
Adding more instances to the pool spreads the load, reducing the burden on individual servers.
Why this answer
Horizontal scaling (adding more instances) or vertical scaling (increasing instance size) are standard responses to high utilization.
A startup is looking for a cloud deployment model where they pay only for resources used and share underlying hardware with other tenants. What model is this?
Public cloud is multi-tenant and consumption-based.
Why this answer
This is the definition of a public cloud model.
Which TWO criteria are essential when selecting a cloud vendor for an enterprise?
Enterprises must ensure the provider meets their specific industry regulations.
Why this answer
Reliability (uptime/SLA) and compliance certifications are primary drivers for enterprise adoption.
An application is suffering from high latency for users across the globe. Which service can help cache content closer to the users?
CDN caches data at the edge.
Why this answer
A Content Delivery Network (CDN) caches content at edge locations globally.
You are implementing a disaster recovery strategy. You need to ensure that database backups are stored in a different geographic region than the primary production database. What is this concept known as in cloud management?
Storing data in a separate geographic region provides regional disaster protection.
Why this answer
Geographic redundancy or cross-region replication is the practice of storing data in a different physical location to survive regional disasters.
When evaluating a cloud-based database service, which TWO of the following are key benefits compared to self-managed databases?
Managed services handle OS and database engine updates.
Why this answer
Managed database services reduce the operational overhead of patching and backups.
A company is shifting from CapEx to OpEx for its infrastructure. Which financial metric should the CFO prioritize to justify this transition?
ROI helps evaluate the efficiency of the capital investment in cloud services versus traditional hardware.
Why this answer
Moving to OpEx allows companies to align costs with revenue generation rather than long-term asset depreciation.
An organization is migrating to a hybrid cloud model. They require a dedicated, private connection between their on-premises data center and the cloud provider to reduce latency. Which service should be provisioned?
Direct Connect establishes a private, physical connection from the data center to the cloud.
Why this answer
Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated physical connection to the cloud, bypassing the public internet.
Page 3 of 3
Practice CLO-002 by domain
Target a specific domain to shore up weak areas.