CLO-002 Cloud Concepts — 40 Questions

Question 1

A developer needs to host a static website on AWS S3. Which configuration is required to make the objects publicly accessible?

Accepted Answer

Enable Static Website Hosting. Enabling Static Website Hosting is correct because S3 requires this feature to serve index and error documents over HTTP for a bucket. When enabled, S3 returns the configured index document for root requests and the error document for missing objects, and provides a website endpoint. Combined with a public bucket policy (or CloudFront with OAC), this makes objects publicly accessible as a static site.

Answer

Configure a NAT Gateway

Answer

Attach an Elastic IP

Answer

Create an EC2 instance

Question 2

You need to ensure that a web server can only accept traffic on port 443. Where should this rule be defined?

Accepted Answer

Security Group. A Security Group (A) is the correct place to define a rule that allows a web server to accept traffic only on port 443, because security groups act as stateful virtual firewalls at the instance level. They control inbound and outbound traffic per instance, making them ideal for port-specific rules.

Answer

Route Table

Answer

Network ACL

Answer

VPC Peering

Question 3

What is the primary purpose of a cloud provider's region?

Accepted Answer

To provide low latency to specific users. A cloud region is a geographic cluster of availability zones designed to place resources close to end users, reducing network latency and improving application responsiveness. By deploying workloads in the region nearest their user base, organizations satisfy latency, data residency, and compliance requirements. This geographic distribution is the primary purpose of regions from a design standpoint.

Answer

To provide a single point of failure

Answer

To simplify the billing structure

Answer

To lower the cost of hardware

Question 4

A security auditor requests a solution to ensure that all data stored in the cloud is encrypted at rest. What should the administrator implement?

Accepted Answer

Server-side encryption. Server-side encryption (SSE) is the correct answer because it encrypts data at rest on the storage medium itself, with the cloud provider managing the encryption keys and the encryption/decryption process transparently to the user. This directly satisfies the auditor's requirement that all stored cloud data be encrypted at rest, covering object storage, block volumes, and managed databases. SSE variants (SSE-S3, SSE-KMS, SSE-C) allow the administrator to choose key ownership models while ensuring data is unreadable if the physical media is compromised.

Answer

VPC Security Groups

Answer

SSL/TLS

Answer

Multi-factor authentication

Question 5

Which TWO cloud deployment models allow for a hybrid cloud setup?

Accepted Answer

Public Cloud. A hybrid cloud is formed by combining a private cloud with a public cloud (or multiple clouds), so option A (Public Cloud) is correct because the public portion provides on-demand, third-party-operated resources that integrate with the organization's private infrastructure. Option E (Private Cloud) is also correct because it supplies the dedicated, single-tenant environment that pairs with the public cloud to create the hybrid model. Options B (IaaS) and D (Serverless) are incorrect because they are service/deployment consumption models, not cloud deployment models, and option C (Community Cloud) is a distinct deployment model shared by several organizations rather than a component that defines a hybrid cloud setup.

Answer

IaaS

Answer

Community Cloud

Answer

Serverless

Question 6

A company wants to move their legacy on-premises application to the cloud without refactoring the code. Which service model should they choose to minimize operational burden while maintaining application compatibility?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking resources on demand, allowing the company to lift and shift the legacy application without refactoring. The cloud provider manages the underlying infrastructure, reducing operational burden compared to on-premises, while the company retains control over the OS and application stack for compatibility.

Answer

SaaS

Answer

PaaS

Answer

Serverless

Question 7

A healthcare startup needs to ensure that patient data remains within a specific geographic region to comply with local privacy regulations. Which deployment model best addresses this data sovereignty requirement?

Accepted Answer

Community Cloud. A Community Cloud is built to serve a specific group of organizations with shared concerns, such as regulatory compliance, and can be restricted to specific data centers.

Answer

Multi-Cloud

Answer

Public Cloud

Answer

Hybrid Cloud

Question 8

Your organization is reviewing the shared responsibility model. Which TWO of the following are typically the responsibility of the cloud service provider?

Accepted Answer

Maintenance of the host virtualization layer. Option C is correct because the hypervisor/virtualization layer that runs beneath customer workloads is part of the provider's managed infrastructure in IaaS, PaaS, and SaaS, so the provider patches and maintains it. Option D is correct because physical security controls such as data center access, surveillance, environmental controls, and hardware protection always remain with the cloud provider under the shared responsibility model. Options A and E are incorrect because firewall rule configuration and user access management (IAM) are customer-side responsibilities for protecting their own data and identities. Option B is incorrect because guest OS management belongs to the customer in IaaS (and is handled by the provider only in PaaS/SaaS, where the customer no longer manages the OS), so it is not a typical provider responsibility in the general shared responsibility model.

Answer

Configuration of customer firewall rules

Answer

Management of customer guest OS

Answer

User access management

Question 9

A financial services firm is evaluating cloud service models for a new application. The firm's developers want to focus on writing code and not worry about patching the operating system, runtime, or middleware. However, the firm's security team requires that the application runs on a dedicated, isolated environment with no other tenants sharing the underlying operating system kernel. Which cloud service model best meets these requirements?

Accepted Answer

Containers as a Service (CaaS). CaaS lets developers deploy containerized applications without managing the OS, runtime, or middleware, while offering options for dedicated isolation. PaaS also abstracts infrastructure but typically shares the OS kernel among tenants, which the security team prohibits. IaaS requires too much management, and SaaS does not allow custom code. CaaS with dedicated hosts or strong isolation meets both needs.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 10

An online retailer forecasts unpredictable traffic during flash sales and wants to avoid capital expenditure on servers that sit idle most of the year. The finance team also requires granular cost visibility per business unit. Which cloud characteristic MOST directly addresses both the variable-capacity and cost-accountability requirements?

Accepted Answer

Measured service. Measured service is the cloud characteristic built on metering of actual consumption, which simultaneously enables pay-for-use economics and the granular reporting finance needs for chargeback. Rapid elasticity handles the traffic spikes, but only measured service supplies the consumption data that makes per-business-unit cost accountability possible.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 11

A media company needs to store and process large video files. The files are uploaded continuously, and processing jobs run only when new files arrive. The company wants to minimize cost and administrative overhead. Which cloud characteristic should the company leverage?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic scaling of resources to match demand. The media company can use event-driven triggers to start processing jobs when files arrive and stop them when idle, paying only for active compute. This minimizes cost and administrative overhead while handling continuous uploads efficiently.

Answer

High availability

Answer

Multi-tenancy

Answer

Measured service

Question 12

An administrator needs to ensure that cloud resources are geographically separated to maintain availability during a regional disaster. Which feature should they configure?

Accepted Answer

Multi-Region deployment. A multi-region deployment places resources in geographically distinct regions (e.g., US-East and EU-West), ensuring that a regional disaster affecting one region does not take down the entire application. This is the only option that provides true geographic separation at the region level, which is what is required to survive a regional outage. Availability Zones are isolated datacenters within a single region, so they do not protect against region-wide failures.

Answer

Availability Zone replication

Answer

Load Balancer

Answer

Auto Scaling Group

Question 13

An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Answer

Site-to-Site VPN

Answer

Client VPN

Answer

Public IP peering

Question 14

A startup is looking for a cloud deployment model where they pay only for resources used and share underlying hardware with other tenants. What model is this?

Accepted Answer

Public Cloud. A public cloud deployment model is characterised by resources owned by a third-party provider and shared among multiple tenants over the internet, with pay-as-you-go pricing based on consumption. The startup's requirements — pay only for resources used and share underlying hardware with other tenants — match the public cloud model exactly.

Answer

Hybrid Cloud

Answer

Community Cloud

Answer

Private Cloud

Question 15

You are troubleshooting a connectivity issue where an application in a private subnet cannot reach the internet to download updates. Which component is missing?

Accepted Answer

NAT Gateway. A NAT Gateway is required because resources in a private subnet have no route to the internet and cannot hold public IP addresses. The NAT Gateway resides in a public subnet and performs source NAT, allowing outbound-only traffic from private instances to reach the internet while blocking inbound connections. An Internet Gateway alone cannot serve private subnets because those subnets lack a route to it and their instances have no public IPs.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Route Table

Question 16

A company is moving from a capital expenditure model to an operational expenditure model. What is the primary benefit?

Accepted Answer

Removal of upfront capital costs. The primary benefit of moving from CapEx to OpEx is the elimination of large upfront capital investments. In a CapEx model, a company must purchase hardware and infrastructure outright, which requires significant capital outlay and depreciates over time. In an OpEx model, such as with cloud services, the company pays for what it uses on a subscription or pay-as-you-go basis, converting that large upfront cost into smaller, recurring operational expenses. This improves cash flow and allows the company to scale resources up or down as needed without being locked into a long-term asset.

Answer

Increased control over hardware

Answer

Predictable monthly billing

Answer

No hardware maintenance

Question 17

A company is migrating an on-premises database to a public cloud. The database requires low latency and high IOPS. Which storage type should the architect select?

Accepted Answer

Provisioned IOPS SSD. A Provisioned IOPS SSD (e.g., AWS io1/io2, Azure Premium SSD v2) is designed for latency-sensitive, high-throughput database workloads because it lets you specify both IOPS and throughput independently of capacity. This directly satisfies the low-latency and high-IOPS requirements of a migrated on-premises database. The other options are optimized for cost, capacity, or archival rather than sustained high-performance random I/O.

Answer

Cold Storage

Answer

Magnetic HDD

Answer

Object Storage

Question 18

Which cloud characteristic allows an organization to rapidly increase resources during a spike in traffic and decrease them when traffic drops?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic, rapid scaling of resources up during demand spikes and down when demand subsides, ideally in near-real time. It is what allows an e-commerce site to absorb a flash sale and then release capacity afterward, paying only for what was used.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 19

An application requires a database that can handle unstructured data and scale horizontally. Which database type is best?

Accepted Answer

NoSQL Database. NoSQL databases are designed to handle unstructured or semi-structured data (e.g., JSON, key-value, graph) and are built for horizontal scaling across distributed clusters. They sacrifice strict ACID transactions and fixed schemas for flexibility and partition tolerance, making them ideal for large-scale, rapidly evolving applications. In contrast, relational databases require predefined schemas and typically scale vertically, while data warehouses are optimized for analytical queries on structured data, and in-memory databases prioritize speed but not necessarily horizontal scalability for unstructured data.

Answer

Data Warehouse

Answer

In-memory Database

Answer

Relational Database

Question 20

Which of the following represents a major benefit of cloud computing where resources are shared among multiple customers?

Accepted Answer

Resource pooling. Resource pooling is the multi-tenant cloud characteristic where compute, storage, and network resources are shared among many customers from a pooled infrastructure, with dynamic assignment based on demand. This sharing drives economies of scale and cost efficiency, which is the benefit described in the question.

Answer

Local area networking

Answer

Static provisioning

Answer

Dedicated hosting