CLO-002 Business Principles OF Cloud Environments — Timed 10 Questions

Question 1

A healthcare company must comply with HIPAA. When selecting a cloud provider, which document provides the best assurance of compliance?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is an independent audit that evaluates a cloud provider's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6–12 months). For HIPAA compliance, it provides strong third-party assurance that the provider has implemented and consistently operated the controls necessary to protect ePHI. It is widely accepted by auditors and regulators as evidence of a mature compliance posture.

Answer

Vendor marketing brochure

Answer

Service Level Agreement (SLA)

Answer

Public pricing catalog

Question 2

An organization wants to use AWS Cost Explorer to identify cost-saving opportunities. Which filter should the administrator apply to find idle resources?

Accepted Answer

Usage Type Group. AWS Cost Explorer provides a 'Usage Type Group' filter that categorizes costs by specific usage types, such as 'EC2: Running Hours' or 'EC2: Data Transfer'. By filtering on usage type groups, administrators can isolate resources that are incurring charges but not actively used, such as stopped instances that still have attached EBS volumes or idle load balancers. This filter directly surfaces cost anomalies tied to resource utilization, making it the correct choice for identifying idle resources.

Answer

API Activity Log

Answer

Service Quotas

Answer

Resource Tagging

Question 3

A company is shifting from CapEx to OpEx for its infrastructure. Which financial metric should the CFO prioritize to justify this transition?

Accepted Answer

Return on Investment (ROI). When shifting from CapEx to OpEx, the CFO needs to justify the ongoing operational spend against the business value it delivers, and ROI is the metric that directly compares returns to costs. ROI expresses the financial benefit of the cloud investment as a percentage, making it the most relevant metric for evaluating whether the OpEx model pays off.

Answer

Debt-to-Equity Ratio

Answer

Internal Rate of Return (IRR)

Answer

Net Present Value (NPV)

Question 4

When assessing cloud readiness, what is a 'Legacy' application characteristic that might make migration difficult?

Accepted Answer

Hard-coded IP addresses. A 'Legacy' application characteristic that makes migration difficult is hard-coded IP addresses. Such applications have dependencies on specific IP addresses for communication, which can break when moved to the cloud where IP addresses are dynamic or change upon migration. This requires refactoring or workarounds like Elastic IPs, which may not be feasible for all components.

Answer

Written in Java

Answer

Used by a small team

Answer

Web-based interface

Question 5

Which THREE components are typically included in the cloud provider's 'Shared Responsibility Model' as the CUSTOMER'S responsibility?

Accepted Answer

Identity and access management (IAM) policies. In the cloud Shared Responsibility Model, the customer is always responsible for their own data, identities, and access controls, so option A (IAM policies) is correct because configuring users, roles, permissions, and least-privilege access is a customer task regardless of service model. Option B (client-side data encryption) is correct because encrypting data before it leaves the customer's environment, including key management choices, remains the customer's responsibility to protect data confidentiality. Option C (operating system patch management) is correct for IaaS deployments, where the customer manages the guest OS, including applying security patches, while the provider only patches the underlying hypervisor and infrastructure. Options D (global network physical cabling) and E (physical data center security) are not customer responsibilities because the cloud provider owns and secures the physical facilities, hardware, and network backbone under its control.

Answer

Global network physical cabling

Answer

Physical data center security

Question 6

Which THREE risks are associated with a 'Lift and Shift' (re-hosting) migration strategy?

Accepted Answer

Lower performance than on-premises. Option C is correct because a lift-and-shift re-host moves workloads to cloud VMs without refactoring, so the same CPU/RAM/IO profile is often paired with shared or throttled cloud resources and higher-latency storage/network paths, yielding lower performance than dedicated on-premises hardware. Option D is correct because re-hosting typically preserves the existing VM sizing and always-on provisioning, so organizations pay for idle capacity and miss rightsizing, reserved instances, savings plans, and autoscaling, failing to optimize cloud costs. Option E is correct because lift-and-shift does not redesign the application to use managed services such as serverless, containers, managed databases, or auto-scaling, so the organization misses out on cloud-native features and elasticity. Option A is not correct because re-hosting usually maintains or can improve the existing security posture through cloud provider controls, so lower security is not an inherent risk of the strategy. Option B is not correct because moving to cloud VMs shifts hardware maintenance to the cloud provider, reducing rather than increasing hardware maintenance burden.

Answer

Lower security

Answer

Increased hardware maintenance

Question 7

Which THREE activities are included in the 'Cloud Adoption Strategy' planning phase?

Accepted Answer

Identifying security and compliance requirements. In the Cloud Adoption Strategy planning phase, C (identifying security and compliance requirements) is correct because the strategy must define the regulatory, data-residency, and security controls (e.g., GDPR, HIPAA, ISO 27001) that constrain provider and architecture choices before any migration begins. D (selecting the cloud service provider) is correct because choosing among AWS, Azure, or GCP — and the specific services and regions — is a foundational strategic decision that shapes cost, capability, and lock-in. E (performing a TCO analysis) is correct because comparing on-premises capital and operational costs against cloud consumption pricing (compute, storage, egress, licensing) is a core planning activity used to justify and scope the adoption. Options A and B are incorrect because updating a break room menu and buying office chairs are facilities and office-management tasks unrelated to cloud adoption strategy, governance, or financial planning.

Answer

Updating the break room menu

Answer

Buying office chairs for the staff

Question 8

A company is preparing a cloud business case and must justify migrating an on-premises legacy application. The finance department requires a direct comparison of current hardware refresh costs versus cloud consumption models. Which metric should the cloud architect prioritize to demonstrate the financial benefit?

Accepted Answer

Capital Expenditure (CapEx) reduction. Capital Expenditure (CapEx) reduction is the metric that directly compares current hardware refresh costs (a CapEx model) with cloud consumption models (an OpEx model). By migrating to the cloud, the company avoids large upfront hardware purchases and instead pays for resources as operational expenses, which is the financial benefit the finance department needs to see. This metric highlights the shift from CapEx to OpEx and the associated cost savings.

Answer

Service Level Agreement (SLA) uptime

Answer

Return on Investment (ROI)

Answer

Mean Time to Repair (MTTR)

Question 9

A healthcare organization is migrating patient records to a public cloud. The compliance team requires that data remains within the country and that access is restricted to authorized personnel. Which two AWS features should be implemented to meet these requirements? (Choose two.)

Accepted Answer

AWS Identity and Access Management (IAM) policies. To meet data residency and access control requirements, the organization should use AWS Regions to keep data within the country and IAM policies to restrict access to authorized personnel. These features directly address the compliance needs.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Artifact

Answer

AWS Lambda functions

Question 10

A company is evaluating the total cost of ownership (TCO) for moving its on-premises data center to the cloud. Which two factors should be included in the TCO analysis? (Choose two.)

Accepted Answer

Cloud provider's monthly subscription fees. A TCO analysis for cloud migration should include costs that are directly attributable to the cloud model, such as monthly subscription fees and staff training. It should exclude on-premises costs that are eliminated, like hardware depreciation, cooling, power, and maintenance contracts. Including both would distort the comparison and lead to inaccurate financial decisions.

Answer

Cost of physical server hardware depreciation

Answer

Cost of data center cooling and power

Answer

Cost of hardware maintenance contracts