CLO-002 Practice Test 25 — 15 Questions

Question 1

A regional healthcare provider is planning its first cloud migration. The CFO wants to understand how operational expenses will change after workloads move to a public cloud. Which statement accurately describes the financial shift the provider should expect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capital expenditures decrease while operational expenditures increase.. Moving workloads to a public cloud replaces large upfront hardware purchases with recurring usage-based fees. The provider's capital budget shrinks while its operating budget grows, which is the classic CapEx-to-OpEx conversion that cloud economics describes. Understanding this shift helps the CFO forecast cash flow and budget approval cycles accurately.

Answer

Both capital and operational expenditures decrease immediately.

Answer

Capital and operational expenditures remain unchanged because costs simply move.

Answer

Capital expenditures increase while operational expenditures decrease.

Question 2

A cloud engineer must ensure that an Amazon S3 bucket used for regulatory archives cannot have objects deleted or overwritten by any user, including the root account, for a fixed retention period of seven years. Which combination of settings should the engineer configure?

Accepted Answer

Enable S3 Object Lock in compliance mode with a seven-year retention period. S3 Object Lock in compliance mode enforces write-once-read-many protection that no user, including the root account, can override before the retention period ends. Combined with a seven-year retention period, it provides the immutable archive the regulation demands, unlike governance mode or policy-based controls that privileged users can bypass.

Answer

Configure an S3 Lifecycle rule transitioning objects to S3 Glacier Deep Archive

Answer

Enable S3 Versioning and attach a bucket policy denying s3:DeleteObject

Answer

Enable S3 Object Lock in governance mode with a seven-year retention period

Question 3

A cloud operations team is preparing to migrate a business-critical workload to a public cloud provider. Leadership wants assurance that the provider's internal controls, security posture, and compliance status have been independently validated. Which TWO artifacts should the team request from the cloud provider to satisfy this due diligence? (Choose two.)

Accepted Answer

A SOC 2 Type II report covering security, availability, and confidentiality trust services criteria. SOC 2 Type II reports and ISO/IEC 27001 certificates are both produced through independent third-party audits of a provider's controls and management systems. They give leadership verifiable evidence of security posture and compliance status, whereas internal metrics, marketing material, and SLAs lack independent validation.

Answer

The provider's internal security awareness training completion statistics

Answer

A marketing whitepaper describing the provider's security architecture

Answer

The provider's service level agreement listing uptime commitments

Question 4

A university's research department wants to store and analyze sensitive genomic data. The data must remain on infrastructure dedicated to a specific group of accredited universities that share common compliance requirements. Which cloud deployment model best fits this need?

Accepted Answer

Community cloud. A community cloud serves a defined group of organizations that share compliance, security, or mission requirements. The accredited universities need shared infrastructure restricted to their community while meeting common genomic data regulations, making this deployment model the natural fit. It balances collaboration and cost sharing against the exclusivity that public tenancy cannot guarantee.

Answer

Private cloud

Answer

Public cloud

Answer

Hybrid cloud

Question 5

A retail company wants to run its e-commerce application in the cloud but must ensure that a hardware failure in one data center does not take the storefront offline. The company's architects plan to deploy identical application stacks into multiple isolated locations within the same metropolitan area to achieve low-latency failover. Which cloud construct are they designing around?

Accepted Answer

Availability zones within a region. Availability zones are the isolated, low-latency data center groups inside a region that allow an application to survive the failure of any single facility. By deploying identical stacks into multiple zones in the same metro area, the retailer achieves both hardware-failure resilience and fast failover, which matches the architects' stated design goal.

Answer

A content delivery network edge location

Answer

A virtual private network gateway

Answer

A single region with one availability zone

Question 6

A logistics company runs its dispatch platform in a public cloud. Management asks the cloud team to identify the factor that most directly determines whether the company can move that platform to a different cloud provider later. Which consideration should the team evaluate first?

Accepted Answer

The use of proprietary managed services and nonstandard APIs in the platform's architecture.. Portability is determined by architectural dependencies on provider-specific services, APIs, and data formats. A platform built on open standards and portable components can be migrated with moderate effort, while one woven into proprietary managed services becomes costly to relocate. Evaluating these dependencies first tells the company whether a future provider change is realistic.

Answer

The monthly cost difference between the two providers' compute instances.

Answer

The geographic distance between the company's offices and provider data centers.

Answer

The number of availability zones offered by each provider.

Question 7

A multinational corporation stores personal data of European Union residents in a public cloud. The legal team must ensure the company can lawfully transfer that data to a cloud region outside the EU while meeting GDPR requirements. Which of the following is the most appropriate mechanism to rely on?

Accepted Answer

Standard Contractual Clauses (SCCs) approved by the European Commission. Standard Contractual Clauses are European Commission-approved terms that impose enforceable data protection obligations on the data importer, making them a recognized transfer mechanism under the GDPR. A DPA governs processor relationships but does not authorize transfers, while encryption and public privacy policies serve different purposes. The legal team should pair SCCs with a transfer impact assessment for the specific cloud region.

Answer

Encrypting the data with customer-managed keys before storing it in the non-EU region

Answer

Relying on the cloud provider's global privacy policy published on its website

Answer

A data processing agreement (DPA) signed with the cloud provider

Question 8

A logistics company is choosing a deployment model for a new shipment-tracking platform. The platform must integrate tightly with internal warehouse systems that cannot be exposed to the public internet, yet the company wants the scalability and managed services of a public cloud for the customer-facing portal. Which deployment model best satisfies both needs?

Accepted Answer

Hybrid cloud. Hybrid cloud is designed for exactly this split: sensitive internal systems remain on private infrastructure while scalable, customer-facing components run in the public cloud, with secure connectivity between them. It satisfies both the privacy constraint on warehouse integration and the desire for public cloud elasticity for the portal.

Answer

Public cloud only

Answer

Community cloud

Answer

Private cloud only

Question 9

A retailer's cloud architect is designing a strategy to avoid vendor lock-in for a containerized order-processing application. The application must be able to move between Amazon Elastic Kubernetes Service and Azure Kubernetes Service with minimal rework. Which approach best supports this goal?

Accepted Answer

Package the application as standard OCI container images and deploy with Kubernetes manifests and Helm charts. Portability across Kubernetes services comes from relying on standard OCI images plus portable orchestration artifacts such as Kubernetes manifests and Helm charts. Provider-specific platforms like ECS task definitions, App Mesh, or Azure Container Apps introduce dependencies that must be rewritten during migration, defeating the anti-lock-in goal.

Answer

Use AWS Fargate profiles with task definitions written in Amazon ECS format

Answer

Deploy the application using Azure Container Apps with Dapr sidecars

Answer

Integrate the application with AWS App Mesh for service-to-service traffic management

Question 10

A cloud operations team is implementing a cost optimization strategy for their Google Cloud environment. They want to reduce spend on Compute Engine instances without affecting performance. Which TWO actions should they take? (Choose two.)

Accepted Answer

Purchase committed use discounts for steady-state workloads.. Committed use discounts offer substantial savings for predictable workloads by committing to a term, while autoscaling ensures resources match demand, reducing waste. Both actions directly reduce costs without compromising performance. Preemptible VMs risk termination, custom machine types alone may not yield significant savings, and sustained use discounts are automatic rather than an action.

Answer

Enable sustained use discounts by running instances continuously for a month.

Answer

Switch all instances to preemptible VMs to reduce costs.

Answer

Use custom machine types to exactly match workload requirements.

Question 11

A national retailer is building a business case for migrating its e-commerce platform to a public cloud. The finance team wants the analysis to capture the full economic picture across the entire lifecycle. Which TWO cost categories must be included in a complete total cost of ownership (TCO) comparison? (Choose two.)

Accepted Answer

Data egress and inter-region transfer charges. A credible lifecycle TCO includes not only compute and storage fees but also data egress and cross-region transfer charges, plus the labor and tooling required to assess, refactor, and migrate applications. These two categories are frequently underestimated or omitted, yet they materially affect the break-even point. Capturing them produces a realistic comparison against the on-premises baseline.

Answer

The provider's marketing spend on advertising campaigns

Answer

The salaries of the provider's data center security guards

Answer

The resale value of the provider's decommissioned hardware

Question 12

A company is deploying a new web application on AWS. The security team requires that all data stored in Amazon S3 be encrypted at rest. The operations team wants to minimize management overhead while ensuring compliance. Which S3 encryption option should they choose?

Accepted Answer

SSE-S3 with AWS managed keys. SSE-S3 with AWS managed keys provides automatic encryption at rest with no additional management from the operations team. AWS handles key rotation and storage, ensuring compliance with minimal effort. Other options require more active key management, increasing overhead. SSE-S3 is the simplest and most aligned with the requirement to minimize management overhead.

Answer

SSE-C with customer-provided keys

Answer

SSE-KMS with customer managed keys

Answer

Client-side encryption with a custom key management solution

Question 13

A software company is evaluating a cloud provider for a new application that will process payment card data. The security team must confirm that the provider's environment supports the company's PCI DSS obligations. Which of the following should the team verify first?

Accepted Answer

That the provider is listed as a PCI DSS validated service provider on the PCI Security Standards Council website. Checking the PCI Security Standards Council's list of validated service providers confirms that the provider has been assessed against PCI DSS for the relevant services. This documented validation is the first step in determining whether the provider can support the company's cardholder data environment. Cost, marketing language, and hardware installation options do not substitute for verified compliance.

Answer

That the provider allows the company to install its own hardware security modules in the data center

Answer

That the provider's marketing materials mention security as a core value

Answer

That the provider offers the lowest cost per gigabyte for storage in the target region

Question 14

A cloud operations team is implementing a governance strategy to manage risk across multiple business units using different public cloud providers. The governance board wants to establish controls that provide centralized visibility and consistent policy enforcement. Which two of the following should the team implement? (Choose two.)

Accepted Answer

A cloud access security broker (CASB) to enforce data loss prevention and visibility policies across providers. Centralized visibility and consistent policy enforcement across multiple providers are best achieved with a cloud access security broker for policy control and a centralized cloud management platform for aggregated inventory, cost, and compliance data. Independent baselines, fragmented key custody, and disabled logging all reduce oversight and increase risk, so they conflict with the governance board's objectives.

Answer

Storing all encryption keys exclusively with each business unit's local administrators

Answer

Disabling audit logging in providers that charge for log ingestion to reduce operational costs

Answer

Allowing each business unit to define its own security baselines independently to preserve agility

Question 15

A media streaming company wants to reduce the risk of a single cloud provider outage taking its service offline. Leadership proposes running the primary platform with one provider and a warm standby with a second provider. Which business consideration most directly justifies the added complexity and cost of this arrangement?

Accepted Answer

It reduces the impact of a provider-wide outage by enabling failover to an independent platform.. A warm standby with a second provider protects against provider-wide failures because the two environments share no common infrastructure or control plane. When the primary provider suffers a broad outage, the independent standby can take over, preserving service continuity. The added architectural complexity and duplicate cost are justified by this reduction in correlated failure risk.

Answer

It eliminates the need for any disaster recovery planning within each provider.

Answer

It guarantees lower subscription pricing through competitive bidding between providers.

Answer

It allows the company to avoid complying with data residency regulations in each region.