CLO-002 Cloud Concepts Practice Test 4 — 15 Questions

Question 1

Which THREE security controls are the responsibility of the cloud user under the Shared Responsibility Model?

Accepted Answer

Data encryption. Under the Shared Responsibility Model, the cloud user is responsible for securing what they put in and how they configure the cloud: option A (Data encryption) is correct because protecting data at rest and in transit—choosing algorithms, managing keys via KMS, and enabling TLS—remains the customer's duty even though the provider secures the underlying storage and network. Option B (Identity and Access Management) is correct because the customer must manage their own users, groups, roles, policies, MFA, and least-privilege permissions within services like AWS IAM or Azure Entra ID; the provider only secures the IAM service itself. Option D (Firewall configuration) is correct because the customer defines security groups, NACLs, WAF rules, and host-based firewalls to control traffic to their workloads, while the provider only supplies the virtual network fabric. Option C (Hypervisor patching) is not the user's responsibility—the provider patches the hypervisor and virtualization layer. Option E (Physical data center security) is also the provider's responsibility, covering facilities, biometric access, and hardware protection.

Answer

Hypervisor patching

Answer

Physical data center security

Question 2

Which TWO advantages does a public cloud provide for a small business?

Accepted Answer

Ability to scale instantly. Option A is correct because public cloud providers offer elastic, on-demand resource provisioning (e.g., AWS EC2 Auto Scaling, Azure VM Scale Sets), letting a small business scale compute, storage, or bandwidth up or down instantly without buying hardware. Option E is correct because the pay-as-you-go, OPEX-based model (e.g., AWS Free Tier, Azure pay-as-you-go pricing) removes the large upfront capital expenditure of servers, licensing, and datacenter space, so a small business can start with minimal investment. Option B is not correct because public cloud customers share the provider's infrastructure and do not control the underlying physical hardware, hypervisors, or datacenter. Option C is not correct because public cloud is multi-tenant by design and does not guarantee absolute data privacy; privacy depends on the customer's configuration, encryption, and compliance controls under the shared responsibility model. Option D is not correct because public cloud services are accessed over the internet, so reliable internet connectivity is required.

Answer

Total control over hardware

Answer

Guaranteed data privacy

Answer

No internet connectivity needed

Question 3

Which THREE items should be included in a disaster recovery plan?

Accepted Answer

Backup strategy. A Backup strategy is correct because a DR plan must define how data and systems are backed up (full/incremental/differential, frequency, retention, and offsite/cloud copies) so that restoration is actually possible after a disaster. C Recovery Time Objective (RTO) is correct because it specifies the maximum acceptable downtime — the target time within which systems and services must be restored — and drives the choice of recovery site, hardware, and procedures. D Recovery Point Objective (RPO) is correct because it defines the maximum tolerable data loss measured in time, which dictates backup frequency and replication method (for example, a 15-minute RPO requires near-continuous replication rather than nightly backups). B Customer marketing materials and E Physical access badges are not core DR plan components: marketing collateral is irrelevant to restoring IT services, and while physical security may appear in a broader business continuity plan, access badges themselves are not a required DR planning item.

Answer

Customer marketing materials

Answer

Physical access badges

Question 4

Your organization is experiencing high latency for end-users accessing a global web application. The static assets are currently stored in a single bucket in the US-East region. Which architectural change will most effectively reduce latency for international users?

Accepted Answer

Implementing a CDN. A Content Delivery Network (CDN) caches static assets at edge locations distributed globally, so international users fetch content from a nearby PoP (Point of Presence) instead of traversing the internet to US-East. This dramatically reduces round-trip latency, packet loss, and jitter for static content like images, CSS, and JavaScript. Because the question specifies static assets in a single bucket, a CDN is the direct, high-impact architectural fix.

Answer

Moving the database to a NoSQL engine

Answer

Switching to Private VCN peering

Answer

Vertical scaling of the web servers

Question 5

A developer needs a storage solution for high-frequency trading logs that must be instantly accessible for analysis, with high IOPS, and low latency. Which storage type is most appropriate?

Accepted Answer

Block Storage. Block storage (e.g., AWS EBS, Azure Managed Disks) provides raw, low-latency, high-IOPS volumes attached to a single compute instance, making it the right choice for high-frequency trading logs that demand instant access and consistent performance. It behaves like a local disk, so databases and latency-sensitive workloads run directly against it without the overhead of network file protocols or object APIs.

Answer

Archive Storage

Answer

File Storage

Answer

Object Storage

Question 6

Which cloud characteristic allows a startup to automatically increase their compute resources during a marketing campaign and decrease them afterward without manual intervention?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to be automatically scaled up or down based on demand. In this scenario, the startup can automatically increase compute resources during a marketing campaign and decrease them afterward without manual intervention, which is the definition of elasticity. Therefore, elasticity is correct.

Answer

Resource pooling

Answer

Measured service

Answer

Broad network access

Question 7

A firm is deploying a web application across two different cloud providers to ensure business continuity. What is the most critical challenge they must overcome regarding data consistency?

Accepted Answer

Data synchronization and interoperability. In a multi-cloud deployment, each provider maintains its own data stores, APIs, and replication mechanisms, so keeping data consistent across both environments is the hardest problem. Without a unified synchronization strategy and interoperable data formats, the two sites can diverge, causing stale reads, conflicting writes, and failed failover. This directly threatens business continuity because the standby site may not reflect the true state of the primary. Billing, identity, and CI/CD are operational concerns but do not determine whether the application can correctly serve the same data from either cloud.

Answer

Managing different billing cycles

Answer

Configuring identity federation

Answer

Scaling the CI/CD pipeline

Question 8

A security administrator needs to ensure that all traffic between their on-premises data center and their cloud environment is encrypted and traverses a dedicated, private connection. What should they implement?

Accepted Answer

A dedicated private circuit with VPN encryption. A dedicated private circuit (such as AWS Direct Connect or Azure ExpressRoute) combined with VPN encryption provides a private, non-internet path between on-premises and cloud while encrypting the traffic in transit. This satisfies both requirements: dedicated connectivity and encryption.

Answer

A public load balancer

Answer

A public internet VPN

Answer

A standard cloud gateway

Question 9

Which THREE factors should a cloud architect consider when designing for high availability?

Accepted Answer

Multi-region deployment. Multi-region deployment (C) is correct because distributing workloads across geographically separate regions protects against region-wide failures and satisfies disaster-recovery and latency requirements for high availability. Automated health checks and failover (D) are correct because continuous monitoring of instance or service health, combined with automatic failover (for example, via Route 53 health checks, Auto Scaling, or RDS Multi-AZ failover), removes single points of failure and minimizes downtime without manual intervention. Load balancing across availability zones (E) is correct because an elastic load balancer spreading traffic over multiple AZs ensures that the loss of one data center does not take the application offline. Centralizing all resources in a single region (A) is not appropriate because it concentrates risk and creates a single point of failure, and fixed-capacity hardware provisioning (B) is not appropriate because it prevents the elastic scaling and rapid replacement of failed capacity that high availability designs require.

Answer

Centralizing all resources in a single region

Answer

Fixed-capacity hardware provisioning

Question 10

When evaluating a cloud-based database service, which TWO of the following are key benefits compared to self-managed databases?

Accepted Answer

Automated patching and maintenance. Option A is correct because cloud-based database services (such as Amazon RDS, Azure SQL Database, or Google Cloud SQL) handle routine patching, version upgrades, and maintenance windows automatically, offloading operational overhead from the customer. Option D is correct because these managed services provide built-in, often automated backup, point-in-time restore, and cross-region replication capabilities that simplify disaster recovery compared to building and testing such mechanisms manually. Option B is not a benefit of managed services, since customers generally cannot modify the underlying database engine source code. Option C is not inherently true, as network latency depends on client location and architecture, and managed services can even add latency versus a locally hosted database. Option E is incorrect because managed services often impose constraints on schema, extensions, and configuration, reducing rather than increasing design control.

Answer

Ability to modify the database source code

Answer

Lower network latency

Answer

Unlimited database schema design control

Question 11

A media company runs a video transcoding workload in a public cloud. The workload is latency-sensitive and must complete within strict deadlines, but the company wants to reduce compute costs during off-peak hours. Which cloud characteristic should the company leverage to meet these requirements?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to be dynamically provisioned and released to match demand. For a latency-sensitive transcoding workload, the company can scale out during peak times to meet deadlines and scale in during off-peak hours to cut costs. High availability, multi-tenancy, and measured service are important but do not directly enable this automatic scaling behavior.

Answer

High availability

Answer

Multi-tenancy

Answer

Measured service

Question 12

A retail company runs its e-commerce platform on a public cloud. During a flash sale, traffic spikes from 500 to 20,000 concurrent users within minutes. The operations team wants the environment to automatically add and remove server instances based on CPU utilization without manual intervention. Which cloud characteristic should they rely on to meet this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity is the ability to automatically and quickly scale resources out and in as demand changes. For a flash sale with sudden traffic spikes, the platform needs to add instances when CPU utilization rises and remove them when it falls, without manual intervention. Measured service, resource pooling, and broad network access are separate characteristics that do not provide automatic scaling.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 13

A small marketing agency wants to move its customer relationship management (CRM) system to the cloud. The agency has limited IT staff and wants the provider to manage the operating system, middleware, and runtime, while the agency only manages its custom CRM application and data. Which cloud service model best fits this requirement?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a managed platform that includes the operating system, middleware, and runtime, leaving the customer responsible only for the application and data. This aligns with the agency's need to offload infrastructure management while retaining control over its custom CRM application. IaaS requires more customer management, SaaS removes application control, and FaaS is unsuitable for a full CRM system.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 14

A healthcare company is designing a new patient portal. Regulatory requirements mandate that patient data must remain within a specific country's borders and that the company must have direct control over the encryption keys used to protect the data at rest. The company wants to use a public cloud provider. Which combination of cloud characteristics and controls should the company implement to meet these requirements?

Accepted Answer

Use a public cloud region in the required country and implement customer-managed encryption keys using a key management service.. The company must satisfy two distinct requirements: data residency and direct control over encryption keys. Choosing a region within the required country addresses residency, and using customer-managed keys in a key management service provides direct key control. Options that use provider-managed or default encryption fail the key control requirement, and options that use an arbitrary region fail data residency.

Answer

Use a public cloud region in the required country and enable provider-managed encryption keys.

Answer

Use a public cloud region in the required country and rely on default platform encryption without managing keys.

Answer

Use a public cloud region in any country and implement customer-managed encryption keys using a key management service.

Question 15

A small marketing agency wants to move its client project files to a cloud storage solution. The agency has unpredictable storage needs, wants to avoid purchasing hardware, and requires access from Windows, macOS, and mobile devices. Which cloud characteristic best describes the agency's ability to provision storage on demand without human intervention from the provider?

Accepted Answer

On-demand self-service. On-demand self-service is the cloud characteristic that lets a consumer provision resources such as storage automatically, without human interaction with the provider. The agency can use a portal or API to allocate storage immediately, which suits unpredictable needs and avoids hardware purchases. Broad network access, rapid elasticity, and resource pooling are separate characteristics that do not directly address unassisted provisioning.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling