CLO-002 Governance Risk Compliance And Security Practice Test 2 — 15 Questions

Question 1

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Accepted Answer

S3 Object Lock in Compliance Mode. S3 Object Lock in Compliance Mode prevents any user, including the root account, from overwriting or deleting an object version until its retention period expires. This provides true WORM (Write Once, Read Many) immutability for the required seven years, satisfying regulatory compliance requirements.

Answer

S3 Intelligent Tiering

Answer

S3 Standard Storage Class

Answer

S3 Cross-Region Replication

Question 2

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against desired rules, so it can detect resources missing the required 'Owner' and 'Environment' tags and trigger automatic remediation (e.g., via SSM Automation documents). This is exactly the governance/compliance use case described. CloudWatch, Trusted Advisor, and Systems Manager do not provide rule-based configuration compliance evaluation with remediation.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 3

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that describes the ability to automatically add and remove resources in response to real-time demand, scaling out during traffic spikes and scaling in when demand drops. This matches the question's emphasis on maintaining performance while matching capacity to traffic. Scalability, by contrast, is the broader ability to grow, but it does not inherently imply automatic, bidirectional adjustment.

Answer

Multi-tenancy

Answer

High Availability

Answer

Scalability

Question 4

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a dedicated account- and bucket-level setting that overrides any ACL or bucket policy granting public access, providing a hard guardrail against accidental public exposure. Enabling it at the account level ensures that even if someone later attaches a permissive bucket policy or ACL, public access remains blocked. This is the AWS-recommended control specifically designed to prevent the incident described.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 5

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Accepted Answer

Regional Resource Placement. Regional Resource Placement means deploying and storing resources within a specific geographic region (e.g., a country) to comply with data sovereignty laws. By choosing a region that is within the required borders, organizations ensure that data does not leave the country, thus meeting legal requirements.

Answer

Content Delivery Network (CDN)

Answer

Global Accelerator

Answer

VPC Peering

Question 6

When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?

Accepted Answer

Guest OS patching. In the Shared Responsibility Model for IaaS, the customer is responsible for everything from the guest OS upward, including patching the guest operating system, middleware, runtime, applications, and data. The cloud provider manages the physical hosts, hypervisor, network, and data center. Guest OS patching is therefore squarely the customer's duty in IaaS.

Answer

Hypervisor security

Answer

Physical security of the data center

Answer

Host OS patching

Question 7

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Accepted Answer

Client-side encryption. Client-side encryption is correct because data is encrypted by the organization before it ever leaves its premises, meaning the cloud provider receives only ciphertext and never has access to plaintext or keys. This satisfies the requirement that all data be encrypted 'before being sent to the cloud.' Server-side encryption and TDE both encrypt data after it reaches the provider's infrastructure, and TLS protects data only in transit, not at rest in the cloud.

Answer

Server-side encryption

Answer

TLS 1.2

Answer

Transparent Data Encryption (TDE)

Question 8

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

Accepted Answer

Service Level Agreement (SLA). A Service Level Agreement (SLA) is the contractual document in which a cloud provider commits to specific uptime, availability, and performance metrics, along with remedies (service credits) if those commitments are missed. It is the authoritative source for assessing the impact of a provider outage on the customer's operations.

Answer

Cloud Security Alliance (CSA) report

Answer

Acceptable Use Policy

Answer

Privacy Policy

Question 9

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

Accepted Answer

AWS Security Hub with Cross-Account Aggregation. AWS Security Hub with cross-account aggregation lets a designated security (administrator) account collect and view findings from multiple member accounts in one place, using AWS Organizations integration and the Security Hub administrator-member relationship. It normalizes findings from services like GuardDuty, Inspector, and Macie into a common ASFF format, giving centralized visibility. This is the purpose-built service for aggregating security logs/findings across accounts into a single security account.

Answer

AWS CloudTrail in individual accounts

Answer

AWS Transit Gateway

Answer

AWS Systems Manager OpsCenter

Question 10

An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?

Accepted Answer

SAML. SAML 2.0 is the standard XML-based protocol used to federate corporate identity providers (like Active Directory Federation Services or Okta) with cloud service providers, enabling single sign-on with corporate credentials. The IdP issues a signed SAML assertion that the cloud provider trusts, authenticating the user without a separate cloud password. This is the canonical federation pattern for enterprise cloud logins.

Answer

SNMP

Answer

SSH

Answer

ICMP

Question 11

A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?

Accepted Answer

SQL Injection Managed Rule Set. A SQL Injection Managed Rule Set is specifically designed to detect and block SQL injection patterns by inspecting HTTP requests for malicious SQL syntax, such as tautologies, UNION queries, and comment sequences. It uses predefined signatures and anomaly scoring to identify known attack vectors, providing targeted protection. This is the most effective feature because it directly addresses the attack technique rather than relying on indirect indicators like request rate or source IP.

Answer

Rate Limiting

Answer

IP Blacklisting

Answer

Geo-blocking

Question 12

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Accepted Answer

IAM Role. An IAM Role is designed for delegation: it has no long-term credentials and instead issues temporary security credentials via STS when assumed. A third-party service provider can be granted permission to assume a role in your account using a trust policy, giving them time-limited access without ever sharing your access keys. This is the AWS best practice for cross-account and third-party access.

Answer

IAM Group

Answer

IAM Access Key

Answer

IAM User

Question 13

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Accepted Answer

Separation of Duties. Separation of Duties (SoD) is the security principle that divides critical functions among multiple individuals so that no single administrator has end-to-end control over a sensitive process. By splitting responsibilities — for example, one admin provisions resources while another approves access — SoD prevents a single actor from both performing and concealing a malicious or erroneous action. This directly addresses the requirement that no single administrator has full control.

Answer

Encryption at rest

Answer

Multi-Factor Authentication (MFA)

Answer

Password Complexity Policy

Question 14

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

Accepted Answer

Faster time-to-market for new features. Agility in cloud adoption refers to the ability to rapidly provision resources, iterate on features, and shorten release cycles — directly enabling faster time-to-market for new features. It is about speed and responsiveness, not cost or uptime. This is the business driver most aligned with agility.

Answer

Increased server uptime

Answer

Reduced capital expenditure

Answer

Improved compliance reporting

Question 15

A company is using a SaaS application for email. Which part of the security responsibility remains with the company?

Accepted Answer

Identity and access management. In a SaaS model, the provider manages the application, servers, and infrastructure, but the customer remains responsible for identity and access management, including user accounts, passwords, and access policies. This is a key tenet of the Shared Responsibility Model.

Answer

Server physical security

Answer

Patching the application software

Answer

Database engine version