CLO-002 Practice Exam 1 — 20 Questions

Question 1

A healthcare company is migrating its electronic health records (EHR) system to the cloud. The company must ensure compliance with HIPAA regulations. Which of the following is the primary responsibility of the company under the shared responsibility model when using an IaaS cloud provider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managing the guest operating system, applications, and data. Under the IaaS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes the guest operating system, applications, and data. For a healthcare company, this means protecting ePHI through encryption, access management, and compliance controls. The cloud provider secures the physical infrastructure and hypervisor, but the company must ensure its own configurations and data are HIPAA-compliant.

Answer

Securing the physical data center and network infrastructure

Answer

Ensuring the cloud provider's hypervisor is patched and secure

Answer

Configuring the physical network firewalls and routers

Question 2

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Accepted Answer

Client-side encryption. Client-side encryption is correct because data is encrypted by the organization before it ever leaves its premises, meaning the cloud provider receives only ciphertext and never has access to plaintext or keys. This satisfies the requirement that all data be encrypted 'before being sent to the cloud.' Server-side encryption and TDE both encrypt data after it reaches the provider's infrastructure, and TLS protects data only in transit, not at rest in the cloud.

Answer

Server-side encryption

Answer

TLS 1.2

Answer

Transparent Data Encryption (TDE)

Question 3

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the managed service for creating and controlling customer-managed keys (CMKs) used to encrypt data at rest, and it integrates with AWS CloudTrail to produce audit logs of every key usage. KMS supports key policies, grants, and automatic rotation, satisfying both the customer-managed key requirement and the compliance audit requirement. This is why C is correct.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Question 4

An organization is evaluating cloud providers based on 'Shared Responsibility Model' documentation. What does the cloud provider typically remain responsible for?

Accepted Answer

Physical hardware and infrastructure security. Under the Shared Responsibility Model, the cloud provider is always responsible for the security of the cloud — the physical facilities, hardware, network infrastructure, and hypervisor layer. Customers are responsible for security in the cloud, which includes their data, IAM configuration, and guest OS patching (for IaaS). Physical hardware and infrastructure security cannot be delegated to the customer, so it remains the provider's domain.

Answer

Data encryption at rest

Answer

Guest operating system patches

Answer

Identity and Access Management (IAM) configuration

Question 5

Which TWO advantages does a 'Community Cloud' offer over a 'Public Cloud'?

Accepted Answer

Higher level of security or compliance for a shared industry. Option A is correct because a community cloud is provisioned for a specific group of organizations with shared concerns (e.g., banks, healthcare, government), so the provider can implement industry-specific security controls and compliance frameworks (such as PCI DSS, HIPAA, or FedRAMP) that a generic public cloud may not enforce by default. Option D is correct because the cloud infrastructure and its operational costs are pooled among the community members, so each participant pays only a fraction of the total cost rather than bearing the full expense alone. Options B, C, and E do not belong: physical data center power grid control is not a defining community cloud advantage (and is typically retained by the provider, not the tenants), global region access is a characteristic of large public clouds rather than a community cloud benefit, and community clouds generally have higher initial setup costs than public clouds because the infrastructure is dedicated to a narrower group.

Answer

Total control over the physical data center power grid

Answer

Unlimited access to all global regions

Answer

Lower initial setup cost than public cloud

Question 6

An administrator is setting up a new cloud account. What is the first security best practice they should implement?

Accepted Answer

Enable MFA on the root account. Enabling MFA is the most critical first step to secure any account access.

Answer

Increase instance capacity

Answer

Create a support ticket

Answer

Upload a custom logo

Question 7

An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Answer

Site-to-Site VPN

Answer

Client VPN

Answer

Public IP peering

Question 8

Which TWO cloud service models are most appropriate for a developer who wants to focus solely on code?

Accepted Answer

PaaS. PaaS (A) is correct because it abstracts the underlying infrastructure—servers, OS, runtime, and middleware—so the developer only deploys and manages application code and configuration. Serverless/FaaS (B) is correct because it goes even further, letting the developer write individual functions while the provider fully manages scaling, patching, and server provisioning, leaving only code as the concern. Bare Metal (C) is not appropriate because it exposes raw hardware, requiring the developer to manage the OS and everything above it. IaaS (D) is not appropriate because it still requires managing VMs, operating systems, and runtime environments. SaaS (E) is not appropriate because it delivers a finished application, not a platform for writing and deploying custom code.

Answer

Bare Metal

Answer

IaaS

Answer

SaaS

Question 9

A cloud architect is choosing between IaaS and SaaS for a new CRM system. What is the primary business advantage of selecting SaaS?

Accepted Answer

Reduced administrative overhead. SaaS shifts operational responsibility for the application, middleware, OS, and infrastructure to the provider. The customer only manages data and user access, so the primary business advantage is reduced administrative overhead—no patching, scaling, or server maintenance by internal IT. Lower initial cost can be true but is not the defining advantage; reduced admin overhead is the core SaaS value proposition.

Answer

Lower initial implementation cost

Answer

Full control over the operating system

Answer

Customizable hardware configuration

Question 10

A company is planning to migrate its on-premises workloads to a public cloud. The IT director asks which factors are key considerations when evaluating the cloud provider's service level agreement (SLA). (Choose two.)

Accepted Answer

The scope of services covered and any exclusions.. The two key SLA factors are the guaranteed uptime percentage and remedies, and the scope of services covered with exclusions. These define what the provider commits to and what happens if commitments are missed. They directly affect availability expectations and risk management for the migration.

Answer

The provider's data center locations and their proximity to the company's offices.

Answer

The provider's process for handling customer support tickets.

Answer

The maximum number of virtual machines the company can deploy.

Question 11

A healthcare company is designing a new patient portal. Regulatory requirements mandate that patient data must remain within a specific country's borders and that the company must have direct control over the encryption keys used to protect the data at rest. The company wants to use a public cloud provider. Which combination of cloud characteristics and controls should the company implement to meet these requirements?

Accepted Answer

Use a public cloud region in the required country and implement customer-managed encryption keys using a key management service.. The company must satisfy two distinct requirements: data residency and direct control over encryption keys. Choosing a region within the required country addresses residency, and using customer-managed keys in a key management service provides direct key control. Options that use provider-managed or default encryption fail the key control requirement, and options that use an arbitrary region fail data residency.

Answer

Use a public cloud region in the required country and enable provider-managed encryption keys.

Answer

Use a public cloud region in the required country and rely on default platform encryption without managing keys.

Answer

Use a public cloud region in any country and implement customer-managed encryption keys using a key management service.

Question 12

Which THREE items should be included in an incident response plan?

Accepted Answer

Monitoring and alerting thresholds. A monitoring and alerting thresholds are correct because an incident response plan must specify the detection criteria and severity triggers that determine when an alert escalates into a declared incident, enabling consistent triage and response. B communication plan is correct because it defines who notifies whom, via which channels, and in what timeframe, including internal stakeholders, legal, and external parties, which is essential for coordinated response and regulatory notification. C defined roles and responsibilities is correct because the plan must assign clear ownership such as incident commander, communications lead, and technical responders so actions are not duplicated or missed during an event. D employee training manuals are not a core component of the plan itself; training is a supporting program that socializes the plan, not an item included within it. E budget approval workflows concern financial governance and procurement, not the detection, containment, eradication, and recovery activities that an incident response plan must document.

Answer

Employee training manuals

Answer

Budget approval workflows

Question 13

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the dedicated cost management dashboard that visualizes historical and current spend, forecasts future costs, and surfaces budget alerts and anomaly detections. It directly answers the governance question of 'what are we spending and are we within budget?' by aggregating billing data across services, accounts, and tags. Budgets configured in AWS Budgets appear as alerts tied to the same cost data Cost Explorer presents.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 14

A financial services firm runs regulated workloads on AWS. An auditor requires proof that data stored in Amazon S3 is encrypted at rest with keys the firm controls, that key usage is logged, and that keys can be rotated on a defined schedule. Which combination of AWS services and features satisfies these requirements?

Accepted Answer

S3 default encryption with SSE-KMS using a customer managed key, key rotation enabled, and AWS CloudTrail logging of KMS API calls.. The requirements map to customer-controlled encryption keys, scheduled rotation, and auditable key usage. SSE-KMS with a customer managed key provides customer control over key policy and lifecycle, automatic rotation rotates key material on a schedule, and CloudTrail records KMS API activity for audit. AWS managed keys and SSE-S3 remove customer control, while Object Lock and access logging address different controls.

Answer

Client-side encryption with a key stored in AWS Secrets Manager and S3 access logging enabled.

Answer

S3 default encryption with SSE-S3 and S3 server access logging enabled on the bucket.

Answer

S3 default encryption with SSE-KMS using an AWS managed key and S3 Object Lock in compliance mode.

Question 15

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

Accepted Answer

Enforce a tagging policy that requires specific tags on all resources at creation time.. Accurate cost allocation depends on resources being labeled with consistent metadata such as cost center and owner. Enforcing a tagging policy at resource creation ensures every resource is attributable, which directly enables correct invoice allocation. Security controls like MFA or a CASB, and monitoring tools like budget alerts, do not provide the per-resource attribution the business requires.

Answer

Configure a budget alert to notify administrators when spending exceeds a threshold.

Answer

Implement a cloud access security broker to inspect traffic to cloud services.

Answer

Enable multi-factor authentication for all administrative accounts.

Question 16

A small business is considering moving its email and collaboration suite to a cloud-based service where the provider manages the application, including updates and security patches. The business will access the software via a web browser. Which cloud service model is being described?

Accepted Answer

Software as a Service (SaaS). The scenario describes a fully managed application accessed via a browser, which is the definition of Software as a Service. In SaaS, the provider handles everything from infrastructure to application updates, and the customer simply uses the software. This contrasts with IaaS, PaaS, and FaaS, where the customer retains varying degrees of management responsibility.

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 17

A multinational enterprise is migrating a latency-sensitive trading application to a public cloud. The architecture team must select deployment characteristics that minimize network round-trip time for users in multiple regions while maintaining high availability. Which TWO characteristics should the team prioritize? (Choose two.)

Accepted Answer

Deploy the application in multiple regions close to major user concentrations.. Minimizing latency for a globally distributed user base requires bringing compute closer to users and steering each user to the nearest healthy endpoint. Deploying across multiple regions near user concentrations reduces physical distance, and latency-based or geolocation DNS routing ensures traffic reaches the optimal region while enabling failover. Together these deliver both low round-trip time and high availability.

Answer

Use a content delivery network to cache dynamic API responses at edge locations.

Answer

Increase the size of the database instance to handle more concurrent connections.

Answer

Consolidate all application instances into a single region with the lowest average latency to all users.

Question 18

A financial services firm is adopting a public cloud and must decide how to handle privileged access to the cloud management console. The security policy requires that no single administrator can both modify production workloads and delete audit logs. Which approach best satisfies this requirement?

Accepted Answer

Implement role-based access control with separate roles for workload administration and audit log management, and enforce least privilege.. Separation of duties is achieved by dividing permissions across distinct roles so that no single identity can both change production workloads and remove audit logs. Role-based access control with least privilege enforces this technically and supports accountability, whereas policies, shared credentials, and MFA address different risks and do not prevent one administrator from holding both capabilities.

Answer

Grant all administrators full access but require them to sign an acceptable use policy annually.

Answer

Enable multi-factor authentication for all administrators accessing the console.

Answer

Require administrators to use shared credentials stored in a password vault.

Question 19

Which THREE cloud management tools should be utilized to control costs?

Accepted Answer

Cost Explorer or similar visualization tool. Cost Explorer (A) is correct because it provides visualization and analysis of historical cloud spend by service, account, and tag, enabling teams to identify cost drivers and trends. Budgeting and forecasting alerts (B) are correct because they proactively notify stakeholders when actual or forecasted spend approaches or exceeds defined thresholds, allowing corrective action before overruns occur. Resource tagging policies (E) are correct because consistent tags (e.g., cost center, owner, environment) enable accurate cost allocation, chargeback, and filtering in billing reports, which is foundational to cost control. Option C, a physical server monitoring camera, is irrelevant to cloud financial management since it addresses physical security, not billing or usage. Option D, the company's external marketing agency, does not manage cloud infrastructure or billing and therefore cannot control cloud costs.

Answer

A physical server monitoring camera

Answer

The company's external marketing agency

Question 20

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical infrastructure, including data centers, hardware, and network facilities.. Under the shared responsibility model, the cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and network infrastructure. The customer is responsible for security in the cloud, such as configuring security groups, managing access, and encrypting data. The correct answer is the one that describes physical infrastructure security.

Answer

Encrypting the customer's data before it is uploaded to the cloud.

Answer

Configuring security groups and network ACLs for the customer's virtual private cloud.

Answer

Managing user access keys and permissions for the customer's cloud resources.