Pass the CompTIA Cloud Essentials CLO-002 Questions and answers with ExamsMirror

One of the risks that an organization can transfer by adopting the cloud is data breach due to a break-in at the facility. This is because the cloud service provider (CSP) is responsible for the physical security of the data center where the data is stored and processed. The CSP should have adequate measures to prevent unauthorized access, theft, or damage to the hardware and infrastructure. By outsourcing the data storage and processing to the CSP, the organization transfers the risk of physical breach to the CSP. However, the organization still retains the risk of data breach due to other factors, such as network attacks, misconfiguration, or human error. Therefore, the organization should also implement appropriate controls to protect the data in transit and at rest, such as encryption, authentication, and monitoring. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 5: Risk Management, page 1661 and page 1692. The Top Cloud Computing Risk Treatment Options | CSA3.

Containerization is a software deployment process that bundles an application’s code with all the files and libraries it needs to run on any infrastructure. Containerization does not include an underlying operating system that would require patching and management, as containers share the host operating system kernel and run in isolated user spaces. Containerization allows applications to run consistently and portably on any platform or cloud, regardless of the differences in operating systems, hardware, or configurations. Containerization also enables faster and easier deployment, scalability, and fault tolerance of applications. Therefore, containerization would best meet the need of a vendor who wants to distribute a cloud management application in a format that can be used on both public and private clouds.

The other options are not relevant to the question. Federation is a process of integrating multiple cloud services or providers to create a unified cloud environment. Collaboration is a process of working together on a shared project or goal using cloud-based tools and platforms. Microservices are a software architecture style that breaks down a complex application into smaller, independent, and loosely coupled services that communicate through APIs. Microservices can be implemented using containers, but they are not a software deployment format. Therefore, the correct answer is A. Containerization.

Audit and system logs are the best resource to use to start the investigation of an email phishing campaign against a company’s email server. Audit and system logs are records of events and activities that occur on a system or a network, such as user login, file access, configuration changes, or network traffic. Audit and system logs can help an incident response team to identify the source, scope, and impact of the phishing attack, as well as to collect evidence, trace the attack steps, and determine the root cause. Audit and system logs can also help the incident response team to evaluate the security posture and controls of the email server, and to recommend remediation and mitigation actions12

 The cost savings by converting all four of the cloud servers to reserved instances can be calculated as follows:

The current pricing is $200 per month per server, which means the total cost for keeping three servers online for another nine months is $200 x 3 x 9 = $5,400, and the total cost for keeping one server online for a year is $200 x 1 x 12 = $2,400. The total cost for all four servers is $5,400 + $2,400 = $7,800.

The sale price of $1,500 per year per reserved instance means the total cost for converting all four servers to reserved instances is $1,500 x 4 = $6,000.

The cost savings by converting all four servers to reserved instances is $7,800 - $6,000 = $1,800.

A reserved instance is a type of cloud instance that offers a discounted hourly rate and capacity reservation for a specific period of time, typically one or three years. Reserved instances are suitable for applications that have predictable usage patterns and require uninterrupted performance. By converting the server to a reserved instance, the IT department can reduce the costs of the server by up to 72%, compared to on-demand instances1. Additionally, reserved instances can provide more stability and availability than spot instances, which are subject to interruption and fluctuating prices. References: Spot Instances vs Reserved Instances: Which is The Right EC2 Pricing Model?; On-Demand vs Reserved vs Spot Instances | Incredibuild; Spot Instances - Amazon Elastic Compute Cloud.

Infrastructure as code (IaC) is a software engineering approach that allows the provisioning and management of infrastructure resources using code and automation1. It involves defining infrastructure configurations and provisioning them through code, rather than manually configuring and managing infrastructure resources2. One of the main reasons for using IaC is to capture the system configurations to track changes and remediate configuration drift3. Configuration drift is the phenomenon where the actual state of an infrastructure resourcedeviates from its desired state over time due to manual interventions, updates, patches, or other factors. Configuration drift can cause inconsistencies, errors, and security issues in the infrastructure environment. IaC helps to prevent and detect configuration drift by storing the infrastructure configuration code in a version control system and applying it consistently across all environments. IaC also enables the use of automated testing and validation tools to verify the compliance and functionality of the infrastructure resources. By using IaC, DevOps teams can ensure that the infrastructure is always in a known and reproducible state, and that any changes are documented and traceable. References: 1: https://technology.gov.capital/infrastructure-as-code-iac/ 2: https://aws.amazon.com/what-is/iac/ 3: https://learn.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code : https://www.comptia.org/training/books/cloud-essentials-clo-002-study-guide, Chapter 5, page 179-180

An audit policy is a set of rules and guidelines that define how to monitor and record the activities and events that occur on a system or network1. An audit policy can help track and report the actions of users, applications, processes, or devices, and provide evidence of compliance, security, or performance issues. An audit policy can also help deter unauthorized or malicious activities, as the users know that their actions are being logged and reviewed.

A cloud administrator who configures a server to insert an entry into a log file whenever an administrator logs in to the server remotely is using an audit policy, as they are enabling the collection and recording of a specific event that relates to the access and management of the server. The log file can then be used to verify the identity, time, and frequency of the administrator logins, and to detect any anomalies or suspicious activities.

An authorization policy is a set of rules and guidelines that define what actions or resources a user or a system can access or perform2. An authorization policy can help enforce the principle of least privilege, which means that users or systems are only granted the minimum level of access or permissions they need to perform their tasks. An authorization policy can also help prevent unauthorized or malicious activities, as the users or systems are restricted from accessing or performing actions that are not allowed or necessary.

A hardening policy is a set of rules and guidelines that define how to reduce the attack surface and vulnerability of a system or network3. A hardening policy can help improve the security and resilience of a system or network, by applying various measures such as disabling unnecessary services, removing default accounts, applying patches and updates, configuring firewalls and antivirus software, etc. A hardening policy can also help prevent unauthorized or malicious activities, as the users or systems are faced with more obstacles and challenges to compromise the system or network.

An access policy is a set of rules and guidelines that define who or what can access a system or network, and under what conditions or circumstances4. An access policy can help control the authentication and identification of users or systems, and the verification and validation of their credentials. An access policy can also help prevent unauthorized or malicious activities, as the users or systems are required to prove their identity and legitimacy before accessing the system or network. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 6: Cloud Service Management, pages 229-230.

 Data sovereignty is the concept that best represents the requirement for keeping intellectual property within a country’s borders. Data sovereignty refers to the idea that data is subject to the laws and governance of the country in which it is stored or processed. Data sovereignty can have implications for data privacy, security, compliance, and access, as different countries may have different regulations, standards, or policies regarding data protection, ownership, or transfer.Data sovereignty can also affect the choice of cloud providers, as some cloud providers may store or process data in multiple locations across the world, which may not comply with the data sovereignty requirements of the customer or the country. Therefore, customers who need to ensure data sovereignty should carefully review the terms and conditions of the cloud provider, and choose the one that offers the appropriate data location, encryption, or isolation options12

Lift and shift is a cloud migration approach that involves moving applications to the cloud as-is, without making any major changes to the application code or architecture. This approach is suitable for legacy applications that depend on specific databases or platforms that are no longer supported or available on-premise. Lift and shift can help reduce the cost and complexity of migration, while preserving the functionality and performance of the applications. However, lift and shift may not take full advantage of the cloud features and benefits, such as scalability, elasticity, and automation. Therefore, some applications may require further optimization or refactoring after the initial migration.

 The highest utilization is represented by the application server as it has the highest percentage of used space to allocated space. The application server has used 188GB out of 100GB allocated space, which is 188% utilization. The mail server has used 55GB out of 80GB allocated space, which is 68.75% utilization. The file server has used 70GB out of 90GB allocated space, which is 77.78% utilization. The web server has used 105GB out of 130GB allocated space, which is 80.77% utilization. References: https://www.comptia.org/training/books/cloud-essentials-clo-002-study-guide