CLO-002 Governance Risk Compliance And Security — 20 Questions

Question 1

An organization wants to prevent users from creating resources in regions other than the ones approved by corporate policy. What should be used to enforce this?

Accepted Answer

AWS Organizations Service Control Policy (SCP). IAM policies using conditions (e.g., 'aws:RequestedRegion') effectively restrict geographic deployments.

Answer

CloudFormation StackSet

Answer

Resource Tagging

Question 2

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Accepted Answer

Site-to-Site VPN. A VPN tunnel provides an encrypted connection over the public internet, essential for hybrid connectivity security.

Answer

VPC Peering

Answer

IGW (Internet Gateway)

Answer

Direct Connect

Question 3

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Accepted Answer

AWS CloudTrail. CloudTrail captures API logs, providing a trail of who performed which action in the account.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudWatch

Answer

AWS Security Hub

Question 4

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

Accepted Answer

Azure Policy. Policy engines allow for the automated enforcement of configurations to ensure continuous compliance.

Answer

Azure Backup

Answer

Azure Resource Manager templates

Answer

Azure Monitor

Question 5

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Accepted Answer

AWS Cost Explorer. Cloud providers use budget services to track spending and send notifications when limits are approached.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the standard service for managing cryptographic keys and provides audit logs through CloudTrail, satisfying compliance requirements for customer-managed keys.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Question 7

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

Accepted Answer

Azure SQL Advanced Data Security. Azure SQL Advanced Data Security provides vulnerability assessment and advanced threat protection, essential for GDPR compliance.

Answer

Azure Information Protection

Answer

Azure AD Conditional Access

Answer

Azure Firewall

Question 8

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Accepted Answer

Allow TCP 443 from 0.0.0.0/0. HTTPS traffic uses TCP port 443; limiting the rule to this specific port minimizes the attack surface.

Answer

Allow TCP 80 from 0.0.0.0/0

Answer

Allow all TCP from 0.0.0.0/0

Answer

Allow UDP 443 from 0.0.0.0/0

Question 9

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

Accepted Answer

Risk Register. The Risk Register is the formal document where identified risks, their impact, and mitigation strategies are documented.

Answer

Cloud Service Level Agreement (SLA)

Answer

System Security Plan (SSP)

Answer

Network Topology Diagram

Question 10

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Accepted Answer

S3 Object Lock in Compliance Mode. Object locking or WORM (Write Once Read Many) policies are designed for regulatory compliance in storage.

Answer

S3 Intelligent Tiering

Answer

S3 Standard Storage Class

Answer

S3 Cross-Region Replication

Question 11

A company needs to ensure that only authorized devices can access internal cloud applications. Which mechanism verifies device posture before granting access?

Accepted Answer

Conditional Access Policies. Endpoint management and Conditional Access policies look at device state (e.g., compliant, patched) before allowing access.

Answer

Security Groups

Answer

MFA (Multi-Factor Authentication)

Answer

IAM Role Assumption

Question 12

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config provides rules to check for tags and can trigger automation to remediate non-compliance.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 13

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Accepted Answer

Elasticity. Elasticity is the defining characteristic of cloud computing that allows scaling based on demand.

Answer

Multi-tenancy

Answer

High Availability

Answer

Scalability

Question 14

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a setting that overrides bucket-level permissions to prevent public exposure.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 15

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Accepted Answer

Regional Resource Placement. Selecting the appropriate cloud region ensures that data remains within the physical infrastructure of a specific legal jurisdiction.

Answer

Content Delivery Network (CDN)

Answer

Global Accelerator

Answer

VPC Peering

Question 16

A developer is writing code that accesses an API key. Instead of hardcoding the key, which service should they use to retrieve it securely at runtime?

Accepted Answer

AWS Secrets Manager. Secrets Manager is specifically designed to store and retrieve API keys, database credentials, and secrets securely.

Answer

Environment Variables

Answer

Parameter Store

Answer

IAM Roles

Question 17

When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?

Accepted Answer

Guest OS patching. In IaaS, the customer manages the guest OS, applications, and security group configurations.

Answer

Hypervisor security

Answer

Physical security of the data center

Answer

Host OS patching

Question 18

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Accepted Answer

Client-side encryption. Client-side encryption ensures that data is encrypted at the source, before it enters the cloud provider's network.

Answer

Server-side encryption

Answer

TLS 1.2

Answer

Transparent Data Encryption (TDE)

Question 19

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

Accepted Answer

Service Level Agreement (SLA). The Service Level Agreement (SLA) defines the expected service availability and compensation for downtime.

Answer

Cloud Security Alliance (CSA) report

Answer

Acceptable Use Policy

Answer

Privacy Policy

Question 20

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

Accepted Answer

AWS Security Hub with Cross-Account Aggregation. AWS Organizations and log shipping (using CloudWatch Logs or S3) allow for centralizing security data for auditing.

Answer

AWS CloudTrail in individual accounts

Answer

AWS Transit Gateway

Answer

AWS Systems Manager OpsCenter