CLO-002 Cloud Concepts — 10 Questions

Question 1

A developer needs to host a static website on AWS S3. Which configuration is required to make the objects publicly accessible?

Accepted Answer

Enable Static Website Hosting. Enabling Static Website Hosting is correct because S3 requires this feature to serve index and error documents over HTTP for a bucket. When enabled, S3 returns the configured index document for root requests and the error document for missing objects, and provides a website endpoint. Combined with a public bucket policy (or CloudFront with OAC), this makes objects publicly accessible as a static site.

Answer

Configure a NAT Gateway

Answer

Attach an Elastic IP

Answer

Create an EC2 instance

Question 2

You need to ensure that a web server can only accept traffic on port 443. Where should this rule be defined?

Accepted Answer

Security Group. A Security Group (A) is the correct place to define a rule that allows a web server to accept traffic only on port 443, because security groups act as stateful virtual firewalls at the instance level. They control inbound and outbound traffic per instance, making them ideal for port-specific rules.

Answer

Route Table

Answer

Network ACL

Answer

VPC Peering

Question 3

What is the primary purpose of a cloud provider's region?

Accepted Answer

To provide low latency to specific users. A cloud region is a geographic cluster of availability zones designed to place resources close to end users, reducing network latency and improving application responsiveness. By deploying workloads in the region nearest their user base, organizations satisfy latency, data residency, and compliance requirements. This geographic distribution is the primary purpose of regions from a design standpoint.

Answer

To provide a single point of failure

Answer

To simplify the billing structure

Answer

To lower the cost of hardware

Question 4

A security auditor requests a solution to ensure that all data stored in the cloud is encrypted at rest. What should the administrator implement?

Accepted Answer

Server-side encryption. Server-side encryption (SSE) is the correct answer because it encrypts data at rest on the storage medium itself, with the cloud provider managing the encryption keys and the encryption/decryption process transparently to the user. This directly satisfies the auditor's requirement that all stored cloud data be encrypted at rest, covering object storage, block volumes, and managed databases. SSE variants (SSE-S3, SSE-KMS, SSE-C) allow the administrator to choose key ownership models while ensuring data is unreadable if the physical media is compromised.

Answer

VPC Security Groups

Answer

SSL/TLS

Answer

Multi-factor authentication

Question 5

Which TWO cloud deployment models allow for a hybrid cloud setup?

Accepted Answer

Public Cloud. A hybrid cloud is formed by combining a private cloud with a public cloud (or multiple clouds), so option A (Public Cloud) is correct because the public portion provides on-demand, third-party-operated resources that integrate with the organization's private infrastructure. Option E (Private Cloud) is also correct because it supplies the dedicated, single-tenant environment that pairs with the public cloud to create the hybrid model. Options B (IaaS) and D (Serverless) are incorrect because they are service/deployment consumption models, not cloud deployment models, and option C (Community Cloud) is a distinct deployment model shared by several organizations rather than a component that defines a hybrid cloud setup.

Answer

IaaS

Answer

Community Cloud

Answer

Serverless

Question 6

A company wants to move their legacy on-premises application to the cloud without refactoring the code. Which service model should they choose to minimize operational burden while maintaining application compatibility?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking resources on demand, allowing the company to lift and shift the legacy application without refactoring. The cloud provider manages the underlying infrastructure, reducing operational burden compared to on-premises, while the company retains control over the OS and application stack for compatibility.

Answer

SaaS

Answer

PaaS

Answer

Serverless

Question 7

A healthcare startup needs to ensure that patient data remains within a specific geographic region to comply with local privacy regulations. Which deployment model best addresses this data sovereignty requirement?

Accepted Answer

Community Cloud. A Community Cloud is built to serve a specific group of organizations with shared concerns, such as regulatory compliance, and can be restricted to specific data centers.

Answer

Multi-Cloud

Answer

Public Cloud

Answer

Hybrid Cloud

Question 8

Your organization is reviewing the shared responsibility model. Which TWO of the following are typically the responsibility of the cloud service provider?

Accepted Answer

Maintenance of the host virtualization layer. Option C is correct because the hypervisor/virtualization layer that runs beneath customer workloads is part of the provider's managed infrastructure in IaaS, PaaS, and SaaS, so the provider patches and maintains it. Option D is correct because physical security controls such as data center access, surveillance, environmental controls, and hardware protection always remain with the cloud provider under the shared responsibility model. Options A and E are incorrect because firewall rule configuration and user access management (IAM) are customer-side responsibilities for protecting their own data and identities. Option B is incorrect because guest OS management belongs to the customer in IaaS (and is handled by the provider only in PaaS/SaaS, where the customer no longer manages the OS), so it is not a typical provider responsibility in the general shared responsibility model.

Answer

Configuration of customer firewall rules

Answer

Management of customer guest OS

Answer

User access management

Question 9

A financial services firm is evaluating cloud service models for a new application. The firm's developers want to focus on writing code and not worry about patching the operating system, runtime, or middleware. However, the firm's security team requires that the application runs on a dedicated, isolated environment with no other tenants sharing the underlying operating system kernel. Which cloud service model best meets these requirements?

Accepted Answer

Containers as a Service (CaaS). CaaS lets developers deploy containerized applications without managing the OS, runtime, or middleware, while offering options for dedicated isolation. PaaS also abstracts infrastructure but typically shares the OS kernel among tenants, which the security team prohibits. IaaS requires too much management, and SaaS does not allow custom code. CaaS with dedicated hosts or strong isolation meets both needs.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 10

An online retailer forecasts unpredictable traffic during flash sales and wants to avoid capital expenditure on servers that sit idle most of the year. The finance team also requires granular cost visibility per business unit. Which cloud characteristic MOST directly addresses both the variable-capacity and cost-accountability requirements?

Accepted Answer

Measured service. Measured service is the cloud characteristic built on metering of actual consumption, which simultaneously enables pay-for-use economics and the granular reporting finance needs for chargeback. Rapid elasticity handles the traffic spikes, but only measured service supplies the consumption data that makes per-business-unit cost accountability possible.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity