CompTIA Cloud Essentials+ (CLO-002) (CLO-002) (CLO-002) — Questions 226–300

Data residency refers to the physical or geographic location where data is stored. By verifying that the cloud provider stores data within the United States, the organization can ensure compliance with HIPAA and data sovereignty requirements. This directly addresses the legal team's concern about keeping PHI within national borders and is a critical consideration for regulated industries.

Multi-AZ deployment distributes resources across physically separate availability zones within a region, each with independent power, cooling, and networking. This satisfies the resilience requirement by surviving the complete failure of any single data centre without application downtime.

Open standards and portable technologies, such as containers and Kubernetes, allow workloads to run across multiple cloud providers with minimal changes. This reduces lock-in and increases flexibility. Prioritizing these technologies aligns with the CIO's goal to maintain the ability to move workloads between providers.

The core benefit of a warm standby with a different provider is that a provider-wide failure does not take the streaming service down entirely. Because the two environments rely on separate infrastructure and control planes, the standby can absorb traffic during a major outage, directly addressing the continuity concern.

Cloud providers commonly charge for data leaving their network and for traffic crossing regions, and e-commerce platforms generate heavy outbound traffic to customers. Omitting egress fees understates the ongoing bill and can make a cloud option appear cheaper than it is over the full lifecycle.

Customer-managed keys let the hospital generate, store, and rotate encryption keys outside the provider's exclusive control. Because the provider lacks standing access to the key material, it cannot decrypt the records at rest. This satisfies the compliance officer's requirement while still allowing the provider to store the encrypted data, making it the appropriate capability.

SLAs define the remedy when the provider misses its commitments, so they specify service credits issued as a percentage of monthly fees. This financial mechanism gives customers contractual recourse for outages, satisfying the stem's requirement for a standard SLA component.

Agility in cloud adoption means provisioning resources on demand and releasing changes rapidly, so faster time-to-market for new features directly reflects that business driver. Cost, scalability and resilience are separate drivers, not the agility axis.

Declarative templates eliminate configuration drift by provisioning identical environments on every run, so compliance controls are applied uniformly rather than depending on manual steps. This directly satisfies the stem's requirement for repeatable, auditable infrastructure, giving assessors reproducible evidence that each deployment meets the same baseline.

Rapid provisioning allows developers to quickly spin up development, testing, and production environments on demand. This accelerates the software development lifecycle and enables faster deployment of new features. It directly supports the need for frequent code changes and rapid iteration.

In a public cloud, the provider owns and maintains the physical servers, so the customer no longer needs to purchase hardware upfront. This shifts costs from capital expenditure (CapEx) to operational expenditure (OpEx). Eliminating large upfront hardware purchases is a primary financial benefit of cloud adoption. This directly addresses the CFO's concern about reducing capital costs.

Centralised configuration management stores configuration in one authoritative source and pushes updates to all containers automatically, removing manual edits. This satisfies the stem's constraint of propagating configuration changes across hundreds of containers without manual intervention.

Cloud providers bill for provisioned block storage regardless of attached state, so an unused volume continues accruing charges until removed. Deleting the volume releases the underlying capacity and terminates billing; detaching or stopping merely preserves the resource and its cost.

Active connection count reports how many concurrent connections the load balancer is currently handling. Rising values approaching its capacity indicate the balancer is struggling with concurrent user connections, directly satisfying the metric the scenario requires.

CloudFormation provisions infrastructure as code, letting templates define and deploy AWS resources repeatably without manual configuration. This directly satisfies the automation requirement in the stem, since template-driven orchestration removes human intervention from resource creation and updates, making it a core service for automating cloud infrastructure deployment.

In an IaaS model, the customer is responsible for securing and managing the guest operating system, installed applications, and data. For a healthcare company, this means implementing access controls, encryption, and auditing to protect electronic protected health information (ePHI). The company must also ensure that the cloud provider's infrastructure meets HIPAA requirements through a Business Associate Agreement (BAA).

Under the Shared Responsibility Model, the provider secures the cloud infrastructure, while the customer configures security groups, IAM policies and data. Security group rules are customer-controlled access decisions, so their configuration sits firmly on the customer's side of the divide.

Rapid elasticity is a NIST essential characteristic. Imaging archives experience variable study volumes, so the ability to scale capacity outward quickly and release it when demand falls demonstrates the elasticity that distinguishes cloud from fixed-capacity hosting. Auditors confirming this trait would verify that capacity can grow and shrink with demand rather than being permanently provisioned.

Spot Instances use spare AWS capacity and cost up to 90% less than On-Demand. Because the workload is stateless and interruption-tolerant, Spot interruption notices can be handled by draining connections or terminating instances without data loss. This matches the requirement for the lowest cost while maintaining high availability through a diversified fleet across multiple Spot capacity pools.

A GDPR DPA is a legally binding document that outlines how the cloud provider processes personal data on behalf of the customer. It includes standard contractual clauses (SCCs) and other GDPR-mandated terms. This directly confirms the provider's commitment to GDPR data processing requirements. It is the specific document needed to verify compliance.

AWS KMS stores and manages customer-managed keys, integrates with CloudTrail to log every key use for compliance auditing, and encrypts data at rest across AWS services. This satisfies both the customer-managed key and audit log requirements.

A community cloud serves organisations with common requirements, so the shared infrastructure can be engineered to meet that sector's specific security or compliance controls. This tailored governance exceeds the generic baseline of a public cloud, giving members stronger assurance for their shared regulatory obligations.

Federating both clouds to a central identity provider means authentication and group membership are managed in one place. Access to each provider is granted through role or group mappings, so disabling the central account immediately blocks access everywhere. This satisfies both the unified policy requirement and the rapid revocation requirement without duplicating identity stores.

Direct Connect establishes a dedicated private fibre link between your on-premises data centre and the VPC, bypassing the public internet entirely. This satisfies the stem's core constraint of private connectivity, offering consistent latency and higher bandwidth than IPsec VPN tunnels, which route traffic over the public internet.

Provides a platform for code deployment without OS management.

SaaS removes the need for the organization to patch, scale, and maintain the CRM's underlying infrastructure; the vendor handles all of that. This directly satisfies the stem's requirement for the primary business advantage, cutting internal administrative overhead compared with managing IaaS components themselves.

Selecting a region within the required country ensures data residency, while customer-managed keys in a key management service give the company direct control over key creation, rotation, and revocation. This satisfies both the regulatory data location mandate and the requirement for direct key control. The provider still manages the underlying infrastructure, but the company controls the keys.

Rapid elasticity allows cloud resources to scale out automatically when demand increases and scale in when demand drops, matching capacity to workload. In this scenario, the flash sale spike can be absorbed by provisioning additional instances on demand, then releasing them afterward. This directly prevents the slowdown without the cost of permanently adding on-premises hardware, making it the characteristic that solves the stated problem.

An SLA specifies which services and components are covered and lists exclusions, such as scheduled maintenance or customer misconfiguration. Understanding the scope prevents false assumptions about what is guaranteed. If critical services are excluded, the company may need additional mitigation, so this is a key consideration.

Azure Policy evaluates resource properties against defined rules and enforces effects such as deny or audit, so non-compliant VM names or missing cost-tracking tags are blocked or flagged. This satisfies the stem's requirement to enforce naming conventions and tags consistently across all virtual machines.

SSE-KMS with a customer managed key gives the firm control over the key policy and lifecycle. Enabling automatic key rotation rotates the backing key material on a defined schedule, and CloudTrail records KMS API calls such as Encrypt and Decrypt, providing the key-usage audit trail. Together these satisfy control, rotation, and logging requirements.

PaaS supplies a managed runtime, middleware, and deployment pipeline, so developers push code while the provider handles servers, patching, and scaling. This removes the infrastructure management burden the startup must avoid, unlike IaaS, which still requires operating-system administration.

NoSQL databases use flexible, schema-less document, key-value or graph models rather than rigid relational tables, so they store unstructured data natively. Their shared-nothing architecture partitions data across nodes, delivering the horizontal scaling the application demands.

A post-incident review captures root cause, response gaps and lessons learned after containment and recovery, feeding improvements back into the incident response plan. It satisfies the stem as the closing phase that distinguishes a complete cloud incident response process from mere firefighting.

A tagging policy ensures that resources carry the metadata needed for cost allocation, ownership, and reporting. By enforcing required tags at creation, the business prevents untagged resources that would break invoice allocation. This is a foundational governance control that supports financial accountability and is directly aligned with the goal of accurate cost center attribution.

SaaS delivers a complete application over the internet, with the provider managing all underlying infrastructure, platforms, and application updates. The business simply accesses the software via a browser, exactly as described. This model eliminates the need for the business to handle any maintenance or patching, aligning perfectly with the scenario.

This directly impacts the integrity of the data.

Provisioned IOPS SSD decouples performance from capacity, guaranteeing sustained IOPS and consistent low latency. General-purpose SSDs share throughput and can burst only briefly, so they cannot satisfy the database's demanding IOPS and latency constraint under continuous load.

Placing application instances in multiple regions near user concentrations reduces the physical distance data must travel, directly lowering round-trip latency. It also provides regional fault isolation, so an outage in one region does not take down the entire service, satisfying both the latency and high availability goals.

Data sovereignty violations arise when data is stored or processed in a jurisdiction whose laws conflict with the residency or regulatory obligations the organisation must satisfy. Because cloud providers replicate and host data across regions, workloads can breach local data-protection requirements without deliberate misconfiguration.

Separating permissions into distinct roles so that workload administrators cannot delete audit logs and log administrators cannot modify workloads enforces separation of duties technically. Combined with least privilege, this ensures no single identity holds both capabilities, directly meeting the security policy for privileged console access.

Multi-AZ deployment synchronously replicates data and resources across physically separate zones, so a single zone failure does not cause data loss or downtime. This directly mitigates the availability and durability risk inherent in single-zone storage.

Initial migration and training costs capture the one-off expenditure incurred before cloud benefits accrue, which TCO savings alone omit. ROI compares total benefits against total costs, so excluding these upfront outlays overstates returns. Including them satisfies the stem's requirement for a secondary financial factor beyond ongoing TCO savings.

Cost Explorer visualises historical spend and usage by service, account and tag, and produces forecasts, enabling identification of cost drivers. This satisfies the stem's requirement for a cloud management tool that controls costs through analysis and trend visibility.

Cost allocation reports break spend down by tag, subscription, resource group or service, exposing which workload or team is driving the overrun. This satisfies the stem's requirement to identify the source of excess spend before remediation, rather than merely observing the total.

Providers bill egress traffic leaving their network, so cross-region replication, internet downloads and multi-cloud architectures incur charges. This metered data transfer rate is a primary cost driver, satisfying the stem's requirement for a factor governing cloud spend.

The cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and the underlying network. This is a fundamental aspect of the shared responsibility model. The customer is not responsible for physical security. This option correctly identifies the provider's responsibility.

Compute Optimizer analyses CloudWatch metrics such as CPU, memory and network utilisation over time, then applies machine learning to flag over-provisioned instances. This directly satisfies the stem's requirement for a right-sizing recommendation on an underutilised virtual machine, unlike tools that only report cost or inventory.

IaaS provides virtualized compute, storage, and networking on which the firm can install and manage its own operating system and application. Because the workload can be lifted and shifted without code changes and the firm retains OS-level administrative control, IaaS matches both the no-modification constraint and the requirement to manage patching and runtime configuration itself.

Elasticity automatically provisions and de-provisions resources to match demand in real time, so capacity expands during seasonal peaks and contracts afterwards. This directly satisfies the requirement to scale for traffic spikes, unlike scalability, which only describes the capacity to grow without addressing dynamic, temporary demand.

Data residency policies define where data can be stored and processed. By restricting resource deployment to approved regions, the company ensures compliance with local laws that mandate data stays within certain geographic boundaries. This is a direct governance control for data sovereignty.

A managed instance group with health checks and autohealing continuously monitors instance health and automatically recreates unhealthy instances. When configured as a regional managed instance group, it can distribute instances across multiple zones and recreate them in a healthy zone if one zone fails. This provides automatic recovery without manual intervention, meeting the requirement.

Client-side encryption encrypts data within the organisation's own environment before transmission, so plaintext never leaves the premises and cloud providers receive only ciphertext. Server-side methods encrypt after arrival, failing the requirement that data be encrypted prior to being sent to the cloud.

The application tier shows sustained CPU near 95 percent with rising queue depth, which is the classic signal for horizontal scaling. Adding instances distributes the request load and reduces queue depth, restoring response times while keeping the service available. A target tracking policy on CPU utilization automates this for future peaks without manual intervention.

Key Management Service provides centralised creation, rotation, and access control of encryption keys, letting the organisation retain strict key custody rather than handing control to the cloud provider. This directly satisfies the stem's constraint of maintaining strict control over encryption keys during cloud migration.

Cloud compute is billed by consumption, often per second or per minute, so transcoding jobs incur charges only while running. This variable, usage-based billing is a defining characteristic of the cloud model and must be modeled against the fixed cost of owned servers. It directly reflects how the workload's duration drives cloud spend.

SaaS typically converts upfront capital expenditures (CapEx) for servers, licenses, and infrastructure into ongoing operational expenditures (OpEx) through subscription fees. This improves cash flow and reduces the need for large initial investments. The agency can budget monthly or annually, making financial planning easier and aligning costs with usage.

The status dashboard publishes real-time health per region and service, showing active incidents and remediation progress during outages. Checking it verifies current infrastructure state directly, satisfying the stem's requirement to confirm the provider's live operational status.

Elastic scalability enables applications to automatically scale resources up or down based on demand, ensuring performance during peak usage without manual intervention. This agility supports rapid experimentation and deployment of new features, as teams do not need to over-provision for worst-case scenarios. It directly contributes to faster time-to-market by removing infrastructure constraints.

Committed use discounts (CUDs) provide significant discounts (up to 57% for most machine types) in exchange for committing to a 1- or 3-year term for a specific amount of vCPU and memory. This is ideal for predictable, steady-state workloads, as it reduces cost without impacting performance. It aligns with cost optimization best practices by leveraging long-term commitments for baseline usage.

Enabling MFA on the root account is the first practice because the root account holds unrestricted access to all resources and billing. MFA adds a second authentication factor, so a leaked password alone cannot compromise the entire cloud account, satisfying the stem's initial security hardening requirement.

Multi-AZ deployment satisfies the synchronous replication requirement by maintaining a standby replica in a separate availability zone, with writes committed to both before acknowledgement. This delivers the low recovery time and automatic failover the stem demands, unlike read replicas, which replicate asynchronously and cannot provide zero-data-loss zone resilience.

Placing the primary database and its backups in the same in-country region and turning off cross-region replication ensures that records are written and retained only within that jurisdiction. This directly satisfies data residency because storage, backup copies, and recovery points all remain in the required country, which is the most enforceable configuration.

A Cloud Adoption Strategy document sequences the organisation's move to cloud, so the migration roadmap and timeline translate strategic goals into phased, dated workloads and milestones. This satisfies the requirement for actionable planning content rather than purely financial or architectural detail.

Each cloud provider supplies its own native monitoring console, so correlating performance and availability across AWS, Azure and GCP demands a unified monitoring tool that aggregates metrics and logs into a single pane of glass, satisfying the cross-provider visibility requirement.

IaaS provides virtualised compute, storage and networking where the customer controls the operating system and network configuration, while the provider handles physical hardware. PaaS and SaaS abstract away OS and network control, so they fail the control requirement.

Systems Manager Automation lets you build runbooks that perform actions such as stopping or resizing instances, and it integrates with CloudWatch alarms and Amazon EventBridge to trigger automatically. It can also invoke Lambda or send notifications, so it satisfies the requirement for unattended remediation plus Slack notification without writing a custom application.

A managed service such as RDS handles provisioning, patching, backups and scaling, so the customer's team no longer performs those database administration tasks. This directly reduces operational overhead compared with running a self-managed database on a virtual machine.

A private cloud deployment keeps the workload on infrastructure dedicated to the single organisation, giving full control over data residency, isolation and compliance controls. This satisfies the strict regulatory requirements that a shared public or community cloud tenancy could not guarantee for the database.

Multi-tenancy allows multiple customers to share the same physical infrastructure, but logical isolation ensures that each tenant's data and processes are separated. This isolation, enforced through virtualization, access controls, and network segmentation, prevents other customers from accessing the retail company's data. It is the characteristic that directly addresses the security concern in a shared environment.

AWS Compute Optimizer analyses historical CloudWatch utilisation metrics for EC2 instances and returns rightsizing recommendations with over-provisioned and under-provisioned findings. This satisfies the stem's constraint of historical-utilisation-based rightsizing guidance, unlike CloudWatch alone, which only reports raw metrics without recommendations.

Spreading resources across multiple regions and using global traffic management ensures that if one region fails, traffic can be redirected to another region. This directly addresses the need to survive a full region outage. It introduces additional cost and complexity, which the company is willing to accept, making it the most appropriate design.

Re-platforming modifies the underlying platform — such as upgrading to a supported OS — while preserving the application's core code and logic. This resolves the unsupported-OS constraint without the cost and risk of a full rewrite that re-architecting would demand.

A DynamoDB table provides the state-locking mechanism Terraform requires when using the AWS S3 backend, acquiring a lock before any plan or apply and releasing it afterwards. This prevents concurrent CI/CD pipeline runs from modifying the same state file simultaneously, satisfying the stem's requirement to block parallel modifications.

In SaaS, the provider secures the application, runtime and infrastructure, but the customer's users, credentials and permissions remain their own responsibility. Identity and access management therefore stays with the company, satisfying the stem's question about which security responsibility persists under the shared responsibility model.