CLO-002 Practice Test 7 — 10 Questions

Question 1

An organization is migrating to a public cloud but has a small amount of highly sensitive data that cannot reside in a public environment. Which strategy should they use?

Accepted Answer

Hybrid cloud strategy. A hybrid cloud strategy keeps highly sensitive data on-premises or in a private environment while leveraging the public cloud for less sensitive workloads. This satisfies the constraint that sensitive data cannot reside in a public environment while still enabling cloud benefits for the rest of the organization.

Answer

Full public cloud migration

Answer

Multi-tenant public cloud

Answer

Edge computing

Question 2

An company is performing a cloud migration. What is the primary purpose of a 'Cloud Center of Excellence' (CCoE)?

Accepted Answer

Establishing best practices and governance. A Cloud Center of Excellence is a cross-functional team that establishes cloud best practices, governance, standards, and reusable patterns to guide an organization's cloud adoption. Its primary purpose is to provide centralized expertise and guardrails rather than to perform day-to-day operational tasks. This enables consistent, secure, and cost-effective cloud migration across business units.

Answer

Managing physical server repairs

Answer

Executing code deployments

Answer

Directly handling all customer support tickets

Question 3

Which tool provides a 'Right-sizing' recommendation for an underutilized virtual machine?

Accepted Answer

Compute Optimizer. AWS Compute Optimizer analyzes CloudWatch metrics (CPU, memory, network, disk) over a lookback period and generates right-sizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It flags over-provisioned resources so you can downsize instance types and reduce cost. This is exactly the 'right-sizing' capability described in the question.

Answer

IAM Policy Generator

Answer

CloudFront

Answer

Network ACLs

Question 4

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a dedicated account- and bucket-level setting that overrides any ACL or bucket policy granting public access, providing a hard guardrail against accidental public exposure. Enabling it at the account level ensures that even if someone later attaches a permissive bucket policy or ACL, public access remains blocked. This is the AWS-recommended control specifically designed to prevent the incident described.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 5

When a cloud service experiences a global outage, which document should you check to verify the current status of the provider's infrastructure?

Accepted Answer

Cloud provider status dashboard. A cloud provider's public status dashboard (e.g., status.cloud.google.com, status.aws.amazon.com) is the authoritative, real-time source for current service health and ongoing incidents. It shows per-region, per-service status and incident timelines. This is the correct place to verify whether an outage is provider-side and its scope.

Answer

Internal IT wiki

Answer

Billing report

Answer

Service Level Agreement (SLA) doc

Question 6

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. An IAM Role is designed for delegation: it has no long-term credentials and instead issues temporary security credentials via STS when assumed. A third-party service provider can be granted permission to assume a role in your account using a trust policy, giving them time-limited access without ever sharing your access keys. This is the AWS best practice for cross-account and third-party access.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 7

Which TWO scenarios are appropriate for using a load balancer?

Accepted Answer

To distribute traffic across multiple instances. Option C is correct because a load balancer's primary function is to distribute incoming traffic across multiple backend instances, preventing any single instance from being overwhelmed and enabling horizontal scaling. Option D is correct because by spreading requests across multiple instances and performing health checks, a load balancer can route traffic away from unhealthy instances, thereby improving fault tolerance and availability. Option A is incorrect because persistent data storage is the role of databases or storage services, not load balancers. Option B is incorrect because reducing internet latency is achieved through CDNs or edge caching, not load balancing. Option E is incorrect because encryption of data at rest is handled by storage-level encryption mechanisms, not load balancers.

Answer

To store persistent data

Answer

To reduce network latency to the internet

Answer

To encrypt data at rest

Question 8

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Accepted Answer

Allow TCP 443 from 0.0.0.0/0. To allow only standard HTTPS traffic, the inbound rule must permit TCP port 443. Option A specifies TCP 443 from 0.0.0.0/0, which allows HTTPS from any source — this is the correct port and protocol for HTTPS. While 0.0.0.0/0 is broad, the question asks which rule allows only standard HTTPS traffic, and TCP 443 is the defining characteristic of HTTPS.

Answer

Allow TCP 80 from 0.0.0.0/0

Answer

Allow all TCP from 0.0.0.0/0

Answer

Allow UDP 443 from 0.0.0.0/0

Question 9

A healthcare company is migrating a patient records system to the cloud. The system must comply with strict data residency regulations that require all patient data to remain within the country. The company also wants to minimize latency for local users. Which cloud deployment model is MOST appropriate?

Accepted Answer

Private cloud hosted within the country. A private cloud hosted within the country is the most appropriate because it guarantees that patient data remains within national borders, directly meeting data residency regulations. It also gives the healthcare company control over the infrastructure, which helps with compliance audits and local latency optimization. The other models either risk cross-border data movement or do not inherently ensure in-country data location.

Answer

Community cloud shared with other healthcare providers globally

Answer

Hybrid cloud using a public cloud for primary storage and an on-premises private cloud for backup

Answer

Public cloud with resources in multiple global regions

Question 10

Which TWO criteria are essential when selecting a cloud vendor for an enterprise?

Accepted Answer

Compliance and regulatory certifications. Option D is correct because compliance and regulatory certifications (for example ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, or GDPR alignment) are essential to verify that the vendor meets the legal, industry, and data-protection obligations the enterprise must satisfy. Option E is correct because the Service Level Agreement defines measurable guarantees such as uptime percentage, latency, RTO/RPO, and remediation or credits, which directly determine whether the cloud service can meet the enterprise's availability and performance requirements. Options A, B, and C are not essential selection criteria: free trial gifts have no bearing on production suitability, the number of employees does not indicate service quality or compliance, and the headquarters location alone does not establish where data is stored or processed, which is what actually matters for regulatory and latency concerns.

Answer

Availability of free trial gifts

Answer

The number of employees at the cloud company

Answer

The physical location of the cloud company's headquarters