CLF-C02 Practice Test 5 — 10 Questions

Question 1

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce a policy that prevents any user, including the root user, in any member account from disabling the 'Block Public Access' setting on Amazon S3 buckets. The policy must be centrally managed and automatically applied to all existing and future member accounts. Which AWS feature should the security team use?

Accepted Answer

AWS Service Control Policy (SCP). AWS Service Control Policies (SCPs) are the correct choice because they allow central management of permissions across all accounts in an AWS Organization. SCPs can explicitly deny actions like s3:PutBucketPublicAccessBlock at the root, OU, or account level, and they apply to all principals, including the root user, in member accounts. SCPs are automatically inherited by new accounts added to the organization, ensuring consistent enforcement without per-account configuration.

Answer

AWS Identity and Access Management (IAM) policy

Answer

AWS Config rule with automatic remediation

Answer

AWS Trusted Advisor

Question 2

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Answer

Amazon Cognito

Question 3

A new AWS customer wants to explore AWS services for the first time. They launch a t2.micro EC2 instance and use up to 5 GB of Amazon S3 storage. They want to understand if these will incur charges. Which AWS programme provides limited free usage of many services for new accounts during the first 12 months?

Accepted Answer

AWS Free Tier. The AWS Free Tier is designed specifically for new AWS customers, offering limited free usage of select services—including t2.micro EC2 instances and 5 GB of Amazon S3 storage—for the first 12 months after account creation. This program allows users to explore AWS services without incurring charges, as long as they stay within the defined usage limits. The scenario matches the Free Tier's eligibility criteria exactly, making option B correct.

Answer

AWS Enterprise Support

Answer

AWS Credits Programme

Answer

Reserved Instance discount

Question 4

A company wants to migrate 50 virtual machines from their on-premises data centre to AWS as quickly as possible to reduce data centre costs. They plan to move the VMs without making any changes to the applications. Which cloud migration strategy does this represent?

Accepted Answer

Rehost. Option C (Rehost) is correct because the company is migrating 50 virtual machines to AWS without making any changes to the applications, which is the defining characteristic of a 'lift and shift' migration. This strategy involves moving the VMs as-is, typically using AWS Server Migration Service (SMS) or AWS Application Migration Service (AWS MGN), to quickly reduce on-premises data center costs without application refactoring.

Answer

Refactor

Answer

Replatform

Answer

Retire

Question 5

A company used to spend $2 million upfront purchasing servers and building a data centre before launching a new product. With AWS, they provision resources as needed and pay monthly based on actual usage. Which cloud benefit does this represent?

Accepted Answer

Trade capital expense for variable expense. This scenario describes shifting from a large upfront capital expenditure (CapEx) on servers and data centers to a variable operational expenditure (OpEx) based on actual usage. AWS's pay-as-you-go model directly enables this trade, allowing the company to align costs with consumption rather than paying for idle capacity. This is the core benefit of trading capital expense for variable expense.

Answer

Stop guessing about capacity

Answer

Benefit from economies of scale

Answer

Increase speed and agility

Question 6

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they allow AWS Organizations to centrally define permission guardrails that apply to all IAM users and roles across member accounts. SCPs can explicitly deny actions like s3:PutBucketPolicy to prevent any account administrator from modifying S3 bucket policies to grant public access, and these restrictions cannot be overridden by any IAM entity within the member account.

Answer

IAM permissions boundaries

Answer

AWS Config conformance packs

Answer

AWS CloudTrail Insights

Question 7

A data science team wants to build, train, and deploy machine learning models without managing the underlying server infrastructure for training and inference. Which AWS service provides a fully managed environment for the machine learning workflow?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is a fully managed service that provides every component needed for the machine learning workflow, including data labeling, model building, training, tuning, and deployment. It eliminates the need to manage underlying server infrastructure for both training and inference by automatically provisioning, scaling, and managing compute resources.

Answer

AWS Lambda

Answer

Amazon EC2 with NVIDIA GPUs

Answer

Amazon Rekognition

Question 8

A company runs a multi-step order fulfilment process that includes payment verification, inventory check, warehouse notification, and shipping label generation. Each step is implemented as a Lambda function. They need a service to coordinate these steps, handle retries on failure, and visualise workflow state. Which AWS service should they use?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services, including Lambda functions, into a visual workflow. It natively supports sequential execution, parallel branches, retries on failure, and state visualization, making it the ideal choice for a multi-step order fulfillment process.

Answer

Amazon SQS

Answer

Amazon EventBridge

Answer

Amazon SNS

Question 9

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF rules

Answer

VPC route tables

Question 10

A company wants to purchase and deploy a third-party security software solution (a firewall appliance) directly to their AWS environment, with licensing costs added to their AWS monthly bill. Where can they find and subscribe to this software?

Accepted Answer

AWS Marketplace. AWS Marketplace is the correct place to find, subscribe to, and purchase third-party software solutions like a firewall appliance. It allows you to launch the software directly into your AWS environment and have the licensing costs added to your monthly AWS bill through consolidated billing.

Answer

AWS Service Catalog

Answer

AWS Partner Network

Answer

AWS Trusted Advisor