CLO-002 Timed Practice Test 1 — 10 Questions

Question 1

A healthcare company is migrating its electronic health records (EHR) system to the cloud. The company must ensure compliance with HIPAA regulations. Which of the following is the primary responsibility of the company under the shared responsibility model when using an IaaS cloud provider?

10 minute time limit — choose an answer to begin.

Accepted Answer

Managing the guest operating system, applications, and data. Under the IaaS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes the guest operating system, applications, and data. For a healthcare company, this means protecting ePHI through encryption, access management, and compliance controls. The cloud provider secures the physical infrastructure and hypervisor, but the company must ensure its own configurations and data are HIPAA-compliant.

Answer

Securing the physical data center and network infrastructure

Answer

Ensuring the cloud provider's hypervisor is patched and secure

Answer

Configuring the physical network firewalls and routers

Question 2

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Accepted Answer

Client-side encryption. Client-side encryption is correct because data is encrypted by the organization before it ever leaves its premises, meaning the cloud provider receives only ciphertext and never has access to plaintext or keys. This satisfies the requirement that all data be encrypted 'before being sent to the cloud.' Server-side encryption and TDE both encrypt data after it reaches the provider's infrastructure, and TLS protects data only in transit, not at rest in the cloud.

Answer

Server-side encryption

Answer

TLS 1.2

Answer

Transparent Data Encryption (TDE)

Question 3

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the managed service for creating and controlling customer-managed keys (CMKs) used to encrypt data at rest, and it integrates with AWS CloudTrail to produce audit logs of every key usage. KMS supports key policies, grants, and automatic rotation, satisfying both the customer-managed key requirement and the compliance audit requirement. This is why C is correct.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Question 4

An organization is evaluating cloud providers based on 'Shared Responsibility Model' documentation. What does the cloud provider typically remain responsible for?

Accepted Answer

Physical hardware and infrastructure security. Under the Shared Responsibility Model, the cloud provider is always responsible for the security of the cloud — the physical facilities, hardware, network infrastructure, and hypervisor layer. Customers are responsible for security in the cloud, which includes their data, IAM configuration, and guest OS patching (for IaaS). Physical hardware and infrastructure security cannot be delegated to the customer, so it remains the provider's domain.

Answer

Data encryption at rest

Answer

Guest operating system patches

Answer

Identity and Access Management (IAM) configuration

Question 5

Which TWO advantages does a 'Community Cloud' offer over a 'Public Cloud'?

Accepted Answer

Higher level of security or compliance for a shared industry. Option A is correct because a community cloud is provisioned for a specific group of organizations with shared concerns (e.g., banks, healthcare, government), so the provider can implement industry-specific security controls and compliance frameworks (such as PCI DSS, HIPAA, or FedRAMP) that a generic public cloud may not enforce by default. Option D is correct because the cloud infrastructure and its operational costs are pooled among the community members, so each participant pays only a fraction of the total cost rather than bearing the full expense alone. Options B, C, and E do not belong: physical data center power grid control is not a defining community cloud advantage (and is typically retained by the provider, not the tenants), global region access is a characteristic of large public clouds rather than a community cloud benefit, and community clouds generally have higher initial setup costs than public clouds because the infrastructure is dedicated to a narrower group.

Answer

Total control over the physical data center power grid

Answer

Unlimited access to all global regions

Answer

Lower initial setup cost than public cloud

Question 6

An administrator is setting up a new cloud account. What is the first security best practice they should implement?

Accepted Answer

Enable MFA on the root account. Enabling MFA is the most critical first step to secure any account access.

Answer

Increase instance capacity

Answer

Create a support ticket

Answer

Upload a custom logo

Question 7

An organization needs to extend its on-premises data center to a VPC while ensuring private connectivity that avoids the public internet. Which connectivity option is best?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises infrastructure to a VPC, bypassing the public internet entirely. This delivers consistent latency, higher bandwidth, and improved security compared to internet-based options, making it the correct choice for private connectivity requirements.

Answer

Site-to-Site VPN

Answer

Client VPN

Answer

Public IP peering

Question 8

Which TWO cloud service models are most appropriate for a developer who wants to focus solely on code?

Accepted Answer

PaaS. PaaS (A) is correct because it abstracts the underlying infrastructure—servers, OS, runtime, and middleware—so the developer only deploys and manages application code and configuration. Serverless/FaaS (B) is correct because it goes even further, letting the developer write individual functions while the provider fully manages scaling, patching, and server provisioning, leaving only code as the concern. Bare Metal (C) is not appropriate because it exposes raw hardware, requiring the developer to manage the OS and everything above it. IaaS (D) is not appropriate because it still requires managing VMs, operating systems, and runtime environments. SaaS (E) is not appropriate because it delivers a finished application, not a platform for writing and deploying custom code.

Answer

Bare Metal

Answer

IaaS

Answer

SaaS

Question 9

A cloud architect is choosing between IaaS and SaaS for a new CRM system. What is the primary business advantage of selecting SaaS?

Accepted Answer

Reduced administrative overhead. SaaS shifts operational responsibility for the application, middleware, OS, and infrastructure to the provider. The customer only manages data and user access, so the primary business advantage is reduced administrative overhead—no patching, scaling, or server maintenance by internal IT. Lower initial cost can be true but is not the defining advantage; reduced admin overhead is the core SaaS value proposition.

Answer

Lower initial implementation cost

Answer

Full control over the operating system

Answer

Customizable hardware configuration

Question 10

A company is planning to migrate its on-premises workloads to a public cloud. The IT director asks which factors are key considerations when evaluating the cloud provider's service level agreement (SLA). (Choose two.)

Accepted Answer

The scope of services covered and any exclusions.. The two key SLA factors are the guaranteed uptime percentage and remedies, and the scope of services covered with exclusions. These define what the provider commits to and what happens if commitments are missed. They directly affect availability expectations and risk management for the migration.

Answer

The provider's data center locations and their proximity to the company's offices.

Answer

The provider's process for handling customer support tickets.

Answer

The maximum number of virtual machines the company can deploy.