CompTIA CompTIA Certifications CLO-002 Questions & Answers

• Question 111:

  A human resources department is considering a SaaS-based human resources portal and requires a risk analysis.

  Which of the following are requirements to consider? (Choose two.)

  A. Support

  B. Threats

  C. Chargebacks

  D. Vulnerabilities

  E. Maintenance

  F. Gap analysis

  Correct Answer: BD

  Explanation: A risk analysis is a process of identifying and assessing the potential threats and vulnerabilities that could affect the confidentiality, integrity, and availability of data and systems. A SaaS-based human resources portal is a cloud

  service that provides access to human resources applications and data over the internet. The human resources department should consider the following requirements when conducting a risk analysis for this service:

  Threats: These are the sources or events that could exploit the vulnerabilities of the service and cause harm to the data or systems. For example, malicious actors, natural disasters, power outages, network failures, etc. The human resources

  department should identify the possible threats that could affect the SaaS service and evaluate their likelihood and impact.

  Vulnerabilities: These are the weaknesses or gaps in the security of the service that could be exploited by the threats. For example, misconfigurations, outdated software, lack of encryption, insufficient authentication, etc. The human

  resources department should identify the existing and potential vulnerabilities of the SaaS service and evaluate their severity and exposure. The other options are not relevant for a risk analysis:

  Support: This is the assistance or guidance provided by the SaaS provider or a third party to the customers of the service. Support is not a requirement for a risk analysis, but rather a factor to consider when selecting or evaluating a SaaS

  provider.

  Chargebacks: These are the fees or penalties imposed by the SaaS provider to the customers for exceeding the agreed-upon service levels or usage limits. Chargebacks are not a requirement for a risk analysis, but rather a factor to consider

  when negotiating or reviewing the service level agreement (SLA) with the SaaS provider.

  Maintenance: This is the process of updating, repairing, or improving the service to ensure its functionality and performance. Maintenance is not a requirement for a risk analysis, but rather a responsibility of the SaaS provider that should be

  specified in the SLA.

  Gap analysis: This is a process of comparing the current state and the desired state of a system or a process and identifying the gaps or differences between them. Gap analysis is not a requirement for a risk analysis, but rather a tool to use

  for planning or implementing improvements or changes.

  References:

  CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 2: Cloud Concepts and Models, Section 2.3: Cloud Security Concepts, p. 54-55 CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 4: Cloud Business Principles, Section

  4.1: Cloud Service Agreements, p. 116-117

• Question 112:

  The optimal, sequential order in which cloud resources should be recovered in the event of a major failure would be defined in the:

  A. recovery point objective.

  B. disaster recovery plan.

  C. incident response plan.

  D. network topology diagram.

  Correct Answer: B

  Explanation: A disaster recovery plan (DRP) is a document that defines the procedures and resources needed to restore normal operations after a major disruption. A DRP typically includes the following elements: The scope and objectives of the plan The roles and responsibilities of the DR team The inventory and location of critical assets and resources The recovery strategies and procedures for different scenarios The testing and maintenance schedule for the plan The communication plan for internal and external stakeholders One of the key components of a DRP is the recovery sequence, which is the optimal, sequential order in which cloud resources should be recovered in the event of a major failure. The recovery sequence is based on the priority and dependency of the resources, as well as the recovery time objective (RTO) and recovery point objective (RPO) of the business. The recovery sequence helps to minimize the downtime and data loss, and ensure the continuity of the business operations. A recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time. It indicates how often the data should be backed up and how much data can be restored after a disaster. A recovery time objective (RTO) is the maximum acceptable amount of time that a system or application can be offline after a disaster. It indicates how quickly the system or application should be restored and how much downtime can be tolerated by the business. An incident response plan (IRP) is a document that defines the procedures and actions to be taken in response to a security breach or cyberattack. An IRP typically includes the following elements: The scope and objectives of the plan The roles and responsibilities of the incident response team The incident identification and classification criteria The incident containment, eradication, and recovery steps The incident analysis and reporting methods The incident prevention and improvement measures A network topology diagram is a visual representation of the physical and logical layout of a network. It shows the devices, connections, and configurations of the network. A network topology diagram can help to identify the potential points of failure, the impact of a failure, and the recovery options for a network. However, it does not define the optimal, sequential order in which cloud resources should be recovered in the event of a major failure. References: The following sources were used to create this answer: Disaster recovery planning guide | Cloud Architecture Center - Google Cloud What is Disaster Recovery and Why Is It Important? - Google Cloud Key considerations when building a disaster recovery plan for private cloud - Continuity Central 12 Essential Points Of the Disaster Recovery Plan Checklist - NAKIVO Building a Cloud Disaster Recovery Plan: Tips and Approaches - MSP360

• Question 113:

  Due to local natural disaster concerns, a cloud customer is transferring all of its cold storage data to servers in a safer geographic region. Which of the following risk response techniques is the cloud customer employing?

  A. Avoidance

  B. Transference

  C. Mitigation

  D. Acceptance

  Correct Answer: A

  Explanation: Avoidance is a risk response technique that involves changing the project plan to eliminate the risk or protect the project objectives from its impact. Avoidance can be done by modifying the scope, schedule, cost, or quality of the project. Avoidance is usually the most effective way to deal with a risk, but it may not always be possible or desirable. In this case, the cloud customer is transferring all of its cold storage data to servers in a safer geographic region, which means they are changing the location of their data storage to avoid the risk of a natural disaster affecting their data. This way, they are eliminating the possibility of losing their data due to a natural disaster in their original region. This is an example of avoidance as a risk response technique. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 4: Cloud Security, Section 4.2: Cloud Security Concepts, Page 153. 5 Risk Response Strategies ProjectEngineer1

• Question 114:

  An organization's servers are experiencing performance degradation from oversubscription of memory in the virtual environment and exhausted physical RAM.

  Which of the following cloud computing characteristics would BEST address the issue?

  A. Availability

  B. Elasticity

  C. Pay-as-you-go

  D. Self-service

  Correct Answer: B

  Explanation: Elasticity is the cloud computing characteristic that allows the cloud service to scale up or down the resources dynamically according to the demand. Elasticity can help the organization address the issue of performance degradation from oversubscription of memory in the virtual environment and exhausted physical RAM by automatically allocating more memory resources to the servers when needed and releasing them when not needed. This way, the organization can avoid the risk of running out of memory and ensure optimal performance of the servers. References: CompTIA Cloud Essentials+ CLO-002 Certification Study Guide, Chapter 1: Cloud Computing Concepts, Section 1.2: Cloud Computing Characteristics, Page 17

• Question 115:

  Which of the following BEST explains why there should be an established communication policy between CSPs and clients?

  A. To set guidelines for securing network traffic for all communications with endpoints on the corporate local area network

  B. To ensure all staff know the acceptable guidelines for representing themselves on social media.

  C. To have protocols in place for notifying staff when a cloud outage occurs.

  D. To have proper procedures in place for interactions between internal departments and cloud vendors submitting bids for software or service.

  Correct Answer: C

  Explanation: A communication policy between CSPs and clients is a set of rules and guidelines that define how, when, and what information is exchanged between the parties involved in a cloud service relationship. A communication policy can help ensure transparency, accountability, trust, and collaboration between CSPs and clients, as well as improve the quality and efficiency of the cloud service delivery and management. One of the main reasons why there should be an established communication policy between CSPs and clients is to have protocols in place for notifying staff when a cloud outage occurs. A cloud outage is a disruption or interruption of the availability or functionality of a cloud service, which can affect the performance, reliability, and security of the cloud service and its users. A cloud outage can be caused by various factors, such as hardware failures, software bugs, network issues, human errors, cyberattacks, or natural disasters. A communication policy can help define the roles and responsibilities of the CSPs and clients in the event of a cloud outage, such as who should report, monitor, escalate, resolve, and communicate the outage, and how they should do so. A communication policy can also help specify the communication channels, methods, formats, and frequencies that should be used to inform the relevant staff and stakeholders about the outage, such as email, phone, text, web portal, dashboard, or social media. A communication policy can also help establish the communication standards, expectations, and metrics that should be followed to ensure the accuracy, timeliness, and completeness of the outage information, such as the cause, impact, status, duration, and resolution of the outage. By having protocols in place for notifying staff when a cloud outage occurs, a communication policy can help minimize the negative effects of the outage, such as customer dissatisfaction, revenue loss, reputation damage, or legal liability. A communication policy can also help enhance the positive outcomes of the outage, such as customer loyalty, service improvement, incident learning, or risk mitigation. Therefore, option C is the best explanation of why there should be an established communication policy between CSPs and clients. Option A is incorrect because it does not explain why there should be a communication policy between CSPs and clients, but rather how to secure network traffic for all communications with endpoints on the corporate local area network. Network security is an important aspect of cloud service delivery and management, but it is not the same as communication policy. Option B is incorrect because it does not explain why there should be a communication policy between CSPs and clients, but rather how to ensure all staff know the acceptable guidelines for representing themselves on social media. Social media is one of the possible communication channels that can be used to exchange information between CSPs and clients, but it is not the same as communication policy. Option D is incorrect because it does not explain why there should be a communication policy between CSPs and clients, but rather how to have proper procedures in place for interactions between internal departments and cloud vendors submitting bids for software or service. Cloud vendor selection is an important aspect of cloud service procurement and contracting, but it is not the same as communication policy. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 3: Cloud Business Principles, Section 3.5: Cloud Communication and Stakeholder Management, Page 971 and The Importance of Communication in Cloud Computing | Cloud Computing News

• Question 116:

  A company migrated all of its infrastructure to the cloud. The cloud security team must review the security post-migration.

  Which of the following is the MOST appropriate task for the cloud security team to perform?

  A. Risk register

  B. Threat assessment

  C. Application scan

  D. Vulnerability scan

  Correct Answer: D

  Explanation: A vulnerability scan is a process of identifying and reporting potential security weaknesses in a system or network. A vulnerability scan can help detect misconfigurations, outdated software, missing patches, and other issues that could compromise the security of the cloud environment. A vulnerability scan is an appropriate task for the cloud security team to perform after migrating the infrastructure to the cloud, as it can help identify and remediate any security gaps that may have occurred during the migration process. A vulnerability scan can also help the cloud security team comply with the security standards and regulations that apply to the cloud service provider and the cloud customer. A risk register is a document that lists the identified risks, their likelihood, impact, and mitigation strategies for a project or organization. A risk register is not a post-migration task, but rather a pre-migration task that should be created and updated throughout the cloud migration process. A risk register can help the cloud security team assess and manage the risks associated with the cloud migration, and plan for contingencies and backups in case of any unforeseen events. A threat assessment is a process of identifying and analyzing the potential threats that could harm a system or network. A threat assessment can help the cloud security team determine the sources, motives, capabilities, and methods of the attackers, and prioritize the most critical and likely threats. A threat assessment is not a post-migration task, but rather a continuous task that should be performed regularly to monitor and respond to the evolving threat landscape. A threat assessment can help the cloud security team enhance the security posture and resilience of the cloud environment, and implement appropriate countermeasures and controls. An application scan is a process of testing and verifying the functionality and security of an application. An application scan can help detect and report any errors, bugs, vulnerabilities, or performance issues in an application. An application scan is not a post-migration task, but rather a development and deployment task that should be performed before and after launching an application in the cloud. An application scan can help the cloud security team ensure the quality and reliability of the application, and fix any issues that could affect the user experience or security of the application. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 4: Cloud Security Principles and Practices, pages 153-154.

• Question 117:

  A business analyst is comparing used vs. allocated storage cost for each reserved instance on a financial expenditures report related to the cloud. The CSP is currently billing at the following rates for storage:

  $1.50 per GB of used space $0.75 per GB of allocated space

  The operating expenditures the analyst is reviewing are as follows:

  

  Given this scenario, which of the following servers is costing the firm the least, and which should have storage increased due to over 70% utilization?

  A. Least: File server Optimize: Application server

  B. Least: Application server Optimize: Mail server

  C. Least: Mail server Optimize: File server

  D. Least: Application server Optimize: File server

  Correct Answer: D

  The least costing server is the application server because it has the lowest used space and allocated space. The file server should have storage increased due to over 70% utilization because it has the highest used space and allocated

  space. To calculate the cost of each server, we can use the following formula:

  Cost = ($1.50 x Used space) + ($0.75 x Allocated space) Using this formula, we can find the cost of each server as follows:

  Application server: Cost = ($1.50 x 186 GB) + ($0.75 x 250 GB) = $279 + $187.50 = $466.50

  Mail server: Cost = ($1.50 x 250 GB) + ($0.75 x 300 GB) = $375 + $225 = $600 File server: Cost = ($1.50 x 450 GB) + ($0.75 x 500 GB) = $675 + $375 = $1050 The application server has the lowest cost of $466.50, while the file server has

  the highest cost of $1050. To find the utilization percentage of each server, we can use the following formula:

  Utilization = (Used space / Allocated space) x 100% Using this formula, we can find the utilization percentage of each server as follows:

  Application server: Utilization = (186 GB / 250 GB) x 100% = 74.4% Mail server: Utilization = (250 GB / 300 GB) x 100% = 83.3% File server: Utilization = (450 GB / 500 GB) x 100% = 90% The file server has the highest utilization percentage

  of 90%, which means that it is running out of storage space and may affect its performance and availability. The application server has the lowest utilization percentage of 74.4%, which means that it has some unused storage space and may

  be overprovisioned. Therefore, the file server should have storage increased to reduce its utilization and improve its efficiency, while the application server is costing the firm the least and does not need any changes in its storage allocation.

  References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 3: Cloud Business Principles, Section 3.4: Cloud Billing and Cost Management, Page 87 and [Cloud Storage Utilization and Optimization | CloudHealth by VMware]

• Question 118:

  A document that outlines the scope of a project, specific deliverables, scheduling, and additional specific details from the client/buyer is called a:

  A. statement of work.

  B. standard operating procedure.

  C. master service document.

  D. service level agreement.

  Correct Answer: A

  A statement of work (SOW) is a document that outlines the scope of a project, specific deliverables, scheduling, and additional specific details from the client/buyer1. A SOW defines what the service provider will do for the client and how they

  will do it, as well as the expected outcomes and quality standards2. A SOW is typically used as a supplement to a master service agreement (MSA) or a contract that establishes the general terms and conditions of the business relationship3.

  References:

  CompTIA Cloud Essentials CLO-002 Certification Study Guide, Chapter 2:

  Business Principles of Cloud Environments, page 65 Statement of Work (SOW): What Is It and How to Write One, The Blueprint Master Services Agreement vs Statement Of Work, Difference between MSA and SOW, PandaDoc

• Question 119:

  Which of the following is the BEST approach to optimize data security in an IaaS migration of data to the cloud?

  A. Review the risk register.

  B. Perform a vulnerability scan

  C. Perform server hardening.

  D. Configure encryption in transit.

  Correct Answer: D

• Question 120:

  A company is moving its long-term archive data to the cloud. Which of the following storage types will the company MOST likely use?

  A. File

  B. Object

  C. Tape

  D. Block

  Correct Answer: B

  Explanation: Object storage is a type of cloud storage that stores data as discrete units called objects. Each object has a unique identifier, metadata, and data. Object storage is ideal for storing long-term archive data in the cloud because it offers high scalability, durability, availability, and cost-effectiveness12. Object storage can handle large amounts of unstructured data, such as documents, images, videos, and backups, and allows users to access them from anywhere using a simple web interface3. Object storage also supports features such as encryption, versioning, lifecycle management, and replication to ensure the security and integrity of the archive data45. References: [CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (LO-002)], Chapter 2: Cloud Computing Concepts, pages 36-37.