CompTIA Cloud Essentials+ (CLO-002) (CLO-002) (CLO-002) — Questions 76–150

PaaS satisfies the stem's constraint by abstracting the OS, runtime, and hardware layers, leaving the provider responsible for patching, scaling, and infrastructure. The company retains control only over its application code and data, which matches the stated requirement precisely. IaaS would still demand OS management, while SaaS removes application control entirely.

Elastic scaling lets the company match resource consumption to actual demand, avoiding the cost of overprovisioning for peak loads. This is a direct economic benefit because the company pays only for what it uses and can respond to business changes without long procurement cycles for new hardware.

SaaS delivers fully managed applications over subscription, so the company rents software rather than purchasing licences and running it on its own infrastructure. This satisfies the Buy-to-Rent shift because ongoing operational payments replace upfront capital purchase and ownership of the software.

A defined failover procedure supplies the sequenced, tested steps that shift workloads to the recovery environment, satisfying the stem's demand for robustness. Without documented invocation criteria, role assignments and rollback actions, recovery stalls during an actual outage, so the procedure converts standby capacity into workable continuity.

Automating security configuration audits continuously enforces baselines across cloud resources, satisfying the stem's requirement for proactive, scalable security. Unlike manual reviews, scheduled tooling detects drift and misconfiguration immediately, aligning with Microsoft Entra ID and broader cloud governance guidance. This makes it a recognised best practice.

Caching static assets at edge nodes means repeat requests are served without touching the origin, directly cutting origin bandwidth, compute and egress costs. This satisfies the stem's benefit of relieving pressure on the backend infrastructure that would otherwise handle every user request.

Geographical distribution protects against regional outages.

Multiple layers of security controls is the defining characteristic of defence in depth: an attacker must defeat several independent controls rather than a single point of failure. Each layer assumes the preceding one may be breached.

Advanced Data Security bundles vulnerability assessment and Advanced Threat Protection, scanning Azure SQL Database for misconfigurations and anomalous access patterns. This satisfies the GDPR requirement to identify potential vulnerabilities and anomalies affecting stored personal data.

A PodDisruptionBudget specifies the minimum number of pods that must remain available during voluntary disruptions such as node drains or upgrades. It prevents the eviction API from taking down too many replicas at once. This is the standard mechanism to ensure that maintenance operations respect availability requirements, directly addressing the second part of the scenario.

Standard OCI images and Kubernetes manifests or Helm charts are portable across conformant Kubernetes distributions such as EKS and AKS. Avoiding provider-specific extensions keeps the deployment artifacts reusable, so the workload can be moved between clouds with minimal changes, directly supporting the anti-lock-in objective.

Cloud audit logging records API calls and configuration changes across the environment. By configuring alerts on anomalous patterns, the security team gains the detection and response capability required. This is the native mechanism for monitoring control plane activity and is essential for security operations in the cloud.

When migrating to a public cloud, the provider manages the underlying physical servers, including maintenance. The customer no longer pays for hardware maintenance contracts, which is a direct cost savings. This aligns with the cloud's pay-as-you-go model and reduces capital expenditures. Thus, server hardware maintenance contracts are typically eliminated.

Managing workloads across several providers multiplies tooling, identity, networking and policy surfaces, so operational complexity rises sharply. This is the primary management risk, distinct from vendor lock-in or cost, because teams must maintain disparate skills, consoles and governance processes across each cloud.

Container orchestration platforms abstract workloads from the underlying provider, so containers can be redeployed across clouds with minimal rework. This satisfies the CIO's anti-lock-in mandate by keeping application packaging portable rather than tied to proprietary provider services.

Compliance management continuously audits, reports and remediates against corporate policies and regulatory frameworks, directly satisfying the stem's requirement to ensure the cloud environment adheres to security and regulatory standards rather than merely deploying or monitoring resources.

Hybrid cloud keeps latency-sensitive workloads on-premises while extending others to the public cloud, directly satisfying the low-latency requirement to legacy systems. A private cloud alone lacks cloud-first scalability; public cloud alone cannot guarantee the required proximity. Hybrid therefore reconciles the Cloud-First mandate with the on-premises communication constraint.

Resource tagging attaches business-unit, cost-centre or project metadata to each cloud resource, enabling cost allocation reports that map spend to the owning unit. This satisfies the alignment requirement because billing data can be grouped and charged back per business unit rather than appearing as one undifferentiated invoice.

Auditing API access logs is a core cloud monitoring task, satisfying the need to track who called which service and when. It provides the visibility required for security, compliance and troubleshooting across cloud resources, complementing metrics and alerting rather than replacing them.

The Service Level Agreement defines the provider's guaranteed uptime percentage, plus the specific exclusions, measurement windows and remedies that bound that commitment. Reviewing the SLA directly satisfies the stem's requirement to understand both scope and limitations, since those limitations appear only in the SLA's exclusions and service-credit terms.

Region-specific storage ensures data remains within a chosen geographic boundary. Geo-fencing policies can enforce that data is not replicated or moved outside that region. This directly addresses GDPR's data residency requirements. It is the correct approach for compliance with data sovereignty laws.

A Site-to-Site VPN creates an IPsec-encrypted tunnel between the on-premises gateway and the cloud virtual network, encrypting data in transit across the public internet. This directly satisfies the hybrid requirement that traffic between the data centre and provider stays encrypted.

Azure Database for PostgreSQL Flexible Server is a managed platform-as-a-service offering that automates patching, backups, and zone-redundant high availability while preserving full PostgreSQL compatibility. The team keeps control over schema design, indexes, and query tuning, and administrative overhead for routine maintenance is largely eliminated.

A SOC 2 report or ISO 27001 certification report is an independent auditor's attestation that the provider's controls meet recognised standards. This third-party evidence satisfies the audit requirement, unlike a self-issued statement or marketing whitepaper, which carry no independent assurance.

IAM policies define granular permissions for who can access S3 buckets and what actions they can perform, while CloudTrail logs all API activity, including access to S3 objects. Together, they enforce least privilege and provide an audit trail, directly satisfying the requirement for authorized access and logging.

Elasticity lets capacity grow automatically when demand rises, adding web servers, containers or serverless capacity as a sale drives traffic up, and shrink again afterwards, so the company pays for extra resources only while it needs them. That keeps the site responsive at peak without buying for the peak all year. Pre-scaling before a known sale helps, because scaling takes a little time to react.

BYOK allows the customer to generate, manage, and control their own encryption keys while using the cloud provider's infrastructure. The healthcare company wants to control the keys, which is exactly what BYOK provides. This satisfies the requirement for data encryption at rest and in transit while keeping key management in the company's hands, which is often necessary for compliance with regulations such as HIPAA.

An internet gateway provides the route between a VPC and the public internet, performing NAT for instances with public IP addresses. It satisfies the stem's requirement that a public-subnet instance reach the internet, since without this attached gateway no external traffic can flow.

SaaS delivers a complete, provider-managed application over the internet. The cloud provider handles the infrastructure, operating system, middleware, and application updates, so the marketing agency only needs to configure and use the CRM. This directly matches the goal of eliminating server maintenance, patching, and database administration.

SaaS delivers a complete application managed by the provider, billed per user, with patching, availability, and application maintenance handled on the provider side. This matches the practice's lack of administrative staff and its desire for a subscription-based email and collaboration service with no infrastructure to manage.

A SOC 2 Type II report is issued by an independent auditor and describes the design and operating effectiveness of the provider's controls over a period of time. It gives leadership evidence that security and availability controls were consistently applied, which is exactly the independent validation the due diligence effort requires.

Continuous log shipping replicates transaction logs to a standby database, enabling an RPO as low as a few minutes and allowing automated failover within the 2-hour RTO. This directly meets both objectives by minimizing data loss and recovery time. It is the appropriate architectural change for a critical database with strict RPO and RTO requirements.

SaaS provides a complete, vendor-managed application accessed through a browser or thin client. The provider handles servers, storage, patching, and application updates, which matches the agency's need to avoid all infrastructure and software management. Email and collaboration suites are classic SaaS offerings, so this model directly satisfies the stated requirement.

Agility lets organisations provision resources quickly and cheaply, so teams can trial ideas, fail fast and iterate without heavy capital commitment. This directly delivers lower-risk experimentation, satisfying the stem's requirement for a business benefit driven by agility.

Measured service means the provider automatically controls and optimizes resource use through metering, and consumers pay only for what they consume. This pay-as-you-go model is a core characteristic of cloud computing and supports the shift from capital expenditure to operational expenditure. For the company's migration, it enables cost transparency and aligns spending with actual usage, which is essential to the cloud value proposition.

Upgrading to a higher-performance storage volume directly addresses the I/O bottleneck by increasing IOPS and reducing latency, satisfying the stem's high I/O wait constraint. Storage throughput, not CPU or memory, governs disk-bound wait times, so this change targets the actual limiting resource rather than masking symptoms elsewhere.

Monthly subscription fees for cloud services are operational expenditures because they are recurring payments for ongoing use of resources. In a cloud model, organizations pay for what they consume, which is treated as OpEx. This contrasts with CapEx, where large upfront investments are made for hardware and software. Thus, subscription fees are a classic OpEx item.

Federated identity with SAML or OIDC allows a central identity provider to authenticate users and issue tokens that each cloud provider trusts. This centralizes authentication and enables consistent authorization policies. If one cloud's credentials are compromised, the attacker does not automatically gain access to the other cloud because access is governed by the central IdP and separate trust relationships, reducing lateral movement risk.

A data classification scheme is essential because it defines sensitivity tiers that determine handling, storage and protection requirements. Without it, cloud controls cannot be mapped to data sensitivity, so the policy would lack the basis for proportionate safeguarding.

In IaaS the provider secures the physical hosts, hypervisor and network fabric, while the customer owns everything from the guest operating system upward. Patching the guest OS, including its kernel and installed components, therefore remains the customer's responsibility under the Shared Responsibility Model.

CDNs serve content from geographically distributed locations, placing data closer to the user.

Federating cloud IAM with a central IdP allows users to authenticate once and access multiple clouds with the same credentials. It centralizes user management and enables uniform policy enforcement through the IdP. This is a standard approach for multi-cloud IAM. It reduces administrative overhead and improves security.

A region is a geographic area where a cloud provider has data centers. By selecting a region within the EU, the company can ensure that data is stored and processed within that jurisdiction, complying with GDPR. Regions are the primary way to control data residency and sovereignty in the cloud.

CSPM tools continuously monitor cloud environments for misconfigurations and compliance violations against standards like CIS, PCI DSS, or HIPAA. This provides the ongoing compliance monitoring required, ensuring that resources remain compliant and alerting on drift, which is critical for a financial services company.

Infrastructure as code stores the desired state of the environment in version-controlled templates, so every change is reviewable, repeatable, and reversible. This directly supports controlled change management after cutover because modifications go through the same review and approval process as application code, and drift can be detected by comparing deployed state to the template.

Multi-AZ deployment spreads resources across physically separate availability zones within one region, each with independent power, cooling and networking. A complete data centre failure therefore only takes down one zone; the workload keeps running from the surviving zones, satisfying the stem's survival requirement without the latency of cross-region replication.

SOC 2 Type II reports contain an independent auditor's opinion on the operating effectiveness of controls over a period, not just design. This independently verified evidence of sustained security and availability controls satisfies the stem's need to confirm a CSP's reliability and security posture.

Manual DB snapshots are retained until explicitly deleted, so they satisfy long-term retention beyond the automated backup window. Copying the snapshot to another Region provides additional durability and disaster recovery. This action, combined with automated backups, ensures both point-in-time recovery and long-term retention as required.

HIPAA governs protected health information, so an enterprise handling patient data must audit its cloud provider's administrative, physical and technical safeguards. It satisfies the stem by being a regulatory framework whose requirements extend to the provider hosting the data.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of controls over a period, which can be mapped to HIPAA Security Rule safeguards. It gives continuous assurance without the organization performing its own audit each quarter, and it is the standard evidence cloud providers supply to customers for compliance verification.

Regional resource placement confines the database to a specific AWS Region, whose facilities reside within defined national borders. This satisfies data sovereignty by ensuring storage and processing never replicate outside the required country, unlike global or multi-region architectures.

Patching operating systems keeps cloud workloads secure and compliant, directly satisfying the maintenance requirement to remediate vulnerabilities across compute instances. Unlike provisioning or decommissioning, patching is an ongoing operational task performed throughout a resource's lifecycle, making it a core component of cloud resource maintenance under CompTIA Cloud+ objectives.

The customer is always responsible for its own data, user identities, access permissions, and application-level configuration, regardless of the service model. For a CRM system, this means the retail company must enforce least privilege, manage user accounts, and configure the application to satisfy applicable regulations. The provider secures the underlying infrastructure, but not the customer's use of it.

A backup strategy is essential because it defines how data is copied, retained and restored after disruption, directly satisfying the plan's recovery point and recovery time objectives. Without documented backup frequency, storage location and restoration procedures, the organisation cannot recover lost data or meet the availability commitments a disaster recovery plan must address.

RASP integrates with the application runtime and can detect and block attacks by analyzing behavior and input in real time. It complements perimeter defenses like WAFs and can protect against zero-day attacks. PCI DSS does not mandate RASP, but it is an effective control for protecting web applications and meeting the intent of requirement 6.6.

A Cloud Centre of Excellence is a central team that defines standards, reference architectures, security guardrails and cost controls, then enables delivery teams to adopt them. This satisfies the migration's need for consistent governance and repeatable best practice across workloads.

A network ACL is a stateless, subnet-level filter that evaluates inbound and outbound rules before traffic reaches any instance, making it the outermost boundary for a private subnet. Security groups operate at the instance level, so they cannot act as the subnet's first line of defence.

Security Hub cross-account aggregation consolidates findings from member accounts into a single administrator account, giving one central view of security logs. This satisfies the stem's requirement to aggregate security logs from multiple cloud accounts into one security account.

Capital expenditure avoidance directly quantifies the financial benefit of not having to purchase and depreciate long-lived assets such as servers and data-center equipment. In this scenario, the company avoids a large upfront data-center expansion, so this metric precisely captures the CFO's requested benefit. It is a recognized cloud business-case metric for shifting from CapEx to OpEx.

A SOC 2 Type II report provides an independent auditor's opinion on the effectiveness of a service organization's controls over a period of time, including security, availability, and confidentiality. It covers physical security controls such as data center access, environmental monitoring, and power redundancy, making it the appropriate evidence for the auditor.

Least privilege restricts each account, service and process to only the permissions its function requires, shrinking the exploitable attack surface if credentials are compromised. This directly satisfies the stem's requirement for a best practice securing a cloud virtual machine.

Cloud providers publish independent audit reports such as SOC 2 Type II and ISO 27001 certifications in a trust center or compliance portal. Requesting these documents is the direct way to verify that the provider's data centers have been audited against the required standards. This satisfies the compliance team's requirement without duplicating audit effort or relying on unverified claims.

A VPC Endpoint creates a private connection between the VPC and supported cloud services, routing traffic through the provider's internal network rather than the public internet. This satisfies the requirement to access cloud services privately.

Elasticity automatically provisions and deprovisions compute capacity in response to real-time demand, scaling out during the campaign and back in afterwards without manual intervention. This matches the stem's requirement for automatic, unprompted adjustment, whereas scalability alone only describes the capacity ceiling.

On-demand instances bill per second or per hour with no upfront payment or long-term commitment. The company pays only for the compute capacity it actually uses, which directly addresses the concern about unpredictable bills and matches the pay-as-you-go model. This is the most flexible and consumption-based option.

Multi-Region deployment replicates workloads across geographically separate Azure regions, so a regional outage leaves another region serving traffic. This directly satisfies the stem's requirement for geographic separation to sustain availability during a regional disaster, unlike availability zones, which only span a single region.

Automated patch management applies updates across the fleet on a schedule without manual intervention per instance, satisfying the requirement for automatic software patch updates. It is cloud-native because it uses managed tooling rather than bespoke scripting.

Azure Cost Management budgets let you define a scope, time grain, and amount, then trigger alerts when actual or forecasted spend crosses configured thresholds. Attaching an action group routes the alert to email, SMS, or automation, which satisfies the automated notification requirement without relying on manual review.

Read replicas create additional database copies that serve read-only queries, offloading SELECT traffic from the primary instance. Distributing reads across replicas directly relieves the bottleneck, improving read performance without altering the write path or schema.

SaaS delivers fully managed applications over the internet, so end users simply authenticate through a browser without installing, patching or hosting anything. This satisfies the stem's requirement, since the provider owns the entire stack beneath the application.

Metered usage charges are based on actual consumption—such as compute hours, storage, or data transfer—and therefore scale with customer traffic. Subscription fees are recurring fixed amounts for services like reserved capacity or support plans. This categorization directly helps the finance team separate variable costs from fixed monthly expenses in their cloud budget forecast.

A CCoE consolidates cloud governance and security policy ownership into one function, so guardrails, identity controls and compliance checks are defined once and applied consistently. This directly satisfies the stem's requirement for a valid CCoE purpose by removing fragmented, team-by-team security decisions.

One-time migration costs, including staff training and potential downtime, are critical for an accurate TCO. The IT team omitted these, so the TCO is incomplete. Including them provides a realistic view of the total investment required for the migration, which the CFO needs for decision-making.

AWS Config continuously records resource configuration changes and evaluates them against rules, so it detects untagged resources and can trigger remediation through SSM Automation. This directly satisfies the governance requirement to automate detection and remediation of resources missing the 'Owner' and 'Environment' tags.

Object versioning retains every overwrite and delete as a distinct, retrievable version, so an accidental deletion removes only the current version while prior versions remain intact. This directly satisfies the stem's protection requirement, letting administrators restore the last good object without external backups.