CLO-002 Practice Test 7 — 10 Questions

Question 1

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Accepted Answer

S3 Object Lock in Compliance Mode. Object locking or WORM (Write Once Read Many) policies are designed for regulatory compliance in storage.

Answer

S3 Intelligent Tiering

Answer

S3 Standard Storage Class

Answer

S3 Cross-Region Replication

Question 2

Which TWO things should be checked when a cloud service is exceeding its budget?

Accepted Answer

Cost allocation reports. Budget overruns are typically caused by either runaway resource usage or inefficient resource selection.

Answer

The provider's marketing website

Answer

Internet speed tests

Answer

Internal employee email logs

Question 3

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Accepted Answer

Site-to-Site VPN. A VPN tunnel provides an encrypted connection over the public internet, essential for hybrid connectivity security.

Answer

VPC Peering

Answer

IGW (Internet Gateway)

Answer

Direct Connect

Question 4

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Accepted Answer

Elasticity. Elasticity is the defining characteristic of cloud computing that allows scaling based on demand.

Answer

Multi-tenancy

Answer

High Availability

Answer

Scalability

Question 5

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Accepted Answer

Separation of Duties. Separation of duties ensures that critical tasks are divided between multiple people to prevent fraud or error.

Answer

Encryption at rest

Answer

Multi-Factor Authentication (MFA)

Answer

Password Complexity Policy

Question 6

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a setting that overrides bucket-level permissions to prevent public exposure.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 7

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. IAM Roles are designed for temporary, cross-account, or service-based access via tokenized credentials.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 8

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config provides rules to check for tags and can trigger automation to remediate non-compliance.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 9

What is the primary risk mitigation strategy when storing data in a single availability zone?

Accepted Answer

Multi-AZ deployment. If an entire availability zone fails, data in that zone is lost; using multi-AZ deployments mitigates this risk.

Answer

Using stronger encryption

Answer

Implementing MFA

Answer

Increasing compute power

Question 10

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. Cloud providers maintain a public Status Dashboard to track the real-time health of their services.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc