CLO-002 Hard Questions — 25 Difficult Questions

Question 1

An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Answer

Site-to-Site VPN

Answer

Client VPN

Answer

Public IP peering

Question 2

Which THREE items should be included in an incident response plan?

Accepted Answer

Monitoring and alerting thresholds. A monitoring and alerting thresholds are correct because an incident response plan must specify the detection criteria and severity triggers that determine when an alert escalates into a declared incident, enabling consistent triage and response. B communication plan is correct because it defines who notifies whom, via which channels, and in what timeframe, including internal stakeholders, legal, and external parties, which is essential for coordinated response and regulatory notification. C defined roles and responsibilities is correct because the plan must assign clear ownership such as incident commander, communications lead, and technical responders so actions are not duplicated or missed during an event. D employee training manuals are not a core component of the plan itself; training is a supporting program that socializes the plan, not an item included within it. E budget approval workflows concern financial governance and procurement, not the detection, containment, eradication, and recovery activities that an incident response plan must document.

Answer

Employee training manuals

Answer

Budget approval workflows

Question 3

A financial services firm runs regulated workloads on AWS. An auditor requires proof that data stored in Amazon S3 is encrypted at rest with keys the firm controls, that key usage is logged, and that keys can be rotated on a defined schedule. Which combination of AWS services and features satisfies these requirements?

Accepted Answer

S3 default encryption with SSE-KMS using a customer managed key, key rotation enabled, and AWS CloudTrail logging of KMS API calls.. The requirements map to customer-controlled encryption keys, scheduled rotation, and auditable key usage. SSE-KMS with a customer managed key provides customer control over key policy and lifecycle, automatic rotation rotates key material on a schedule, and CloudTrail records KMS API activity for audit. AWS managed keys and SSE-S3 remove customer control, while Object Lock and access logging address different controls.

Answer

Client-side encryption with a key stored in AWS Secrets Manager and S3 access logging enabled.

Answer

S3 default encryption with SSE-S3 and S3 server access logging enabled on the bucket.

Answer

S3 default encryption with SSE-KMS using an AWS managed key and S3 Object Lock in compliance mode.

Question 4

A multinational enterprise is migrating a latency-sensitive trading application to a public cloud. The architecture team must select deployment characteristics that minimize network round-trip time for users in multiple regions while maintaining high availability. Which TWO characteristics should the team prioritize? (Choose two.)

Accepted Answer

Deploy the application in multiple regions close to major user concentrations.. Minimizing latency for a globally distributed user base requires bringing compute closer to users and steering each user to the nearest healthy endpoint. Deploying across multiple regions near user concentrations reduces physical distance, and latency-based or geolocation DNS routing ensures traffic reaches the optimal region while enabling failover. Together these deliver both low round-trip time and high availability.

Answer

Use a content delivery network to cache dynamic API responses at edge locations.

Answer

Increase the size of the database instance to handle more concurrent connections.

Answer

Consolidate all application instances into a single region with the lowest average latency to all users.

Question 5

Which THREE cloud management tools should be utilized to control costs?

Accepted Answer

Cost Explorer or similar visualization tool. Cost Explorer (A) is correct because it provides visualization and analysis of historical cloud spend by service, account, and tag, enabling teams to identify cost drivers and trends. Budgeting and forecasting alerts (B) are correct because they proactively notify stakeholders when actual or forecasted spend approaches or exceeds defined thresholds, allowing corrective action before overruns occur. Resource tagging policies (E) are correct because consistent tags (e.g., cost center, owner, environment) enable accurate cost allocation, chargeback, and filtering in billing reports, which is foundational to cost control. Option C, a physical server monitoring camera, is irrelevant to cloud financial management since it addresses physical security, not billing or usage. Option D, the company's external marketing agency, does not manage cloud infrastructure or billing and therefore cannot control cloud costs.

Answer

A physical server monitoring camera

Answer

The company's external marketing agency

Question 6

What is the purpose of a VPC Endpoint?

Accepted Answer

To access cloud services privately. A VPC Endpoint is correct because it enables private connectivity from a VPC to supported cloud services (like S3, DynamoDB, or KMS) without traversing the public internet, keeping traffic on the provider's private network. This improves security by removing exposure to the internet and can reduce NAT gateway data-processing costs. It is the standard mechanism for private service access from within a VPC.

Answer

To connect two VPCs

Answer

To encrypt data transit

Answer

To provide public access

Question 7

You are utilizing Infrastructure as Code (IaC) templates. You notice that a specific resource update is causing service downtime. Which deployment pattern should you adopt to verify updates in a controlled environment before rolling out to production?

Accepted Answer

Blue/Green deployment. Blue/Green deployment is the correct pattern because it maintains two identical environments (blue = current production, green = new version) and allows you to verify the update in the green environment before switching traffic over. This provides a controlled, low-risk way to test changes and enables instant rollback by switching traffic back to blue if issues arise. It directly addresses the requirement to verify updates in a controlled environment before production rollout.

Answer

Canary release

Answer

In-place upgrade

Answer

Rolling update

Question 8

You are troubleshooting a connectivity issue where an application in a private subnet cannot reach the internet to download updates. Which component is missing?

Accepted Answer

NAT Gateway. A NAT Gateway is required because resources in a private subnet have no route to the internet and cannot hold public IP addresses. The NAT Gateway resides in a public subnet and performs source NAT, allowing outbound-only traffic from private instances to reach the internet while blocking inbound connections. An Internet Gateway alone cannot serve private subnets because those subnets lack a route to it and their instances have no public IPs.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Route Table

Question 9

You need to allow temporary access to a file stored in a private bucket for a third party. What is the most secure method?

Accepted Answer

Create a Pre-signed URL. A pre-signed URL embeds the signer's credentials and an expiry timestamp into a time-limited URL, granting temporary, scoped access to a single object without changing bucket permissions or creating identities. This is the most secure method because access automatically expires, is limited to the specific object and HTTP method, and can be revoked by rotating the signing key or deleting the object.

Answer

Create an IAM user for them

Answer

Email the file

Answer

Make the bucket public

Question 10

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

Accepted Answer

Deploy the database and its backups in the region corresponding to each customer's country and disable cross-region replication.. Data residency is enforced by controlling the physical location of storage, including replicas and backups. Deploying the database and its backups in the country of collection and disabling cross-region replication keeps every copy of the record within the required jurisdiction, which is the only configuration among the choices that directly enforces the requirement.

Answer

Use a cloud access security broker to inspect data in transit between regions.

Answer

Enable geo-restriction at the content delivery network edge for all customer traffic.

Answer

Apply resource tags indicating the customer's country and use them in cost allocation reports.

Question 11

You are managing a multi-cloud environment using Terraform. You need to ensure that the infrastructure state is locked to prevent concurrent modifications during CI/CD pipeline runs. Which backend component should you implement to achieve state locking?

Accepted Answer

DynamoDB table. DynamoDB is the standard remote backend component for Terraform state locking when using the S3 backend. Terraform writes a lock item to a DynamoDB table (specified via the dynamodb_table argument in the backend block) before any state-modifying operation, and releases it afterward. This prevents two CI/CD pipeline runs from concurrently applying changes and corrupting the state file.

Answer

S3 Versioning

Answer

Terraform Cloud Workspaces

Answer

IAM Policy

Question 12

You need to store audit logs that are immutable and cannot be deleted for a set period. Which feature should you enable?

Accepted Answer

Object Lock. S3 Object Lock enforces WORM (Write Once, Read Many) semantics, preventing objects from being deleted or overwritten for a specified retention period. It is the correct feature for immutable audit logs that must be preserved for compliance. Object Lock requires S3 Versioning to be enabled on the bucket and is configured in Governance or Compliance mode.

Answer

Access Logs

Answer

Versioning

Answer

Encryption

Question 13

A company uses a hybrid cloud. They need to move a database workload to the cloud that has strict regulatory requirements. Which deployment model is most appropriate?

Accepted Answer

Private cloud deployment. Private cloud deployment is correct because strict regulatory requirements (e.g., PCI-DSS, HIPAA, GDPR data residency, FedRAMP) often mandate dedicated infrastructure, full control over data location, and isolation from other tenants. A private cloud provides single-tenant hardware and network, enabling the organization to meet compliance controls around data sovereignty, access, and auditing that multi-tenant public clouds may not satisfy without extensive additional controls.

Answer

Public cloud multi-tenant

Answer

Community cloud

Answer

Serverless functions

Question 14

You are migrating a legacy application to the cloud. The application requires an OS that is no longer supported by the provider. Which migration strategy is most appropriate?

Accepted Answer

Re-platforming. Re-platforming (lift, tinker, and shift) involves making targeted changes to the application or its runtime to take advantage of cloud capabilities — including moving to a supported OS or managed service. Since the legacy OS is unsupported, re-platforming lets you migrate while modernizing the OS/runtime, avoiding the security and support risks of re-hosting an unsupported platform.

Answer

Re-hosting (Lift and Shift)

Answer

Retaining

Answer

Retiring

Question 15

When evaluating a cloud service provider (CSP), which TWO of the following business-focused documentation should be requested to verify the vendor's reliability and security posture?

Accepted Answer

SOC 2 Type II reports. Option C, SOC 2 Type II reports, is correct because they are independent audit attestations covering the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) over a defined review period, giving direct evidence of the vendor's security controls and operational reliability. Option E, Service Level Agreement (SLA) documentation, is correct because it contractually defines measurable commitments such as uptime percentage, availability targets, performance metrics, and remedies or credits for failures, which is exactly what a business needs to assess vendor reliability. The unmarked options do not belong: A, the quarterly stock earnings report, reflects financial market performance rather than security posture or service reliability; B, employee payroll records, is confidential HR data irrelevant to security evaluation and would raise privacy concerns; and D, internal office floor plans, is physical layout information with no bearing on the CSP's security or reliability assurances.

Answer

The provider's quarterly stock earnings report

Answer

Employee payroll records

Answer

Internal office floor plans

Question 16

A global company needs to ensure compliance with GDPR. Which feature of a cloud provider is most critical for compliance?

Accepted Answer

Data residency controls. GDPR requires that personal data of EU residents be stored and processed under specific legal frameworks, and data residency controls let organizations pin data to specific geographic regions (e.g., EU-West) to satisfy these requirements. This is the most critical cloud feature for GDPR compliance because it directly addresses the regulation's data sovereignty and cross-border transfer rules. Without residency controls, data may be replicated or processed outside approved jurisdictions, creating legal exposure.

Answer

Auto-scaling groups

Answer

Multi-region replication

Answer

Public IP addresses

Question 17

An organization runs a containerized e-commerce platform on a managed Kubernetes service. During a flash sale, response times degrade sharply. Metrics show the application pods are healthy and the database is not saturated, but the cluster reports that some nodes cannot schedule new pods because of resource pressure. The team must add capacity automatically when pod demand rises and remove it when demand falls. Which action should the team take?

Accepted Answer

Enable the cluster autoscaler so the node pool grows and shrinks with pending pod demand. The cluster autoscaler is designed for exactly this situation: it detects pods that are pending because no node has enough allocatable resources, then adds nodes to the pool, and later removes underutilized nodes when demand subsides. Because the workload pods are already healthy and the database is not the bottleneck, the missing piece is automatic node-level capacity, which this component supplies.

Answer

Configure a horizontal pod autoscaler to increase the replica count based on CPU utilization

Answer

Increase the CPU request and limit values on the existing application deployment

Answer

Create a pod disruption budget to guarantee minimum availability during scaling events

Question 18

Which THREE are key characteristics of cloud computing?

Accepted Answer

Measured service. A. Measured service is correct because cloud providers meter resource usage (compute, storage, bandwidth) and bill customers based on consumption, enabling pay-as-you-go pricing. B. Broad network access is correct because cloud services are delivered over the network via standard mechanisms (e.g., HTTP/HTTPS, APIs) and accessible from diverse client devices such as laptops, phones, and tablets. E. Rapid elasticity is correct because cloud resources can scale out and in automatically or on demand to match workload changes, appearing nearly unlimited to the consumer. C. Static hardware provisioning is incorrect because cloud computing emphasizes dynamic, on-demand provisioning rather than fixed, pre-allocated hardware. D. Physical media access is incorrect because cloud services are accessed remotely over networks, not through physical media such as tapes, disks, or direct hardware connections.

Answer

Static hardware provisioning

Answer

Physical media access

Question 19

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates and normalizes findings from services like AWS Config, Inspector, GuardDuty, and third-party tools, and it includes the AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark standards. Running the CIS standard in Security Hub produces a consolidated compliance view showing which resources are non-compliant, which is exactly what the compliance officer needs. This makes Security Hub the right reporting layer.

Answer

AWS Config

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 20

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

Accepted Answer

Classifying data based on sensitivity and regulatory requirements. Under the shared responsibility model, the customer is responsible for data classification and IAM configuration, as these are directly related to how data is handled and accessed. The provider is responsible for physical security and hypervisor patching. Key management can be shared, but the two clear customer responsibilities are data classification and IAM policies.

Answer

Patching the hypervisor that hosts virtual machines

Answer

Managing the lifecycle of encryption keys stored in a hardware security module (HSM)

Answer

Ensuring physical security of data center facilities