CLO-002 Flashcards — Free CompTIA Cloud Essentials+ (CLO-002) (CLO-002) Study Cards

DynamoDB table

DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Site-to-Site VPN

A Site-to-Site VPN creates an encrypted IPsec tunnel between the on-premises gateway and the cloud provider's virtual private gateway, ensuring all data in transit is encrypted. This directly satisfies the requirement for encryption of data moving between the data center and the cloud. It is the standard mechanism when encryption over a public network path is required.

Data egress fees

Data egress fees are the classic hidden cost in cloud TCO analyses because organizations focus on compute, storage, and licensing while forgetting that moving data OUT of the cloud provider's network is metered and billed. In a database migration scenario, ongoing replication, backups to on-premises, or application traffic leaving Azure all incur egress charges that can accumulate significantly over time. Unlike power, cooling, or hardware maintenance — which are eliminated by moving to cloud — egress is a NEW cost that did not exist on-premises, making it the most commonly overlooked line item.

Multi-Region deployment

A multi-region deployment places resources in geographically distinct regions (e.g., US-East and EU-West), ensuring that a regional disaster affecting one region does not take down the entire application. This is the only option that provides true geographic separation at the region level, which is what is required to survive a regional outage. Availability Zones are isolated datacenters within a single region, so they do not protect against region-wide failures.

Managing the guest operating system, applications, and data

Under the IaaS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes the guest operating system, applications, and data. For a healthcare company, this means protecting ePHI through encryption, access management, and compliance controls. The cloud provider secures the physical infrastructure and hypervisor, but the company must ensure its own configurations and data are HIPAA-compliant.

Client-side encryption

Client-side encryption is correct because data is encrypted by the organization before it ever leaves its premises, meaning the cloud provider receives only ciphertext and never has access to plaintext or keys. This satisfies the requirement that all data be encrypted 'before being sent to the cloud.' Server-side encryption and TDE both encrypt data after it reaches the provider's infrastructure, and TLS protects data only in transit, not at rest in the cloud.

AWS Key Management Service (KMS)

AWS KMS is the managed service for creating and controlling customer-managed keys (CMKs) used to encrypt data at rest, and it integrates with AWS CloudTrail to produce audit logs of every key usage. KMS supports key policies, grants, and automatic rotation, satisfying both the customer-managed key requirement and the compliance audit requirement. This is why C is correct.

Physical hardware and infrastructure security

Under the Shared Responsibility Model, the cloud provider is always responsible for the security of the cloud — the physical facilities, hardware, network infrastructure, and hypervisor layer. Customers are responsible for security in the cloud, which includes their data, IAM configuration, and guest OS patching (for IaaS). Physical hardware and infrastructure security cannot be delegated to the customer, so it remains the provider's domain.

Enable MFA on the root account

Enabling MFA is the most critical first step to secure any account access.

Direct Connect

AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Reduced administrative overhead

SaaS shifts operational responsibility for the application, middleware, OS, and infrastructure to the provider. The customer only manages data and user access, so the primary business advantage is reduced administrative overhead—no patching, scaling, or server maintenance by internal IT. Lower initial cost can be true but is not the defining advantage; reduced admin overhead is the core SaaS value proposition.

Use a public cloud region in the required country and implement customer-managed encryption keys using a key management service.

The company must satisfy two distinct requirements: data residency and direct control over encryption keys. Choosing a region within the required country addresses residency, and using customer-managed keys in a key management service provides direct key control. Options that use provider-managed or default encryption fail the key control requirement, and options that use an arbitrary region fail data residency.

AWS Cost Explorer

AWS Cost Explorer is the dedicated cost management dashboard that visualizes historical and current spend, forecasts future costs, and surfaces budget alerts and anomaly detections. It directly answers the governance question of 'what are we spending and are we within budget?' by aggregating billing data across services, accounts, and tags. Budgets configured in AWS Budgets appear as alerts tied to the same cost data Cost Explorer presents.

S3 default encryption with SSE-KMS using a customer managed key, key rotation enabled, and AWS CloudTrail logging of KMS API calls.

The requirements map to customer-controlled encryption keys, scheduled rotation, and auditable key usage. SSE-KMS with a customer managed key provides customer control over key policy and lifecycle, automatic rotation rotates key material on a schedule, and CloudTrail records KMS API activity for audit. AWS managed keys and SSE-S3 remove customer control, while Object Lock and access logging address different controls.

Enforce a tagging policy that requires specific tags on all resources at creation time.

Accurate cost allocation depends on resources being labeled with consistent metadata such as cost center and owner. Enforcing a tagging policy at resource creation ensures every resource is attributable, which directly enables correct invoice allocation. Security controls like MFA or a CASB, and monitoring tools like budget alerts, do not provide the per-resource attribution the business requires.

Software as a Service (SaaS)

The scenario describes a fully managed application accessed via a browser, which is the definition of Software as a Service. In SaaS, the provider handles everything from infrastructure to application updates, and the customer simply uses the software. This contrasts with IaaS, PaaS, and FaaS, where the customer retains varying degrees of management responsibility.

Implement role-based access control with separate roles for workload administration and audit log management, and enforce least privilege.

Separation of duties is achieved by dividing permissions across distinct roles so that no single identity can both change production workloads and remove audit logs. Role-based access control with least privilege enforces this technically and supports accountability, whereas policies, shared credentials, and MFA address different risks and do not prevent one administrator from holding both capabilities.

Securing the physical infrastructure, including data centers, hardware, and network facilities.

Under the shared responsibility model, the cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and network infrastructure. The customer is responsible for security in the cloud, such as configuring security groups, managing access, and encrypting data. The correct answer is the one that describes physical infrastructure security.

Service Level Agreement (SLA)

A Service Level Agreement (SLA) is the contractual document in which a cloud provider commits to specific uptime, availability, and performance metrics, along with remedies (service credits) if those commitments are missed. It is the authoritative source for assessing the impact of a provider outage on the customer's operations.

Data residency policies that restrict resource deployment to approved regions.

Data residency requirements are met by implementing governance policies that restrict where resources can be deployed. By defining approved regions and enforcing those restrictions through policy, the company ensures that data remains within the required geographic boundaries. Other options either do not address residency or actively conflict with it by distributing data globally.

Scale out the application tier using an Auto Scaling group policy based on CPU utilization.

High sustained CPU on the application tier combined with growing queue depth indicates the tier lacks compute capacity, so horizontal scaling is the fastest way to add capacity without downtime. A target tracking Auto Scaling policy on CPU utilization adds instances automatically during peaks and removes them afterward. The database and web tiers show healthy metrics, so changes there would not address the actual bottleneck.

Spot instances can be reclaimed by the provider

Spot Instances use spare AWS capacity and can be interrupted with a two-minute warning whenever AWS needs the capacity back, making them unsuitable for workloads that cannot tolerate interruption. Reserved Instances, by contrast, are a billing commitment (1 or 3 years) that provides a capacity discount with no interruption risk. The defining difference is therefore that Spot instances can be reclaimed by the provider.