CLO-002

A firewall is the general security service that controls and restricts network traffic to and from cloud resources by allowing or denying connections according to rules. A VPN creates an encrypted tunnel to provide connectivity rather than restrict it, and an intrusion detection system only monitors and alerts without blocking traffic. Security lists are one provider's name for a virtual firewall feature (Oracle Cloud Infrastructure), so the generic service being tested is the firewall.

With pay-as-you-go pricing, the organization pays only for the resources it consumes as a recurring operating expense instead of buying hardware up front as a capital expense. Elasticity lets resources scale up and down, self-service lets users provision resources on demand, and availability describes uptime; none of these by itself changes how the cost is accounted for.

Application programming interfaces (APIs) are how DevOps tools and applications integrate with cloud services, letting code create, query and manage cloud resources programmatically. Provisioning and automation are activities that are typically carried out through those APIs, and SOA (service-oriented architecture) is a design approach rather than an integration mechanism.

A statement of work (SOW) is the contract document that defines the project scope, the specific deliverables and tasks, the schedule and other details the buyer requires from the provider. A service level agreement instead defines measurable service commitments such as uptime and response times, a standard operating procedure documents how routine internal tasks are performed, and a master service agreement sets general terms that individual SOWs are written under.

In infrastructure as a service (IaaS), the customer manages the operating systems and software running on the provider's infrastructure, so the customer's IT department is responsible for patching and updating them and can do so to meet its compliance requirements. In SaaS, DBaaS and DRaaS the provider manages and patches the underlying platform and software, leaving the customer little or no control over updates.

Machine learning and AI workloads need large amounts of compute for short periods, and cloud elasticity gives access to a large pool of resources that can be scaled up for training and released afterward. Pay-as-you-go pricing means the company pays only for that compute while it is used instead of buying expensive hardware that sits idle. Technical support and the shared responsibility model are not specific advantages for analytics, and the DevOps options describe what AI or ML do, not why running them in the cloud is better than on premises.

A content delivery network (CDN) caches an application's files at edge locations around the world so users download them from a nearby server, reducing latency and improving the user experience. A SAN is block storage for servers in a data center, VDI delivers virtual desktops, and an API is an interface for programmatic access; none of them distribute content globally.

Big Data is commonly described by the four Vs: volume (the amount of data), variety (the different types and formats), velocity (the speed at which it is generated and processed) and veracity (its quality and trustworthiness). Machine learning, microservices, blockchain and object storage may work with large data sets, but these four characteristics define Big Data itself.

The provider uses a contract clause to shift the consequences of service misuse onto the customer, which is risk transference (transfer), one of the four risk responses in the Cloud Essentials+ objectives. Avoidance would mean not offering the service or activity at all, so the risk no longer exists. Acceptance means keeping the risk without action, and mitigation means adding controls to reduce its likelihood or impact.

Change management is the process that requests, tests, approves, schedules and documents changes to production systems, which is exactly what is needed to roll out the upgrade safely. Configuration management tracks the settings and baselines of systems but is not the approval workflow for a change. Incident management restores service after an outage, and resource management deals with allocating capacity and assets.

Cloud bursting keeps the workload on premises and sends only the overflow to a public cloud when demand spikes, so the retailer handles the holiday peak without moving its IT operations to the cloud. Elasticity and scalability describe how cloud resources grow and shrink, but they assume the workload already runs in the cloud. Self-service is the ability to provision resources without provider interaction and does not address seasonal load by itself.

The Cloud Essentials+ objectives list asset inventory, classification and ownership as the components of a risk assessment: you first list what you have, then classify the data by sensitivity to judge the impact of a loss. Asset management is the ongoing process of maintaining assets over their life cycle, not a section of the assessment itself. Database type, encryption algorithms and certificate names are technical details, not risk assessment components.

Software as a Service delivers a complete application, such as an ERP system, that the provider hosts and manages while the customer simply uses it. Public cloud and hybrid cloud are deployment models, not service models. IaaS supplies only compute, storage and networking, leaving the customer to install and run the application.

Lift and shift moves the existing applications to the cloud largely unchanged, which is the fastest approach and keeps the custom accounting software. Rip and replace would swap the applications for new ones, which the scenario rules out. A phased migration spreads the move over time and a hybrid deployment keeps part of the environment on premises, which conflicts with the deadline and the plan to decommission the internal hosting.

Spot instances use spare provider capacity at a deep discount, but the provider can reclaim them at short notice, so the application must tolerate being interrupted and resume or redistribute its work. Spot instances place no special requirement on databases or network communication, and they can run compute-intensive workloads; in fact batch compute jobs are a common use.

A feasibility study, part of a cloud assessment, determines whether a workload can actually run in the target cloud model; an application tied to a very old, non-upgradable OS may not be supported by a PaaS platform. A baseline and benchmarks measure current and comparative performance, and a risk register records identified risks, but none of them answers whether the application can be supported.

Lift and shift (rehosting) moves workloads and their data to the cloud as they are, without changing the applications, and bulk-copying existing VMs and data onto a shipped transfer appliance is a common way to do it. Rip and replace discards the existing systems and replaces them with new cloud-native or SaaS solutions, so the existing VMs would not be moved at all. Replatforming makes some optimizations during the move, and a phased approach moves workloads in stages rather than all at once.

With software as a service, the provider runs the whole stack: infrastructure, platform and the application itself, so the customer only uses and configures the software. PaaS still leaves the customer to build, deploy and maintain applications, and IaaS leaves the operating system, middleware and applications to the customer, so both carry more overhead. MaaS (monitoring as a service) is a specialized service, not a general model that minimizes overhead.

User self-service lets users provision resources on demand, often from approved templates or a catalog, without waiting for IT to build them by hand. The developer is deploying servers from templates prepared by the cloud engineer, which is exactly that. Subscription services describe a billing model, containerization packages applications with their dependencies, and autonomous environments manage themselves without user requests.

In a multicloud model, workloads and data must be able to move between and work across different providers, so data portability (open formats, export options and compatible services) is the key requirement. Data sovereignty and classification matter in any cloud deployment and are not specific to using several providers. Change management is a general process concern rather than a defining need of a multicloud model.