CLO-002 Practice Test 9 — 10 Questions

Question 1

A company is migrating an on-premises database to a public cloud. The database requires low latency and high IOPS. Which storage type should the architect select?

Accepted Answer

Provisioned IOPS SSD. A Provisioned IOPS SSD (e.g., AWS io1/io2, Azure Premium SSD v2) is designed for latency-sensitive, high-throughput database workloads because it lets you specify both IOPS and throughput independently of capacity. This directly satisfies the low-latency and high-IOPS requirements of a migrated on-premises database. The other options are optimized for cost, capacity, or archival rather than sustained high-performance random I/O.

Answer

Cold Storage

Answer

Magnetic HDD

Answer

Object Storage

Question 2

What is the primary risk mitigation strategy when storing data in a single availability zone?

Accepted Answer

Multi-AZ deployment. The primary risk of storing data in a single availability zone is that a failure of that AZ (power, network, natural disaster) would make the data unavailable or lost. Multi-AZ deployment mitigates this by replicating data across multiple AZs, ensuring high availability and durability. This is the fundamental risk mitigation strategy for AZ-level failures.

Answer

Using stronger encryption

Answer

Implementing MFA

Answer

Increasing compute power

Question 3

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Accepted Answer

Separation of Duties. Separation of Duties (SoD) is the security principle that divides critical functions among multiple individuals so that no single administrator has end-to-end control over a sensitive process. By splitting responsibilities — for example, one admin provisions resources while another approves access — SoD prevents a single actor from both performing and concealing a malicious or erroneous action. This directly addresses the requirement that no single administrator has full control.

Answer

Encryption at rest

Answer

Multi-Factor Authentication (MFA)

Answer

Password Complexity Policy

Question 4

A company is migrating to the cloud to scale for seasonal traffic spikes. Which cloud characteristic best addresses this business need?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to automatically scale up or down based on demand, which directly addresses seasonal traffic spikes. It enables the company to provision additional capacity during peak periods and release it when demand drops, paying only for what is used. This matches the business need of scaling for variable traffic without over-provisioning.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 5

Which TWO of the following are key responsibilities of a Cloud Governance Committee?

Accepted Answer

Establishing security and compliance standards. Option C is correct because a Cloud Governance Committee sets the overarching security and compliance standards that all cloud workloads must adhere to, defining policies, controls, and guardrails rather than performing hands-on administration. Option E is correct because defining cloud investment policies—such as budgeting, cost allocation, funding models, and financial guardrails—is a core governance function that steers how cloud resources are funded and consumed across the organization. Options A and B are incorrect because installing OS patches and managing individual VM performance are operational, day-to-day tasks handled by cloud operations or systems administrators, not by a governance body. Option D is incorrect because writing application source code is a development responsibility, outside the strategic and policy-setting scope of a governance committee.

Answer

Installing OS patches

Answer

Managing individual virtual machine performance

Answer

Writing application source code

Question 6

A financial services firm is evaluating a cloud provider for a new analytics platform. The firm's auditors require proof that the provider undergoes independent security assessments and that the firm can review those results before signing. Which cloud concept should the firm examine?

Accepted Answer

The provider's compliance certifications and audit reports. Auditors seeking evidence of independent security assessment need artifacts such as SOC 2 reports, ISO 27001 certificates, or equivalent attestations. These documents show that a third party evaluated the provider's controls. Uptime agreements, API quotas, and egress pricing address availability, capacity, and cost, not the compliance assurance the firm requires.

Answer

The provider's data egress pricing schedule

Answer

The provider's service level agreement for uptime

Answer

The provider's published API rate limits and quotas

Question 7

Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?

Accepted Answer

Centralizing security and governance. Option C (Centralizing security and governance) is correct because a CCoE consolidates cloud security policies, guardrails, IAM standards, and compliance controls so that every team adopts consistent, auditable governance rather than fragmented per-team practices. Option D (Standardizing cloud adoption patterns) is correct because the CCoE produces reusable reference architectures, landing zones, IaC templates, and well-architected best practices that make cloud deployments repeatable and reduce drift. Option E (Fostering cross-departmental collaboration) is correct because the CCoE is a cross-functional body that brings together security, finance, operations, and application teams to share knowledge, align priorities, and spread cloud expertise across the organization. Option A (Hiring software developers) is not a defining CCoE purpose, since developer recruitment is a line-management/HR activity rather than the CCoE's governance and enablement mission. Option B (Managing local desktop hardware) is unrelated to cloud adoption and falls under endpoint/IT support operations, not a Cloud Center of Excellence.

Answer

Hiring software developers

Answer

Managing local desktop hardware

Question 8

A company is using a SaaS application for email. Which part of the security responsibility remains with the company?

Accepted Answer

Identity and access management. In a SaaS model, the provider manages the application, servers, and infrastructure, but the customer remains responsible for identity and access management, including user accounts, passwords, and access policies. This is a key tenet of the Shared Responsibility Model.

Answer

Server physical security

Answer

Patching the application software

Answer

Database engine version

Question 9

A multinational corporation is evaluating cloud vendors for compliance with international data residency laws. Which selection criterion is most critical to ensure legal compliance during vendor selection?

Accepted Answer

Geographic availability of data centers. Data residency laws (such as GDPR, PIPL, or data localisation statutes) require that data be stored and processed within specific jurisdictions. The geographic location of the vendor's data centers directly determines whether data can legally reside in the required country or region, making it the most critical selection criterion for legal compliance.

Answer

Vendor market share in the industry

Answer

Availability of proprietary development tools

Answer

Cost of egress fees

Question 10

A startup is looking for a cloud deployment model where they pay only for resources used and share underlying hardware with other tenants. What model is this?

Accepted Answer

Public Cloud. A public cloud deployment model is characterised by resources owned by a third-party provider and shared among multiple tenants over the internet, with pay-as-you-go pricing based on consumption. The startup's requirements — pay only for resources used and share underlying hardware with other tenants — match the public cloud model exactly.

Answer

Hybrid Cloud

Answer

Community Cloud

Answer

Private Cloud