CompTIA Cloud Essentials+ (CLO-002) (CLO-002) (CLO-002) — Questions 301–333

Customer-managed keys give the company exclusive control over key generation, rotation, and revocation. When stored in an HSM or customer-controlled KMS, the provider cannot access the plaintext keys, satisfying the requirement that the provider be unable to decrypt data. This approach aligns with compliance mandates for data sovereignty and key custody.

Data residency controls let the company pin where personal data is stored and processed, directly satisfying GDPR's restrictions on transferring EU personal data outside the European Economic Area. Without them, the provider could replicate or process data in jurisdictions that undermine lawful transfer mechanisms.

Blue/green deployment maintains two identical environments, routing production traffic only to the live one. Updates deploy to the idle environment first, where they can be verified in isolation before traffic switches over, satisfying the requirement to validate changes in a controlled environment prior to production rollout.

The cluster autoscaler watches for pods that cannot be scheduled due to insufficient node resources and adds nodes to the node pool. When demand drops and nodes are underutilized, it drains and removes them. This directly addresses the reported scheduling pressure while providing the automatic scale-in the team needs to control cost.

Measured service satisfies the metered-usage constraint by automatically monitoring, controlling and reporting resource consumption, enabling pay-per-use billing. Unlike fixed-capacity on-premises models, it provides the elasticity and cost transparency that define cloud computing under the NIST model.

The PCI Security Standards Council maintains a list of validated service providers, and checking it confirms the provider has undergone the required assessment for the services the company intends to use. This verification is a foundational due diligence step before architecting a cardholder data environment. It gives the software company documented assurance that the provider meets PCI DSS requirements for its portion of the shared responsibility.

Security groups act as virtual stateful firewalls at the instance or resource level. By default they deny all inbound traffic, so explicitly allowing only TCP 80 and 443 from any source achieves the desired minimal attack surface for the web tier while automatically permitting return traffic for established connections.

PaaS delivers a managed platform including the operating system, middleware, and runtime, so the customer only deploys and manages the application and its data. For a small agency with limited IT staff, this removes the burden of patching and scaling the underlying stack. The agency can focus on its custom CRM application while the provider handles the platform.

Resource pooling lets the provider serve multiple customers from shared physical or virtual capacity, dynamically assigning and reassigning resources as demand shifts. This multi-tenant model delivers the economies of scale, cost efficiency and elasticity that distinguish cloud from dedicated single-tenant hosting.

An IAM role issues temporary, automatically expiring credentials via STS assume-role, so the third party never receives long-term access keys. This satisfies the requirement to delegate access without sharing persistent credentials, unlike IAM users with static keys.

PaaS provides a platform including runtime, middleware, and database services, allowing developers to deploy code without managing the underlying infrastructure. The team is responsible for their application and data, which matches the PaaS model. This is the correct answer because the team focuses on code while the provider manages the platform.

Data classification is the customer's responsibility because only the customer knows the nature and sensitivity of its data. The cloud provider cannot determine which data is subject to GDPR; the customer must classify data to apply appropriate controls and ensure compliance with regulations like GDPR.

Cloud Logging provides a centralized log management interface where logs from all projects can be aggregated into a log bucket or viewed via a log router. It supports log-based metrics that can be created from audit logs and then used for alerting. This directly meets the need for a single view and metric creation across projects.

AWS Budgets lets you define a cost budget with a threshold and configure email notifications when actual or forecast spend exceeds it. That directly satisfies the $500 monthly alert requirement without needing custom billing API polling.

Measured service means the provider meters resource consumption and bills accordingly. Because the data scientists use GPU instances sporadically and the company wants to pay only while those machines run, the metered, pay-per-use billing model is the characteristic being leveraged. This directly ties cost to actual consumption rather than to a fixed owned asset.

TCP port 443 is the standard HTTPS listener, and permitting it from 0.0.0.0/0 allows public web access while denying every other port and protocol. This satisfies least privilege by exposing only the single service the web server must serve.

On-demand self-service allows consumers to unilaterally provision computing capabilities, such as storage, as needed automatically without requiring human interaction with the service provider. This matches the agency's need to provision storage on demand without provider intervention. It enables the agency to get resources immediately through a web console or API, which is essential for unpredictable storage needs and cross-platform access.

S3 Object Lock in compliance mode prevents any principal, including the root account, from deleting or overwriting protected object versions until the retention date passes. It directly enforces the seven-year immutable retention the regulation demands and cannot be shortened or bypassed, which is exactly the required guarantee.

Shadow IT means teams procure cloud resources outside IT governance, so instances and storage appear with no owner, budget or lifecycle oversight. This satisfies the stem's sprawl factor: unapproved provisioning bypasses the controls that would otherwise track and reclaim resources.

A private cloud hosted within the country ensures that all data remains within national borders, satisfying data residency requirements. It also allows the company to control the infrastructure and optimize network paths for local users, reducing latency. This model provides the necessary compliance and performance without relying on cross-border data flows.

A load balancer spreads incoming requests across multiple backend instances, preventing any single server from becoming a bottleneck. This satisfies the scaling constraint, allowing capacity to grow horizontally while presenting one stable endpoint to clients.

OpEx converts large upfront hardware and datacentre purchases into pay-as-you-go consumption charges, eliminating the initial capital outlay and its depreciation. This removal of upfront capital costs frees cash flow and shifts spending to ongoing operational budgets, which is the primary benefit of the model change.

Retraining and upskilling staff is a hidden administrative cost because it rarely appears in initial migration budgets, yet it is unavoidable when teams must learn new cloud tooling, revised operational processes and changed role responsibilities, consuming both training spend and productivity.

Adding more instances to the pool spreads the load, reducing the burden on individual servers.

Public cloud satisfies both constraints: multi-tenancy, where physical hardware is shared across customers, and consumption-based billing, where you pay only for resources used. It delivers these through provider-owned infrastructure, unlike private cloud (dedicated hardware) or hybrid models that combine on-premises and cloud resources.

Compliance and regulatory certifications evidence that a provider meets mandated standards such as ISO 27001, SOC 2 or GDPR. For an enterprise, this satisfies the due-diligence constraint, since unverified vendors expose the organisation to legal penalties and audit failures.

A Content Delivery Network caches static and cacheable content at edge locations distributed globally, so users retrieve assets from a nearby point of presence rather than the origin server. This reduces round-trip distance and origin load, directly addressing the high latency experienced across the globe.

Using customer-managed keys stored in an HSM ensures that the cloud provider cannot access the plaintext data because the keys are not available to the provider. The provider manages the infrastructure but cannot decrypt the data without the customer's keys. This directly addresses the requirement that provider employees cannot access the data.

Geo-redundancy replicates data to a secondary region, so backups survive a regional outage affecting the primary database. This directly satisfies the stem's requirement that backups reside in a different geographic region from production, distinguishing it from local redundancy, which keeps copies within a single region or availability zone.

Automated patching and maintenance removes the operational burden of applying database engine updates, security fixes and minor version upgrades. The provider handles this lifecycle work, which is a core managed-service benefit over self-managed databases where the team owns patching.

S3 Object Lock in compliance mode prevents any user, including the root account, from deleting or overwriting an object version until the retention date passes. This provides immutable storage for the seven-year period and meets the regulatory requirement that reports cannot be removed even by accident or malicious action.

Compliance certifications and independent audit reports, such as SOC 2 or ISO 27001 attestations, document that a third party has assessed the provider's controls. Auditors can review these artifacts to confirm security practices before contracting. This directly meets the requirement for proof of independent assessment, making it the correct concept to examine.

SCCs are pre-approved contractual terms that provide appropriate safeguards for transferring personal data outside the European Economic Area under the GDPR. They create enforceable data protection obligations between the exporter and importer, and remain a valid transfer mechanism when supported by a transfer impact assessment. For a multinational storing EU resident data in a non-EU cloud region, SCCs are the most appropriate mechanism.