CompTIA Cloud Essentials+ (CLO-002) (CLO-002) (CLO-002) — Questions 151–225

Auto Scaling health checks continuously probe instance and ELB status, then terminate and replace instances failing those checks, maintaining desired capacity automatically. This satisfies the requirement to replace unhealthy EC2 instances without manual intervention, unlike scaling policies that only react to demand metrics.

Cloud vendors aggregate demand from many tenants, so fixed infrastructure and operational costs spread across a far larger customer base than any single organisation could achieve. That volume drives down the per-unit price of compute, storage and bandwidth, directly satisfying the stem's economies-of-scale benefit of lower unit costs for resources.

Data portability determines how easily the business can retrieve its email and files if it decides to switch providers. Without export capabilities, the business could face high costs or technical barriers to leaving. Evaluating this before signing helps avoid lock-in and ensures the exit strategy is viable. It is a critical due diligence item for any cloud service contract.

Reserved instances allow the company to commit to a one- or three-year term in exchange for a significant discount compared to on-demand rates. This provides predictable monthly costs, addressing the CFO's concern about budget variability. Since the workload is steady and predictable, the company can confidently commit to reserved capacity and realize cost savings while stabilizing its cloud spending.

AWS WAF inspects incoming HTTP(S) requests at the Application Load Balancer and applies rule groups that block SQL injection and cross-site scripting patterns before traffic reaches the EC2 instances. It requires no application code changes, integrates natively with ALB, and satisfies the security team's mandate for inline inspection.

SSE-S3 provides server-side encryption with AWS managed keys, where AWS handles key management, rotation, and storage. It requires no additional configuration or overhead from the operations team, and it encrypts all objects at rest by default. This meets the compliance requirement for encryption at rest with minimal management effort, making it the simplest and most cost-effective option.

Pay-as-you-go bills per unit of consumption, so the firm pays only for compute cycles the batch job actually uses, with no upfront commitment or idle capacity charges. This directly satisfies the stem's requirement to pay only for cycles consumed.

Under the shared responsibility model, the cloud customer owns their data and its regulatory obligations, so they must notify authorities after a breach. This satisfies the stem's question of who bears breach-notification responsibility in the cloud.

Tiered storage aligns cost with access frequency: frequently accessed data sits on high-performance, expensive tiers, while infrequently accessed data moves to cheaper tiers. This directly satisfies the cost-benefit analysis constraint by reducing expenditure on rarely used data without sacrificing availability for hot data.

Egress charges bill data transferred outbound from the provider's network to the internet or another region. The invoice spike reflects outbound traffic volume, so identifying egress clarifies which workloads generate the cost and where architecture changes could reduce it.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of a service organization's controls over a period of time, covering trust services criteria such as security, availability, and confidentiality. This directly satisfies the marketing firm's need for validated evidence. The report is the standard artifact customers request to assess a provider's control environment.

A governance framework codifies policies, controls and accountability, so risk identification, assessment and mitigation follow repeatable, auditable processes across every cloud service and team. That standardisation directly satisfies the stem's requirement for consistent risk management, eliminating ad-hoc, per-project decisions that leave gaps and duplicate effort.

A private cloud provides dedicated infrastructure for a single organization, which can satisfy regulatory mandates for dedicated physical hardware and reduce noisy neighbor interference. It also allows the firm to optimize the environment for sub-millisecond latency. This model aligns with the need for isolation, control, and compliance.

Compliance certifications such as SOC 2 or ISO 27001 are independent audit reports that verify the cloud provider's security, availability, and confidentiality controls. They provide the assurance the CIO needs that the provider meets specific compliance requirements. Requesting these documents is a standard due diligence step in cloud adoption.

AWS Cost Explorer gives the most direct view of current resource costs and budget alerts, satisfying the budget governance constraint. It visualises spend by service and time period, and surfaces AWS Budgets alerts when thresholds are breached, unlike broader monitoring dashboards that track performance metrics rather than cost.

TLS 1.2/1.3 encrypts data in transit using authenticated ciphersuites, protecting traffic between clients and cloud services from interception or tampering. It directly satisfies the in-transit constraint, unlike at-rest encryption or access controls, which secure stored data or identities rather than the wire.

A CASB sits between users and cloud services to enforce security policies such as data loss prevention, access control, and activity monitoring across multiple providers. For a governance board needing centralized visibility and consistent enforcement, a CASB provides a unified control point. It directly addresses the requirement to manage risk consistently across different cloud environments.

Migration is not merely subscription substitution: existing applications often need re-platforming or rewriting before they run in the cloud. Counting refactoring and development labour satisfies the stem's thorough TCO requirement by capturing the one-off transformation cost that precedes any ongoing cloud consumption.

Policy enforcement automation continuously applies and audits configuration rules across cloud resources, satisfying the stem's compliance consideration by replacing manual checks with repeatable, evidence-generating controls. It detects drift against regulatory baselines in near real time, ensuring Microsoft Entra ID and workload settings remain auditable without relying on periodic human review.

Reserved Instances commit to a one- or three-year term for specific compute capacity, exchanging that commitment for a substantial discount compared with on-demand pricing. The primary business benefit is therefore significant cost savings over long-term, predictable usage.

EventBridge schedules cron-style rules, invoking Lambda at 02:00 nightly without any server running between executions. This satisfies the stem's requirement for an automated, recurring trigger, since Lambda supplies the serverless compute and EventBridge supplies the time-based event source.

RBAC restricts data access to users based on their role, ensuring only authorized personnel can view ePHI. Enabling audit logging captures all access events, satisfying the requirement to log access for audits. Together, these controls address both the authorization and logging aspects of the scenario.

On-demand self-service is a defining characteristic of the public cloud: consumers provision compute, storage, and network through APIs or portals automatically, with no provider staff involvement. This is inherent to the model and directly relevant because the logistics firm could stand up routing-engine capacity whenever needed without waiting on a vendor ticket.

Establishing security and compliance standards is a governance function: the committee defines the policies, controls and regulatory baselines that cloud teams must follow. It satisfies the question's requirement for committee responsibilities, distinct from day-to-day operational tasks performed by engineering teams.

Identity and Access Management provides the directory constructs — users, groups, roles, and policies — used to authenticate principals and authorise their access to cloud resources, satisfying the requirement to create and manage those identities securely.

Metering measures resource consumption over time, recording quantities such as compute hours, storage gigabytes or requests, which providers then multiply by unit prices to produce bills. It is the measurement layer underpinning cloud chargeback and pay-as-you-go billing models.

Migration and transition labour covers the one-off effort of moving workloads, retraining staff and reworking processes. A cost-benefit analysis must include this upfront investment, since it offsets projected cloud savings and determines the payback period for adoption.

Block storage presents raw volumes over protocols such as iSCSI or Fibre Channel, giving the low latency and high IOPS that high-frequency trading logs demand for instant analysis. Object and file storage add overhead unsuited to this workload.

On-premises TCO must include power, cooling, and facility overhead, which are often omitted when teams focus only on server and license costs. These operational expenses can be substantial and disappear from the cloud bill because the provider bundles them into the service price. Adding them gives a fair comparison. Without them, the on-premises option appears artificially cheaper, leading to a skewed business case.

Compliance certifications like HIPAA and HITRUST demonstrate that the cloud provider has met specific security and privacy standards for handling protected health information. For a healthcare organization, these certifications are critical to ensure regulatory compliance and avoid penalties. They provide assurance that the provider has appropriate controls in place, which is a top priority given the sensitive nature of EHR data.

Object lock in compliance mode enforces a write-once-read-many model where no user, including the root account, can delete or overwrite the protected object version until the retention period expires. This satisfies the legal hold requirement at the storage layer without depending on application code.

A private cloud dedicates infrastructure to a single organisation, so compute, storage and networking remain isolated from other tenants. This directly satisfies the strict regulatory data isolation constraint, since no shared hardware or multi-tenant hypervisor boundary is involved. Public and community models cannot guarantee that degree of exclusive control.

Independent audit reports and certifications give the firm documented evidence that the provider's security and operational controls have been examined against recognized standards. They support the compliance officer's demand for independent assessment and help map provider controls to the firm's own regulatory obligations. These artifacts are typically available through the provider's trust or compliance portal.

Encryption at rest ensures that data stored on physical media is unreadable without the decryption key. If the storage media is stolen, the ciphertext is useless without the key. Provider-managed keys are acceptable here because the threat is physical theft, not provider insider access. This control directly addresses the scenario's requirement.

A community cloud is provisioned for exclusive use by a specific community of organizations with shared concerns such as compliance, security, or mission. Accredited universities with common genomic data regulations fit this model precisely, allowing shared cost and collaboration while restricting access to the defined group.

Portability hinges on how tightly the platform depends on provider-specific services, APIs, and data formats. If dispatch logic relies on proprietary serverless functions, managed queues, or vendor-only database engines, moving it requires significant rework. Assessing these dependencies first gives the clearest picture of migration difficulty.

Versioning preserves prior object versions, and object lock with a retention period prevents those versions from being deleted or overwritten for a set time, even by authorized users. This directly addresses accidental deletion by providing recoverability and an immutability guarantee, which is a recognized governance control for protecting stored data.

PaaS delivers a managed platform where the provider handles the operating system, runtime, middleware, and scaling infrastructure, while the customer focuses on application code and configuration. This matches the startup's desire to configure web server settings and deploy code without patching servers. By abstracting the lower layers, PaaS minimizes operational overhead while still giving control over the application environment, making it the best fit.

Cloud monitoring services evaluate metric streams against defined thresholds over a specified evaluation period. Creating an alarm on average CPU utilization with an 80 percent threshold and a five-minute evaluation window, plus a notification action such as an email or webhook, delivers automatic alerting exactly as requested. This is the native, low-effort way to convert a metric condition into an actionable notification.

AWS Security Hub runs automated security checks against standards such as CIS AWS Foundations Benchmark, surfacing each failed control as a finding. This directly satisfies the compliance officer's need to report every non-compliant instance, since findings are aggregated per resource and filterable by compliance status.

Blue/green deployment maintains two identical environments, routing traffic to the new green stack only after validation, then switching back instantly if faults appear. This pattern delivers near-zero-downtime releases with rapid rollback, a defining characteristic of common cloud deployment patterns.

Under the shared responsibility model, the customer is responsible for security in the cloud, which includes classifying data, enabling encryption, and managing identity and access. The provider supplies the tools, but the customer must configure them correctly. This ensures that only authorized employees can access the data and that it is encrypted as required.

A documented, tested rollback plan makes changes reversible in practice rather than only on paper. Validating it in staging reveals gaps such as data migrations that cannot be cleanly undone, so the team knows the true recovery time. This directly addresses the reversibility goal and complements review and traceability controls.

Data residency laws require data to remain within specific jurisdictions, so the geographic location of data centres determines whether a vendor can legally store the corporation's data. Other criteria such as cost or support matter, but only physical location satisfies the legal constraint.

Rapid elasticity is the cloud characteristic that allows resources to scale out and in automatically and quickly as demand changes. In this scenario, the platform can add server instances when CPU utilization rises during the flash sale and remove them afterward, matching capacity to demand without manual provisioning. This directly addresses the need for automatic, dynamic scaling.

Under the Shared Responsibility Model, the cloud provider always owns security of the cloud: physical datacentre facilities, hosts, and the underlying network hardware. Customers retain responsibility for what they place in the cloud, such as data, identities, and configurations, so physical infrastructure security is the provider's domain.

Azure Policy evaluates resources against defined rules and enforces configuration automatically, denying or remediating non-compliant VMs. It directly satisfies the requirement to enforce corporate security standards such as approved OS versions across all virtual machines without manual review.

Infrastructure as Code templates capture the declarative configuration of the application tier, including network topology, instance types, and load balancer settings. Reapplying these templates in a recovery region recreates the environment consistently without manual rebuilds, which is exactly what is missing when only database backups exist. This directly addresses the requirement to redeploy the application tier identically.

Provisioning infrastructure in minutes rather than weeks compresses development and release cycles, so new features reach customers sooner. Faster delivery is a primary business driver because it supports competitive differentiation and revenue capture, not merely operational convenience.

Automated configuration checks continuously evaluate deployed resources against a security benchmark and alert when drift occurs. This detects misconfigurations that appear after deployment, such as a storage bucket made public or a security group opened to the internet. Together with preventive controls, it closes the loop between prevention and detection for continuous compliance.

PaaS delivers managed runtimes, middleware and operating systems, so developers deploy code while the provider handles patching, scaling and servers. This directly satisfies the stem's constraint of building applications without managing underlying infrastructure, unlike IaaS, which still requires OS administration, or SaaS, which offers finished software rather than a deployment platform.

Compliance certifications such as ISO 27001, SOC 2, or HIPAA attestations demonstrate that the provider undergoes independent audits. Data residency options allow the organization to select a region within the required country. Together, these directly address the compliance officer's demands for in-country data storage and regular third-party validation of security controls.

A NAT Gateway performs source network address translation, letting instances in a private subnet initiate outbound connections to the internet while remaining unreachable inbound. This satisfies the stem's requirement: the application needs outbound access for updates, but no route to the internet exists without this component.

Migration scripts apply ordered schema changes, such as adding columns or altering types, while preserving existing rows through the transition. This satisfies the stem's constraint of updating the schema without data loss, since ad-hoc manual edits or dropping and recreating tables would destroy the existing records.

Multiple availability zones within a region are physically separated data centers with independent power, cooling, and networking, so the application can survive the loss of an entire zone. Configuring automatic failover, such as a load balancer with health checks and multi-AZ instances, ensures minimal downtime. This approach directly satisfies the need to remain available during a data center outage while keeping latency low within the region.

A multi-region active-active deployment runs duplicate resources in a second region and can automatically shift traffic when one region fails. Because the company is willing to pay for duplicate resources and wants automatic failover, this approach directly satisfies the requirement to remain available during a full region outage.

SSH encrypts the entire management session over TCP port 22, providing the secure remote shell access the stem demands for Linux-based cloud VMs. Its native integration with Linux and key-based authentication satisfies the encrypted remote management constraint directly, unlike RDP (Windows-oriented) or unencrypted Telnet.

Shifting collaboration workloads to the cloud converts upfront capital expenditure for servers and storage into predictable operational expenditure. This frees capital for clinical initiatives and reduces the burden of hardware refresh cycles. The financial benefit is a core part of the business case and aligns with cloud economic principles. It should be quantified with current depreciation and maintenance costs.

Data classification and tagging involves identifying and labeling data based on its sensitivity and regulatory requirements, such as GDPR. This enables proper handling, access controls, and encryption. It is foundational for compliance because it ensures that personal data is identified and protected according to its classification, directly supporting GDPR principles.

SAML is the XML-based federation standard in which an identity provider issues signed assertions that a service provider trusts, enabling employees to authenticate to cloud applications with corporate credentials without separate accounts, satisfying the IdP requirement.

Azure Application Gateway is a layer 7 load balancer that supports URL path-based routing, multiple-site hosting, and TLS/SSL termination. It is designed for HTTP/HTTPS traffic and can route requests to different backend pools based on the URL. This directly satisfies the requirement to distribute HTTP traffic with URL-based routing and TLS termination in a single region.

Elasticity benefit.

This approach satisfies both data residency and high availability. Multiple availability zones within a region are physically separate but within the same country, so data remains compliant. Distributing the data warehouse across zones ensures that if one zone fails, the application can continue running from another. This is a standard best practice for critical workloads in regulated industries.

A hybrid deployment connects private infrastructure with public cloud resources, allowing workloads to burst outward for peak demand while sensitive data remains on company-owned hardware. This satisfies both the CIO's elasticity goal and the legal mandate. The legacy application can remain largely unchanged while the hybrid architecture absorbs seasonal load, making this the balanced and compliant choice.

Spreading the stateless fleet across multiple availability zones means the loss of one zone only removes a subset of instances, and the load balancer automatically stops routing to unhealthy targets. Because the application holds no local state, remaining instances absorb the traffic without data reconciliation, giving a very low recovery time with almost no manual intervention.

This hybrid approach balances cost predictability and scalability. Reserved instances cover the steady baseline traffic at a discounted rate, providing predictable costs. On-demand instances handle the seasonal spikes without long-term commitment. This aligns with the CIO's need for accurate forecasting while ensuring the application can scale during peak sales periods, optimizing both cost and performance.

SaaS delivers fully managed applications over the internet, so the provider handles servers, storage, and software updates. The design firm can simply subscribe, upload files, and let designers access them from any device via a browser or app. This matches the requirement to avoid managing infrastructure or installing and maintaining software locally.

This is secure and temporary.

Pay-as-you-go billing charges solely for consumed resources, metered hourly or per second, with no upfront commitment. This satisfies the stem's requirement for a typical cloud financial model by eliminating capital expenditure, letting organisations scale spend directly with actual usage rather than provisioning fixed capacity in advance.

Spot instances use spare cloud capacity at steep discounts but can be reclaimed when demand rises. For a batch transcoding job that can tolerate interruptions and is idle most of the day, spot instances minimize cost while providing the burst capacity needed when new content arrives, directly matching the stated tolerance for interruptions.

Proprietary APIs are unique to one provider, so application code built against them cannot be redeployed elsewhere without rewriting integration layers. That coupling raises migration cost and effort, which is precisely what creates vendor lock-in.

CPU utilization is the standard Auto Scaling trigger because it directly reflects compute load across instances. When average CPU breaches the target threshold, the group scales out, satisfying the stem's need for the most common metric driving instance increases.

FaaS platforms such as AWS Lambda run code in response to events without provisioning or managing servers, scaling per invocation. This satisfies the stem's serverless, event-driven requirement, unlike IaaS or PaaS, which still require capacity or runtime management.

A policy engine can enforce tagging by preventing the creation of resources that do not have required tags. This actively ensures compliance with tagging standards. It is a proactive governance control that aligns with compliance and cost management objectives. This is the most effective way to enforce tagging.

Customer-managed keys allow the customer to create, manage, and rotate encryption keys independently. The cloud KMS provides secure key storage and audit logs. This meets the requirement for customer control and independent rotation. It is the correct solution for encrypting data at rest with customer-managed keys.