CLO-002 Practice Test 13 — 15 Questions

Question 1

You are implementing a disaster recovery strategy. You need to ensure that database backups are stored in a different geographic region than the primary production database. What is this concept known as in cloud management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Geo-redundancy. Geo-redundancy refers to the practice of replicating data and services across multiple geographic regions to ensure availability and disaster recovery. In the context of database backups, storing them in a different geographic region than the primary production database is a form of geo-redundancy, which protects against regional failures and meets compliance requirements for data durability.

Answer

Horizontal scaling

Answer

Availability Zone failover

Answer

Local data caching

Question 2

A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?

Accepted Answer

SOC 2 / ISO Certification Report. A SOC 2 report or ISO/IEC 27001 certification report is the independent third-party attestation that a cloud provider's controls meet recognized security and compliance standards. Auditors rely on these documents — produced by an independent CPA firm or accredited certification body — to verify compliance without auditing the provider themselves. This is exactly what a firm should obtain to demonstrate the provider's ISO 27001 compliance during a third-party audit.

Answer

Annual Financial Report

Answer

Network Infrastructure Diagram

Answer

Service Level Agreement

Question 3

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Accepted Answer

Performing periodic penetration tests. Performing periodic penetration tests (A) is correct because it proactively identifies exploitable vulnerabilities and misconfigurations in cloud workloads, APIs, and identity controls before attackers can abuse them, directly reducing the likelihood and impact of cloud-related breaches. Implementing automated compliance monitoring (D) is correct because continuous, policy-as-code evaluation of cloud resources against standards such as CIS Benchmarks, ISO 27001, PCI DSS, or HIPAA detects drift and non-compliant configurations in near real time, enabling rapid remediation. Requiring multi-factor authentication for all users (E) is correct because MFA blocks credential-based attacks such as phishing, password spraying, and credential stuffing, which are among the leading initial access vectors in cloud environments, and it strengthens identity as the primary security perimeter. Reducing the number of cloud regions used (B) is not a valid mitigation because it does not address security risk and can actually increase blast radius and reduce resilience, since multi-region architectures improve availability and disaster recovery. Using only one cloud provider (C) is not a valid mitigation because single-provider dependence increases vendor lock-in, concentration risk, and single points of failure, whereas a multi-cloud or hybrid strategy can improve resilience and negotiating leverage.

Answer

Reducing the number of cloud regions used

Answer

Using only one cloud provider

Question 4

Which THREE factors can lead to 'Cloud Sprawl' (unmanaged resource accumulation)?

Accepted Answer

Shadow IT usage. Cloud sprawl occurs when unmanaged resources accumulate, and option A (Shadow IT usage) is correct because business units provisioning cloud services outside IT governance create untracked instances, storage, and accounts that no one centrally manages or monitors. Option D (Lack of centralized resource tagging) is correct because without a consistent tagging policy (e.g., mandatory tags for owner, cost center, environment, and expiration), organizations cannot inventory, attribute costs, or identify orphaned resources, so unused assets silently pile up. Option E (Failure to decommission development environments) is correct because dev/test sandboxes, proof-of-concept VMs, and temporary databases are frequently left running after a project ends, directly producing idle, billable resource accumulation. Option B (High internet speed) is not a cause of sprawl; faster connectivity may ease provisioning but does not itself create unmanaged resources. Option C (Over-hiring of IT personnel) is unrelated, since headcount growth does not inherently generate ungoverned cloud resources and could even improve oversight.

Answer

High internet speed

Answer

Over-hiring of IT personnel

Question 5

A multinational corporation is deploying a multi-cloud strategy with workloads on two different cloud providers. The security team must ensure that identity and access management (IAM) policies are consistently enforced across both environments, and that a single compromise of one cloud's credentials does not grant access to the other. Which solution BEST addresses these requirements?

Accepted Answer

Implement a federated identity solution using SAML 2.0 or OpenID Connect to centralize authentication and apply consistent authorization policies across both clouds.. Federated identity using SAML or OIDC centralizes authentication and enables consistent authorization across multiple clouds. It ensures that a compromise in one cloud does not automatically grant access to the other because each cloud trusts the central IdP independently. Separate or shared credentials increase risk, while manual synchronization is unreliable and does not provide real-time enforcement.

Answer

Rely on each cloud provider's native IAM and manually synchronize policies on a periodic basis.

Answer

Use a shared service account with long-lived API keys that have permissions in both clouds, stored in a central secrets manager.

Answer

Create separate IAM users in each cloud with identical usernames and passwords, and enforce a strong password policy.

Question 6

What is the primary benefit of using a Managed Service (like RDS) over a self-managed database on a virtual machine?

Accepted Answer

Reduced operational overhead. Managed services handle operational tasks like patching, backups, and maintenance, reducing the operational burden on the user.

Answer

Access to underlying OS

Answer

Lower cost

Answer

Unlimited performance

Question 7

Which TWO factors should be considered when conducting a cost-benefit analysis for cloud adoption?

Accepted Answer

Initial migration and transition labor costs. Option A (Initial migration and transition labor costs) is correct because a cloud cost-benefit analysis must capture one-time costs such as staff time, consulting, training, and application refactoring required to move workloads to the cloud. Option E (Potential long-term reduction in physical maintenance expenses) is correct because the ongoing savings from eliminating or reducing on-premises hardware, data center power/cooling, and related maintenance are a core benefit that offsets migration costs. Option B (Number of employees) is not a direct cost or benefit factor; headcount may influence scale but is not itself a financial input to the analysis. Option C (Office furniture costs) is unrelated to cloud adoption economics, and Option D (Cloud provider color scheme) is a cosmetic branding detail with no bearing on cost-benefit calculations.

Answer

Number of employees in the company

Answer

Office furniture costs

Answer

Cloud provider color scheme

Question 8

What is the primary benefit of 'Elasticity' for an e-commerce company during a major sale?

Accepted Answer

Dynamically scaling resources to meet demand. Elasticity is the cloud capability to automatically provision and de-provision resources in response to real-time demand. During a major e-commerce sale, traffic can spike by orders of magnitude within minutes; elasticity lets the platform add compute, memory, and storage capacity on demand and release it afterward, so the site stays responsive without over-provisioning for peak load year-round. This directly matches option B.

Answer

Reducing the number of required database admins

Answer

Ensuring the website never experiences any latency

Answer

Decreasing the need for network security

Question 9

An application requires a database that can handle unstructured data and scale horizontally. Which database type is best?

Accepted Answer

NoSQL Database. NoSQL databases are designed to handle unstructured or semi-structured data (e.g., JSON, key-value, graph) and are built for horizontal scaling across distributed clusters. They sacrifice strict ACID transactions and fixed schemas for flexibility and partition tolerance, making them ideal for large-scale, rapidly evolving applications. In contrast, relational databases require predefined schemas and typically scale vertically, while data warehouses are optimized for analytical queries on structured data, and in-memory databases prioritize speed but not necessarily horizontal scalability for unstructured data.

Answer

Data Warehouse

Answer

In-memory Database

Answer

Relational Database

Question 10

A healthcare company must run a patient-portal workload that processes protected health information. The compliance team requires that the cloud provider supply independent audit reports and a contractual commitment for data handling, while the company retains full control of the guest operating system and application stack. Which cloud service model BEST satisfies these requirements?

Accepted Answer

Infrastructure as a Service (IaaS). The requirement to retain control of the guest operating system and application stack points to Infrastructure as a Service, where the customer manages everything above the hypervisor. The provider still furnishes independent audit reports and signs contractual data-handling commitments covering the physical and virtualization layers, satisfying the compliance team without surrendering guest-level administration.

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 11

A retail company is evaluating a move to cloud-based analytics. The CFO asks the cloud team to quantify the benefit of avoiding a large upfront data-center expansion. Which financial metric best captures this specific advantage?

Accepted Answer

Capital expenditure avoidance. Cloud adoption commonly replaces large upfront capital investments with variable operating expenses. The CFO's request focuses on the advantage of not building out or expanding a data center, which is a capital expenditure. Capital expenditure avoidance is the metric that isolates that benefit. ROI, TCO, and operational expenditure reduction are broader or different measures and do not specifically quantify the avoided upfront capital outlay described in the scenario.

Answer

Operational expenditure reduction

Answer

Return on investment (ROI)

Answer

Total cost of ownership (TCO)

Question 12

A financial services company is designing a cloud architecture that must remain operational even if an entire cloud provider region becomes unavailable. The company wants to avoid a single point of failure and is willing to accept some additional cost and complexity. Which design approach BEST meets this requirement?

Accepted Answer

Deploy resources across multiple regions and use global load balancing or DNS failover.. Deploying across multiple regions with global load balancing or DNS failover is the only option that directly protects against a complete region outage. It ensures that another region can take over traffic and continue serving users. The other options either rely on a single region, a single zone, or a caching layer that cannot replace the full application stack during a regional disaster.

Answer

Deploy all resources in a single availability zone within one region and rely on the provider's SLA.

Answer

Use a content delivery network (CDN) to cache all application responses at edge locations.

Answer

Deploy resources across multiple availability zones within a single region.

Question 13

A financial services company is evaluating a public cloud provider. The company must ensure that its data is encrypted at rest and in transit, and that only authorized employees can access it. The provider offers encryption and identity management services. Under the shared responsibility model, which statement is correct?

Accepted Answer

The customer is responsible for configuring encryption and managing access controls for their data.. The customer is responsible for security in the cloud, including encryption and access management. The provider secures the underlying infrastructure, but the customer must configure encryption, manage keys, and define IAM policies. This division ensures the financial firm meets its compliance obligations for data protection and authorized access.

Answer

The cloud provider is responsible for managing user identities and access permissions.

Answer

The customer is responsible for the physical security of the data center.

Answer

The cloud provider is responsible for encrypting all customer data at rest and in transit.

Question 14

A media company is comparing total cost of ownership for running a video transcoding workload on-premises versus in the public cloud. The finance team wants to identify costs that are characteristic of the cloud consumption model but are often overlooked. Which TWO factors should the team include? (Choose two.)

Accepted Answer

Per-second or per-minute metered compute charges during transcoding jobs. Cloud consumption economics center on variable, usage-based charges and network transfer fees. Metered compute reflects paying only for active transcoding time, while egress charges capture the cost of delivering finished video to viewers. Together they represent the two cloud-specific cost drivers finance must model, unlike depreciation, idle capacity, and facility power, which belong to the on-premises capital model.

Answer

Idle capacity reserved for projected peak transcoding demand

Answer

Depreciation of the physical servers that host the transcoding farm

Answer

Facility power and cooling costs for the company's own data center

Question 15

A hospital is migrating patient records to a cloud environment. The compliance officer insists that the hospital retain control over encryption keys so that the cloud provider cannot read the data at rest. Which capability should the hospital require from the provider?

Accepted Answer

Customer-managed encryption keys held in the hospital's own key management system. The compliance officer's requirement is cryptographic control: the provider must be unable to read records at rest. Customer-managed keys, held in the hospital's own key management system or hardware security module, achieve this because the provider never possesses the key material needed to decrypt. Provider-managed keys, TLS, and MFA address other risks and leave decryption capability with the provider.

Answer

Transport Layer Security enforced for all connections to the storage service

Answer

Provider-managed encryption with keys stored in the provider's key vault

Answer

Multi-factor authentication enforced for all hospital administrator accounts