Multiple-response question
A question requiring you to select more than one correct answer from the choices given.
Getting Started: How the Exam Works
Free knowledge base
CompTIA Cloud Essentials+ (CLO-002) — key terms, tricks & tips
Everything from the course in one searchable place: 249 entries. Use it to review before a practice test or look up a word you forgot.
249 results
Scaled score
A converted score on a fixed range used to report exam results, rather than raw percent correct.
Getting Started: How the Exam Works
Passing score
The minimum scaled score CompTIA requires to earn certification; verify current value officially.
Getting Started: How the Exam Works
Pearson VUE
The testing provider CompTIA uses to deliver exams at test centers and online.
Getting Started: How the Exam Works
Online proctoring
Remote exam delivery method where a proctor monitors the candidate via webcam.
Getting Started: How the Exam Works
Score report
The document given after the exam showing pass/fail status and domain-level performance.
Getting Started: How the Exam Works
Performance-based question
A hands-on simulation task type; CLO-002 does not use this format, unlike some technical CompTIA exams.
Getting Started: How the Exam Works
CLO-002 Exam Overview, Format, and Scoring
Think S.C.O.R.E: Scenario-based, Choice-driven (multiple choice/response), Online or onsite, Rated on a scale, End with a report.
Getting Started: How the Exam Works
CLO-002 Exam Overview, Format, and Scoring
The exam objectives list does not state exact question counts, time limits, or passing scores within the domain content itself — these logistics appear on CompTIA's official exam page, which is updated periodically. On the real exam, focus on business-scenario keywords like 'the company wants to reduce cost' or 'stakeholders need to understand risk' rather than memorizing a number that could change.
Getting Started: How the Exam Works
CLO-002 Exam Overview, Format, and Scoring
Assuming CLO-002 includes hands-on labs or simulations like more technical CompTIA exams
Getting Started: How the Exam Works
CLO-002 Exam Overview, Format, and Scoring
Memorizing outdated time limits or passing scores instead of checking CompTIA's current official page
Getting Started: How the Exam Works
CLO-002 Exam Overview, Format, and Scoring
Getting stuck too long on one scenario question instead of flagging and moving forward
Getting Started: How the Exam Works
Exam objectives document
CompTIA's official PDF listing every domain, weight, and testable topic for an exam version.
Getting Started: How the Exam Works
Domain weight
The percentage of exam questions drawn from a specific content domain.
Getting Started: How the Exam Works
Cloud Business Value
CLO-002 domain covering cost models, ROI, and financial impact of cloud adoption.
Getting Started: How the Exam Works
Governance
Policies and controls an organization uses to manage cloud risk, compliance, and decision rights.
Getting Started: How the Exam Works
Confidence rating
A self-assessed score of how well you know a topic, used to prioritize study time.
Getting Started: How the Exam Works
Migration planning
The process of preparing to move workloads, data, or systems into a cloud environment.
Getting Started: How the Exam Works
Return on investment (ROI)
A financial measure comparing the benefit of an investment to its cost.
Getting Started: How the Exam Works
Study Strategy and Domain Weight Breakdown
Think 'CBBI': Concepts, Business principles, Business value, Implementation — in order of the cloud adoption lifecycle, with Business principles carrying the biggest slice.
Getting Started: How the Exam Works
Study Strategy and Domain Weight Breakdown
The exam objectives document is versioned; always confirm you are studying the current CLO-002 objectives and weight table before memorizing percentages, since CompTIA updates them periodically.
Getting Started: How the Exam Works
Study Strategy and Domain Weight Breakdown
Studying every domain equally instead of weighting time by exam percentage
Getting Started: How the Exam Works
Study Strategy and Domain Weight Breakdown
Memorizing an outdated weight breakdown from an old exam objectives version
Getting Started: How the Exam Works
Study Strategy and Domain Weight Breakdown
Ignoring personal weak areas just because a domain has lower overall weight
Getting Started: How the Exam Works
IaaS (Infrastructure as a Service)
Cloud model providing virtualized compute, storage, and networking; customer manages OS and above.
Cloud Concepts
PaaS (Platform as a Service)
Cloud model providing a managed OS, runtime, and middleware platform for building applications.
Cloud Concepts
SaaS (Software as a Service)
Cloud model delivering a complete, ready-to-use application managed entirely by the provider.
Cloud Concepts
Shared responsibility model
Framework defining which security and management tasks belong to the provider vs. the customer.
Cloud Concepts
Middleware
Software layer connecting applications to operating systems or databases, often managed in PaaS.
Cloud Concepts
Runtime environment
Software needed to execute application code, such as a Java or .NET runtime.
Cloud Concepts
Consumption-based billing
Pricing model where customers pay only for resources actually used, common across all service models.
Cloud Concepts
Service Models: IaaS, PaaS, and SaaS Explained
I Pack Software: IaaS (Infrastructure), PaaS (Platform), SaaS (Software) — each step up the ladder, the provider packs more of the stack for you.
Cloud Concepts
Service Models: IaaS, PaaS, and SaaS Explained
CLO-002 frequently presents a short business scenario and asks you to pick the correct service model based on who needs to manage the OS, platform, or nothing at all. Memorize the responsibility split precisely: IaaS = you manage OS-up; PaaS = you manage app/data only; SaaS = you manage data/users only.
Cloud Concepts
Service Models: IaaS, PaaS, and SaaS Explained
Confusing PaaS and SaaS by assuming PaaS includes a finished application when it only provides a development platform
Cloud Concepts
Service Models: IaaS, PaaS, and SaaS Explained
Assuming the customer has zero responsibility in SaaS — data protection and user access management are still the customer's job
Cloud Concepts
Service Models: IaaS, PaaS, and SaaS Explained
Picking IaaS for a scenario that clearly needs no server management, when SaaS or PaaS is the better fit
Cloud Concepts
Public cloud
Multi-tenant cloud infrastructure owned by a third-party provider and shared across customers.
Cloud Concepts
Private cloud
Cloud infrastructure dedicated to a single organization, on-premises or hosted.
Cloud Concepts
Hybrid cloud
Combination of two or more distinct cloud deployment models connected together.
Cloud Concepts
Community cloud
Cloud infrastructure shared by several organizations with common concerns or requirements.
Cloud Concepts
Multi-tenant
Architecture where multiple customers share the same physical infrastructure, logically isolated.
Cloud Concepts
Cloud bursting
Technique of using public cloud capacity to handle spikes beyond private cloud capacity.
Cloud Concepts
Data sovereignty
Requirement that data be subject to the laws of the country in which it is stored.
Cloud Concepts
Cloud Deployment Models: Public, Private, Hybrid, Community
PPHC: 'Please Provide Hybrid Cars' — Public (shared with all), Private (just for me), Hybrid (a mix of both), Community (shared with friends).
Cloud Concepts
Cloud Deployment Models: Public, Private, Hybrid, Community
CLO-002 exam scenarios often describe a business need (regulation, cost sensitivity, traffic spikes, shared industry group) and ask you to pick the deployment model by name. Memorize the trigger words: 'shared by multiple companies with similar compliance needs' = community; 'dedicated, single organization, high control' = private; 'burst capacity, connect two environments' = hybrid; 'pay-as-you-go, shared, no infrastructure ownership' = public.
Cloud Concepts
Cloud Deployment Models: Public, Private, Hybrid, Community
Confusing hybrid (two connected environments) with multi-cloud (using multiple public providers separately, not necessarily connected)
Cloud Concepts
Cloud Deployment Models: Public, Private, Hybrid, Community
Assuming private cloud must be on-premises; it can be hosted by a third party as long as it's single-tenant
Cloud Concepts
Cloud Deployment Models: Public, Private, Hybrid, Community
Thinking community cloud is the same as public cloud just because multiple organizations use it—community is restricted to a defined group, not open to anyone
Cloud Concepts
Elasticity
Automatic, short-term expansion and contraction of resources to match real-time demand.
Cloud Concepts
Scalability
Planned ability of a system to grow (or shrink) capacity over time.
Cloud Concepts
Vertical scaling
Adding more power (CPU, RAM) to an existing single resource.
Cloud Concepts
Horizontal scaling
Adding more instances or nodes to share workload across resources.
Cloud Concepts
Auto-scaling
Cloud feature that automatically adds or removes resources based on defined triggers.
Cloud Concepts
Load balancer
Component that distributes traffic across multiple horizontally scaled resources.
Cloud Concepts
Elasticity, Scalability & Shared Responsibility
E is for 'Elastic band' — stretches and snaps back with demand. S is for 'Staircase' — built step by step for long-term growth.
Cloud Concepts
Elasticity, Scalability & Shared Responsibility
CLO-002 objectives explicitly test the ability to differentiate elasticity from scalability and to map shared responsibility duties across IaaS, PaaS, and SaaS; expect scenario questions asking who (provider or customer) is responsible for a specific task like patching, physical security, or data encryption.
Cloud Concepts
Elasticity, Scalability & Shared Responsibility
Using 'elasticity' and 'scalability' interchangeably instead of recognizing elasticity is automatic/short-term and scalability is planned/long-term
Cloud Concepts
Elasticity, Scalability & Shared Responsibility
Assuming the cloud provider is responsible for everything, including customer data and access configuration
Cloud Concepts
Elasticity, Scalability & Shared Responsibility
Forgetting that as you move from IaaS to SaaS, the customer's responsibility decreases but never disappears entirely
Cloud Concepts
Availability
Percentage of time a system is accessible and operational, often defined in an SLA.
Cloud Concepts
Redundancy
Duplicating components so a single failure does not interrupt service.
Cloud Concepts
Fault Tolerance
A system's ability to keep operating correctly despite a component failure.
Cloud Concepts
Block Storage
Data split into fixed-size blocks with individual addresses, used like a raw disk.
Cloud Concepts
File Storage
Data organized in a folder hierarchy, accessed over a network like a shared drive.
Cloud Concepts
Object Storage
Data stored as objects with metadata and a unique ID in a flat namespace, accessed via API.
Cloud Concepts
Storage Tier
A pricing/performance category for data based on how frequently it is accessed.
Cloud Concepts
SLA (Service Level Agreement)
A contract defining guaranteed service levels, such as uptime percentage.
Cloud Concepts
Availability, Storage Types & Cloud Storage Tiers
BFO for storage types: Block=raw disk, File=folders, Object=API with metadata. Tiers get colder as access gets rarer: Hot, Cool, Cold, Archive.
Cloud Concepts
Availability, Storage Types & Cloud Storage Tiers
CLO-002 objectives explicitly list block, file, and object storage plus storage tiering (hot/cold) as topics to know for cost and performance trade-off questions; also expect SLA/uptime percentage math and redundancy vs. fault tolerance definitions.
Cloud Concepts
Availability, Storage Types & Cloud Storage Tiers
Confusing high availability (uptime) with backup/disaster recovery (data protection)—they solve different problems
Cloud Concepts
Availability, Storage Types & Cloud Storage Tiers
Choosing archive tier for data that needs frequent or urgent access, causing slow retrieval and unexpected fees
Cloud Concepts
Availability, Storage Types & Cloud Storage Tiers
Assuming file storage scales the same way object storage does for massive unstructured datasets
Cloud Concepts
VPN (Virtual Private Network)
Encrypted tunnel over the public internet connecting users or sites to cloud resources.
Cloud Concepts
Dedicated connection
A private, physical network link directly to a cloud provider, bypassing the public internet.
Cloud Concepts
Latency
The delay before data transfer begins, often caused by physical distance.
Cloud Concepts
Bandwidth
The maximum volume of data a network connection can carry at one time.
Cloud Concepts
CDN (Content Delivery Network)
A distributed set of edge servers that cache content closer to end users.
Cloud Concepts
Edge server / PoP
A server located near users that stores cached copies of content.
Cloud Concepts
Origin server
The primary server where the original, authoritative content is stored.
Cloud Concepts
Cloud Networking Basics & CDN Fundamentals
CDN = 'Closer Delivers Now' — content is delivered faster because it's cached closer to the user.
Cloud Concepts
Cloud Networking Basics & CDN Fundamentals
The exam expects you to match a business scenario (global users, slow load times, need for security) to the right networking solution: VPN, dedicated connection, load balancer, or CDN. Memorize that a CDN's main benefit is reduced latency through geographic caching, not increased storage or compute power.
Cloud Concepts
Cloud Networking Basics & CDN Fundamentals
Assuming a CDN increases server processing power rather than reducing delivery distance/latency.
Cloud Concepts
Cloud Networking Basics & CDN Fundamentals
Confusing latency (delay) with bandwidth (capacity) — they require different fixes.
Cloud Concepts
Cloud Networking Basics & CDN Fundamentals
Choosing a VPN for a mission-critical, high-performance link when a dedicated connection is the better business fit.
Cloud Concepts
Cloud assessment
Structured evaluation of technical, organizational, and financial readiness for cloud adoption
Business Principles of Cloud Environments
As-is state
Documented description of the current environment, processes, and costs
Business Principles of Cloud Environments
To-be state
Desired future environment expressed as measurable business goals
Business Principles of Cloud Environments
Gap analysis
Process of comparing current and desired states to identify missing capabilities
Business Principles of Cloud Environments
Gap register
Document listing each identified gap, its impact, owner, and remediation plan
Business Principles of Cloud Environments
Readiness report
Deliverable scoring an organization's preparedness across people, process, and technology
Business Principles of Cloud Environments
Roadmap
Prioritized plan of action for closing gaps and achieving the to-be state
Business Principles of Cloud Environments
Conducting Cloud Assessments and Gap Analysis
AS-IS to TO-BE, find the GAP in between: Assess, State current, Imagine future, Spot differences.
Business Principles of Cloud Environments
Conducting Cloud Assessments and Gap Analysis
CLO-002 objective 1.3 tests your ability to recognize gap analysis and assessment scenarios; watch for questions describing a company documenting current vs. desired capabilities before a cloud decision — the answer is usually 'gap analysis' or 'cloud assessment,' not 'feasibility study' or 'TCO' (those are later, separate lessons).
Business Principles of Cloud Environments
Conducting Cloud Assessments and Gap Analysis
Treating the assessment as a formality and skipping documentation of the as-is state
Business Principles of Cloud Environments
Conducting Cloud Assessments and Gap Analysis
Writing future-state goals too vaguely to measure ('be more efficient') instead of specific outcomes
Business Principles of Cloud Environments
Conducting Cloud Assessments and Gap Analysis
Confusing gap analysis with a full feasibility study or TCO calculation, which come later and use the gap findings as input
Business Principles of Cloud Environments
Feasibility Study
An upfront evaluation of whether a proposed project is practical across technical, financial, legal, and operational dimensions.
Business Principles of Cloud Environments
Total Cost of Ownership (TCO)
The full cost of acquiring, operating, and retiring a solution over its lifetime.
Business Principles of Cloud Environments
Direct Costs
Clearly attributable expenses like licenses, subscriptions, or hardware.
Business Principles of Cloud Environments
Indirect Costs
Less obvious expenses such as training, downtime, or staff time.
Business Principles of Cloud Environments
Payback Period
The time required for cost savings or benefits to equal the initial investment.
Business Principles of Cloud Environments
Business Case
A document combining cost, benefit, and risk data to justify a proposed initiative.
Business Principles of Cloud Environments
Sensitivity Analysis
Testing how changes in assumptions (usage, pricing) affect the TCO outcome.
Business Principles of Cloud Environments
Feasibility Studies and Total Cost of Ownership
TCO = 'Total Cost Over time' — think Purchase, Operate, Maintain, Retire, all the way to the exit door.
Business Principles of Cloud Environments
Feasibility Studies and Total Cost of Ownership
CLO-002 objectives explicitly list 'feasibility studies' and 'total cost of ownership' under business principles — expect a scenario question asking you to identify which costs belong in TCO (including hidden/indirect costs) or to recognize that feasibility covers more than just cost.
Business Principles of Cloud Environments
Feasibility Studies and Total Cost of Ownership
Calculating TCO using only the sticker price/subscription fee and ignoring migration, training, or downtime costs
Business Principles of Cloud Environments
Feasibility Studies and Total Cost of Ownership
Treating feasibility study as purely a technical check instead of also weighing legal, financial, and operational fit
Business Principles of Cloud Environments
Feasibility Studies and Total Cost of Ownership
Forgetting to include exit/retirement costs when comparing long-term cloud vs on-premises options
Business Principles of Cloud Environments
CapEx (Capital Expenditure)
Upfront spending on long-term assets, capitalized and depreciated over time.
Business Principles of Cloud Environments
OpEx (Operating Expenditure)
Ongoing spending for operations, fully expensed in the period incurred.
Business Principles of Cloud Environments
Depreciation
Accounting method spreading an asset's cost over its useful life.
Business Principles of Cloud Environments
Pay-as-you-go
Pricing model charging only for actual resource consumption, typical of OpEx cloud billing.
Business Principles of Cloud Environments
Balance sheet
Financial statement showing assets, liabilities, and equity at a point in time.
Business Principles of Cloud Environments
Cash flow
Movement of money in and out of a business, a key concern in CapEx vs OpEx decisions.
Business Principles of Cloud Environments
CapEx vs OpEx and Cloud Financial Models
CapEx = 'Cap'ture an asset (own it, depreciate it); OpEx = 'Op'erate month to month (rent it, expense it now).
Business Principles of Cloud Environments
CapEx vs OpEx and Cloud Financial Models
The exam frequently presents a business scenario and asks whether it describes CapEx or OpEx, or asks which cloud benefit relates to the CapEx-to-OpEx shift. Memorize: CapEx = upfront/owned/depreciated; OpEx = recurring/rented/expensed immediately.
Business Principles of Cloud Environments
CapEx vs OpEx and Cloud Financial Models
Assuming cloud OpEx is always cheaper than CapEx long-term without doing a TCO comparison
Business Principles of Cloud Environments
CapEx vs OpEx and Cloud Financial Models
Confusing depreciation timing with cash outflow timing — cash leaves upfront in CapEx even though the expense is spread out
Business Principles of Cloud Environments
CapEx vs OpEx and Cloud Financial Models
Forgetting that OpEx approval is usually faster/easier than CapEx, which is a key business agility argument for cloud
Business Principles of Cloud Environments
Perpetual license
One-time fee granting indefinite use of a specific software version.
Business Principles of Cloud Environments
Subscription license
Recurring fee for continued access to current software or service.
Business Principles of Cloud Environments
Reserved/committed-use pricing
Discounted rate in exchange for a usage or term commitment.
Business Principles of Cloud Environments
Tiered pricing
Rate that changes as usage crosses defined volume thresholds.
Business Principles of Cloud Environments
Spot pricing
Discounted price for unused capacity that can be reclaimed anytime.
Business Principles of Cloud Environments
Consumption-based licensing
Licensing fee tied directly to metered actual usage.
Business Principles of Cloud Environments
Software audit
Vendor review comparing licenses purchased against actual usage.
Business Principles of Cloud Environments
Licensing Models and Cloud Pricing Structures
PURSE: Pay-as-you-go, User-based, Reserved, Subscription, Enterprise — the ways you 'pay' for cloud.
Business Principles of Cloud Environments
Licensing Models and Cloud Pricing Structures
CLO-002 objective 1.3 tests your ability to compare licensing models (perpetual, subscription, user/device-based) and pricing structures (on-demand, tiered, reserved). Expect scenario questions asking which model minimizes cost or risk for a described workload pattern.
Business Principles of Cloud Environments
Licensing Models and Cloud Pricing Structures
Assuming pay-as-you-go is always cheapest; steady workloads often save more with reserved pricing
Business Principles of Cloud Environments
Licensing Models and Cloud Pricing Structures
Forgetting that under-licensing can trigger compliance audits and penalties
Business Principles of Cloud Environments
Licensing Models and Cloud Pricing Structures
Confusing licensing model (right to use software) with pricing structure (how infrastructure/service is billed)
Business Principles of Cloud Environments
Rehost
Migrating an application to the cloud with little or no modification.
Business Principles of Cloud Environments
Refactor
Rebuilding an application to use cloud-native architecture and features.
Business Principles of Cloud Environments
Managed Service Provider (MSP)
Third party that operates and maintains IT/cloud services for a customer.
Business Principles of Cloud Environments
SLA (Service-Level Agreement)
Contract defining guaranteed service levels and remedies for failures.
Business Principles of Cloud Environments
RTO (Recovery Time Objective)
Maximum acceptable time to restore a service after an outage.
Business Principles of Cloud Environments
RPO (Recovery Point Objective)
Maximum acceptable amount of data loss, measured in time.
Business Principles of Cloud Environments
Vendor lock-in
Dependency on a provider's proprietary technology that makes switching costly.
Business Principles of Cloud Environments
Migration Approaches, Managed Services, and SLAs
6 R's: 'Real Rabbits Run, Race, Rest, and Retreat' → Rehost, Replatform, Refactor, Repurchase, Retire, Retain.
Business Principles of Cloud Environments
Migration Approaches, Managed Services, and SLAs
The exam commonly presents a scenario and asks you to pick the correct migration term (rehost vs. refactor vs. repurchase) or to interpret an SLA metric like RTO vs. RPO — memorize that RTO is about time-to-restore and RPO is about data-loss tolerance, they are often swapped as distractors.
Business Principles of Cloud Environments
Migration Approaches, Managed Services, and SLAs
Confusing RTO (time to recover) with RPO (data loss tolerance) — they measure different things
Business Principles of Cloud Environments
Migration Approaches, Managed Services, and SLAs
Assuming rehosting always saves the most money long-term, when refactoring often yields greater cloud-native savings
Business Principles of Cloud Environments
Migration Approaches, Managed Services, and SLAs
Signing an SLA/contract without planning an exit strategy, leading to vendor lock-in later
Business Principles of Cloud Environments
Incremental backup
Backs up only data changed since the last backup of any type.
Management and Technical Operations
Differential backup
Backs up all data changed since the last full backup.
Management and Technical Operations
Snapshot
Point-in-time copy of a volume, disk, or database for quick rollback.
Management and Technical Operations
Pilot light DR
DR strategy keeping only critical core systems running in standby region.
Management and Technical Operations
Data residency
Requirement that data be stored/processed within a specific geographic location.
Management and Technical Operations
Retention policy
Rules defining how long data must be kept before secure deletion.
Management and Technical Operations
Data Management, Backup & Disaster Recovery
RPO = 'Point' in the past you can lose (data), RTO = 'Time' it takes to come back online.
Management and Technical Operations
Data Management, Backup & Disaster Recovery
CLO-002 objectives explicitly test RPO vs RTO definitions and matching them to backup/DR strategy choices—expect scenario questions asking which strategy fits a stated RPO/RTO or budget constraint.
Management and Technical Operations
Data Management, Backup & Disaster Recovery
Confusing RPO (data loss) with RTO (downtime) on scenario questions
Management and Technical Operations
Data Management, Backup & Disaster Recovery
Assuming every workload needs a hot site regardless of cost/criticality
Management and Technical Operations
Data Management, Backup & Disaster Recovery
Forgetting that incremental backups require restoring the full chain in order, increasing restore time
Management and Technical Operations
SLO (Service Level Objective)
Internal target for performance, typically stricter than the SLA.
Management and Technical Operations
SLI (Service Level Indicator)
Actual measured data point used to evaluate SLO/SLA compliance.
Management and Technical Operations
Throughput
Volume of work or requests a system handles in a given time.
Management and Technical Operations
Failover
Automatic switch to a backup system when the primary fails.
Management and Technical Operations
Load balancing
Distributing traffic across multiple servers to avoid overload.
Management and Technical Operations
Ensuring Availability & Performance Monitoring
SLA-SLO-SLI: 'Agreement, Objective, Indicator' — the Agreement is the promise, the Objective is the goal, the Indicator is the proof.
Management and Technical Operations
Ensuring Availability & Performance Monitoring
CLO-002 objectives explicitly list SLA, availability, and performance monitoring under business continuity and operations; expect questions asking you to interpret an uptime percentage or match a scenario to SLA vs SLO vs SLI.
Management and Technical Operations
Ensuring Availability & Performance Monitoring
Confusing SLA (external contract) with SLO (internal goal) — they are not the same thing
Management and Technical Operations
Ensuring Availability & Performance Monitoring
Assuming high availability alone guarantees good performance, ignoring latency and error rates
Management and Technical Operations
Ensuring Availability & Performance Monitoring
Waiting for customer complaints instead of relying on proactive alerting and dashboards
Management and Technical Operations
DevOps
Culture merging development and operations to automate and improve software delivery collaboratively.
Management and Technical Operations
Continuous Integration (CI)
Practice of frequently merging and automatically testing small code changes.
Management and Technical Operations
Continuous Delivery
Automated release-readiness of code with a manual approval before production deployment.
Management and Technical Operations
Continuous Deployment
Fully automated release pipeline that pushes every passing change straight to production.
Management and Technical Operations
Pipeline
Automated sequence of steps that builds, tests, and deploys software.
Management and Technical Operations
Rollback
Reverting a deployment to a previous stable version after a failure.
Management and Technical Operations
Artifact
Packaged, deployable output of a build process, such as a container image.
Management and Technical Operations
Staging Environment
Test environment that closely mirrors production before final release.
Management and Technical Operations
DevOps and CI/CD Pipelines in the Cloud
CI catches bugs Close to commit; CD Carries the Deliverable further — Delivery pauses for a Decision, Deployment just goes.
Management and Technical Operations
DevOps and CI/CD Pipelines in the Cloud
CLO-002 objectives explicitly list DevOps and CI/CD as management/technical operations concepts. Expect scenario questions asking you to distinguish continuous delivery (manual approval) from continuous deployment (fully automatic), and to identify DevOps as breaking down Dev/Ops silos to speed delivery.
Management and Technical Operations
DevOps and CI/CD Pipelines in the Cloud
Confusing continuous delivery (human approves) with continuous deployment (fully automatic, no approval)
Management and Technical Operations
DevOps and CI/CD Pipelines in the Cloud
Thinking DevOps is only a set of tools rather than a cultural and organizational shift
Management and Technical Operations
DevOps and CI/CD Pipelines in the Cloud
Assuming CI/CD eliminates the need for testing, when automated testing is actually a core required stage
Management and Technical Operations
Infrastructure as Code (IaC)
Managing and provisioning infrastructure through machine-readable definition files rather than manual configuration.
Management and Technical Operations
Declarative model
IaC approach describing the desired end state, letting the tool determine execution steps.
Management and Technical Operations
Imperative model
IaC approach specifying exact ordered commands to reach a result.
Management and Technical Operations
Automated provisioning
Using tools and templates to create or remove cloud resources without manual, step-by-step setup.
Management and Technical Operations
Configuration drift
Divergence between environments or between live infrastructure and its defined template over time.
Management and Technical Operations
Self-service portal
Interface letting authorized users request pre-approved infrastructure without filing an IT ticket.
Management and Technical Operations
Version control
System for tracking, reviewing, and reverting changes to code or template files over time.
Management and Technical Operations
Infrastructure as Code and Automated Provisioning
IaC = 'Identical automatically Created' — the whole point is repeatable, identical environments every time.
Management and Technical Operations
Infrastructure as Code and Automated Provisioning
The exam frames IaC/automation as a business enabler: expect scenario questions asking why a company should adopt IaC (speed, consistency, reduced errors, repeatability) rather than asking you to write code. Know the terms 'declarative' vs 'imperative' and 'configuration drift' as vocabulary triggers.
Management and Technical Operations
Infrastructure as Code and Automated Provisioning
Assuming IaC eliminates all human error risk instead of just reducing manual mistakes; bad templates can still cause large-scale failures
Management and Technical Operations
Infrastructure as Code and Automated Provisioning
Confusing IaC (defining infrastructure) with CI/CD (automating software deployment pipelines) even though they often work together
Management and Technical Operations
Infrastructure as Code and Automated Provisioning
Allowing manual console changes to bypass IaC templates, causing configuration drift
Management and Technical Operations
Tagging
Attaching key-value metadata labels to cloud resources for tracking and automation.
Management and Technical Operations
Right-sizing
Adjusting resource capacity to match actual workload demand, avoiding overpaying.
Management and Technical Operations
Chargeback
Billing model that allocates actual cloud costs to the consuming business unit.
Management and Technical Operations
Showback
Reporting cloud costs to business units for awareness without formal billing.
Management and Technical Operations
Quota
A limit on the number or size of resources a team or account can provision.
Management and Technical Operations
Reserved instance
Pricing model offering discounts for committing to use resources long-term.
Management and Technical Operations
Orphaned resource
A cloud resource left running with no clear owner, often wasting money.
Management and Technical Operations
Policy-as-code
Governance rules written and enforced automatically through automated tooling.
Management and Technical Operations
Cost Optimization, Tagging & Resource Governance
TAG IT: Track spend, Allocate to owners, Govern with policy, Improve continuously, Total accountability.
Management and Technical Operations
Cost Optimization, Tagging & Resource Governance
The exam may present a scenario asking you to choose between chargeback and showback, or ask what mechanism (tagging, budgets, quotas) solves a specific cost-visibility or governance problem — match the tool to the described business need.
Management and Technical Operations
Cost Optimization, Tagging & Resource Governance
Assuming cloud is automatically cheaper without active cost management and right-sizing
Management and Technical Operations
Cost Optimization, Tagging & Resource Governance
Skipping tagging standards, leading to unusable, fragmented cost reports
Management and Technical Operations
Cost Optimization, Tagging & Resource Governance
Confusing chargeback (real billing) with showback (informational only) on the exam
Management and Technical Operations
Risk Management Framework
A structured, repeatable process for identifying, assessing, and responding to organizational risks
Governance, Risk, Compliance and Security
Risk Register
A documented list of identified risks, their ratings, and assigned owners
Governance, Risk, Compliance and Security
Risk Avoidance
Eliminating an activity entirely so the associated risk cannot occur
Governance, Risk, Compliance and Security
Risk Mitigation
Applying controls to reduce a risk's likelihood or impact
Governance, Risk, Compliance and Security
Risk Transference
Shifting financial responsibility for a risk to a third party, e.g. insurance
Governance, Risk, Compliance and Security
Risk Acceptance
A deliberate decision to tolerate a risk without further action
Governance, Risk, Compliance and Security
Cloud Policy
A formal organizational document defining acceptable cloud use, vendors, and controls
Governance, Risk, Compliance and Security
Shadow IT
Cloud services adopted by employees without IT department approval or oversight
Governance, Risk, Compliance and Security
Risk Management Frameworks & Cloud Policies
A-M-T-A: 'Any Manager Truly Accepts' risk one of four ways — Avoid, Mitigate, Transfer, Accept.
Governance, Risk, Compliance and Security
Risk Management Frameworks & Cloud Policies
The exam frequently presents a scenario and asks you to pick which risk response (avoid/mitigate/transfer/accept) fits — memorize the four terms precisely and watch for keywords like 'insurance' (transfer), 'stopped using' (avoid), and 'documented but no action' (accept).
Governance, Risk, Compliance and Security
Risk Management Frameworks & Cloud Policies
Confusing mitigation (reducing risk) with transference (shifting financial liability) — they are not the same
Governance, Risk, Compliance and Security
Risk Management Frameworks & Cloud Policies
Treating risk management as a one-time project instead of a continuous monitoring cycle
Governance, Risk, Compliance and Security
Risk Management Frameworks & Cloud Policies
Assuming cloud policies only apply to IT staff, when they must govern all employees to prevent shadow IT
Governance, Risk, Compliance and Security
GDPR
EU regulation protecting personal data and privacy rights of EU residents
Governance, Risk, Compliance and Security
HIPAA
US law protecting privacy and security of health information (PHI)
Governance, Risk, Compliance and Security
PCI DSS
Industry security standard for organizations handling payment card data
Governance, Risk, Compliance and Security
Business Associate Agreement (BAA)
Contract required under HIPAA between a covered entity and a vendor handling PHI
Governance, Risk, Compliance and Security
Data Processing Agreement (DPA)
GDPR-required contract defining how a processor handles personal data
Governance, Risk, Compliance and Security
Data Sovereignty & Compliance: GDPR, HIPAA, PCI DSS
G-H-P: 'Global privacy, Health privacy, Payment protection' — GDPR=Global(EU) privacy, HIPAA=Health privacy, PCI DSS=Payment protection.
Governance, Risk, Compliance and Security
Data Sovereignty & Compliance: GDPR, HIPAA, PCI DSS
The exam expects you to match a scenario to the correct regulation (health data = HIPAA, EU personal data = GDPR, payment card data = PCI DSS) and to know that using a compliant cloud provider does not automatically make the customer compliant — watch for questions testing the shared responsibility concept.
Governance, Risk, Compliance and Security
Data Sovereignty & Compliance: GDPR, HIPAA, PCI DSS
Assuming a cloud provider's certification alone guarantees the customer's application is compliant
Governance, Risk, Compliance and Security
Data Sovereignty & Compliance: GDPR, HIPAA, PCI DSS
Confusing PCI DSS (a contractual industry standard) with a government law
Governance, Risk, Compliance and Security
Data Sovereignty & Compliance: GDPR, HIPAA, PCI DSS
Forgetting that GDPR can apply to non-EU companies serving EU residents
Governance, Risk, Compliance and Security
Exit strategy
Documented plan for transitioning away from a cloud provider.
Governance, Risk, Compliance and Security
Data portability
Ability to move data between providers in a usable format.
Governance, Risk, Compliance and Security
Egress fees
Charges a provider imposes for data leaving its cloud.
Governance, Risk, Compliance and Security
Multi-cloud strategy
Using multiple cloud providers to reduce dependency on one.
Governance, Risk, Compliance and Security
Proprietary API
Vendor-specific interface not portable to other platforms.
Governance, Risk, Compliance and Security
Transition assistance clause
Contract term requiring vendor cooperation during offboarding.
Governance, Risk, Compliance and Security
Avoiding Vendor Lock-In & Exit Strategies
LOCK: Long contracts, Open-standard avoidance, Costly egress, Kept-in data — the four faces of lock-in.
Governance, Risk, Compliance and Security
Avoiding Vendor Lock-In & Exit Strategies
CLO-002 often tests this as a scenario: a company can't leave its provider due to high egress costs or proprietary formats — recognize this as vendor lock-in and select answers favoring open standards, portability clauses, or documented exit strategies.
Governance, Risk, Compliance and Security
Avoiding Vendor Lock-In & Exit Strategies
Assuming lock-in only means contract length, ignoring technical/data dependency
Governance, Risk, Compliance and Security
Avoiding Vendor Lock-In & Exit Strategies
Waiting until a crisis to plan an exit instead of building it into the initial contract
Governance, Risk, Compliance and Security
Avoiding Vendor Lock-In & Exit Strategies
Forgetting to test data export processes, so 'portability' exists only on paper
Governance, Risk, Compliance and Security
Preventive control
A safeguard designed to stop a security incident before it occurs.
Governance, Risk, Compliance and Security
Detective control
A mechanism that identifies and alerts on security incidents in progress or after the fact.
Governance, Risk, Compliance and Security
Corrective control
An action taken to fix damage and restore systems after an incident.
Governance, Risk, Compliance and Security
Encryption
Converting data into unreadable ciphertext accessible only with the correct key.
Governance, Risk, Compliance and Security
IAM (Identity and Access Management)
The framework of policies and tools controlling who can access what resources.
Governance, Risk, Compliance and Security
MFA (Multi-Factor Authentication)
Requiring two or more proofs of identity to authenticate a user.
Governance, Risk, Compliance and Security
RBAC (Role-Based Access Control)
Assigning system permissions based on a user's job role.
Governance, Risk, Compliance and Security
Least privilege
Granting users only the minimum access needed to perform their job.
Governance, Risk, Compliance and Security
Security Controls, Encryption & IAM Basics
P-D-C: 'Police Detect Crime' — Preventive stops it, Detective spots it, Corrective cleans it up.
Governance, Risk, Compliance and Security
Security Controls, Encryption & IAM Basics
CLO-002 objective 2.3 explicitly tests security controls (preventive/detective/corrective), encryption states, and IAM concepts like MFA, SSO, and RBAC. Expect scenario questions asking you to classify a control type or pick the best IAM solution for a described access problem.
Governance, Risk, Compliance and Security
Security Controls, Encryption & IAM Basics
Assuming cloud providers automatically secure identity and access management—IAM configuration is usually the customer's responsibility, not the provider's.
Governance, Risk, Compliance and Security
Security Controls, Encryption & IAM Basics
Confusing authentication (who you are) with authorization (what you can do) as the same step.
Governance, Risk, Compliance and Security
Security Controls, Encryption & IAM Basics
Forgetting that data in use is a separate, harder-to-protect state distinct from at-rest and in-transit encryption.
Governance, Risk, Compliance and Security