CLO-002 Practice Test 10 — 10 Questions

Question 1

Your team needs to share a large, sensitive file with an external partner. What is the secure way to share this file in the cloud?

Accepted Answer

Use a pre-signed URL. Pre-signed URLs or temporary access links allow secure, limited-time access to specific objects in cloud storage.

Answer

Give the partner your root credentials

Answer

Email the file as an attachment

Answer

Make the bucket public

Question 2

A financial services company is using a public cloud to host a web application. The security team wants to ensure that all data stored in the cloud is encrypted at rest using keys that the company controls and can rotate independently. Which cloud service or feature should they implement to meet this requirement?

Accepted Answer

Customer-managed keys (CMK) using a cloud key management service (KMS).. The requirement is to encrypt data at rest with keys the customer controls and can rotate independently. Customer-managed keys in a cloud KMS allow the customer to generate, manage, and rotate keys, while the provider secures the key management infrastructure. Provider-managed keys do not give the customer control. Client-side encryption with on-premises keys may not integrate with cloud services for at-rest encryption. SSL/TLS is for data in transit.

Answer

Client-side encryption with keys stored on-premises.

Answer

Provider-managed encryption keys with automatic rotation.

Answer

SSL/TLS certificates for data in transit.

Question 3

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

Accepted Answer

Faster time-to-market for new features. Agility in cloud adoption refers to the ability to rapidly provision resources, iterate on features, and shorten release cycles — directly enabling faster time-to-market for new features. It is about speed and responsiveness, not cost or uptime. This is the business driver most aligned with agility.

Answer

Increased server uptime

Answer

Reduced capital expenditure

Answer

Improved compliance reporting

Question 4

An organization is migrating to a cloud environment and needs to maintain strict control over its encryption keys. Which service should they utilize?

Accepted Answer

Key Management Service (KMS). A Key Management Service (KMS) is purpose-built to create, store, rotate, and control access to cryptographic keys, giving the organization strict control over key lifecycle and usage. It provides centralized key management with audit logging and integration with cloud services for encryption at rest.

Answer

Identity and Access Management (IAM)

Answer

Security Groups

Answer

Public Key Infrastructure (PKI)

Question 5

Which TWO of the following are benefits of using Infrastructure as Code (IaC) for compliance?

Accepted Answer

Ensuring consistent and repeatable deployments. Option C is correct because IaC defines infrastructure in versioned templates and declarative configuration files, so every deployment applies the same parameters and resource definitions, eliminating configuration drift and making compliance-relevant builds consistent and repeatable. Option E is correct because IaC templates and state files are typically stored in version control systems such as Git, where each commit, pull request, and approval creates an immutable, timestamped record of who changed which configuration and when, giving auditors a clear audit trail. The unmarked options do not belong: A is wrong because IaC automates provisioning and configuration, not physical hardware repair; B is wrong because insider-threat detection is performed by security monitoring tools such as SIEM or UEBA, not by IaC; and D is wrong because IaC does not inherently reduce the number of cloud regions, which is an architectural and cost decision unrelated to compliance benefits.

Answer

Increasing the speed of physical repairs

Answer

Automatically detecting insider threats

Answer

Reducing the number of cloud regions

Question 6

A company is assessing the business value of migrating its legacy order-processing system to the cloud. The system is critical and has frequent code changes. Which cloud characteristic directly supports faster deployment of new features?

Accepted Answer

Rapid provisioning. Rapid provisioning is a cloud characteristic that enables developers to quickly create and tear down environments, which shortens development and testing cycles. This directly supports faster deployment of new features for a system with frequent code changes. High availability, elasticity, and measured service are valuable but do not primarily address development speed.

Answer

Measured service

Answer

Elasticity

Answer

High availability

Question 7

A company is evaluating the financial implications of moving from on-premises infrastructure to a public cloud. The CFO wants to understand which cost factors are typically eliminated or reduced when using a public cloud. (Choose two.)

Accepted Answer

Upfront capital expenditure for physical servers. Moving to the public cloud eliminates the need for upfront capital expenditure on physical servers and removes the direct operational costs of data center power and cooling. These are shifted to the provider and become part of the service fee. Application licensing, IT staff salaries, and data egress costs are not eliminated; in fact, data egress can be a new expense. The CFO should focus on the CapEx and facility OpEx reductions.

Answer

Salaries for IT staff who manage the cloud infrastructure

Answer

Costs for application licensing

Answer

Costs associated with data egress

Question 8

You have a microservices architecture. How can you effectively manage the deployment of configuration changes across hundreds of containers without manual intervention?

Accepted Answer

Centralized configuration management. Centralized configuration management (e.g., Consul, etcd, AWS AppConfig, Spring Cloud Config, or Kubernetes ConfigMaps/Secrets) lets you define configuration in one authoritative place and push or inject it into hundreds of containers automatically. Containers can watch for changes and reload without manual SSH or redeployment, which is essential for consistency and auditability at scale. This eliminates configuration drift and human error across the fleet.

Answer

Rebooting the instances

Answer

Manual SSH access

Answer

Hard-coding values

Question 9

Which of the following is an example of 'Infrastructure as Code'?

Accepted Answer

Using Terraform files. Terraform files are declarative configuration code that defines infrastructure resources (VMs, networks, storage) in a version-controlled, repeatable format — the textbook definition of Infrastructure as Code. Terraform's HCL files are executed by the Terraform engine to provision and manage cloud resources idempotently, enabling automation, peer review, and reproducibility.

Answer

Manual console configuration

Answer

Cloud provider dashboard

Answer

Automatic scaling alerts

Question 10

Which metric should you monitor to determine if your application's load balancer is struggling with concurrent user connections?

Accepted Answer

Active connection count. The active connection count directly measures the number of concurrent connections currently handled by the load balancer. This metric reflects the load balancer's capacity to manage simultaneous user sessions, and a high or growing count indicates it may be struggling to keep up. Other metrics like disk I/O, database memory, or log errors are not directly tied to the load balancer's connection handling.

Answer

Disk I/O throughput

Answer

Memory usage of the DB

Answer

Log write errors