CLO-002 Practice Test 2 — 10 Questions

Question 1

A healthcare company is designing a new patient portal. Regulatory requirements mandate that patient data must remain within a specific country's borders and that the company must have direct control over the encryption keys used to protect the data at rest. The company wants to use a public cloud provider. Which combination of cloud characteristics and controls should the company implement to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a public cloud region in the required country and implement customer-managed encryption keys using a key management service.. The company must satisfy two distinct requirements: data residency and direct control over encryption keys. Choosing a region within the required country addresses residency, and using customer-managed keys in a key management service provides direct key control. Options that use provider-managed or default encryption fail the key control requirement, and options that use an arbitrary region fail data residency.

Answer

Use a public cloud region in the required country and enable provider-managed encryption keys.

Answer

Use a public cloud region in the required country and rely on default platform encryption without managing keys.

Answer

Use a public cloud region in any country and implement customer-managed encryption keys using a key management service.

Question 2

Which THREE items should be included in an incident response plan?

Accepted Answer

Monitoring and alerting thresholds. A monitoring and alerting thresholds are correct because an incident response plan must specify the detection criteria and severity triggers that determine when an alert escalates into a declared incident, enabling consistent triage and response. B communication plan is correct because it defines who notifies whom, via which channels, and in what timeframe, including internal stakeholders, legal, and external parties, which is essential for coordinated response and regulatory notification. C defined roles and responsibilities is correct because the plan must assign clear ownership such as incident commander, communications lead, and technical responders so actions are not duplicated or missed during an event. D employee training manuals are not a core component of the plan itself; training is a supporting program that socializes the plan, not an item included within it. E budget approval workflows concern financial governance and procurement, not the detection, containment, eradication, and recovery activities that an incident response plan must document.

Answer

Employee training manuals

Answer

Budget approval workflows

Question 3

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the dedicated cost management dashboard that visualizes historical and current spend, forecasts future costs, and surfaces budget alerts and anomaly detections. It directly answers the governance question of 'what are we spending and are we within budget?' by aggregating billing data across services, accounts, and tags. Budgets configured in AWS Budgets appear as alerts tied to the same cost data Cost Explorer presents.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A financial services firm runs regulated workloads on AWS. An auditor requires proof that data stored in Amazon S3 is encrypted at rest with keys the firm controls, that key usage is logged, and that keys can be rotated on a defined schedule. Which combination of AWS services and features satisfies these requirements?

Accepted Answer

S3 default encryption with SSE-KMS using a customer managed key, key rotation enabled, and AWS CloudTrail logging of KMS API calls.. The requirements map to customer-controlled encryption keys, scheduled rotation, and auditable key usage. SSE-KMS with a customer managed key provides customer control over key policy and lifecycle, automatic rotation rotates key material on a schedule, and CloudTrail records KMS API activity for audit. AWS managed keys and SSE-S3 remove customer control, while Object Lock and access logging address different controls.

Answer

Client-side encryption with a key stored in AWS Secrets Manager and S3 access logging enabled.

Answer

S3 default encryption with SSE-S3 and S3 server access logging enabled on the bucket.

Answer

S3 default encryption with SSE-KMS using an AWS managed key and S3 Object Lock in compliance mode.

Question 5

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

Accepted Answer

Enforce a tagging policy that requires specific tags on all resources at creation time.. Accurate cost allocation depends on resources being labeled with consistent metadata such as cost center and owner. Enforcing a tagging policy at resource creation ensures every resource is attributable, which directly enables correct invoice allocation. Security controls like MFA or a CASB, and monitoring tools like budget alerts, do not provide the per-resource attribution the business requires.

Answer

Configure a budget alert to notify administrators when spending exceeds a threshold.

Answer

Implement a cloud access security broker to inspect traffic to cloud services.

Answer

Enable multi-factor authentication for all administrative accounts.

Question 6

A small business is considering moving its email and collaboration suite to a cloud-based service where the provider manages the application, including updates and security patches. The business will access the software via a web browser. Which cloud service model is being described?

Accepted Answer

Software as a Service (SaaS). The scenario describes a fully managed application accessed via a browser, which is the definition of Software as a Service. In SaaS, the provider handles everything from infrastructure to application updates, and the customer simply uses the software. This contrasts with IaaS, PaaS, and FaaS, where the customer retains varying degrees of management responsibility.

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 7

A multinational enterprise is migrating a latency-sensitive trading application to a public cloud. The architecture team must select deployment characteristics that minimize network round-trip time for users in multiple regions while maintaining high availability. Which TWO characteristics should the team prioritize? (Choose two.)

Accepted Answer

Deploy the application in multiple regions close to major user concentrations.. Minimizing latency for a globally distributed user base requires bringing compute closer to users and steering each user to the nearest healthy endpoint. Deploying across multiple regions near user concentrations reduces physical distance, and latency-based or geolocation DNS routing ensures traffic reaches the optimal region while enabling failover. Together these deliver both low round-trip time and high availability.

Answer

Use a content delivery network to cache dynamic API responses at edge locations.

Answer

Increase the size of the database instance to handle more concurrent connections.

Answer

Consolidate all application instances into a single region with the lowest average latency to all users.

Question 8

A financial services firm is adopting a public cloud and must decide how to handle privileged access to the cloud management console. The security policy requires that no single administrator can both modify production workloads and delete audit logs. Which approach best satisfies this requirement?

Accepted Answer

Implement role-based access control with separate roles for workload administration and audit log management, and enforce least privilege.. Separation of duties is achieved by dividing permissions across distinct roles so that no single identity can both change production workloads and remove audit logs. Role-based access control with least privilege enforces this technically and supports accountability, whereas policies, shared credentials, and MFA address different risks and do not prevent one administrator from holding both capabilities.

Answer

Grant all administrators full access but require them to sign an acceptable use policy annually.

Answer

Enable multi-factor authentication for all administrators accessing the console.

Answer

Require administrators to use shared credentials stored in a password vault.

Question 9

Which THREE cloud management tools should be utilized to control costs?

Accepted Answer

Cost Explorer or similar visualization tool. Cost Explorer (A) is correct because it provides visualization and analysis of historical cloud spend by service, account, and tag, enabling teams to identify cost drivers and trends. Budgeting and forecasting alerts (B) are correct because they proactively notify stakeholders when actual or forecasted spend approaches or exceeds defined thresholds, allowing corrective action before overruns occur. Resource tagging policies (E) are correct because consistent tags (e.g., cost center, owner, environment) enable accurate cost allocation, chargeback, and filtering in billing reports, which is foundational to cost control. Option C, a physical server monitoring camera, is irrelevant to cloud financial management since it addresses physical security, not billing or usage. Option D, the company's external marketing agency, does not manage cloud infrastructure or billing and therefore cannot control cloud costs.

Answer

A physical server monitoring camera

Answer

The company's external marketing agency

Question 10

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical infrastructure, including data centers, hardware, and network facilities.. Under the shared responsibility model, the cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and network infrastructure. The customer is responsible for security in the cloud, such as configuring security groups, managing access, and encrypting data. The correct answer is the one that describes physical infrastructure security.

Answer

Encrypting the customer's data before it is uploaded to the cloud.

Answer

Configuring security groups and network ACLs for the customer's virtual private cloud.

Answer

Managing user access keys and permissions for the customer's cloud resources.