CLO-002 Practice Test 18 — 15 Questions

Question 1

A multinational corporation must ensure that customer data stored in its cloud environment remains within the borders of the country where it was collected, in accordance with local data sovereignty laws. Which cloud governance control should the corporation implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Select cloud regions and availability zones located within the required country and restrict replication to those regions.. Data sovereignty is about the legal jurisdiction where data resides. The enforceable control is to select cloud regions within the required country and prevent replication or failover to regions outside it. Encryption, traffic inspection, and content delivery do not constrain the physical location of stored data and therefore cannot satisfy the legal requirement on their own.

Answer

Configure a content delivery network to cache data at edge locations worldwide.

Answer

Enable customer-managed encryption keys stored in a hardware security module.

Answer

Implement a cloud access security broker to inspect all data flows.

Question 2

A media company runs a video transcoding workload in a public cloud. The workload is latency-sensitive and must complete within strict deadlines, but the company wants to reduce compute costs during off-peak hours. Which cloud characteristic should the company leverage to meet these requirements?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to be dynamically provisioned and released to match demand. For a latency-sensitive transcoding workload, the company can scale out during peak times to meet deadlines and scale in during off-peak hours to cut costs. High availability, multi-tenancy, and measured service are important but do not directly enable this automatic scaling behavior.

Answer

High availability

Answer

Multi-tenancy

Answer

Measured service

Question 3

A healthcare company is migrating its patient portal to a public cloud. The compliance team requires that the cloud provider's data centers be independently audited against SOC 2 Type II and ISO 27001. Which action should the company take FIRST to meet this requirement?

Accepted Answer

Request the cloud provider's third-party audit reports through its compliance portal or trust center.. The compliance team is asking for evidence that the cloud provider's facilities have been independently audited against recognized standards. The correct approach is to obtain the provider's existing SOC 2 Type II and ISO 27001 reports, which are produced by independent auditors and made available to customers. This avoids redundant auditing and directly satisfies the requirement without overstepping the shared responsibility boundary.

Answer

Commission the company's own SOC 2 Type II audit of the cloud provider's data centers.

Answer

Implement customer-managed encryption keys for all patient data stored in the cloud.

Answer

Deploy a third-party vulnerability scanner across all provider-managed infrastructure.

Question 4

A retail company wants to adopt cloud services but is concerned about unpredictable monthly bills. They need a financial model where they pay only for the resources consumed, with no upfront commitment. Which cloud billing model should they choose?

Accepted Answer

On-demand instances. The company needs a billing model that charges only for resources consumed, with no upfront commitment. On-demand instances provide exactly that, allowing the company to pay for what they use without long-term contracts or wasted capacity. Reserved instances, spot instances, and dedicated hosts all involve either upfront payments, commitments, or interruption risks that do not meet the requirement.

Answer

Dedicated hosts

Answer

Reserved instances

Answer

Spot instances

Question 5

A retail company wants to ensure its online store remains available even if an entire cloud region fails. The company is willing to pay for duplicate resources in a second region and wants automatic failover. Which design approach should the company implement?

Accepted Answer

Use a multi-region active-active deployment with automated failover. Surviving a full region failure with automatic failover requires resources in at least two regions and automated traffic redirection. A multi-region active-active design duplicates the environment and shifts traffic when a region becomes unavailable, matching the company's willingness to pay for redundancy. Single-zone, same-region backup, and single-region load balancing designs do not protect against regional outages.

Answer

Configure a single-region load balancer across multiple subnets

Answer

Deploy all resources in a single availability zone within one region

Answer

Take nightly backups to object storage in the same region

Question 6

A company is deploying a new cloud-native application that must comply with GDPR. The application will process personal data of EU citizens. Which cloud governance practice is most important to implement to ensure data protection and privacy?

Accepted Answer

Data classification and tagging. Data classification and tagging is the most important governance practice because it enables the organization to identify personal data and apply appropriate protections, such as encryption and access controls, in line with GDPR. Without proper classification, other measures like MFA might be applied inconsistently, leaving personal data unprotected. It is a prerequisite for effective data governance.

Answer

Cost optimization

Answer

Multi-factor authentication (MFA) for all users

Answer

Resource tagging for billing

Question 7

A company wants to ensure that its cloud resources are tagged correctly for cost allocation and compliance. Which cloud governance practice should they implement to enforce tagging standards?

Accepted Answer

Use a policy engine to deny creation of untagged resources. Enforcing tagging standards requires a proactive control that prevents non-compliant resources from being created. A policy engine can deny untagged resource creation, ensuring compliance. Default tags, manual audits, and email reminders are not enforcement mechanisms and do not guarantee adherence. The policy engine approach is the most effective for governance.

Answer

Enable default tags on all resources

Answer

Conduct monthly manual audits of resource tags

Answer

Send email reminders to engineers about tagging policies

Question 8

A business is analyzing the TCO for a cloud migration. Which item is considered a recurring 'OpEx' cost?

Accepted Answer

Monthly service consumption charges. Monthly service consumption charges are a recurring operational expense (OpEx) because they are paid continuously as the service is used, with no upfront capital outlay. This aligns with the cloud's pay-as-you-go model, where costs scale with consumption and appear on the monthly bill.

Answer

Data center construction

Answer

Hardware purchase price

Answer

Initial software licensing perpetual fee

Question 9

Which TWO items represent 'Cloud-native' architectural practices?

Accepted Answer

Implementing automated CI/CD pipelines. Option C is correct because automated CI/CD pipelines embody cloud-native practice by enabling continuous integration and continuous delivery/deployment, allowing rapid, reliable, and repeatable releases through automation rather than manual processes. Option E is correct because decomposing applications into microservices is a core cloud-native architectural pattern, where loosely coupled, independently deployable services scale and fail in isolation, aligning with dynamic cloud environments. The unmarked options do not belong: buying perpetual software licenses (A) reflects traditional capital-expenditure licensing rather than cloud-native pay-as-you-go consumption; using a single large monolithic server (B) contradicts cloud-native elasticity and distributed design; and manual software installation (D) opposes the automation, infrastructure-as-code, and immutable-deployment principles central to cloud-native architectures.

Answer

Buying perpetual software licenses

Answer

Using a single large, monolithic server

Answer

Manual software installation

Question 10

A media company stores finished video masters in a public cloud object store. Legal requires that each object be retrievable even if a single facility is destroyed, and that any silent data corruption be detectable years later. The storage team wants the provider to handle replication and integrity verification without application changes. Which capability should the team verify is available from the provider?

Accepted Answer

Cross-region replication with checksum-based integrity validation. The legal requirements combine geographic durability with long-term corruption detection. Cross-region replication addresses facility loss, and checksum-based integrity validation catches silent bit-level corruption, both delivered by the provider without application changes. The other capabilities address confidentiality, version history, or authorization, none of which replicate data or verify integrity.

Answer

Object versioning with a lifecycle rule to expire old versions

Answer

A read-only access control list on the bucket

Answer

Client-side encryption with customer-managed keys

Question 11

A firm wants to avoid over-provisioning infrastructure. What feature should they enable to adjust resource counts based on demand?

Accepted Answer

Auto-scaling. Auto-scaling automatically adjusts the number of running compute instances based on real-time demand metrics such as CPU utilization, request count, or queue depth. This lets the firm match capacity to workload, avoiding the cost and waste of over-provisioning while still meeting performance needs during peaks. It is the standard cloud-native mechanism for elastic resource management.

Answer

Virtual LANs

Answer

Load balancing

Answer

Manual provisioning

Question 12

A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?

Accepted Answer

SQL Injection Managed Rule Set. A SQL Injection Managed Rule Set is specifically designed to detect and block SQL injection patterns by inspecting HTTP requests for malicious SQL syntax, such as tautologies, UNION queries, and comment sequences. It uses predefined signatures and anomaly scoring to identify known attack vectors, providing targeted protection. This is the most effective feature because it directly addresses the attack technique rather than relying on indirect indicators like request rate or source IP.

Answer

Rate Limiting

Answer

IP Blacklisting

Answer

Geo-blocking

Question 13

A company is using a cloud provider's infrastructure as a service (IaaS) offering. The security team must ensure that the operating system and applications on the virtual machines are patched and configured securely. According to the shared responsibility model, which party is responsible for these tasks?

Accepted Answer

The customer, because they control the operating system and applications.. In IaaS, the cloud provider manages the physical infrastructure, while the customer is responsible for the guest operating system, applications, and data. Therefore, patching and secure configuration of the OS and applications fall to the customer. This delineation is a fundamental aspect of the shared responsibility model.

Answer

A third-party security vendor, because they specialize in cloud security.

Answer

The cloud provider, because they manage the physical infrastructure.

Answer

Both the customer and the provider share equal responsibility for patching.

Question 14

A company requires that all cloud logs be retained for seven years for legal compliance. Which service should they configure to ensure logs are moved to the cheapest storage class long-term?

Accepted Answer

S3 Lifecycle Policies. S3 Lifecycle Policies allow you to define rules that automatically transition objects (including logs) to cheaper storage classes like S3 Glacier or S3 Glacier Deep Archive after a specified period, and eventually expire them. This directly addresses the requirement to move logs to the cheapest long-term storage for seven-year retention. CloudWatch Logs retention and CloudTrail do not provide automated cost-optimized storage tiering; IAM policies control access, not storage lifecycle.

Answer

CloudWatch Logs retention

Answer

IAM Policies

Answer

AWS CloudTrail

Question 15

What is the benefit of 'measured service' for a business?

Accepted Answer

Pay-as-you-go pricing. Measured service in cloud computing refers to the ability to monitor, control, and report on resource usage, which enables pay-as-you-go pricing models. Businesses only pay for what they consume, providing cost transparency and efficiency.

Answer

Increased security

Answer

Free unlimited resources

Answer

Faster CPU performance