CLO-002 Practice Test 2 — 30 Questions

Question 1

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the database and its backups in the region corresponding to each customer's country and disable cross-region replication.. Data residency is enforced by controlling the physical location of storage, including replicas and backups. Deploying the database and its backups in the country of collection and disabling cross-region replication keeps every copy of the record within the required jurisdiction, which is the only configuration among the choices that directly enforces the requirement.

Answer

Use a cloud access security broker to inspect data in transit between regions.

Answer

Enable geo-restriction at the content delivery network edge for all customer traffic.

Answer

Apply resource tags indicating the customer's country and use them in cost allocation reports.

Question 2

Which THREE of the following are necessary to manage multi-cloud deployments effectively?

Accepted Answer

Unified monitoring tools. Unified monitoring tools (B) are necessary because multi-cloud deployments span AWS, Azure, and GCP, so a single pane of glass aggregating metrics, logs, and traces across providers is required to detect issues and maintain consistent observability. Infrastructure as Code (D) is essential because declarative templates (e.g., Terraform, CloudFormation, ARM/Bicep) let you provision and version identical, repeatable environments across heterogeneous clouds, avoiding manual drift. Centralized identity management (E) is required to federate authentication and authorization across providers using standards like SAML 2.0 or OIDC, so users and service accounts have one consistent identity and RBAC policy set rather than per-cloud silos. Ignoring one cloud provider (A) is wrong because it defeats the purpose of multi-cloud management and leaves resources ungoverned, while printing physical logs (C) is neither scalable nor a real management practice compared with centralized log aggregation.

Answer

Ignoring one cloud provider

Answer

Printing physical logs

Question 3

Which cloud service model would best suit a company that needs complete control over the network configuration and operating system but wants to avoid physical server maintenance?

Accepted Answer

IaaS. IaaS provides virtualized computing resources over the internet, giving the customer control over the operating system, storage, and network configuration while the provider manages the physical infrastructure. This matches the requirement for complete control over network and OS without physical server maintenance.

Answer

PaaS

Answer

SaaS

Answer

Serverless

Question 4

You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?

Accepted Answer

DynamoDB table. DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Answer

S3 Versioning

Answer

Terraform Cloud Workspaces

Answer

IAM Policy

Question 5

A cloud operations team wants to automatically remediate an EC2 instance that has been running with CPU utilization below 5% for 14 consecutive days. The team needs the remediation to trigger without manual intervention and to notify a Slack channel. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

AWS Systems Manager Automation. The requirement is an event-driven, multi-step remediation that stops an underutilized instance and notifies a channel without human action. Systems Manager Automation provides runbooks that can be triggered by CloudWatch alarms or EventBridge rules, execute API calls, and integrate with notification services. The other services either only assess compliance, only provision infrastructure, or only give recommendations, so none can orchestrate the full workflow autonomously.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudFormation

Question 6

You need to store audit logs that are immutable and cannot be deleted for a set period. Which feature should you enable?

Accepted Answer

Object Lock. S3 Object Lock enforces WORM (Write Once, Read Many) semantics, preventing objects from being deleted or overwritten for a specified retention period. It is the correct feature for immutable audit logs that must be preserved for compliance. Object Lock requires S3 Versioning to be enabled on the bucket and is configured in Governance or Compliance mode.

Answer

Access Logs

Answer

Versioning

Answer

Encryption

Question 7

A company uses a hybrid cloud. They need to move a database workload to the cloud that has strict regulatory requirements. Which deployment model is most appropriate?

Accepted Answer

Private cloud deployment. Private cloud deployment is correct because strict regulatory requirements (e.g., PCI-DSS, HIPAA, GDPR data residency, FedRAMP) often mandate dedicated infrastructure, full control over data location, and isolation from other tenants. A private cloud provides single-tenant hardware and network, enabling the organization to meet compliance controls around data sovereignty, access, and auditing that multi-tenant public clouds may not satisfy without extensive additional controls.

Answer

Public cloud multi-tenant

Answer

Community cloud

Answer

Serverless functions

Question 8

A retail company is using a public cloud provider. The IT manager wants to understand how the cloud provider's use of shared physical resources affects the company's data. Which cloud characteristic ensures that the provider's other customers cannot access the retail company's data?

Accepted Answer

Multi-tenancy with logical isolation. Multi-tenancy with logical isolation is the cloud characteristic that allows multiple customers to share physical resources while keeping their data separate. The provider uses virtualization, network segmentation, and access controls to ensure that one tenant cannot access another's data. Elasticity, measured service, and on-demand self-service are important cloud traits but do not provide the security isolation required.

Answer

Measured service

Answer

On-demand self-service

Answer

Elasticity

Question 9

A cloud administrator is tasked with reducing idle resource costs in AWS. Which tool should be configured to provide specific rightsizing recommendations for EC2 instances based on historical utilization data?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical CloudWatch metrics (CPU, memory if the agent is installed, network, disk) and applies machine-learning models to generate specific rightsizing recommendations for EC2 instances, including over-provisioned and under-provisioned findings. It is purpose-built for this task and integrates with Cost Explorer and Trusted Advisor.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 10

Which technology is primarily used to isolate applications while sharing the same OS kernel?

Accepted Answer

Containers. Containers share the host OS kernel and use Linux primitives like namespaces (for isolation of process, network, mount, PID views) and cgroups (for resource limits) to isolate applications from each other. Because they do not bundle a full OS, containers are lightweight and start in milliseconds, unlike VMs which each run their own kernel. This kernel-sharing model is the defining characteristic that distinguishes containers from virtual machines.

Answer

Bare Metal

Answer

Virtual Machines

Answer

Hypervisors

Question 11

You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?

Accepted Answer

Re-platforming. Re-platforming (lift, tinker, and shift) involves making targeted changes to the application or its runtime to take advantage of cloud capabilities — including moving to a supported OS or managed service. Since the legacy OS is unsupported, re-platforming lets you migrate while modernizing the OS/runtime, avoiding the security and support risks of re-hosting an unsupported platform.

Answer

Re-hosting (Lift and Shift)

Answer

Retaining

Answer

Retiring

Question 12

When evaluating a cloud service provider (CSP), which TWO of the following business-focused documentation should be requested to verify the vendor's reliability and security posture?

Accepted Answer

SOC 2 Type II reports. Option C, SOC 2 Type II reports, is correct because they are independent audit attestations covering the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) over a defined review period, giving direct evidence of the vendor's security controls and operational reliability. Option E, Service Level Agreement (SLA) documentation, is correct because it contractually defines measurable commitments such as uptime percentage, availability targets, performance metrics, and remedies or credits for failures, which is exactly what a business needs to assess vendor reliability. The unmarked options do not belong: A, the quarterly stock earnings report, reflects financial market performance rather than security posture or service reliability; B, employee payroll records, is confidential HR data irrelevant to security evaluation and would raise privacy concerns; and D, internal office floor plans, is physical layout information with no bearing on the CSP's security or reliability assurances.

Answer

The provider's quarterly stock earnings report

Answer

Employee payroll records

Answer

Internal office floor plans

Question 13

A global company needs to ensure compliance with GDPR. Which feature of a cloud provider is most critical for compliance?

Accepted Answer

Data residency controls. GDPR requires that personal data of EU residents be stored and processed under specific legal frameworks, and data residency controls let organizations pin data to specific geographic regions (e.g., EU-West) to satisfy these requirements. This is the most critical cloud feature for GDPR compliance because it directly addresses the regulation's data sovereignty and cross-border transfer rules. Without residency controls, data may be replicated or processed outside approved jurisdictions, creating legal exposure.

Answer

Auto-scaling groups

Answer

Multi-region replication

Answer

Public IP addresses

Question 14

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Accepted Answer

TLS 1.2/1.3. TLS 1.2/1.3 (A) is correct because it encrypts application-layer traffic such as HTTPS, securing data as it moves between clients and cloud services. Direct Connect with MACsec (B) is correct because MACsec provides IEEE 802.1AE link-layer encryption on dedicated AWS Direct Connect connections, protecting data in transit over the private network path. VPN Tunnels using IPsec (E) are correct because IPsec encrypts and authenticates IP packets across untrusted networks, securing site-to-site or client-to-cloud transit. Server-side encryption at rest (C) is incorrect because it protects stored data on disks, not data moving across a network. User access logs (D) are incorrect because they record activity for auditing and monitoring but do not encrypt or otherwise secure data in transit.

Answer

Server-side encryption at rest

Answer

User access logs

Question 15

An organization runs a containerized e-commerce platform on a managed Kubernetes service. During a flash sale, response times degrade sharply. Metrics show the application pods are healthy and the database is not saturated, but the cluster reports that some nodes cannot schedule new pods because of resource pressure. The team must add capacity automatically when pod demand rises and remove it when demand falls. Which action should the team take?

Accepted Answer

Enable the cluster autoscaler so the node pool grows and shrinks with pending pod demand. The cluster autoscaler is designed for exactly this situation: it detects pods that are pending because no node has enough allocatable resources, then adds nodes to the pool, and later removes underutilized nodes when demand subsides. Because the workload pods are already healthy and the database is not the bottleneck, the missing piece is automatic node-level capacity, which this component supplies.

Answer

Configure a horizontal pod autoscaler to increase the replica count based on CPU utilization

Answer

Increase the CPU request and limit values on the existing application deployment

Answer

Create a pod disruption budget to guarantee minimum availability during scaling events

Question 16

Which cloud service model is best suited for end-users who want to use software via a browser?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers fully managed applications to end-users over the internet, typically accessed through a browser without any installation or infrastructure management. Examples include Gmail, Salesforce, and Microsoft 365. This matches the question's description of end-users consuming software via a browser.

Answer

DaaS

Answer

IaaS

Answer

PaaS

Question 17

Which THREE are key characteristics of cloud computing?

Accepted Answer

Measured service. A. Measured service is correct because cloud providers meter resource usage (compute, storage, bandwidth) and bill customers based on consumption, enabling pay-as-you-go pricing. B. Broad network access is correct because cloud services are delivered over the network via standard mechanisms (e.g., HTTP/HTTPS, APIs) and accessible from diverse client devices such as laptops, phones, and tablets. E. Rapid elasticity is correct because cloud resources can scale out and in automatically or on demand to match workload changes, appearing nearly unlimited to the consumer. C. Static hardware provisioning is incorrect because cloud computing emphasizes dynamic, on-demand provisioning rather than fixed, pre-allocated hardware. D. Physical media access is incorrect because cloud services are accessed remotely over networks, not through physical media such as tapes, disks, or direct hardware connections.

Answer

Static hardware provisioning

Answer

Physical media access

Question 18

Which cloud principle refers to the ability to pay for only the compute power you consume?

Accepted Answer

Measured service. Measured service is the cloud principle that provides metering of resource usage, enabling pay-per-use billing. In this model, the cloud provider automatically monitors, controls, and reports resource consumption (e.g., compute hours, storage GB, data transfer), and customers are billed only for what they consume. This is distinct from on-demand self-service, which allows provisioning without human interaction, but does not inherently include metering. Thus, measured service directly supports the ability to pay only for the compute power used.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 19

A small marketing agency wants to move its customer relationship management (CRM) system to the cloud. The agency has limited IT staff and wants the provider to manage the operating system, middleware, and runtime, while the agency only manages its custom CRM application and data. Which cloud service model best fits this requirement?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a managed platform that includes the operating system, middleware, and runtime, leaving the customer responsible only for the application and data. This aligns with the agency's need to offload infrastructure management while retaining control over its custom CRM application. IaaS requires more customer management, SaaS removes application control, and FaaS is unsuitable for a full CRM system.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 20

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates and normalizes findings from services like AWS Config, Inspector, GuardDuty, and third-party tools, and it includes the AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark standards. Running the CIS standard in Security Hub produces a consolidated compliance view showing which resources are non-compliant, which is exactly what the compliance officer needs. This makes Security Hub the right reporting layer.

Answer

AWS Config

Answer

AWS Systems Manager

Answer

AWS CloudTrail