CLO-002 Governance Risk Compliance And Security Practice Test 5 — 15 Questions

Question 1

A healthcare organization is migrating patient records to a public cloud. The security team must ensure that only authorized applications can access the storage buckets containing this data, and that access is logged for audit purposes. Which combination of AWS features should they implement to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Identity and Access Management (IAM) policies and AWS CloudTrail. The correct answer is IAM policies and CloudTrail because IAM controls access to S3 resources based on identity and permissions, ensuring only authorized applications can access the buckets. CloudTrail records all API calls, including S3 data access, providing the necessary audit trail. This combination directly addresses both access control and logging requirements for sensitive healthcare data.

Answer

Amazon S3 bucket policies and AWS Config

Answer

Amazon GuardDuty and AWS Security Hub

Answer

AWS Shield and AWS WAF

Question 2

A company is using a cloud provider's infrastructure as a service (IaaS) offering. The security team must ensure that the operating system and applications on the virtual machines are patched and configured securely. According to the shared responsibility model, which party is responsible for these tasks?

Accepted Answer

The customer, because they control the operating system and applications.. In IaaS, the cloud provider manages the physical infrastructure, while the customer is responsible for the guest operating system, applications, and data. Therefore, patching and secure configuration of the OS and applications fall to the customer. This delineation is a fundamental aspect of the shared responsibility model.

Answer

A third-party security vendor, because they specialize in cloud security.

Answer

The cloud provider, because they manage the physical infrastructure.

Answer

Both the customer and the provider share equal responsibility for patching.

Question 3

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

Accepted Answer

Enforce a tagging policy that requires specific tags on all resources at creation time.. Accurate cost allocation depends on resources being labeled with consistent metadata such as cost center and owner. Enforcing a tagging policy at resource creation ensures every resource is attributable, which directly enables correct invoice allocation. Security controls like MFA or a CASB, and monitoring tools like budget alerts, do not provide the per-resource attribution the business requires.

Answer

Configure a budget alert to notify administrators when spending exceeds a threshold.

Answer

Implement a cloud access security broker to inspect traffic to cloud services.

Answer

Enable multi-factor authentication for all administrative accounts.

Question 4

A company is adopting a multi-cloud strategy and needs to implement identity and access management (IAM) consistently across AWS, Azure, and Google Cloud. The security team wants to centralize user authentication and authorization to reduce administrative overhead and enforce uniform security policies. Which two approaches should they use to achieve centralized IAM across multiple clouds? (Choose two.)

Accepted Answer

Federate each cloud provider's IAM with a central identity provider (IdP) such as Azure Active Directory or Okta using SAML 2.0 or OpenID Connect.. Centralizing IAM across multiple clouds is best achieved by federating each cloud's IAM with a central identity provider and/or using a centralized identity broker. These methods provide single sign-on, consistent policy enforcement, and reduced administrative overhead. The other options either fragment identity management or introduce security risks.

Answer

Use each cloud provider's native IAM system independently and synchronize user accounts manually.

Answer

Configure each cloud provider's IAM to trust the others' identity providers directly without a central IdP.

Answer

Store all user credentials in a shared spreadsheet and distribute it to administrators.

Question 5

A financial services company is migrating to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company controls and can revoke at any time. Which key management approach should they implement?

Accepted Answer

Customer-managed keys stored in a hardware security module (HSM). The requirement is for customer-controlled, revocable encryption keys. Customer-managed keys in an HSM provide the necessary control and security. Provider-managed keys and server-side encryption with provider keys do not give the customer control. Client-side encryption with keys in code is insecure and lacks proper revocation mechanisms. Only customer-managed keys in an HSM meet all criteria.

Answer

Provider-managed keys with automatic rotation

Answer

Client-side encryption with keys stored in the application code

Answer

Server-side encryption with keys managed by the cloud provider

Question 6

A cloud governance team is drafting controls to reduce the risk of misconfiguration in a multi-account environment. Which two practices best support continuous compliance monitoring? (Choose two.)

Accepted Answer

Run automated configuration checks that evaluate resources against a benchmark and alert on drift.. Continuous compliance combines preventive and detective controls. Validating infrastructure as code against policy stops noncompliant resources before they exist, while automated configuration checks detect drift and violations after deployment. Together they create a feedback loop that scales across many accounts, unlike annual manual reviews, disabled logging, or overly broad permissions, which either miss changes or increase risk.

Answer

Perform a manual configuration review of all accounts once per year.

Answer

Grant every engineer administrator rights so they can fix issues quickly without tickets.

Answer

Disable all logging to reduce storage costs and simplify the environment.

Question 7

A multinational corporation must ensure that customer data stored in its cloud environment remains within the borders of the country where it was collected, in accordance with local data sovereignty laws. Which cloud governance control should the corporation implement?

Accepted Answer

Select cloud regions and availability zones located within the required country and restrict replication to those regions.. Data sovereignty is about the legal jurisdiction where data resides. The enforceable control is to select cloud regions within the required country and prevent replication or failover to regions outside it. Encryption, traffic inspection, and content delivery do not constrain the physical location of stored data and therefore cannot satisfy the legal requirement on their own.

Answer

Configure a content delivery network to cache data at edge locations worldwide.

Answer

Enable customer-managed encryption keys stored in a hardware security module.

Answer

Implement a cloud access security broker to inspect all data flows.

Question 8

A financial services company is moving its transaction processing system to a public cloud. The compliance team requires that the cloud provider's security controls are independently validated, and that the company can continuously monitor the compliance status of its cloud resources. Which two actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Implement a cloud security posture management (CSPM) tool to continuously assess resource configurations against compliance benchmarks.. The correct actions are obtaining a SOC 2 Type II report and implementing a CSPM tool. The SOC 2 report provides independent validation of the cloud provider's security controls, satisfying the compliance team's requirement. A CSPM tool continuously monitors the company's cloud resources for compliance with benchmarks, ensuring ongoing adherence. Together, they address both independent validation and continuous monitoring.

Answer

Use the cloud provider's shared responsibility model to document that the provider is responsible for all security controls.

Answer

Enable multi-factor authentication (MFA) for all administrative accounts.

Answer

Conduct a penetration test against the cloud provider's infrastructure without prior authorization.

Question 9

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical infrastructure, including data centers, hardware, and network facilities.. Under the shared responsibility model, the cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and network infrastructure. The customer is responsible for security in the cloud, such as configuring security groups, managing access, and encrypting data. The correct answer is the one that describes physical infrastructure security.

Answer

Encrypting the customer's data before it is uploaded to the cloud.

Answer

Configuring security groups and network ACLs for the customer's virtual private cloud.

Answer

Managing user access keys and permissions for the customer's cloud resources.

Question 10

A company wants to ensure that its cloud resources are tagged correctly for cost allocation and compliance. Which cloud governance practice should they implement to enforce tagging standards?

Accepted Answer

Use a policy engine to deny creation of untagged resources. Enforcing tagging standards requires a proactive control that prevents non-compliant resources from being created. A policy engine can deny untagged resource creation, ensuring compliance. Default tags, manual audits, and email reminders are not enforcement mechanisms and do not guarantee adherence. The policy engine approach is the most effective for governance.

Answer

Enable default tags on all resources

Answer

Conduct monthly manual audits of resource tags

Answer

Send email reminders to engineers about tagging policies

Question 11

A startup wants to reduce the risk of losing data stored in a cloud object storage bucket. The team needs a governance control that protects against accidental deletion by an authorized user. Which action should the team take?

Accepted Answer

Enable versioning and object lock with a retention period on the bucket.. Versioning and object lock with retention protect stored objects from accidental or malicious deletion by retaining previous versions and enforcing immutability for a defined period. Lifecycle rules, encryption, and read-only policies address cost, confidentiality, or access, but none of them prevent an authorized user from removing data the way versioning plus object lock does.

Answer

Enable server-side encryption with a provider-managed key.

Answer

Configure a lifecycle rule to transition objects to a colder storage class after 30 days.

Answer

Create a read-only identity and access management policy for all users.

Question 12

A company is deploying a new cloud-native application that must comply with GDPR. The application will process personal data of EU citizens. Which cloud governance practice is most important to implement to ensure data protection and privacy?

Accepted Answer

Data classification and tagging. Data classification and tagging is the most important governance practice because it enables the organization to identify personal data and apply appropriate protections, such as encryption and access controls, in line with GDPR. Without proper classification, other measures like MFA might be applied inconsistently, leaving personal data unprotected. It is a prerequisite for effective data governance.

Answer

Cost optimization

Answer

Multi-factor authentication (MFA) for all users

Answer

Resource tagging for billing

Question 13

An organization's security team wants to detect and respond to suspicious activities in its cloud environment, such as unusual API calls or unauthorized configuration changes. Which cloud-native capability should the team use to meet this requirement?

Accepted Answer

Enable cloud audit logging and configure alerts for anomalous API activity and configuration changes.. Detecting suspicious API calls and unauthorized configuration changes requires visibility into control plane activity. Cloud audit logging captures these events, and alerting on anomalous patterns enables timely detection and response. Application-layer controls, network tunnels, and performance services do not provide the necessary monitoring of administrative and API-level actions.

Answer

Implement a virtual private network for all remote administrative access.

Answer

Configure a content delivery network to accelerate access to cloud management consoles.

Answer

Deploy a web application firewall in front of all public-facing applications.

Question 14

A financial services company is using a public cloud to host a web application. The security team wants to ensure that all data stored in the cloud is encrypted at rest using keys that the company controls and can rotate independently. Which cloud service or feature should they implement to meet this requirement?

Accepted Answer

Customer-managed keys (CMK) using a cloud key management service (KMS).. The requirement is to encrypt data at rest with keys the customer controls and can rotate independently. Customer-managed keys in a cloud KMS allow the customer to generate, manage, and rotate keys, while the provider secures the key management infrastructure. Provider-managed keys do not give the customer control. Client-side encryption with on-premises keys may not integrate with cloud services for at-rest encryption. SSL/TLS is for data in transit.

Answer

Client-side encryption with keys stored on-premises.

Answer

Provider-managed encryption keys with automatic rotation.

Answer

SSL/TLS certificates for data in transit.

Question 15

A multinational corporation must comply with GDPR, which requires that personal data of EU citizens not be transferred outside the EU without adequate safeguards. The company is using a cloud provider with data centers worldwide. Which cloud feature should they use to ensure compliance?

Accepted Answer

Region-specific data storage with geo-fencing policies. GDPR's data residency requirement means personal data of EU citizens must stay within the EU unless adequate safeguards are in place. Region-specific storage with geo-fencing ensures data remains in the chosen region. CDNs, MFA, and encryption do not address data location. Therefore, region-specific storage with geo-fencing is the correct feature.

Answer

Content delivery network (CDN) with global edge locations

Answer

Encryption of data at rest with customer-managed keys

Answer

Multi-factor authentication (MFA) for all users