CLO-002 Practice Test 14 — 15 Questions

Question 1

A company's cloud administrator needs to reduce the cost of a fleet of Amazon EC2 instances that run a stateless web application. The workload can tolerate interruptions but must be highly available. Which AWS purchasing option should the administrator select to achieve the LOWEST cost while meeting these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spot Instances. Spot Instances are the correct choice because they offer the deepest discounts on AWS compute and are designed for fault-tolerant, stateless workloads. The application can be distributed across multiple Spot pools to maintain availability despite interruptions, meeting both the cost and high-availability requirements without long-term commitments.

Answer

Dedicated Hosts

Answer

Reserved Instances

Answer

On-Demand Instances

Question 2

A financial services company must store monthly compliance reports in Amazon S3 for seven years. The reports are accessed only during the first 30 days after creation and must be retained even if accidentally deleted. Which S3 feature should be enabled to prevent deletion during the retention period?

Accepted Answer

S3 Object Lock in compliance mode. The requirement is immutability for seven years, meaning no one can delete the reports during that period. S3 Object Lock in compliance mode enforces a retention period that cannot be shortened or bypassed, even by the root user. Versioning, lifecycle policies, and replication all offer some data protection but none prevent a determined or accidental deletion, so they cannot satisfy the regulatory retention mandate.

Answer

S3 Lifecycle policies

Answer

S3 Versioning

Answer

S3 Cross-Region Replication

Question 3

A financial services company runs a regulated workload on a public cloud. The compliance team requires that all data stored in object storage be encrypted at rest using keys that the company generates and controls, and that key usage be independently auditable. The cloud provider's default encryption uses provider-managed keys. Which action should the cloud operations team take?

Accepted Answer

Configure customer-managed keys in the cloud provider's key management service and enable key usage logging.. Regulated workloads typically require that the customer, not the provider, own the encryption keys and that key operations be logged. Customer-managed keys in a cloud KMS give the organization full control over generation, rotation, and revocation, while key usage logging provides the independent audit trail. Provider-managed keys, network isolation, and client-side-only encryption do not meet both the control and auditability requirements in this scenario.

Answer

Encrypt the data on-premises before upload and disable all server-side encryption on the bucket.

Answer

Enable provider-managed encryption and request an audit log export from the provider's support team.

Answer

Store the data in a private subnet and rely on network isolation instead of encryption at rest.

Question 4

A financial services company is migrating its on-premises application to a public cloud. The security team must ensure that the cloud provider's employees cannot access the company's data, even though the provider manages the underlying infrastructure. Which cloud security mechanism should be implemented to achieve this?

Accepted Answer

Data encryption at rest with customer-managed keys stored in a hardware security module (HSM).. To prevent cloud provider employees from accessing data, the customer must control the encryption keys. When keys are stored in an HSM managed by the customer and not accessible to the provider, the provider cannot decrypt the data even if they have physical or logical access to the storage. This approach, often called customer-managed keys or bring your own key (BYOK), is essential for data confidentiality from the provider.

Answer

Multi-factor authentication (MFA) for all cloud management console logins.

Answer

Security groups and network ACLs to restrict inbound traffic to the application.

Answer

Virtual private network (VPN) connections between the on-premises data center and the cloud.

Question 5

A startup is deploying a new web application on a public cloud. The team wants to minimize the attack surface of the web tier by allowing only HTTP and HTTPS traffic from the internet while blocking all other inbound ports. Which cloud construct should the team configure to enforce this network-level restriction?

Accepted Answer

A security group attached to the web servers that permits inbound TCP 80 and 443 from 0.0.0.0/0 and denies all other inbound traffic by default.. To restrict inbound traffic to only HTTP and HTTPS at the network level, a stateful security group is the appropriate construct. Its default-deny inbound posture means only explicitly allowed ports are reachable, and return traffic for established connections is automatically permitted. This provides centralized, cloud-native enforcement without relying on host-based firewalls.

Answer

A network ACL that allows all inbound traffic and relies on the operating system firewall for port filtering.

Answer

A route table entry that directs all inbound traffic to a NAT gateway for inspection.

Answer

An internet gateway with a policy that blocks non-web ports.

Question 6

A financial services company is moving its transaction processing system to a public cloud. The compliance team requires that the cloud provider's security controls are independently validated, and that the company can continuously monitor the compliance status of its cloud resources. Which two actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Implement a cloud security posture management (CSPM) tool to continuously assess resource configurations against compliance benchmarks.. The correct actions are obtaining a SOC 2 Type II report and implementing a CSPM tool. The SOC 2 report provides independent validation of the cloud provider's security controls, satisfying the compliance team's requirement. A CSPM tool continuously monitors the company's cloud resources for compliance with benchmarks, ensuring ongoing adherence. Together, they address both independent validation and continuous monitoring.

Answer

Use the cloud provider's shared responsibility model to document that the provider is responsible for all security controls.

Answer

Enable multi-factor authentication (MFA) for all administrative accounts.

Answer

Conduct a penetration test against the cloud provider's infrastructure without prior authorization.

Question 7

A cloud operations team needs to ensure that a critical application running on Google Cloud can automatically recover from a zone failure without manual intervention. The application is deployed on Compute Engine instances managed by an instance group. Which feature should the team configure?

Accepted Answer

Managed instance group with health checks and autohealing. A regional managed instance group with health checks and autohealing is the correct configuration because it automatically detects unhealthy instances and recreates them, including in a different zone if one becomes unavailable. This provides the required automatic recovery from zone failure without manual intervention.

Answer

Managed instance group with autoscaling

Answer

Unmanaged instance group

Answer

Sole-tenant nodes

Question 8

A financial services firm is preparing to move a regulated workload to a public cloud. The compliance officer requires evidence that the provider's controls are independently assessed and that the firm can retrieve its data in a usable format if it leaves the provider. Which TWO provider artifacts should the firm obtain? (Choose two.)

Accepted Answer

Third-party audit reports and compliance certifications such as SOC 2 or ISO 27001. Independent audit reports and certifications provide the third-party assurance the compliance officer demands, showing that provider controls meet recognized standards. A documented data portability and export format description proves the firm can retrieve its information in a usable form if it exits. Together they address both the assurance and the exit-strategy concerns for a regulated workload.

Answer

The provider's internal employee training completion statistics

Answer

A list of the provider's other customers in the same industry vertical

Answer

The provider's internal marketing brochure describing the breadth of its global regions

Question 9

A DevOps team manages a Google Cloud environment with many projects. They need a centralized view of all audit logs and the ability to create log-based metrics that alert on suspicious IAM changes across all projects. Which Google Cloud service should they use?

Accepted Answer

Cloud Logging. Centralizing audit logs from multiple projects and building log-based metrics points to Cloud Logging. It can route logs from all projects into a single log bucket, and its log-based metrics can be used with Cloud Monitoring for alerts. Cloud Monitoring, Cloud Asset Inventory, and Security Command Center serve different purposes and do not provide the combined log aggregation and metric creation capability required.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring

Answer

Security Command Center

Question 10

A multinational corporation must ensure that its cloud-based financial application complies with GDPR. The application processes personal data of EU citizens. The company wants to verify that the cloud provider's data processing agreement (DPA) includes the required GDPR clauses. Which document should the company request from the cloud provider to confirm compliance with GDPR data processing requirements?

Accepted Answer

The cloud provider's GDPR Data Processing Addendum (DPA).. GDPR requires a data processing agreement (DPA) between the data controller and processor. The cloud provider's GDPR DPA contains the necessary clauses, such as subject matter, duration, nature and purpose of processing, and obligations. It is the definitive document to confirm GDPR compliance. Other security certifications like SOC 2, ISO 27001, or PCI DSS do not cover GDPR-specific contractual requirements.

Answer

The cloud provider's ISO/IEC 27001 certificate.

Answer

The cloud provider's SOC 2 Type II report.

Answer

The cloud provider's PCI DSS Attestation of Compliance (AOC).

Question 11

A cloud engineer needs to deploy a set of resources on Microsoft Azure in a repeatable and consistent manner. The engineer wants to define the infrastructure as code and be able to deploy it multiple times without manual intervention. Which Azure service should the engineer use?

Accepted Answer

Azure Resource Manager (ARM) templates. ARM templates are the correct choice because they provide a declarative, code-based method to define and deploy Azure infrastructure consistently and repeatedly. They are the native infrastructure-as-code solution in Azure and can be version-controlled and automated, meeting the requirement for repeatable deployments without manual intervention.

Answer

Azure Blueprints

Answer

Azure Advisor

Answer

Azure Policy

Question 12

A cloud operations team is preparing to migrate a legacy three-tier application to a public cloud. The team must ensure the new environment supports operational visibility and controlled change management after cutover. Which two actions should the team take? (Choose two.)

Accepted Answer

Define infrastructure as code templates so environment changes are versioned and repeatable.. Operational visibility and controlled change management after migration depend on two foundations: centralized logging and metrics so the team can see what all tiers are doing, and infrastructure as code so changes are versioned, reviewed, and repeatable. Disabling auto-scaling, granting broad admin rights, and consolidating databases reduce control and resilience rather than supporting the migration goals.

Answer

Disable all auto-scaling groups so instance counts remain fixed and predictable.

Answer

Grant every engineer full administrator rights to speed up troubleshooting.

Answer

Migrate all databases to a single shared instance to simplify the architecture.

Question 13

A multinational corporation must comply with GDPR, which requires that personal data of EU citizens not be transferred outside the EU without adequate safeguards. The company is using a cloud provider with data centers worldwide. Which cloud feature should they use to ensure compliance?

Accepted Answer

Region-specific data storage with geo-fencing policies. GDPR's data residency requirement means personal data of EU citizens must stay within the EU unless adequate safeguards are in place. Region-specific storage with geo-fencing ensures data remains in the chosen region. CDNs, MFA, and encryption do not address data location. Therefore, region-specific storage with geo-fencing is the correct feature.

Answer

Content delivery network (CDN) with global edge locations

Answer

Encryption of data at rest with customer-managed keys

Answer

Multi-factor authentication (MFA) for all users

Question 14

A company is migrating its customer relationship management (CRM) system to the cloud. The CIO wants to ensure that the cloud provider's security controls meet the company's compliance requirements. Which document should the company request from the cloud provider to verify compliance?

Accepted Answer

Compliance certification (e.g., SOC 2, ISO 27001). To verify that a cloud provider's security controls meet compliance requirements, the company should request independent compliance certifications such as SOC 2 or ISO 27001. These reports provide audited evidence of the provider's security posture. SLAs, AUPs, and MSAs are important contractual documents but do not offer the necessary compliance validation.

Answer

Service level agreement (SLA)

Answer

Master service agreement (MSA)

Answer

Acceptable use policy (AUP)

Question 15

A company runs a production workload across two public cloud providers. The security team requires that a single set of identity policies govern access to resources in both environments, and that a terminated employee lose access everywhere within minutes. Which approach should the company adopt?

Accepted Answer

Federate both cloud providers to a central identity provider using SAML or OpenID Connect.. Centralizing identity in one provider and federating both clouds to it using SAML or OpenID Connect gives a single source of truth for authentication and group membership. Disabling the central account immediately prevents new token issuance in both clouds, satisfying rapid revocation. Separate local accounts, shared credentials, and distributed long-lived keys all fragment control and delay revocation.

Answer

Issue long-lived API keys in each provider and distribute them to employees as needed.

Answer

Create separate local user accounts in each cloud provider and synchronize passwords manually.

Answer

Share a single administrator account between the two providers to reduce the number of credentials.