CLO-002 Governance Risk Compliance And Security Practice Test 3 — 15 Questions

Question 1

An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?

Accepted Answer

Network ACL. A Network ACL (NACL) is a stateless, subnet-level firewall that evaluates inbound and outbound rules before traffic reaches any instance, making it the first line of defense for a private subnet. Because it operates at the subnet boundary, it filters traffic regardless of instance-level configuration. Security groups act at the instance level and are evaluated after the NACL, so the NACL is the outermost control.

Answer

NAT Gateway

Answer

Security Group

Answer

Route Table

Question 2

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates and normalizes findings from services like AWS Config, Inspector, GuardDuty, and third-party tools, and it includes the AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark standards. Running the CIS standard in Security Hub produces a consolidated compliance view showing which resources are non-compliant, which is exactly what the compliance officer needs. This makes Security Hub the right reporting layer.

Answer

AWS Config

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 3

What is the primary risk mitigation strategy when storing data in a single availability zone?

Accepted Answer

Multi-AZ deployment. The primary risk of storing data in a single availability zone is that a failure of that AZ (power, network, natural disaster) would make the data unavailable or lost. Multi-AZ deployment mitigates this by replicating data across multiple AZs, ensuring high availability and durability. This is the fundamental risk mitigation strategy for AZ-level failures.

Answer

Using stronger encryption

Answer

Implementing MFA

Answer

Increasing compute power

Question 4

A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?

Accepted Answer

SOC 2 / ISO Certification Report. A SOC 2 report or ISO/IEC 27001 certification report is the independent third-party attestation that a cloud provider's controls meet recognized security and compliance standards. Auditors rely on these documents — produced by an independent CPA firm or accredited certification body — to verify compliance without auditing the provider themselves. This is exactly what a firm should obtain to demonstrate the provider's ISO 27001 compliance during a third-party audit.

Answer

Annual Financial Report

Answer

Network Infrastructure Diagram

Answer

Service Level Agreement

Question 5

Which THREE of the following are common benefits of adopting a Cloud Governance framework?

Accepted Answer

Consistent risk management. A Cloud Governance framework establishes policies, roles, and controls that standardize how cloud resources are evaluated and approved, which directly produces consistent risk management (A) by applying the same risk criteria across all cloud projects and business units. It also enforces alignment between cloud initiatives and organizational objectives through defined decision-making bodies and policy guardrails, giving better alignment with business goals (C). Because governance mandates documented controls, logging, and policy enforcement, it yields improved auditability and compliance (E) against standards such as ISO 27001, SOC 2, or regulatory requirements. Lower hardware maintenance costs (B) is a possible outcome of cloud migration itself, not a governance benefit, and increased cloud deployment speed (D) is typically a DevOps/automation outcome; governance can even add approval steps, so neither is a defining benefit of the framework.

Answer

Lower hardware maintenance costs

Answer

Increased cloud deployment speed

Question 6

When a data breach occurs in a cloud environment, who is responsible for notifying the regulatory authorities?

Accepted Answer

The cloud customer. Under virtually all data protection regulations (GDPR, HIPAA, CCPA, etc.), the data controller — which in a cloud relationship is the cloud customer — bears the legal obligation to notify regulators and affected data subjects of a breach. The cloud provider is typically a data processor acting on the customer's instructions and may contractually assist with notification, but the legal duty rests with the customer. This is a foundational shared-responsibility concept tested heavily on CLO-002.

Answer

The local ISP

Answer

The cloud provider

Answer

The software vendor

Question 7

Which TWO of the following are essential components of a Cloud Security Policy?

Accepted Answer

Data classification scheme. Option C (Data classification scheme) is essential because a Cloud Security Policy must define how data is categorized by sensitivity (e.g., public, internal, confidential, restricted) so that appropriate controls, encryption, and handling procedures can be applied to each class in the cloud. Option E (Access management requirements) is essential because the policy must specify identity and access controls such as least privilege, role-based access control (RBAC), multi-factor authentication (MFA), and periodic access reviews to protect cloud resources. Options A (Cloud provider marketing strategy) and B (Hardware procurement schedule) are business or logistics concerns, not security policy components, and option D (Network cable standards) is a physical-layer infrastructure detail irrelevant to a cloud security policy, since cloud networking is abstracted and governed by the provider.

Answer

Cloud provider marketing strategy

Answer

Hardware procurement schedule

Answer

Network cable standards

Question 8

Which TWO of the following are key responsibilities of a Cloud Governance Committee?

Accepted Answer

Establishing security and compliance standards. Option C is correct because a Cloud Governance Committee sets the overarching security and compliance standards that all cloud workloads must adhere to, defining policies, controls, and guardrails rather than performing hands-on administration. Option E is correct because defining cloud investment policies—such as budgeting, cost allocation, funding models, and financial guardrails—is a core governance function that steers how cloud resources are funded and consumed across the organization. Options A and B are incorrect because installing OS patches and managing individual VM performance are operational, day-to-day tasks handled by cloud operations or systems administrators, not by a governance body. Option D is incorrect because writing application source code is a development responsibility, outside the strategic and policy-setting scope of a governance committee.

Answer

Installing OS patches

Answer

Managing individual virtual machine performance

Answer

Writing application source code

Question 9

Which THREE of the following represent common compliance risks in a cloud environment?

Accepted Answer

Data sovereignty violations. Data sovereignty violations (A) are a common compliance risk because data stored or processed in a cloud region may be subject to different legal jurisdictions, potentially breaching laws like GDPR that restrict cross-border data transfers. Cloud resource misconfiguration (D) is a leading compliance risk since settings such as public S3 buckets, overly permissive security groups, or disabled encryption can directly violate standards like PCI DSS, HIPAA, or ISO 27001. Unauthorized access to sensitive data (E) is a core compliance risk because it breaches confidentiality requirements and mandates for access controls, audit logging, and breach notification under regulations such as HIPAA, SOX, and GDPR. Resource naming conventions (B) are an operational governance or tagging concern, not a compliance risk, and high monthly electricity bills (C) are a cost or sustainability matter unrelated to regulatory compliance obligations.

Answer

Resource naming conventions

Answer

High monthly electricity bills

Question 10

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Accepted Answer

TLS 1.2/1.3. TLS 1.2/1.3 (A) is correct because it encrypts application-layer traffic such as HTTPS, securing data as it moves between clients and cloud services. Direct Connect with MACsec (B) is correct because MACsec provides IEEE 802.1AE link-layer encryption on dedicated AWS Direct Connect connections, protecting data in transit over the private network path. VPN Tunnels using IPsec (E) are correct because IPsec encrypts and authenticates IP packets across untrusted networks, securing site-to-site or client-to-cloud transit. Server-side encryption at rest (C) is incorrect because it protects stored data on disks, not data moving across a network. User access logs (D) are incorrect because they record activity for auditing and monitoring but do not encrypt or otherwise secure data in transit.

Answer

Server-side encryption at rest

Answer

User access logs

Question 11

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Accepted Answer

Performing periodic penetration tests. Performing periodic penetration tests (A) is correct because it proactively identifies exploitable vulnerabilities and misconfigurations in cloud workloads, APIs, and identity controls before attackers can abuse them, directly reducing the likelihood and impact of cloud-related breaches. Implementing automated compliance monitoring (D) is correct because continuous, policy-as-code evaluation of cloud resources against standards such as CIS Benchmarks, ISO 27001, PCI DSS, or HIPAA detects drift and non-compliant configurations in near real time, enabling rapid remediation. Requiring multi-factor authentication for all users (E) is correct because MFA blocks credential-based attacks such as phishing, password spraying, and credential stuffing, which are among the leading initial access vectors in cloud environments, and it strengthens identity as the primary security perimeter. Reducing the number of cloud regions used (B) is not a valid mitigation because it does not address security risk and can actually increase blast radius and reduce resilience, since multi-region architectures improve availability and disaster recovery. Using only one cloud provider (C) is not a valid mitigation because single-provider dependence increases vendor lock-in, concentration risk, and single points of failure, whereas a multi-cloud or hybrid strategy can improve resilience and negotiating leverage.

Answer

Reducing the number of cloud regions used

Answer

Using only one cloud provider

Question 12

Which TWO of the following are key steps in a Cloud Incident Response process?

Accepted Answer

Conducting a post-incident review. Incident response requires structured preparation, containment, and post-incident analysis.

Answer

Purchasing new hardware for the data center

Answer

Notifying the cloud provider's sales team

Answer

Updating the company's social media

Question 13

Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?

Accepted Answer

Centralizing security and governance. Option C (Centralizing security and governance) is correct because a CCoE consolidates cloud security policies, guardrails, IAM standards, and compliance controls so that every team adopts consistent, auditable governance rather than fragmented per-team practices. Option D (Standardizing cloud adoption patterns) is correct because the CCoE produces reusable reference architectures, landing zones, IaC templates, and well-architected best practices that make cloud deployments repeatable and reduce drift. Option E (Fostering cross-departmental collaboration) is correct because the CCoE is a cross-functional body that brings together security, finance, operations, and application teams to share knowledge, align priorities, and spread cloud expertise across the organization. Option A (Hiring software developers) is not a defining CCoE purpose, since developer recruitment is a line-management/HR activity rather than the CCoE's governance and enablement mission. Option B (Managing local desktop hardware) is unrelated to cloud adoption and falls under endpoint/IT support operations, not a Cloud Center of Excellence.

Answer

Hiring software developers

Answer

Managing local desktop hardware

Question 14

Which TWO of the following are common threats to cloud-based data integrity?

Accepted Answer

Unauthorized data modification. Option B (Unauthorized data modification) is correct because any tampering with stored data by an attacker or rogue insider directly violates data integrity, altering values without authorization and potentially corrupting records or transactions. Option C (Code injection attacks) is correct because techniques such as SQL injection or cross-site scripting let attackers execute malicious code that inserts, updates, or deletes data, which is a classic integrity threat in cloud-hosted applications. Option A (Network latency increases) affects availability and performance, not the correctness of data, so it is not an integrity threat. Option D (Database snapshot frequency) is a backup/recovery design choice that influences RPO, not a threat to integrity. Option E (System-wide power failure) primarily threatens availability and can cause corruption, but it is an environmental/availability risk rather than a common cloud data-integrity threat in the sense of malicious or unauthorized alteration.

Answer

Network latency increases

Answer

Database snapshot frequency

Answer

System-wide power failure

Question 15

Which THREE of the following are cloud security best practices?

Accepted Answer

Automating security configuration audits. Option A is correct because automating security configuration audits ensures continuous, repeatable detection of drift and misconfigurations across cloud resources, aligning with frameworks like CIS Benchmarks and tools such as AWS Config or Azure Policy. Option D is correct because enforcing the principle of least privilege limits identities and roles to only the permissions required for their tasks, reducing the blast radius of compromised credentials and satisfying standards like NIST and ISO 27001. Option E is correct because encrypting all sensitive data at rest protects confidentiality even if storage media or snapshots are exposed, using services such as AWS KMS, Azure Key Vault, or GCP CMEK. Option B does not belong because storing passwords in plain text files exposes credentials to anyone with file access and violates secure secret management practices. Option C does not belong because granting 'Full Access' to all developers violates least privilege and dramatically increases the risk of accidental or malicious damage.

Answer

Storing passwords in plain text files

Answer

Granting 'Full Access' to all developers