CompTIA Cloud Essentials+ (CLO-002) (CLO-002) (CLO-002) — Questions 1–75

Cloud governance frameworks define policies and controls to ensure that cloud usage aligns with business objectives and complies with regulations. This is a primary objective, as it mitigates risk and ensures accountability. It encompasses areas such as data protection, access management, and cost control. Without this, organizations face compliance breaches and financial losses.

Data sovereignty requires that data remain within a specific legal jurisdiction. Choosing in-country regions and preventing replication outside them ensures storage and processing occur only where permitted. This control directly addresses the legal requirement and is enforceable through region selection and replication policies in the cloud platform.

Monthly service consumption charges recur for as long as the service runs, making them operational expenditure under the cloud provider's pay-as-you-go model. One-off migration costs and capital purchases such as hardware fall outside this recurring OpEx category.

The SLA is the contractually binding document in which a provider states its uptime commitment, typically as a percentage with defined remedies. It directly answers the risk assessment's need to quantify outage impact, since the guaranteed availability figure and service credits establish the provider's formal obligation.

Cross-region replication copies objects to geographically separate facilities, satisfying the facility-loss requirement, while checksum-based validation such as content-MD5 or provider-side integrity hashing detects bit rot and silent corruption over time. Both are provider-managed and require no application modification, matching every stated constraint for the archived video masters.

Replicating data across two providers requires reconciling differing consistency models, APIs and replication semantics, so writes may conflict or lag. This satisfies the stem's continuity goal by naming the hardest problem: keeping both providers' copies synchronised and interoperable during failover.

Object Lock enforces write-once-read-many (WORM) protection at the object level, preventing deletion or modification for a defined retention period. This directly satisfies the immutability and retention constraint for audit logs, unlike versioning or soft delete, which permit removal.

Auto-scaling dynamically adjusts the number of running instances to match current demand, so capacity tracks load rather than sitting idle. This directly satisfies the goal of avoiding over-provisioning, since resources are added during peaks and removed during troughs without manual intervention.

Automated CI/CD pipelines embody cloud-native practise by treating infrastructure and releases as code, enabling frequent, small, low-risk deployments. This directly satisfies the stem's requirement for cloud-native architectural practices, since continuous delivery with automated testing and rollback is fundamental to elastic, resilient cloud environments rather than traditional monolithic release cycles.

The SQL Injection Managed Rule Set provides preconfigured signatures that inspect incoming HTTP requests and block known injection patterns before they reach the application, directly satisfying the requirement to defend a public-facing app against common SQL injection attacks.

ARM templates are JSON files that define the infrastructure and configuration for an Azure deployment declaratively. They enable repeatable, consistent deployments and can be integrated into CI/CD pipelines. This directly satisfies the requirement to define infrastructure as code and deploy it multiple times without manual steps. ARM templates also support parameters and variables for reusability.

Instance size determines the hourly rate charged for compute or database capacity, so larger resource types raise the baseline cost. It is a primary input when estimating spend, since pricing scales directly with the selected resource type.

Under the shared responsibility model for IaaS, the customer is responsible for securing everything they deploy on the infrastructure, including the guest operating system, applications, and data. Patching and secure configuration of the OS and applications are customer responsibilities, not the provider's.

Measured service means the provider meters consumption of compute, storage and other resources, and bills accordingly. This metering underpins pay-as-you-go pricing, letting a business pay only for what it actually uses rather than a fixed upfront commitment.

Elasticity matches the stem's requirement to add and remove resources automatically as traffic demands change. Unlike scalability, which describes capacity growth, elasticity covers both expansion and contraction, provisioning and deprovisioning resources dynamically to sustain performance while controlling cost during fluctuating demand.

S3 Lifecycle Policies automate transitions between storage classes, such as moving objects to Glacier Deep Archive after a set period, satisfying the seven-year retention requirement at the lowest cost. Manual tiering or versioning alone cannot enforce scheduled, cost-optimised long-term retention.

Containers share the host operating system kernel while isolating each application through namespaces and cgroups, so multiple workloads run on one kernel without full OS duplication. This satisfies the stem's requirement of isolation while sharing the same OS kernel, unlike virtual machines, which each run a separate kernel.

A risk register records identified cloud risks alongside their mitigation strategies, owners and residual status, directly evidencing risk management to an auditor. It is the primary artefact demonstrating that mitigation decisions are documented and tracked, unlike policies or audit logs.

A cloud-native DLP policy is the most direct control because it inspects data content and enforces where ePHI may be stored. In this scenario, it would detect the ePHI pattern in the copied snapshot and block the write to the personal bucket, while generating an auditable alert. That directly prevents recurrence and produces evidence auditors can review, satisfying both prevention and detection requirements.

IaaS gives the customer control over the guest OS, runtime, middleware, and application while the provider delivers compute, storage, and networking. Because the customer configures and patches the guest layer, it can implement PHI-specific controls directly, and the provider still exposes audit artifacts and signs a business associate agreement covering the underlying infrastructure.

Object storage provides durable, low-cost capacity for static assets, accessed directly over HTTP without a running server or attached disk. Its pay-per-gigabyte model suits infrequently changing images and CSS files better than block or file storage.

Spot instances run on spare provider capacity and can be reclaimed at any time with short notice, making them unsuitable for uninterrupted workloads. Reserved instances instead guarantee capacity for a committed term at a discounted rate, so the reclaimability axis is the defining difference.

Separation of Duties splits critical tasks across multiple administrators, so no single account holds end-to-end control. This directly satisfies the stem's constraint that no one administrator has full control, enforcing checks and balances through distinct role assignments rather than concentrating privileged permissions in one identity.

High availability uses redundancy across components and zones so that when one fails, another takes over, minimising downtime during system failures. This resilience is the primary advantage, satisfying the requirement to keep services accessible despite failures.

A dedicated private circuit provides the private path the stem demands, while layering VPN encryption over it satisfies the requirement that all traffic be encrypted. Neither a standard internet VPN nor a public connection alone delivers both dedicated routing and confidentiality.

Measured service is a core cloud characteristic where resource usage is monitored, controlled, and reported, enabling pay-per-use billing. In this scenario, the retail company only pays for the capacity consumed during flash sales, aligning costs with actual demand. This directly addresses the finance team's goal of avoiding payment for idle capacity.

Public cloud offers rapid elasticity, allowing the retail company to scale resources up during peak shopping seasons and down during off-peak times. This matches demand and avoids over-provisioning. It is a key benefit because the company only pays for what it uses, improving cost efficiency and operational agility. This is a fundamental advantage of public cloud.

Data encryption, including at rest and in transit, remains the cloud user's responsibility because the provider cannot access or classify customer data. It satisfies the Shared Responsibility Model constraint that security of the data itself always stays with the consumer, regardless of service model.

A Region defines the geographic location where data is stored and processed, so selecting one directly determines whether workloads satisfy legal data residency and sovereignty obligations. This makes Region choice a compliance decision, not merely a latency one.

An RFP solicits detailed vendor proposals against stated performance, security and financial criteria, giving the organisation a structured basis for comparison. It satisfies the stem's requirement for a document outlining specific requirements essential to cloud vendor selection.

Traffic patterns directly determine how demand fluctuates over time, driving the choice between horizontal and vertical scaling and the use of auto-scaling. Peak-to-trough ratios and seasonality dictate provisioned capacity, ensuring resources match actual load without over-provisioning, which satisfies the scalability decision's need to align capacity with observed demand.

IaaS leaves the customer managing operating systems, middleware and runtime, while the provider handles only virtualisation, servers, storage and networking. This highest customer operational burden is precisely the differing management level the question asks about.

Tags attach metadata such as cost centre, project, or owner to resources, enabling billing reports to be grouped and filtered by those keys. This granular attribution satisfies the requirement for improved cost allocation across departments and workloads.

Elasticity allows the company to automatically scale compute resources up during peak transcoding demand and down during off-peak hours, ensuring deadlines are met while reducing costs. This matches the need for rapid, dynamic provisioning and de-provisioning of resources based on workload. It directly addresses both the performance requirement and the cost-saving goal.

Terraform declaratively defines infrastructure resources in version-controlled configuration files, then provisions them through an automated workflow. This satisfies Infrastructure as Code because the desired-state definition, not manual console clicking, drives deployment, enabling repeatable, auditable environments. It is the only option expressing infrastructure through machine-readable code.

Cloud providers own and maintain the servers, networking and facilities, so the organisation no longer procures, racks, powers or patches physical hardware. This directly removes the burden of physical infrastructure management named in the scenario.

Customer-managed keys give the organization full control over key lifecycle, including revocation. Storing them in an HSM provides strong protection against key extraction. This approach satisfies the compliance requirement for customer control and revocability. It is the standard method for meeting strict data sovereignty and encryption mandates.

Horizontal scaling adds more nodes or instances to a pool, distributing load across them. Vertical scaling instead increases the resources, such as CPU, memory or storage, of a single existing node, so the axis of difference is node count versus node capacity.

Monitoring and alerting thresholds define what detection signals trigger the incident response process, ensuring incidents are identified promptly rather than discovered by users. This satisfies the plan requirement to specify how incidents are detected and escalated.

A pre-signed URL grants time-limited, scoped access to a specific object without exposing credentials or making the file public. The external partner downloads via the signed link, satisfying secure sharing of sensitive data while the bucket remains private.

Archive/Glacier storage suits seven-year compliance retention because retrieval latency is irrelevant when access is rarely required. Its lowest per-gigabyte cost directly satisfies the cost-effectiveness constraint, unlike cooler tiers priced for frequent access. Microsoft Entra ID is unrelated here; the deciding axis is retrieval latency traded against storage price.

Client-side encryption with customer-managed keys ensures that data is encrypted before it is sent to the cloud, and the keys are generated and controlled by the company. The cloud provider only stores encrypted data and never has access to the keys, satisfying the strict compliance requirement.

A cloud key management service with customer-managed keys lets the firm create, rotate, disable, and delete its own key material while the provider handles the hardened storage and cryptographic operations. Integrated audit logging records key usage events, satisfying the compliance trail requirement with minimal operational overhead.

Compliance Mode enforces a write-once-read-many (WORM) retention policy that no user, including the root account, can override or shorten until the seven-year period expires. This satisfies the read-only immutability constraint, unlike Governance Mode, which privileged users can bypass.

Object lock in compliance mode prevents deletion or modification for a defined retention period, satisfying the immutability requirement. Transitioning to an archive class after 90 days reduces storage costs for long-term retention. Together, these actions meet both the seven-year retention and tamper-proof mandates. This is the correct combination for regulatory audit logs.

SaaS delivers fully functional applications over the internet, with the provider managing all underlying infrastructure, including the operating system, middleware, runtime, and often the application itself. The agency can simply use the CRM software via a browser or API, with no management responsibilities. This aligns perfectly with their limited IT staff and desire to avoid capital expenditure.

Public cloud multi-tenancy pools compute, storage and network resources across customers, with logical isolation enforced by hypervisors and virtual networks. This satisfies the stem's definition directly: multiple customers share the same physical hardware while remaining logically separated.

Containers allow applications to run consistently across any environment, reducing cloud-specific dependencies.

Database auditing and query logging capture executed statements and record them to a secure destination, providing the query-level audit trail the audit demands. It satisfies the requirement directly, unlike encryption or backup features, which do not log individual queries.

A hybrid cloud combines private infrastructure with public cloud services and connects them, often through dedicated links. Keeping sensitive warehouse integration on private systems while running the scalable customer portal in the public cloud is precisely the hybrid pattern, letting each workload reside where its security and scalability requirements are best met.

The shared responsibility model defines which security tasks are handled by the cloud provider and which are the customer's responsibility. It varies by service model (IaaS, PaaS, SaaS). Reviewing this model helps the business understand what it must secure, such as data, access management, and applications, and what the provider secures, such as physical infrastructure.

By moving to the cloud, the organization can reduce or eliminate costs associated with data center real estate, power, cooling, and physical security. These facilities costs are transferred to the cloud provider, who operates at scale and can offer lower costs. The organization may still have some networking costs, but the major facility expenses are reduced or removed.

A community cloud is shared by several organizations with common concerns, such as healthcare providers needing HIPAA compliance. It provides the cost benefits of shared infrastructure while allowing strict security and compliance controls tailored to the community. This matches the requirement to share with other healthcare providers while ensuring compliance.

Training and upskilling staff to operate cloud platforms is rarely itemised in vendor pricing, yet it consumes budget and productivity during migration. This indirect cost must be budgeted alongside subscription fees in the cost-benefit analysis, since existing on-premises skills do not transfer automatically.

Measured service underpins consumption-based billing: the provider meters resource usage, such as compute hours, and charges only for what is consumed. This directly satisfies the stem's requirement to pay solely for used compute power, unlike subscription or reserved models with fixed upfront commitments.

Elasticity automatically scales compute resources out during demand spikes and back in when traffic subsides, matching capacity to load in near real time. This satisfies the stem's requirement to rapidly increase and decrease resources, unlike scalability, which only describes growth capacity.

A risk assessment that maps cloud provider controls to the firm's regulatory obligations ensures that gaps are identified and addressed. It demonstrates due diligence and aligns the migration with the firm's risk appetite. This approach also produces documentation for auditors. It is a core cloud risk management practice, especially in regulated industries like financial services.

Multi-region deployment replicates workloads and data across geographically separate regions, so a total outage in one region does not halt service. Traffic managers or DNS failover redirect users to a surviving region, satisfying the stem's requirement to minimise impact from a complete regional failure rather than merely a single zone or component fault.

Data egress fees are charged for outbound data leaving Azure regions or the cloud, so they rarely appear in initial migration estimates yet accumulate with ongoing query and replication traffic, making them the commonly overlooked TCO line item.

The SLA is the contractual document that states the provider's committed service levels, such as monthly uptime percentages, and describes remedies like service credits when those targets are missed. Reviewing it lets the manager verify whether the guarantee meets business needs and understand the escalation path for outages, which is exactly the concern described.

Availability zones are isolated data center groups within a region, connected by low-latency links, and are designed so that a failure in one zone does not affect others. Deploying identical stacks across multiple zones in the same metro area provides the hardware-failure resilience and low-latency failover the architects require, which is exactly the purpose of multi-AZ design.

AWS CloudTrail records every API call in the account, capturing the IAM user identity, timestamp, source IP and request parameters for each action. This event history directly satisfies the scenario's requirement to attribute unauthorised infrastructure changes to a specific IAM user, which CloudWatch metrics or configuration snapshots cannot provide.

Rapid elasticity allows cloud resources to scale outward and inward automatically based on demand, ensuring that the trading platform can handle sudden increases in volume without manual intervention. This characteristic directly matches the CIO's requirement to automatically adjust resources while maintaining performance. It enables the platform to provision additional capacity quickly and release it when demand drops.

Security and compliance involvement early identifies data residency, encryption and regulatory constraints that shape the entire migration design. Addressing these before architecture is fixed prevents costly rework, since cloud readiness hinges on satisfying governance requirements that other stakeholders cannot override later.

The Service Level Agreement contractually defines uptime guarantees and the service credits payable when targets are missed, so reviewing it answers the comparison directly. Other documents, such as the acceptable use policy, contain no availability commitments.

Re-platform retains the application's core architecture while swapping components for managed cloud equivalents, such as moving to a managed database or container service. This lifts performance and reduces operational overhead without the code rewrite that re-architecting demands.

Azure Monitor collects platform metrics such as CPU utilisation from Azure virtual machines via the diagnostic pipeline, then visualises them in near real time through metrics explorer and dashboards, satisfying the requirement to capture and visualise fleet-wide CPU metrics.

Periodic penetration tests actively uncover exploitable vulnerabilities in cloud workloads, satisfying the stem's demand for risk mitigation rather than mere detection. Testing validates that security controls, patched configurations and identity boundaries around Microsoft Entra ID actually resist real attack techniques, closing gaps that static assessments miss.

S3 Block Public Access applies account-level and bucket-level controls that override any bucket policy or ACL granting public access, directly satisfying the requirement to prevent future public exposure. Unlike bucket policies alone, which can be misconfigured, these settings enforce a hard deny on public access regardless of individual object permissions.

Customer-managed keys in a cloud KMS let the organization generate, control, rotate, and revoke the key material itself. Enabling key usage logging produces an auditable record of every cryptographic operation, which directly satisfies the compliance requirement for independently auditable, customer-controlled encryption at rest. This is the standard pattern for regulated workloads on public cloud object storage.

A hybrid cloud keeps sensitive data on-premises while public cloud resources handle the rest, directly satisfying the constraint that certain data cannot reside in a public environment. Unlike public or community deployment, it permits workload placement by sensitivity, so regulated data stays under organisational control.

Object lock applies write-once-read-many protection at the object level, and in compliance mode no user, including the root account, can delete or alter the object until the retention period expires. Setting a seven-year retention period directly enforces the regulatory requirement and provides the tamper-resistant guarantee the auditors are seeking.

With measured service and pay-as-you-go, the company is billed only for the resources it actually consumes. This means it does not pay for idle servers or over-provisioned capacity, which is a direct financial benefit. It reduces waste and allows costs to track actual usage.

Availability zones are isolated locations within a region, each with independent power, cooling, and networking. Distributing instances across multiple zones ensures that the loss of one data center does not take down the application. This is the standard high-availability pattern for protecting against a single data center failure while keeping latency low.

Cloud consumption is billed as an ongoing operational expense, so the provider stops buying and depreciating servers upfront. This conversion of fixed capital investment into variable operating cost is the core financial principle of cloud economics and directly answers the CFO's question about how expenses change after migration.