CLO-002 Practice Test 22 — 15 Questions

Question 1

A financial services firm is using a public cloud provider. An auditor requests evidence that the provider's physical data centers have adequate controls for access, environmental monitoring, and power redundancy. Which document should the firm provide to the auditor?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SOC 2 Type II report. The auditor needs independent verification of physical controls. A SOC 2 Type II report is produced by a third-party auditor and details the effectiveness of controls over time, including physical security, environmental safeguards, and power redundancy. An SLA, a personal certification, and marketing material do not provide such evidence.

Answer

Cloud provider's marketing brochure

Answer

Service Level Agreement (SLA)

Answer

Certificate of Cloud Security Knowledge (CCSK)

Question 2

An administrator needs to ensure that cloud resources are geographically separated to maintain availability during a regional disaster. Which feature should they configure?

Accepted Answer

Multi-Region deployment. A multi-region deployment places resources in geographically distinct regions (e.g., US-East and EU-West), ensuring that a regional disaster affecting one region does not take down the entire application. This is the only option that provides true geographic separation at the region level, which is what is required to survive a regional outage. Availability Zones are isolated datacenters within a single region, so they do not protect against region-wide failures.

Answer

Availability Zone replication

Answer

Load Balancer

Answer

Auto Scaling Group

Question 3

A cloud operations team wants to receive alerts before their monthly cloud spend exceeds the approved budget for the production subscription. They already use Azure Cost Management and want an automated notification when actual or forecasted costs cross a defined threshold. What should they configure?

Accepted Answer

An Azure Cost Management budget with an alert threshold and an action group.. Azure Cost Management budgets are purpose-built for tracking consumption against a monetary limit and can trigger alerts when actual or forecasted costs cross a threshold. Associating an action group converts that alert into an automated notification or remediation workflow. The other choices monitor technical metrics, enforce configuration compliance, or require custom log pipelines, none of which directly notify on budget overrun.

Answer

A Log Analytics workspace query scheduled with a daily alert rule.

Answer

An Azure Policy definition assigned to the subscription with a deny effect.

Answer

An Azure Monitor metric alert on the subscription's network egress bytes.

Question 4

You have a fleet of instances that need to automatically update their software patches. What is the best cloud-native approach to manage this?

Accepted Answer

Automated patch management. Automated patch management is the best cloud-native approach because it leverages tools like AWS Systems Manager Patch Manager to define patch baselines, schedule maintenance windows, and automatically apply OS and software patches across a fleet of instances without manual intervention. This ensures consistency, reduces human error, and maintains security compliance at scale. Cloud-native services integrate with instance metadata and tagging, allowing dynamic targeting of instances by environment, OS, or tags. This approach aligns with the shared responsibility model, where the customer automates patching of their guest OS and applications.

Answer

Disabling updates

Answer

Re-deploying instances

Answer

Manual login and update

Question 5

A retail company wants to forecast monthly cloud expenses for a new e-commerce platform. The finance team needs to distinguish costs that scale directly with customer traffic from fixed monthly fees. Which cloud billing concept should they use to categorize these costs?

Accepted Answer

Metered usage and subscription fees. Cloud bills typically combine metered usage charges that vary with consumption and subscription fees that remain fixed. For forecasting, separating these two categories allows the finance team to project costs that scale with traffic separately from predictable monthly commitments. This distinction is fundamental to cloud financial management and budgeting.

Answer

Reserved instances and spot instances

Answer

Capital expenditure (CapEx) and operational expenditure (OpEx)

Answer

Total cost of ownership (TCO) and return on investment (ROI)

Question 6

A retail company plans to migrate its e-commerce platform to AWS. The CFO wants to understand the total cost of ownership (TCO) for the first three years. The IT team provides estimates for compute, storage, and network costs but omits the cost of retraining staff and potential downtime during migration. Which additional cost category should be included to make the TCO analysis more accurate?

Accepted Answer

One-time migration costs such as training and downtime. A comprehensive TCO for cloud migration must include one-time costs like training and downtime, which are often overlooked. These costs directly affect the total investment and should be part of the financial analysis. Excluding them leads to an underestimation of the true cost and could result in poor budgeting.

Answer

Capital expenditures for purchasing new servers

Answer

Depreciation of existing on-premises equipment

Answer

Operational expenditures such as ongoing cloud subscription fees

Question 7

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against desired rules, so it can detect resources missing the required 'Owner' and 'Environment' tags and trigger automatic remediation (e.g., via SSM Automation documents). This is exactly the governance/compliance use case described. CloudWatch, Trusted Advisor, and Systems Manager do not provide rule-based configuration compliance evaluation with remediation.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 8

A firm needs to ensure they pay only for the compute cycles used by their batch processing job. Which pricing model is most cost-effective?

Accepted Answer

Pay-as-you-go. Pay-as-you-go (on-demand) pricing charges only for the compute capacity actually consumed, with no upfront commitment or minimum term, which directly matches the requirement to pay only for the cycles a batch job uses. Since batch jobs are typically intermittent and unpredictable, on-demand billing avoids paying for idle capacity between runs. This makes it the most cost-effective model for sporadic workloads.

Answer

Reserved Instances

Answer

Fixed monthly subscription

Answer

Dedicated Hosts

Question 9

Which THREE of the following are common benefits of adopting a Cloud Governance framework?

Accepted Answer

Consistent risk management. A Cloud Governance framework establishes policies, roles, and controls that standardize how cloud resources are evaluated and approved, which directly produces consistent risk management (A) by applying the same risk criteria across all cloud projects and business units. It also enforces alignment between cloud initiatives and organizational objectives through defined decision-making bodies and policy guardrails, giving better alignment with business goals (C). Because governance mandates documented controls, logging, and policy enforcement, it yields improved auditability and compliance (E) against standards such as ISO 27001, SOC 2, or regulatory requirements. Lower hardware maintenance costs (B) is a possible outcome of cloud migration itself, not a governance benefit, and increased cloud deployment speed (D) is typically a DevOps/automation outcome; governance can even add approval steps, so neither is a defining benefit of the framework.

Answer

Lower hardware maintenance costs

Answer

Increased cloud deployment speed

Question 10

An IT manager is reviewing the monthly cloud invoice and notices high costs associated with 'Egress'. What does this cost component represent in a business context?

Accepted Answer

Data leaving the cloud provider's network. Egress in cloud billing refers to data leaving the cloud provider's network boundary, typically billed per gigabyte. In a business context, this represents the cost of delivering data, APIs, or content from cloud-hosted systems to external consumers — whether end users, partner systems, or on-premises datacenters. It is a usage-based charge that scales with outbound traffic volume, making it a critical line item for content-heavy or API-driven workloads.

Answer

The cost of idle virtual machine instances

Answer

Data ingestion into the cloud

Answer

Subscription fees for security software

Question 11

A financial services firm is migrating a legacy trading application to the cloud. The application requires sub-millisecond latency and cannot tolerate noisy neighbors. The firm also needs to comply with regulations that mandate dedicated physical hardware for certain workloads. Which cloud deployment model should the firm choose?

Accepted Answer

Private cloud. The firm requires dedicated physical hardware, isolation from noisy neighbors, and very low latency for a regulated workload. A private cloud provides dedicated infrastructure for a single organization, meeting the regulatory and performance requirements. Public and community clouds involve shared hardware, and hybrid cloud does not inherently guarantee dedicated hardware for the specific workload.

Answer

Community cloud

Answer

Hybrid cloud

Answer

Public cloud

Question 12

Which TWO of the following are key considerations for cloud operational compliance?

Accepted Answer

Policy enforcement automation. Policy enforcement automation (B) is a key operational compliance consideration because it uses tools like AWS Config rules, Azure Policy, or OPA/Gatekeeper to continuously detect and remediate drift from regulatory and internal controls, ensuring consistent enforcement at cloud scale rather than relying on manual checks. Regular security audits (D) are also essential, since frameworks such as SOC 2, ISO 27001, PCI DSS, and HIPAA require periodic independent assessments, log reviews, and control testing to verify that cloud operations remain compliant over time. Ignoring regional laws (A) is wrong because compliance demands adherence to data-residency and privacy regulations like GDPR or PIPEDA, not disregard for them. Avoiding cloud providers (C) is incorrect because cloud operational compliance is about governing cloud usage, not abstaining from it. Using only one password (E) is wrong because it violates least-privilege and unique-credential principles, and is a security anti-pattern rather than a compliance consideration.

Answer

Ignoring regional laws

Answer

Avoiding cloud providers

Answer

Using only one password

Question 13

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team must ensure that only authorized users can access the data and that all access is logged for audit purposes. Which cloud security control should be implemented to meet these requirements?

Accepted Answer

Implement role-based access control (RBAC) and enable audit logging.. The scenario requires controlling who can access ePHI and recording all access. Role-based access control (RBAC) limits access to authorized users based on their roles, and audit logging records every access attempt for compliance audits. These two controls together satisfy both the authorization and logging requirements, unlike the other options which address different security aspects.

Answer

Encrypt the data at rest using provider-managed keys.

Answer

Configure a web application firewall (WAF) to filter malicious traffic.

Answer

Enable multi-factor authentication (MFA) for all user accounts.

Question 14

A logistics firm is evaluating whether to move its custom routing engine to a public cloud. The CIO wants to understand which characteristics are inherent to the public cloud model rather than benefits the firm must build itself. (Choose two.)

Accepted Answer

On-demand self-service provisioning of resources without human interaction from the provider. On-demand self-service and broad network access are two of the essential characteristics that define public cloud, alongside resource pooling, rapid elasticity, and measured service. The logistics firm gets automatic provisioning and reachability from many device types as part of the model, while latency guarantees, code ownership transfer, and mandatory single-tenancy are not cloud characteristics at all.

Answer

Automatic ownership transfer of the customer's source code to the provider

Answer

Mandatory single-tenancy of all physical hosts for every customer

Answer

Guaranteed elimination of all application latency across every geographic region

Question 15

An administrator needs to securely manage access to cloud resources. Which service should be used to create groups, users, and roles?

Accepted Answer

Identity and Access Management. AWS Identity and Access Management (IAM) is the service used to create and manage users, groups, roles, and policies that control access to AWS resources. It provides authentication and authorization for cloud resources. This directly matches the requirement to securely manage access.

Answer

Key Management Service

Answer

Security Groups

Answer

Active Directory