CLO-002 Practice Test 3 — 30 Questions

Question 1

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Accepted Answer

S3 Object Lock in Compliance Mode. Object locking or WORM (Write Once Read Many) policies are designed for regulatory compliance in storage.

Answer

S3 Intelligent Tiering

Answer

S3 Standard Storage Class

Answer

S3 Cross-Region Replication

Question 2

Which TWO things should be checked when a cloud service is exceeding its budget?

Accepted Answer

Cost allocation reports. Budget overruns are typically caused by either runaway resource usage or inefficient resource selection.

Answer

The provider's marketing website

Answer

Internet speed tests

Answer

Internal employee email logs

Question 3

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Accepted Answer

Site-to-Site VPN. A VPN tunnel provides an encrypted connection over the public internet, essential for hybrid connectivity security.

Answer

VPC Peering

Answer

IGW (Internet Gateway)

Answer

Direct Connect

Question 4

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Accepted Answer

Elasticity. Elasticity is the defining characteristic of cloud computing that allows scaling based on demand.

Answer

Multi-tenancy

Answer

High Availability

Answer

Scalability

Question 5

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Accepted Answer

Separation of Duties. Separation of duties ensures that critical tasks are divided between multiple people to prevent fraud or error.

Answer

Encryption at rest

Answer

Multi-Factor Authentication (MFA)

Answer

Password Complexity Policy

Question 6

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a setting that overrides bucket-level permissions to prevent public exposure.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 7

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. IAM Roles are designed for temporary, cross-account, or service-based access via tokenized credentials.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 8

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config provides rules to check for tags and can trigger automation to remediate non-compliance.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 9

What is the primary risk mitigation strategy when storing data in a single availability zone?

Accepted Answer

Multi-AZ deployment. If an entire availability zone fails, data in that zone is lost; using multi-AZ deployments mitigates this risk.

Answer

Using stronger encryption

Answer

Implementing MFA

Answer

Increasing compute power

Question 10

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. Cloud providers maintain a public Status Dashboard to track the real-time health of their services.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc

Question 11

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

Accepted Answer

Faster time-to-market for new features. Agility refers to the ability to provision resources quickly, allowing for faster experimentation and time-to-market.

Answer

Increased server uptime

Answer

Reduced capital expenditure

Answer

Improved compliance reporting

Question 12

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Accepted Answer

Performing periodic penetration tests. Risk mitigation includes regular audits, automated security controls, and strict identity management.

Answer

Reducing the number of cloud regions used

Answer

Using only one cloud provider

Question 13

Which TWO of the following are key steps in a Cloud Incident Response process?

Accepted Answer

Conducting a post-incident review. Incident response requires structured preparation, containment, and post-incident analysis.

Answer

Purchasing new hardware for the data center

Answer

Notifying the cloud provider's sales team

Answer

Updating the company's social media

Question 14

Which THREE items should be included in an incident response plan?

Accepted Answer

Monitoring and alerting thresholds. An incident plan must define who does what (roles), how they identify the issue (monitoring), and how they communicate.

Answer

Employee training manuals

Answer

Budget approval workflows

Question 15

What is the primary benefit of using a Managed Service (like RDS) over a self-managed database on a virtual machine?

Accepted Answer

Reduced operational overhead. Managed services handle operational tasks like patching, backups, and maintenance, reducing the operational burden on the user.

Answer

Access to underlying OS

Answer

Lower cost

Answer

Unlimited performance

Question 16

Your organization uses a 'Shared Responsibility Model'. Which of the following is typically the customer's responsibility in the cloud?

Accepted Answer

Configuration of security groups. In most cloud models, the provider manages the physical hardware, while the customer manages data, patches, and configurations.

Answer

Maintenance of the host OS kernel

Answer

Redundancy of the physical power grid

Answer

Physical security of the data center

Question 17

You are managing a fleet of cloud servers and notice that CPU usage is consistently at 95% during peak hours. What operational action should you take to restore performance?

Accepted Answer

Scale out the application. Horizontal scaling (adding more instances) or vertical scaling (increasing instance size) are standard responses to high utilization.

Answer

Change the time zone

Answer

Reduce the logging level

Answer

Disable the firewall

Question 18

Which THREE services allow you to restrict network access in a cloud VPC?

Accepted Answer

Web Application Firewalls (WAF). Network security in the cloud is enforced through Security Groups, Network ACLs, and Firewalls.

Answer

Content Delivery Network

Answer

Auto Scaling Groups

Question 19

An administrator is setting up a new cloud account. What is the first security best practice they should implement?

Accepted Answer

Enable MFA on the root account. Enabling MFA is the most critical first step to secure any account access.

Answer

Increase instance capacity

Answer

Create a support ticket

Answer

Upload a custom logo

Question 20

An administrator wants to ensure that a storage bucket is not accidentally deleted. Which feature should be enabled?

Accepted Answer

Bucket versioning. Soft delete or bucket versioning ensures that data can be recovered if accidentally deleted.

Answer

Public access block

Answer

Storage encryption

Answer

Cross-region replication