CLO-002 Cloud Concepts — 15 Questions

Question 1

A developer needs to host a static website on AWS S3. Which configuration is required to make the objects publicly accessible?

Accepted Answer

Enable Static Website Hosting. Enabling Static Website Hosting is correct because S3 requires this feature to serve index and error documents over HTTP for a bucket. When enabled, S3 returns the configured index document for root requests and the error document for missing objects, and provides a website endpoint. Combined with a public bucket policy (or CloudFront with OAC), this makes objects publicly accessible as a static site.

Answer

Configure a NAT Gateway

Answer

Attach an Elastic IP

Answer

Create an EC2 instance

Question 2

You need to ensure that a web server can only accept traffic on port 443. Where should this rule be defined?

Accepted Answer

Security Group. A Security Group (A) is the correct place to define a rule that allows a web server to accept traffic only on port 443, because security groups act as stateful virtual firewalls at the instance level. They control inbound and outbound traffic per instance, making them ideal for port-specific rules.

Answer

Route Table

Answer

Network ACL

Answer

VPC Peering

Question 3

What is the primary purpose of a cloud provider's region?

Accepted Answer

To provide low latency to specific users. A cloud region is a geographic cluster of availability zones designed to place resources close to end users, reducing network latency and improving application responsiveness. By deploying workloads in the region nearest their user base, organizations satisfy latency, data residency, and compliance requirements. This geographic distribution is the primary purpose of regions from a design standpoint.

Answer

To provide a single point of failure

Answer

To simplify the billing structure

Answer

To lower the cost of hardware

Question 4

A security auditor requests a solution to ensure that all data stored in the cloud is encrypted at rest. What should the administrator implement?

Accepted Answer

Server-side encryption. Server-side encryption (SSE) is the correct answer because it encrypts data at rest on the storage medium itself, with the cloud provider managing the encryption keys and the encryption/decryption process transparently to the user. This directly satisfies the auditor's requirement that all stored cloud data be encrypted at rest, covering object storage, block volumes, and managed databases. SSE variants (SSE-S3, SSE-KMS, SSE-C) allow the administrator to choose key ownership models while ensuring data is unreadable if the physical media is compromised.

Answer

VPC Security Groups

Answer

SSL/TLS

Answer

Multi-factor authentication

Question 5

Which TWO cloud deployment models allow for a hybrid cloud setup?

Accepted Answer

Public Cloud. A hybrid cloud is formed by combining a private cloud with a public cloud (or multiple clouds), so option A (Public Cloud) is correct because the public portion provides on-demand, third-party-operated resources that integrate with the organization's private infrastructure. Option E (Private Cloud) is also correct because it supplies the dedicated, single-tenant environment that pairs with the public cloud to create the hybrid model. Options B (IaaS) and D (Serverless) are incorrect because they are service/deployment consumption models, not cloud deployment models, and option C (Community Cloud) is a distinct deployment model shared by several organizations rather than a component that defines a hybrid cloud setup.

Answer

IaaS

Answer

Community Cloud

Answer

Serverless

Question 6

A company wants to move their legacy on-premises application to the cloud without refactoring the code. Which service model should they choose to minimize operational burden while maintaining application compatibility?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking resources on demand, allowing the company to lift and shift the legacy application without refactoring. The cloud provider manages the underlying infrastructure, reducing operational burden compared to on-premises, while the company retains control over the OS and application stack for compatibility.

Answer

SaaS

Answer

PaaS

Answer

Serverless

Question 7

A healthcare startup needs to ensure that patient data remains within a specific geographic region to comply with local privacy regulations. Which deployment model best addresses this data sovereignty requirement?

Accepted Answer

Community Cloud. A Community Cloud is built to serve a specific group of organizations with shared concerns, such as regulatory compliance, and can be restricted to specific data centers.

Answer

Multi-Cloud

Answer

Public Cloud

Answer

Hybrid Cloud

Question 8

Your organization is reviewing the shared responsibility model. Which TWO of the following are typically the responsibility of the cloud service provider?

Accepted Answer

Maintenance of the host virtualization layer. Option C is correct because the hypervisor/virtualization layer that runs beneath customer workloads is part of the provider's managed infrastructure in IaaS, PaaS, and SaaS, so the provider patches and maintains it. Option D is correct because physical security controls such as data center access, surveillance, environmental controls, and hardware protection always remain with the cloud provider under the shared responsibility model. Options A and E are incorrect because firewall rule configuration and user access management (IAM) are customer-side responsibilities for protecting their own data and identities. Option B is incorrect because guest OS management belongs to the customer in IaaS (and is handled by the provider only in PaaS/SaaS, where the customer no longer manages the OS), so it is not a typical provider responsibility in the general shared responsibility model.

Answer

Configuration of customer firewall rules

Answer

Management of customer guest OS

Answer

User access management

Question 9

A financial services firm is evaluating cloud service models for a new application. The firm's developers want to focus on writing code and not worry about patching the operating system, runtime, or middleware. However, the firm's security team requires that the application runs on a dedicated, isolated environment with no other tenants sharing the underlying operating system kernel. Which cloud service model best meets these requirements?

Accepted Answer

Containers as a Service (CaaS). CaaS lets developers deploy containerized applications without managing the OS, runtime, or middleware, while offering options for dedicated isolation. PaaS also abstracts infrastructure but typically shares the OS kernel among tenants, which the security team prohibits. IaaS requires too much management, and SaaS does not allow custom code. CaaS with dedicated hosts or strong isolation meets both needs.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 10

An online retailer forecasts unpredictable traffic during flash sales and wants to avoid capital expenditure on servers that sit idle most of the year. The finance team also requires granular cost visibility per business unit. Which cloud characteristic MOST directly addresses both the variable-capacity and cost-accountability requirements?

Accepted Answer

Measured service. Measured service is the cloud characteristic built on metering of actual consumption, which simultaneously enables pay-for-use economics and the granular reporting finance needs for chargeback. Rapid elasticity handles the traffic spikes, but only measured service supplies the consumption data that makes per-business-unit cost accountability possible.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 11

A media company needs to store and process large video files. The files are uploaded continuously, and processing jobs run only when new files arrive. The company wants to minimize cost and administrative overhead. Which cloud characteristic should the company leverage?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic scaling of resources to match demand. The media company can use event-driven triggers to start processing jobs when files arrive and stop them when idle, paying only for active compute. This minimizes cost and administrative overhead while handling continuous uploads efficiently.

Answer

High availability

Answer

Multi-tenancy

Answer

Measured service

Question 12

An administrator needs to ensure that cloud resources are geographically separated to maintain availability during a regional disaster. Which feature should they configure?

Accepted Answer

Multi-Region deployment. A multi-region deployment places resources in geographically distinct regions (e.g., US-East and EU-West), ensuring that a regional disaster affecting one region does not take down the entire application. This is the only option that provides true geographic separation at the region level, which is what is required to survive a regional outage. Availability Zones are isolated datacenters within a single region, so they do not protect against region-wide failures.

Answer

Availability Zone replication

Answer

Load Balancer

Answer

Auto Scaling Group

Question 13

An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Answer

Site-to-Site VPN

Answer

Client VPN

Answer

Public IP peering

Question 14

A startup is looking for a cloud deployment model where they pay only for resources used and share underlying hardware with other tenants. What model is this?

Accepted Answer

Public Cloud. A public cloud deployment model is characterised by resources owned by a third-party provider and shared among multiple tenants over the internet, with pay-as-you-go pricing based on consumption. The startup's requirements — pay only for resources used and share underlying hardware with other tenants — match the public cloud model exactly.

Answer

Hybrid Cloud

Answer

Community Cloud

Answer

Private Cloud

Question 15

You are troubleshooting a connectivity issue where an application in a private subnet cannot reach the internet to download updates. Which component is missing?

Accepted Answer

NAT Gateway. A NAT Gateway is required because resources in a private subnet have no route to the internet and cannot hold public IP addresses. The NAT Gateway resides in a public subnet and performs source NAT, allowing outbound-only traffic from private instances to reach the internet while blocking inbound connections. An Internet Gateway alone cannot serve private subnets because those subnets lack a route to it and their instances have no public IPs.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Route Table