CLO-002 CompTIA Cloud Essentials+ Free Practice Exam Questions (2025 Updated)

Infrastructure as code (IaC) is a DevOps practice that uses code to define and deploy infrastructure, such as networks, virtual machines, load balancers, and connection topologies1. IaC ensures consistency, repeatability, and scalability of the infrastructure, as well as enables automation and orchestration of the provisioning process2. IaC is different from infrastructure templates, which are predefined configurations that can be reused for multiple deployments3. Infrastructure orchestration is the process of coordinating multiple automation tasks to achieve a desired state of the infrastructure4. Infrastructure automation is the broader term for any technique that uses technology to perform infrastructure tasks without human intervention5.

According to the CompTIA Cloud Essentials+ CLO-002 Study Guide, there are four common risk response types: avoid, share or transfer, mitigate, and accept1. These are the appropriate responses to risks, depending on the risk type, assessment, and attitude. The other options are incorrect because they include terms that are not valid risk responses. For example, migrate is not a risk response, but a cloud deployment strategy. Validate is not a risk response, but a quality assurance technique. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 4: Cloud Security, Section 4.2: Cloud Security Concepts, Page 153.

Containerization is a software deployment process that bundles an application’s code with all the files and libraries it needs to run on any infrastructure. Containerization does not include an underlying operating system that would require patching and management, as containers share the host operating system kernel and run in isolated user spaces. Containerization allows applications to run consistently and portably on any platform or cloud, regardless of the differences in operating systems, hardware, or configurations. Containerization also enables faster and easier deployment, scalability, and fault tolerance of applications. Therefore, containerization would best meet the need of a vendor who wants to distribute a cloud management application in a format that can be used on both public and private clouds.

The other options are not relevant to the question. Federation is a process of integrating multiple cloud services or providers to create a unified cloud environment. Collaboration is a process of working together on a shared project or goal using cloud-based tools and platforms. Microservices are a software architecture style that breaks down a complex application into smaller, independent, and loosely coupled services that communicate through APIs. Microservices can be implemented using containers, but they are not a software deployment format. Therefore, the correct answer is A. Containerization.

Multifactor authentication (MFA) is a method of verifying a user’s identity by requiring more than one factor, such as something the user knows, something the user has, or something the user is1. A short message service (SMS) message sent to a phone and an access PIN is an example of MFA, as it combines two factors: something the user has (the phone) and something the user knows (the PIN). This makes the authentication process more secure than using only a password, which is a single factor. Other examples of MFA include using a biometric scan (such as a fingerprint or a face recognition) and a password, or using a hardware token (such as a smart card or a USB key) and a password1. References: 1: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3: Cloud Planning, Section 3.2: Cloud Adoption, Subsection 3.2.1: Identity and Access Management

Orchestration is the process of coordinating multiple automated tasks to create a dynamic and complex workflow1. Orchestration can simplify and streamline the management of cloud resources and services by integrating different scripts, tools, and platforms2. Creating a new script to coordinate all of the existing scripts into one is an example of orchestration, as it involves managing multiple automated tasks to accomplish a larger goal, such as provisioning a virtual machine and updating a change management database. Automation, on the other hand, refers to automating a single task or a small number of related tasks, such as obtaining an IP or populating information in a database1. Automation does not require coordination or decision-making, unlike orchestration. Collaboration and federation are not related to the question, as they refer to the interaction and integration of different cloud providers or users, not the automation or orchestration of cloud tasks3. References: Orchestration vs Automation: The Main Differences - phoenixNAP; Cloud Automation vs Cloud Orchestration: Understanding the Differences; CompTIA Cloud Essentials+ CLO-002 Study Guide, Chapter 3: Cloud Computing Concepts, pages 85-86.

 The SLA should include the Recovery Time Objective (RTO) to satisfy this requirement. The RTO is the maximum acceptable time that an application or service can be unavailable after a disaster or disruption. It defines the target duration for restoring the functionality and performance of the application or service. The RTO is usually measured in hours or days, depending on the criticality of the application or service. In this case, the requirement states that the application must be restored within six hours, which means that the RTO should be six hours or less. The other options are not relevant to this requirement. The Mean Time to Repair (MTTR) is the average time that it takes to fix a faulty component or system. The Recovery Point Objective (RPO) is the maximum acceptable amount of data loss that can occur after a disaster or disruption. It defines the point in time to which the data must be restored. The RPO is usually measured in minutes or hours, depending on the frequency of data backups. The Return on Investment (ROI) is the ratio of the net profit to the initial cost of an investment. It measures the financial benefit of an investment over time. References: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3: Business Principles of Cloud Environments, Section 3.2: Cloud Assessments, p. 103-104.

 A proof of value (POV) is a method of testing a cloud solution before fully adopting it, to ensure that it meets the company’s operations and business processes. A POV can help a company avoid failure of a cloud project by validating the feasibility, functionality, and benefits of the cloud solution, and identifying any gaps or issues that need to be resolved. A POV can also help acompany compare different cloud solutions and select the best one for their needs. A POV is different from a proof of concept (POC), which is a more technical demonstration of the cloud solution’s capabilities and performance. References: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3: Cloud Planning, Section 3.2: Cloud Adoption, Subsection 3.2.2: Proof of Value1

 A feasibility assessment is a process of evaluating the viability and suitability of moving an on-premises application to the cloud. A feasibility assessment can help identify the benefits, risks, costs, and challenges of cloud migration, as well as the technical and business requirements, constraints, and dependencies of the application. A feasibility assessment can also help compare different cloud service models, deployment models, and providers, and recommend the best option for the application. A feasibility assessment would be the best way to review the options for moving a business-critical application to the cloud.

A gap analysis is a process of identifying the differences between the current and desired state of a system or process. A gap analysis can help determine the gaps in performance, functionality, security, or compliance of an on-premises application and a cloud-based application, and suggest the actions needed to close the gaps. A gap analysis is usually performed after a feasibility assessment, when the cloud migration option has been selected, and before the transition planning phase.

A test is a process of verifying the functionality, performance, security, or compatibility of an application or system. A test can help detect and resolve any errors, bugs, or issues in the application or system, and ensure that it meets the expected standards and specifications. A test can be performed in a sandbox environment, which is an isolated and controlled environment that mimics the real production environment. A test is usually performed during or after the cloud migration process, when the application has been deployed or migrated to the cloud, and before the final release or launch.

A high-level architecture is a conceptual or logical design of an application or system that shows the main components, functions, relationships, and interactions of the application or system. A high-level architecture can help visualize and communicate the structure, behavior, and goals of the application or system, and guide the development and implementation process. A high-level architecture is usually created during the design phase of the cloud migration process, after the feasibility assessment and the gap analysis, and before the development and testing phase. References: CompTIA Cloud Essentials+ CLO-002 Study Guide, page 109-110, 113-114, 117-118, 121-122; CompTIA Cloud Essentials+ Certification Training, CertMaster Learn for Cloud Essentials+, Module 3: Cloud Solutions, Lesson 3.2: Cloud Migration, Topic 3.2.1: Cloud Migration Process

Spot instances are cloud resources that are available at a lower price than on-demand instances, but can be terminated by the cloud provider at any time based on supply and demand. Therefore, the application that will run on these instances needs to handle unpredictable instance termination, such as by saving state information, implementing fault tolerance, or using checkpoints12.

The other options are not directly related to the use of spot instances. The application may or may not need to store data in a database, depending on its functionality and design. There is no inherent restriction for distributed network communications when using spot instances, as long as the application can handle network latency and bandwidth issues. Resource-intensive compute loads are not forbidden, but they may increase the likelihood of instance termination, as the cloud provider may reclaim the resources for higher-paying customers.

A disaster recovery strategy is a plan that defines how an organization can recover its data, systems, and operations in the event of a disaster, such as a natural calamity, a cyberattack, or a human error. A disaster recovery strategy should include the following elements12:

Backups: Backups are copies of data and files that are stored in a separate location from the original source. Backups help to restore the data in case of loss, corruption, or deletion. Backups can be performed manually or automatically, and can be stored on-premises, off-site, or in the cloud. Backups should be encrypted, secured, and tested regularly to ensure their integrity and availability3.

Replication: Replication is the process of copying and synchronizing data and systems across multiple locations or platforms. Replication helps to maintain the consistency and availability of the data and systems in case of a failure or outage. Replication can be done at different levels, such as storage, database, application, or virtual machine. Replication can be synchronous or asynchronous, depending on the latency and bandwidth requirements4.

Geo-redundancy: Geo-redundancy is a feature that allows the distribution and replication of data and systems across multiple geographic regions or zones. Geo-redundancy helps to ensure the resiliency and continuity of the data and systems in case of a regional disaster or disruption. Geo-redundancy can also improve the performance and latency of the data and systems by serving the requests from the nearest location. Geo-redundancy can be achieved by using cloud services that offer multi-region or multi-zone capabilities5 .

Audit and system logs are the best resource to use to start the investigation of an email phishing campaign against a company’s email server. Audit and system logs are records of events and activities that occur on a system or a network, such as user login, file access, configuration changes, or network traffic. Audit and system logs can help an incident response team to identify the source, scope, and impact of the phishing attack, as well as to collect evidence, trace the attack steps, and determine the root cause. Audit and system logs can also help the incident response team to evaluate the security posture and controls of the email server, and to recommend remediation and mitigation actions12

Multifactor authentication is a security method that requires users to provide more than one piece of evidence to verify their identity before accessing a cloud service. For example, users may need to enter a password, a code sent to their phone or email, a biometric scan, or a physical token. Multifactor authentication can enhance the security of a cloud service that can be accessed from anywhere, as it can prevent unauthorized access even if the password is compromised or stolen. Multifactor authentication can also protect the cloud service from phishing, brute force, or replay attacks, as well as comply with regulatory or industry standards.

Multifactor authentication is different from other options, such as replication, single sign-on, or data locality. Replication is the process of copying data or resources across multiple locations, such as regions, zones, or data centers, to improve availability, performance, or backup. Single sign-on is a user authentication method that allows users to access multiple cloud services with one set of credentials, such as username and password. Data locality is the principle of storing data close to where it is used, such as in the same region, country, or jurisdiction, to improve performance, security, or compliance. While these options may also have some benefits for a cloud service that can be accessed from anywhere, they do not directly address the security concern, which is the focus of the question. References: What is MFA? - Multi-Factor Authentication and 2FA Explained - AWS, Multi-Factor Authentication (MFA) for IAM - aws.amazon.com, Multi-Factor Authentication & Single Sign-On | Duo Security

A risk assessment is a process of identifying, analyzing, and controlling hazards and risks within a situation or a place1. According to the CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), a risk assessment should include the following steps2:

Identify the assets that are relevant to the scope of the assessment. Assets can be physical, such as hardware and software, or non-physical, such as data and information.

Identify the threats and vulnerabilities that could affect the assets. Threats are sources of potential harm, such as natural disasters, cyberattacks, or human errors. Vulnerabilities areweaknesses or gaps in the security or protection of the assets, such as outdated software, misconfigured settings, or lack of encryption.

Analyze the likelihood and impact of each threat-vulnerability pair. Likelihood is the probability of a threat exploiting a vulnerability, and impact is the severity of the consequences if that happens. The combination of likelihood and impact determines the level of risk for each pair.

Evaluate the risks and prioritize them based on their level. Risks can be categorized as low, medium, high, or critical, depending on the organization’s risk appetite and tolerance. Risk appetite is the amount of risk that the organization is willing to accept, and risk tolerance is the degree of variation from the risk appetite that the organization can endure.

Implement appropriate controls to mitigate or reduce the risks. Controls are measures or actions that can prevent, detect, or correct the occurrence or impact of a risk. Controls can be administrative, technical, or physical, and they can have different functions, such as preventive, detective, corrective, deterrent, or compensating.

Based on these steps, two components that should be included in the draft of a risk assessment are asset inventory and data classification. Asset inventory is the process of identifying and documenting the assets that are within the scope of the assessment1. Data classification is the process of categorizing data based on its sensitivity, value, and criticality to the organization3. These components are essential for determining the potential risks and impacts that could affect the assets and data, and for applying the appropriate controls and protection levels.

https://www.comptia.org/training/books/cloud-essentials-clo-002-study-guide

https://books.google.com/books/about/CompTIA_Cloud_Essentials+_Certification.html?id=S2TNDwAAQBAJ

A content delivery network (CDN) is a technology that distributes web content across multiple servers in different geographic locations to improve user experience11. A CDN can be used to deploy web applications and files globally, so that users can access them faster and more reliably from their nearest server12. A CDN also reduces bandwidth consumption and network congestion by caching static content at the edge servers13.

A service level agreement (SLA) is a contract between a cloud service provider (CSP) and a customer that defines the level of service, performance, availability, and responsibilities of both parties1. An SLA may also include the notification process a CSP follows after discovering a breach of customer data, such as the time frame, the communication channels, the content and format of the notification, and the remediation actions2. A communication plan is a document that outlines the objectives, strategies, and tactics for communicating with different stakeholders, but it may not specify the details of the breach notification process3. An incident response policy is a set of guidelines and procedures for responding to security incidents, such as identifying, containing, analyzing, and recovering from them, but it may not be shared with the customer by the CSP4. Access controls are the mechanisms and policies that regulate who can access what resources and data in a cloud environment, but they are not related to the breach notification process5. References:

1: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3, page 75.

2: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3, page 77.

3: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 3, page 79.

4: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 4, page 105.

5: CompTIA Cloud Essentials+ Certification Study Guide, Second Edition (Exam CLO-002), Chapter 4, page 107.

A statement of work (SOW) is a document that outlines the scope of a project, specific deliverables, scheduling, and additional specific details from the client/buyer1. A SOW defines what the service provider will do for the client and how they will do it, as well as the expected outcomes and quality standards2. A SOW is typically used as a supplement to a master service agreement (MSA) or a contract that establishes the general terms and conditions of the business relationship3.

Redundancy is a term that describes the approach of replicating cloud resources in several different geographic locations. Redundancy can increase the availability, reliability, and performance of cloud services by providing backup or alternative resources in case of failures, disasters, or high demand. Redundancy can also reduce latency by serving users from the nearest location. Redundancy can be implemented at different levels, such as data, network, server, or application. For example, a geo-distributed database is a type of redundancy that offers asynchronous replication across two data centers or cloud regions1. Redundancy is different from disaster recovery, deduplication, and data sovereignty, which are other terms related to cloud computing. Disaster recovery is a term that describes the process of restoring normal operations after a disaster or disruption. Disaster recovery can involve using redundant resources, but it is not the same as redundancy. Deduplication is a term that describes the technique of eliminating redundant copies of data from a storage device, which can reduce the storage space required and improve the efficiency of the storage system. Deduplication does not involve replicating cloud resources in different locations, but rather consolidating and removing duplicates. Data sovereignty is a term that describes the legal and regulatory aspects of data storage and processing in different geographic locations. Data sovereignty can affect the choiceof cloud regions and providers, as some countries or regions may have specific laws or regulations that govern the access, transfer, and protection of data. Data sovereignty does not imply redundancy, but rather compliance. Therefore, the correct term for replicating cloud resources in several different geographic locations is redundancy. References: Geography and regions | Documentation | Google Cloud, What is Database Geo-Distribution? - Yugabyte, Georedundancy: geographical redundancy | Stackscale.

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules1. A firewall can block or allow connection requests to cloud resources based on the source, destination, port, protocol, or content of the packets2. A firewall can be deployed as a hardware appliance, a software application, or a cloud service3.

 Disposable resources are cloud resources that are not needed for the long-term operation of an application or service, and can be easily created and deleted on-demand. Examples of disposable resources include temporary storage, spot instances, and disposable virtual machines. Disposable resources can help to reduce costs and improve flexibility, but they also incur charges when they are in use or attached to other resources. Therefore, when a company decommissioned its testing environment, it should detach and delete disposable resources first to avoid charges12

Emptying the logging directory is not the best option to avoid charges, because logging directory is a folder that stores the records of events and activities that occur in an application or service. Logging directory can help to monitor and troubleshoot the performance and issues of the application or service, but it does not directly affect the charges of the cloud resources. Emptyingthe logging directory may also result in the loss of valuable information and insights that can be used for future improvement or analysis.

Deleting infrastructure as code templates is not the best option to avoid charges, because infrastructure as code templates are files that define and configure the cloud resources using code or scripts. Infrastructure as code templates can help to automate and standardize the deployment and management of the cloud resources, but they do not directly affect the charges of the cloud resources. Deleting infrastructure as code templates may also make it harder to recreate or modify the cloud resources in the future.

Disabling alerts and alarms is not the best option to avoid charges, because alerts and alarms are notifications that are triggered by certain conditions or thresholds that are set for the cloud resources. Alerts and alarms can help to notify and respond to the changes or issues of the cloud resources, but they do not directly affect the charges of the cloud resources. Disabling alerts and alarms may also make it difficult to detect and resolve any problems or anomalies that may occur in the cloud resources.