CLO-002 Governance Risk Compliance And Security — Timed 25 Questions

Question 1

An organization wants to prevent users from creating resources in regions other than the ones approved by corporate policy. What should be used to enforce this?

Accepted Answer

AWS Organizations Service Control Policy (SCP). IAM policies using conditions (e.g., 'aws:RequestedRegion') effectively restrict geographic deployments.

Answer

CloudFormation StackSet

Answer

Resource Tagging

Question 2

A company needs to ensure that only authorized devices can access internal cloud applications. Which mechanism verifies device posture before granting access?

Accepted Answer

Conditional Access Policies. Conditional Access Policies in cloud identity platforms (e.g., Microsoft Entra ID, Microsoft Entra ID) evaluate signals such as device compliance state, device ID, platform, and location before issuing a token or granting access to an application. They are the specific mechanism that enforces device posture checks — a non-compliant or unregistered device can be blocked or forced into remediation. This directly satisfies the requirement that only authorized (compliant, managed, healthy) devices reach internal cloud apps.

Answer

Security Groups

Answer

MFA (Multi-Factor Authentication)

Answer

IAM Role Assumption

Question 3

A developer is writing code that accesses an API key. Instead of hardcoding the key, which service should they use to retrieve it securely at runtime?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for securely storing and retrieving secrets such as API keys, passwords, and tokens. It provides fine-grained access control, automatic rotation, and auditing, making it the ideal service for retrieving an API key securely at runtime.

Answer

Environment Variables

Answer

Parameter Store

Answer

IAM Roles

Question 4

Which TWO of the following scenarios represent a breach of the Shared Responsibility Model?

Accepted Answer

Customer leaves a database port open to the public. Option B is correct because leaving a database port open to the public is a customer-side misconfiguration of the security group or firewall, and under the Shared Responsibility Model the customer is responsible for securing their data, configuring network access controls, and protecting the guest OS and applications in the cloud. Option C is correct because failing to rotate IAM access keys is a customer responsibility — identity and access management, credential hygiene, and key rotation are handled by the customer, not the provider, in IaaS/PaaS environments. Option A does not represent a breach of the Shared Responsibility Model because a data center power outage falls under the provider's responsibility for physical infrastructure and availability, and the model assigns that to the provider rather than the customer. Option D does not represent a breach because deploying code in a private VPC is a legitimate, secure customer configuration choice, not a violation of responsibility boundaries. Option E does not represent a breach of the Shared Responsibility Model because patching physical hardware firmware is the provider's responsibility for the underlying infrastructure, so a provider failure there is a provider-side issue, not a customer breach of the model.

Answer

Provider has a data center power outage

Answer

Customer deploys code in a private VPC

Answer

Provider fails to patch their physical hardware firmware

Question 5

A healthcare company stores patient records in a public cloud object storage bucket. The security team needs to detect and automatically alert on any changes to the bucket's access control list (ACL) or bucket policy in near real-time. Which cloud-native service or feature should they use to achieve this?

Accepted Answer

Cloud provider's native logging and event notification service, such as AWS CloudTrail combined with Amazon CloudWatch Events, to monitor API calls that modify bucket policies.. The need is to detect and alert on changes to bucket ACLs or policies in near real-time. CloudTrail captures management API calls, and CloudWatch Events can trigger notifications based on those events. This combination provides the required monitoring and alerting. Other options either protect data or perform periodic checks but do not provide real-time detection of access control changes.

Answer

Configure a bucket policy that denies all public access and rely on the provider's default security posture.

Answer

Enable versioning on the bucket and configure a lifecycle rule to retain all versions for 90 days.

Answer

Use a third-party vulnerability scanner to periodically scan the bucket for misconfigurations.

Question 6

A multinational corporation is using a hybrid cloud model. The security team needs to ensure that data transferred between the on-premises data center and the public cloud is encrypted and that the encryption keys are managed by the corporation, not the cloud provider. Which solution should they implement?

Accepted Answer

Use a VPN with IPsec and a customer-managed key management service (KMS) for encryption.. The correct solution is a VPN with IPsec and a customer-managed KMS. IPsec VPN encrypts data in transit, and a customer-managed KMS ensures the corporation controls the encryption keys, satisfying both encryption and key custody requirements. Other options either use provider-managed keys or do not provide a integrated key management solution for hybrid cloud.

Answer

Use a site-to-site VPN with AES-256 and store encryption keys in an on-premises hardware security module (HSM).

Answer

Use AWS Direct Connect with MACsec encryption and AWS-managed KMS keys.

Answer

Use SSL/TLS for data transfer and store encryption keys in AWS Secrets Manager.

Question 7

A company is migrating its customer relationship management (CRM) system to a public cloud. The legal team requires that the cloud provider's data processing agreement (DPA) includes specific data protection clauses and that the provider complies with the EU-U.S. Privacy Shield framework. Which action should the company take first to ensure compliance?

Accepted Answer

Review the cloud provider's DPA and verify its certification status on the Privacy Shield List.. The first action should be to review the cloud provider's DPA and verify its Privacy Shield certification. This confirms that the provider has committed to the necessary data protection clauses and is legally recognized as compliant for EU-U.S. data transfers. Without this, other measures like encryption may not satisfy the legal team's requirements.

Answer

Use a third-party auditor to certify the CRM application.

Answer

Conduct a penetration test on the cloud provider's infrastructure.

Answer

Implement encryption for all data at rest and in transit.

Question 8

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Accepted Answer

Site-to-Site VPN. A Site-to-Site VPN creates an encrypted IPsec tunnel between the on-premises gateway and the cloud provider's virtual private gateway, ensuring all data in transit is encrypted. This directly satisfies the requirement for encryption of data moving between the data center and the cloud. It is the standard mechanism when encryption over a public network path is required.

Answer

VPC Peering

Answer

IGW (Internet Gateway)

Answer

Direct Connect

Question 9

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the account, including the identity of the caller (IAM user, role, or federated identity), the action taken, the resource affected, source IP, and timestamp. Analyzing CloudTrail event history lets the analyst pinpoint exactly which IAM user made unauthorized infrastructure changes. This is the authoritative audit log for 'who did what' in AWS.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudWatch

Answer

AWS Security Hub

Question 10

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

Accepted Answer

Azure Policy. Azure Policy is a service that allows administrators to define and enforce rules (policies) that govern resource configurations. It can automatically remediate non-compliant resources and ensure that virtual machines adhere to corporate security standards, such as specific OS versions, by evaluating and enforcing policies at scale.

Answer

Azure Backup

Answer

Azure Resource Manager templates

Answer

Azure Monitor

Question 11

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the dedicated cost management dashboard that visualizes historical and current spend, forecasts future costs, and surfaces budget alerts and anomaly detections. It directly answers the governance question of 'what are we spending and are we within budget?' by aggregating billing data across services, accounts, and tags. Budgets configured in AWS Budgets appear as alerts tied to the same cost data Cost Explorer presents.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the managed service for creating and controlling customer-managed keys (CMKs) used to encrypt data at rest, and it integrates with AWS CloudTrail to produce audit logs of every key usage. KMS supports key policies, grants, and automatic rotation, satisfying both the customer-managed key requirement and the compliance audit requirement. This is why C is correct.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Question 13

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

Accepted Answer

Azure SQL Advanced Data Security. Azure SQL Advanced Data Security (now Microsoft Defender for SQL) includes Vulnerability Assessment and Advanced Threat Protection, which identify potential database vulnerabilities and detect anomalous activities such as SQL injection, brute-force attempts, and unusual access patterns. It is purpose-built for Azure SQL Database and surfaces findings directly in the Azure portal. This directly satisfies the GDPR requirement to protect personal data against unauthorized access by detecting and alerting on threats.

Answer

Azure Information Protection

Answer

Azure AD Conditional Access

Answer

Azure Firewall

Question 14

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Accepted Answer

Allow TCP 443 from 0.0.0.0/0. To allow only standard HTTPS traffic, the inbound rule must permit TCP port 443. Option A specifies TCP 443 from 0.0.0.0/0, which allows HTTPS from any source — this is the correct port and protocol for HTTPS. While 0.0.0.0/0 is broad, the question asks which rule allows only standard HTTPS traffic, and TCP 443 is the defining characteristic of HTTPS.

Answer

Allow TCP 80 from 0.0.0.0/0

Answer

Allow all TCP from 0.0.0.0/0

Answer

Allow UDP 443 from 0.0.0.0/0

Question 15

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

Accepted Answer

Risk Register. A Risk Register is the primary document that identifies, assesses, and records risk mitigation strategies, owners, and status. It directly evidences that the organization is actively managing cloud risks, making it the most appropriate artifact for an auditor seeking proof of risk mitigation.

Answer

Cloud Service Level Agreement (SLA)

Answer

System Security Plan (SSP)

Answer

Network Topology Diagram

Question 16

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Accepted Answer

S3 Object Lock in Compliance Mode. S3 Object Lock in Compliance Mode prevents any user, including the root account, from overwriting or deleting an object version until its retention period expires. This provides true WORM (Write Once, Read Many) immutability for the required seven years, satisfying regulatory compliance requirements.

Answer

S3 Intelligent Tiering

Answer

S3 Standard Storage Class

Answer

S3 Cross-Region Replication

Question 17

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against desired rules, so it can detect resources missing the required 'Owner' and 'Environment' tags and trigger automatic remediation (e.g., via SSM Automation documents). This is exactly the governance/compliance use case described. CloudWatch, Trusted Advisor, and Systems Manager do not provide rule-based configuration compliance evaluation with remediation.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 18

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that describes the ability to automatically add and remove resources in response to real-time demand, scaling out during traffic spikes and scaling in when demand drops. This matches the question's emphasis on maintaining performance while matching capacity to traffic. Scalability, by contrast, is the broader ability to grow, but it does not inherently imply automatic, bidirectional adjustment.

Answer

Multi-tenancy

Answer

High Availability

Answer

Scalability

Question 19

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is a dedicated account- and bucket-level setting that overrides any ACL or bucket policy granting public access, providing a hard guardrail against accidental public exposure. Enabling it at the account level ensures that even if someone later attaches a permissive bucket policy or ACL, public access remains blocked. This is the AWS-recommended control specifically designed to prevent the incident described.

Answer

Access Control Lists (ACLs)

Answer

IAM User Policies

Answer

Bucket Policy

Question 20

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Accepted Answer

Regional Resource Placement. Regional Resource Placement means deploying and storing resources within a specific geographic region (e.g., a country) to comply with data sovereignty laws. By choosing a region that is within the required borders, organizations ensure that data does not leave the country, thus meeting legal requirements.

Answer

Content Delivery Network (CDN)

Answer

Global Accelerator

Answer

VPC Peering