CLO-002 Practice Test 19 — 15 Questions

Question 1

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

Accepted Answer

Risk Register. A Risk Register is the primary document that identifies, assesses, and records risk mitigation strategies, owners, and status. It directly evidences that the organization is actively managing cloud risks, making it the most appropriate artifact for an auditor seeking proof of risk mitigation.

Answer

Cloud Service Level Agreement (SLA)

Answer

System Security Plan (SSP)

Answer

Network Topology Diagram

Question 2

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. An internal audit finds that a developer copied a production database snapshot to a personal cloud storage bucket to test a reporting script. The organization must demonstrate to auditors that such data handling is prevented and detectable going forward. Which control should be implemented FIRST to directly address this governance and compliance gap?

Accepted Answer

Enable a cloud-native data loss prevention (DLP) policy that inspects and blocks ePHI from being written to non-approved storage services.. The gap is unauthorized movement of ePHI to a non-approved location, so the first control must both prevent the action and create audit evidence. A cloud-native DLP policy inspects data content and enforces storage boundaries, blocking the write and alerting security teams. Administrative policies and lifecycle rules do not technically stop the transfer, and JIT access alone still permits a legitimately authorized user to copy data out.

Answer

Configure object storage lifecycle rules to delete any bucket content older than 30 days.

Answer

Require all developers to sign an updated acceptable use policy that prohibits copying production data to personal storage.

Answer

Implement just-in-time (JIT) privileged access so developers only receive production credentials when an approved change ticket exists.

Question 3

A company needs to store static website assets such as images and CSS files cheaply. Which service is appropriate?

Accepted Answer

Object storage. Object storage is appropriate for storing static website assets such as images and CSS files cheaply. Services like Amazon S3 provide highly durable, scalable, and low-cost object storage designed for unstructured data like web assets. It offers features like static website hosting, content delivery via CloudFront, and pay-as-you-go pricing, making it ideal for this use case.

Answer

Block storage

Answer

Ephemeral storage

Answer

Relational database

Question 4

What is the primary advantage of 'High Availability' in cloud architecture?

Accepted Answer

Minimizing downtime during system failures. High Availability in cloud architecture is designed to ensure that a system remains operational and accessible despite component failures, thereby minimizing downtime. It achieves this through redundancy, failover mechanisms, and distributing workloads across multiple availability zones or regions. The primary advantage is continuous service availability, not cost reduction or speed improvement.

Answer

Reducing the total cost of ownership

Answer

Improving security posture

Answer

Increasing processing speed

Question 5

A retail company is planning to adopt a public cloud infrastructure. The IT director wants to understand the financial and operational benefits of the cloud. Which TWO of the following are key benefits of the public cloud model? (Choose two.)

Accepted Answer

Ability to scale resources up or down based on demand. The key benefits of public cloud include the ability to scale resources dynamically based on demand and a pay-as-you-go pricing model that aligns costs with usage. These benefits help a retail company handle seasonal spikes without over-investing in hardware. Eliminating all capital expenditures is an overstatement, controlling physical security is not a customer benefit, and zero downtime is not guaranteed.

Answer

Complete control over the physical security of data centers

Answer

Guaranteed zero downtime for all services

Answer

Elimination of all capital expenditures for IT hardware

Question 6

Which THREE factors influence cloud resource scalability decisions?

Accepted Answer

Traffic patterns. Traffic patterns (A) are a core scalability input because peak vs. off-peak request rates, seasonality, and burstiness determine whether to scale horizontally (add instances) or vertically (resize), and how aggressively auto scaling policies should trigger. Budgetary cost limits (C) directly constrain scalability decisions, since scaling out increases compute, storage, and data-transfer charges, so cost ceilings and reserved vs. on-demand pricing shape the chosen scaling strategy and maximum capacity. Application performance metrics (E) such as CPU utilization, memory pressure, latency, queue depth, and throughput are the signals that drive auto scaling thresholds and right-sizing, making them essential to deciding when and how much to scale. The developer's preferred OS (B) is irrelevant because scalability depends on workload demand and resource capacity, not on which operating system a developer likes. The color of the UI (D) is purely a cosmetic design choice and has no bearing on resource scaling.

Answer

The developer's preferred OS

Answer

The color of the UI

Question 7

Which THREE cloud service models require different levels of operational management from the customer?

Accepted Answer

Infrastructure as a Service (IaaS). The three recognized cloud service models that shift different amounts of operational management to the customer are IaaS, PaaS, and SaaS. Option A, Infrastructure as a Service (IaaS), is correct because the customer manages the operating systems, middleware, runtime, and applications while the provider manages the virtualization, servers, storage, and networking. Option B, Software as a Service (SaaS), is correct because the provider manages essentially the entire stack and the customer only manages their data, user access, and configuration. Option E, Platform as a Service (PaaS), is correct because the provider manages the OS, runtime, and middleware while the customer manages only the deployed applications and their data. Option C, People as a Service, is not a standard cloud service model and is not part of the IaaS/PaaS/SaaS taxonomy. Option D, Hardware as a Service (HaaS), is not one of the three canonical cloud service models tested here, as hardware provisioning is subsumed under IaaS.

Answer

People as a Service

Answer

Hardware as a Service (HaaS)

Question 8

What is the benefit of moving from an on-premises data center to a cloud provider?

Accepted Answer

Reduced physical infrastructure management. Moving to a cloud provider shifts the burden of procuring, racking, powering, cooling, and maintaining physical servers to the provider, so the customer's operational scope shrinks to what they run in the cloud. This reduction in physical infrastructure management is the core benefit. It also enables elasticity and pay-as-you-go economics, but the question asks about the primary benefit of the move itself.

Answer

No need for networking

Answer

Guaranteed 100% uptime

Answer

Elimination of software updates

Question 9

A financial services company is migrating to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company controls and can revoke at any time. Which key management approach should they implement?

Accepted Answer

Customer-managed keys stored in a hardware security module (HSM). The requirement is for customer-controlled, revocable encryption keys. Customer-managed keys in an HSM provide the necessary control and security. Provider-managed keys and server-side encryption with provider keys do not give the customer control. Client-side encryption with keys in code is insecure and lacks proper revocation mechanisms. Only customer-managed keys in an HSM meet all criteria.

Answer

Provider-managed keys with automatic rotation

Answer

Client-side encryption with keys stored in the application code

Answer

Server-side encryption with keys managed by the cloud provider

Question 10

A healthcare company is migrating patient records to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company generates and controls, and that the cloud provider cannot access these keys. Which cloud service model should the company implement?

Accepted Answer

Client-side encryption with customer-managed keys. The requirement is for customer-controlled encryption keys that the cloud provider cannot access. Client-side encryption with customer-managed keys meets this because the data is encrypted before leaving the customer's environment, and the keys never leave the customer's control. Other options either give the provider access to keys or do not address encryption at rest.

Answer

Server-side encryption with customer-provided keys

Answer

Server-side encryption with provider-managed keys

Answer

Transport Layer Security (TLS) encryption in transit

Question 11

A financial services firm runs a regulated workload in a public cloud. Compliance requires that data at rest be encrypted with keys the firm controls and can rotate independently of the provider, and that an audit trail record every key usage. The firm wants to minimize operational overhead while retaining exclusive control of key material. Which approach best satisfies these requirements?

Accepted Answer

Use a cloud key management service with customer-managed keys and integrated audit logging.. The requirement is for customer-controlled key material with independent rotation and a complete audit trail, while minimizing operational burden. A cloud key management service with customer-managed keys provides exactly this balance: the customer owns and controls the keys, rotation can be scheduled or performed on demand, and every cryptographic operation is logged. It avoids the heavy lift of self-managed client-side key infrastructure.

Answer

Implement client-side encryption where the application encrypts data before upload and manages its own keys.

Answer

Use provider-managed encryption keys with automatic annual rotation.

Answer

Store encryption keys in a version-controlled repository and have applications retrieve them at runtime.

Question 12

A cloud engineer is configuring a lifecycle policy for an object storage bucket that holds compliance audit logs. Regulations require that logs be retained for seven years and that they cannot be altered or deleted during that period. Which combination of lifecycle actions should the engineer implement?

Accepted Answer

Transition objects to an archive storage class after 90 days and enable object lock in compliance mode for seven years. Regulatory retention with immutability requires an object lock in compliance mode, which prevents any user, including administrators, from deleting or altering objects for the specified period. Combining this with a lifecycle transition to an archive class after 90 days controls cost while preserving the seven-year retention. Other options lack a true lock mechanism or fail to meet the full retention duration.

Answer

Move objects to a cold storage tier immediately and set a bucket policy that denies delete actions

Answer

Enable versioning and configure a lifecycle rule to delete objects after seven years

Answer

Enable cross-region replication and apply a lifecycle rule to archive objects after one year

Question 13

A multinational corporation is evaluating the total cost of ownership (TCO) for migrating its legacy on-premises applications to a public cloud. The finance team wants to identify which costs are typically eliminated or reduced when moving to the cloud. (Choose two.)

Accepted Answer

Cost of data center real estate and utilities. Migrating to the public cloud eliminates capital expenditures for server hardware and reduces data center facility costs such as real estate, power, and cooling. These are significant TCO savings because they shift from fixed CapEx to variable OpEx. Other costs like software licenses, development staff, and network bandwidth are not eliminated and may even increase, so they should be carefully evaluated.

Answer

Software licensing fees for all applications

Answer

IT staff salaries for application development

Answer

Network bandwidth costs for all users

Question 14

Which cloud architectural practice helps minimize the impact of a total regional outage?

Accepted Answer

Multi-region deployment. Multi-region deployment involves distributing applications and data across multiple geographic regions, so if one region experiences a total outage (e.g., due to a natural disaster, power grid failure, or large-scale service disruption), the application can fail over to another region and continue operating. This directly minimizes the impact of a regional outage by ensuring that no single region failure takes down the entire system. Other options like single-zone deployment, vertical scaling, or private connections do not provide cross-region redundancy.

Answer

Single-zone deployment

Answer

Vertical scaling

Answer

Private connection via Direct Connect

Question 15

A financial services firm is migrating its customer relationship management (CRM) system to a public cloud. The CIO wants to ensure the migration aligns with the firm's risk appetite and regulatory obligations. Which action best demonstrates that the firm is applying proper cloud risk management?

Accepted Answer

Conducting a risk assessment that maps cloud controls to regulatory requirements. Mapping cloud controls to regulatory requirements is a proactive risk management step that shows the firm understands its responsibilities under the shared responsibility model. It ensures compliance is designed into the migration rather than bolted on later. This approach supports audit readiness and aligns with the firm's risk appetite, making it the most appropriate action.

Answer

Transferring all risk to the cloud provider through the service contract

Answer

Accepting the cloud provider's default security settings to avoid configuration errors

Answer

Delaying the migration until the cloud provider achieves perfect security