CLO-002 Practice Test 21 — 15 Questions

Question 1

Which document is essential to review to understand the scope and limitations of a cloud provider's commitment to service uptime?

Accepted Answer

Service Level Agreement (SLA). A Service Level Agreement (SLA) is the contract that defines the provider's committed uptime percentage, the measurement window, exclusions (e.g., scheduled maintenance), and the remedies (service credits) if the commitment is missed. It is the authoritative document for understanding both the scope and the limitations of the provider's uptime commitment. Reviewing it is essential before designing for availability or making claims about resilience.

Answer

Pricing sheet

Answer

Support contact list

Answer

Architecture diagram

Question 2

Which THREE items are considered part of cloud resource maintenance?

Accepted Answer

Patching operating systems. Cloud resource maintenance covers the ongoing operational tasks needed to keep provisioned resources secure, efficient, and healthy. Option A (Patching operating systems) is correct because applying OS security and bug-fix updates to cloud VMs and managed instances is a core maintenance activity that reduces vulnerabilities and keeps systems supported. Option B (Deleting unused volumes) is correct because removing orphaned or unattached storage volumes reclaims capacity and reduces unnecessary cloud spend, a routine maintenance/housekeeping task. Option E (Monitoring health metrics) is correct because continuously tracking metrics such as CPU, memory, disk, and network utilization (e.g., via Amazon CloudWatch or Azure Monitor) is essential maintenance that detects degradation and triggers remediation. Options C (Buying new office desks) and D (Cleaning the office kitchen) are physical workplace/facilities tasks unrelated to maintaining cloud resources, so they do not belong.

Answer

Buying new office desks

Answer

Cleaning the office kitchen

Question 3

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Accepted Answer

Site-to-Site VPN. A Site-to-Site VPN creates an encrypted IPsec tunnel between the on-premises gateway and the cloud provider's virtual private gateway, ensuring all data in transit is encrypted. This directly satisfies the requirement for encryption of data moving between the data center and the cloud. It is the standard mechanism when encryption over a public network path is required.

Answer

VPC Peering

Answer

IGW (Internet Gateway)

Answer

Direct Connect

Question 4

A healthcare organization is migrating patient records to a public cloud. The security team must ensure that only authorized applications can access the storage buckets containing this data, and that access is logged for audit purposes. Which combination of AWS features should they implement to meet these requirements?

Accepted Answer

AWS Identity and Access Management (IAM) policies and AWS CloudTrail. The correct answer is IAM policies and CloudTrail because IAM controls access to S3 resources based on identity and permissions, ensuring only authorized applications can access the buckets. CloudTrail records all API calls, including S3 data access, providing the necessary audit trail. This combination directly addresses both access control and logging requirements for sensitive healthcare data.

Answer

Amazon S3 bucket policies and AWS Config

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Shield and AWS WAF

Question 5

Which cloud networking component allows an instance in a public subnet to communicate with the internet?

Accepted Answer

Internet Gateway. An Internet Gateway (D) is the VPC component that enables communication between instances in a public subnet and the internet. It provides a target for route table entries directing internet-bound traffic and performs NAT for instances with public IPs.

Answer

NAT Gateway

Answer

Peering Connection

Answer

VPC Endpoint

Question 6

A healthcare company is migrating its patient records system to a cloud environment. The company must ensure that only authorized users can access the data and that the data is encrypted both at rest and in transit. The cloud provider offers encryption services, but the company wants to control the encryption keys. Which cloud concept best describes the company's need to manage its own encryption keys while using the provider's infrastructure?

Accepted Answer

Bring your own key (BYOK). BYOK is the cloud concept that lets an organization use its own encryption keys with a cloud provider's services. The healthcare company needs to control keys for compliance and security, so BYOK is the best fit. An HSM may be used to store keys, but the concept of customer-managed keys is BYOK. Shared responsibility and MFA address different aspects of cloud security.

Answer

Multi-factor authentication (MFA)

Answer

Shared responsibility model

Answer

Hardware security module (HSM)

Question 7

A small accounting practice wants to move its email and document collaboration to the cloud. The staff has no server administration skills and wants the provider to manage patching, uptime, and the application itself, paying a per-user subscription. Which cloud service model is the practice seeking?

Accepted Answer

Software as a Service (SaaS). The practice wants a finished application managed end to end by the provider and billed per user, which is the definition of Software as a Service. IaaS and PaaS leave administrative or development responsibilities with the customer, and FaaS targets event-driven code rather than office productivity software.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 8

A small marketing agency wants to move its client relationship management (CRM) application to the cloud. The agency has no IT staff and wants to eliminate server maintenance, patching, and database administration. Which cloud service model should the agency choose?

Accepted Answer

Software as a Service (SaaS). SaaS is the correct choice because it delivers a fully managed application where the provider handles infrastructure, patching, and database maintenance. The agency's lack of IT staff and desire to avoid server administration align with the SaaS consumption model, not with IaaS, PaaS, or CaaS, which all leave significant operational responsibilities with the customer.

Answer

Container as a Service (CaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Question 9

A cloud architect is designing a solution that must provide a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours for a critical database. The database currently runs on a single virtual machine with nightly backups. Which change should the architect implement to meet these objectives?

Accepted Answer

Configure continuous log shipping to a standby database in a second region with automated failover. To achieve a 15-minute RPO and 2-hour RTO, the architect needs near-continuous replication and automated failover. Continuous log shipping to a standby database in another region provides minimal data loss and rapid recovery. Other options rely on periodic backups or manual promotion, which cannot meet the tight objectives for a critical database.

Answer

Increase the frequency of nightly backups to every 12 hours

Answer

Take a snapshot of the database volume every hour and store it in a different availability zone

Answer

Enable database read replicas in the same region and promote one during a failure

Question 10

A small marketing agency wants to move its email and collaboration suite to the cloud. The agency has no IT staff and wants the vendor to manage servers, storage, and the application itself, while users simply log in through a browser. Which cloud service model BEST fits this requirement?

Accepted Answer

Software as a Service (SaaS). SaaS is the only model in which the provider manages the entire stack up through the application, letting users consume the service through a browser. The agency has no IT staff and wants zero responsibility for servers, storage, or application maintenance, which exactly matches the SaaS consumption model rather than infrastructure or platform hosting.

Answer

Desktop as a Service (DaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 11

A company is adopting a multi-cloud strategy and needs to implement identity and access management (IAM) consistently across AWS, Azure, and Google Cloud. The security team wants to centralize user authentication and authorization to reduce administrative overhead and enforce uniform security policies. Which two approaches should they use to achieve centralized IAM across multiple clouds? (Choose two.)

Accepted Answer

Federate each cloud provider's IAM with a central identity provider (IdP) such as Azure Active Directory or Okta using SAML 2.0 or OpenID Connect.. Centralizing IAM across multiple clouds is best achieved by federating each cloud's IAM with a central identity provider and/or using a centralized identity broker. These methods provide single sign-on, consistent policy enforcement, and reduced administrative overhead. The other options either fragment identity management or introduce security risks.

Answer

Use each cloud provider's native IAM system independently and synchronize user accounts manually.

Answer

Configure each cloud provider's IAM to trust the others' identity providers directly without a central IdP.

Answer

Store all user credentials in a shared spreadsheet and distribute it to administrators.

Question 12

Which THREE regulatory or compliance frameworks might an enterprise need to audit a cloud provider for?

Accepted Answer

HIPAA (Healthcare). HIPAA (A) is correct because it governs protected health information (PHI), and an enterprise handling healthcare data must verify that its cloud provider enforces the required administrative, physical, and technical safeguards through a Business Associate Agreement (BAA) and audit rights. PCI-DSS (C) is correct because any organization storing, processing, or transmitting cardholder data must ensure its cloud provider meets the 12 PCI-DSS requirements, and the provider's compliance must be validated via an Attestation of Compliance (AOC) or Report on Compliance (ROC). SOC 2 Type II (D) is correct because it reports on the design and operating effectiveness of a provider's controls over security, availability, processing integrity, confidentiality, and privacy across a defined audit period, which enterprises rely on to satisfy due diligence and vendor risk management. The company dress code policy (B) is an internal HR matter with no regulatory or compliance auditing relevance to a cloud provider, and the local library catalog system (E) is a public information system, not a compliance framework applicable to enterprise cloud audits.

Answer

Company dress code policy

Answer

The local library catalog system

Question 13

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team wants to continuously verify that the cloud provider's controls meet HIPAA requirements without conducting a new audit each quarter. Which action should the team take?

Accepted Answer

Request the cloud provider's SOC 2 Type II report and map its Trust Services Criteria to HIPAA safeguards.. A SOC 2 Type II report is the recognized independent attestation that describes the design and operating effectiveness of a cloud provider's controls over a period. Mapping its Trust Services Criteria to HIPAA safeguards lets the healthcare organization verify compliance continuously without commissioning its own audit each quarter, which is exactly the assurance needed for ePHI.

Answer

Perform a penetration test against the provider's infrastructure every quarter.

Answer

Rely on the cloud provider's marketing statement that its services are HIPAA eligible.

Answer

Ask the cloud provider to sign a new Business Associate Agreement every quarter.

Question 14

A cloud administrator is implementing a backup strategy for an Amazon RDS for MySQL database. The administrator must ensure point-in-time recovery and long-term retention beyond the maximum automated backup window. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a manual DB snapshot and copy it to another AWS Region.. Enabling automated backups with the maximum 35-day retention provides point-in-time recovery within that window, while creating manual snapshots and copying them to another Region ensures long-term retention beyond 35 days. Together, these actions meet both the point-in-time recovery and long-term retention requirements for the RDS for MySQL database.

Answer

Configure a read replica in a different Availability Zone.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Take an automated snapshot every hour using a Lambda function.

Question 15

An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?

Accepted Answer

Network ACL. A Network ACL (NACL) is a stateless, subnet-level firewall that evaluates inbound and outbound rules before traffic reaches any instance, making it the first line of defense for a private subnet. Because it operates at the subnet boundary, it filters traffic regardless of instance-level configuration. Security groups act at the instance level and are evaluated after the NACL, so the NACL is the outermost control.

Answer

NAT Gateway

Answer

Security Group

Answer

Route Table