CLF-C02 Practice Test 11 — 15 Questions

Question 1

A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The application must comply with a security standard that requires encryption in transit for all web traffic. The company needs a service to centrally manage SSL/TLS certificates, automatically renew them, and deploy them to the ALB without manual intervention. Which AWS service should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provides centralized management of SSL/TLS certificates, supports automatic renewal for certificates issued by ACM, and can seamlessly deploy these certificates to an Application Load Balancer (ALB) without any manual intervention. This directly meets the requirement for encryption in transit and compliance with the security standard.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 2

A company is launching a new application and expects user demand to grow gradually over the next 12 months. To control upfront costs, the company plans to start with a small number of Amazon EC2 instances and manually add more instances each month as the user base increases. The operations team will monitor usage and adjust capacity based on observed trends. Which cloud computing concept does this approach BEST illustrate?

Accepted Answer

Scalability. The scenario describes manually adding EC2 instances over time to match growing demand, which is a classic example of scalability—the ability to increase or decrease resources to handle changing workloads. Scalability focuses on planned capacity adjustments, whereas elasticity involves automatic, real-time scaling in response to demand fluctuations. Here, the manual, monthly additions based on observed trends align with scalability, not the automated provisioning that defines elasticity.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 3

A company uses AWS Organizations to manage multiple accounts. The operations team runs hundreds of Amazon EC2 instances across these accounts for various applications. The security team requires that all EC2 instances be patched with the latest security updates within 7 days of release. Currently, the operations team manually applies patches by logging into each account and using Systems Manager Patch Manager individually. The team wants to centralize patch compliance management so that a single operations team can define patch baselines, schedule patching, and view compliance status across all accounts from a single pane of glass, without needing to switch between accounts. Which AWS service or feature should the team use to meet these requirements?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is the correct choice because it allows the operations team to centrally define patch baselines, schedule patching across multiple AWS accounts, and view compliance status from a single pane of glass using AWS Systems Manager Quick Setup or multi-account management features. By integrating with AWS Organizations, Patch Manager can target EC2 instances across all accounts without requiring the team to switch between accounts, meeting the requirement for centralized patch compliance management.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 4

A development team wants to deploy a Python web application to AWS without managing load balancers, auto scaling groups, or the underlying EC2 instance operating systems. They want to upload their code and have AWS handle the infrastructure. Which cloud service model does this represent?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a managed platform where developers can upload code and AWS handles the underlying infrastructure, including load balancing, auto scaling, and OS patching. AWS Elastic Beanstalk is a PaaS service that abstracts EC2 instances, load balancers, and auto scaling groups, allowing the team to focus solely on their Python web application code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Serverless

Question 5

A company runs a nightly batch processing job on AWS that takes exactly 2 hours to complete. The company uses a fixed set of Amazon EC2 instances for the job. AWS automatically tracks the number of instance-hours consumed each month and bills the company precisely for that usage. The company does not need to sign a long-term contract or pay for idle resources. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Measured service. The scenario describes AWS automatically tracking and billing precisely for the number of instance-hours consumed each month, without requiring a long-term contract or payment for idle resources. This directly illustrates the 'measured service' characteristic, where cloud resource usage is metered, monitored, and reported transparently, enabling pay-as-you-go billing. The fixed 2-hour nightly job and exact billing per instance-hour confirm that usage is measured and charged accordingly.

Answer

Resource pooling

Answer

Rapid elasticity

Answer

Broad network access

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a consistent set of security group rules across all accounts. For example, they want to ensure that no security group in any account allows inbound SSH (port 22) from the internet (0.0.0.0/0). If a non-compliant security group is created, the service should automatically remediate by removing the offending rule or by applying a corrective policy. The company wants a managed AWS service that centrally applies these rules and requires no custom scripting. Which AWS service should the security team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized, managed way to apply security group rules across all accounts in an AWS Organization. It can automatically detect non-compliant security groups (e.g., those allowing SSH from 0.0.0.0/0) and remediate them by removing the offending rule or applying a corrective policy, all without custom scripting.

Answer

AWS Config

Answer

AWS Organizations

Answer

AWS Shield Advanced

Question 7

A company uses multiple AWS accounts managed through AWS Organizations. The finance team wants to see a consolidated view of all costs across accounts, and also wants to filter costs by specific projects using custom tags that are applied to resources. The team has already created tag keys and applied them to resources in all accounts. What additional step must the team take in the Management Account to ensure these tags appear as cost allocation dimensions in AWS Cost Explorer?

Accepted Answer

Activate the tag keys for cost allocation tracking.. In AWS Organizations, custom tags must be explicitly activated for cost allocation tracking in the Management Account's Billing and Cost Management console. Without this activation, the tags exist on resources but are not recognized as cost allocation dimensions in AWS Cost Explorer, so the finance team cannot filter costs by those tags. Activating the tag keys enables Cost Explorer to ingest the tag key-value pairs and present them as filtering dimensions in cost reports.

Answer

Enable the AWS Cost Explorer default reports.

Answer

Create a budget using AWS Budgets with the tag filters.

Answer

Configure the AWS Support plan to include cost analysis.

Question 8

A gaming company launches a new online multiplayer game. During peak hours (evenings and weekends), the player count spikes dramatically, requiring dozens of Amazon EC2 instances to handle the load. During off-peak hours, the player count drops to near zero. The company configures an Amazon EC2 Auto Scaling group that automatically adds instances when CPU utilization exceeds 70% and removes instances when utilization drops below 30%. Which characteristic of cloud computing does this configuration best demonstrate?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the Auto Scaling group dynamically adds EC2 instances when CPU utilization exceeds 70% and removes them when it drops below 30%, directly matching the fluctuating player load. This demonstrates elasticity because resources are provisioned and de-provisioned in real-time to match the exact workload, minimizing cost during low usage and ensuring performance during spikes.

Answer

High availability

Answer

Fault tolerance

Answer

Global reach

Question 9

A company is building a web application that requires a fully managed NoSQL database with single-digit millisecond latency at any scale. The application will experience unpredictable traffic spikes, and the database must automatically scale throughput capacity up and down without manual intervention. The developers want to focus on application code rather than database management tasks. Which AWS database service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports automatic scaling of read/write throughput capacity via Auto Scaling policies, eliminating the need for manual intervention. This makes it ideal for web applications with unpredictable traffic spikes, as it offloads all database management tasks to AWS.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 10

A company needs to run a data processing job that typically takes 2 hours to complete. The job is stateless and can be parallelized across multiple workers. The company wants to minimize operational overhead and only pay for the compute time consumed. The job runs only once a month. Which AWS compute service should the company use?

Accepted Answer

AWS Batch. AWS Batch is the correct choice because it is designed for running batch computing workloads that are stateless, parallelizable, and can run on a schedule. It automatically provisions and manages the underlying compute resources (EC2 or Fargate), scales to the required number of workers, and only charges for the compute time consumed. The 2-hour, once-a-month job fits perfectly within AWS Batch's capabilities, and it minimizes operational overhead by handling job queuing, retries, and dependency management.

Answer

AWS Lambda

Answer

Amazon EC2 Spot Instances

Answer

AWS Fargate

Question 11

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 12

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 13

A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and records AWS resource configurations, evaluates them against custom rules (like 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'), and provides a compliance dashboard that shows historical compliance status over time. It directly addresses the need for automated, ongoing evaluation of resource configurations against internal security policies.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 14

AWS can offer lower pay-as-you-go pricing than a single company could achieve operating its own data centre because AWS aggregates usage from hundreds of thousands of customers. Which cloud computing benefit does this describe?

Accepted Answer

Benefit from massive economies of scale. The scenario describes AWS aggregating usage from hundreds of thousands of customers to achieve lower per-unit costs than a single company could achieve operating its own data center. This is the direct definition of economies of scale, where the massive scale of AWS's infrastructure (e.g., purchasing power for hardware, optimized data center design) reduces the average cost per customer, enabling lower pay-as-you-go pricing.

Answer

Trade capital expense for variable expense

Answer

Increase speed and agility

Answer

Go global in minutes

Question 15

A company runs an e-commerce website on Amazon EC2 instances. The website experiences unpredictable traffic spikes during flash sales and returns to normal traffic levels afterward. To handle this, the company configures an Auto Scaling group that adds EC2 instances when the average CPU utilization exceeds 70% and removes instances when it drops below 30%. Which essential characteristic of cloud computing does this configuration primarily demonstrate?

Accepted Answer

Elasticity. This configuration demonstrates elasticity because it automatically scales EC2 instances up during flash sales (when CPU exceeds 70%) and scales them down when traffic normalizes (CPU below 30%). Elasticity is the ability to dynamically provision and de-provision resources to match demand, which is exactly what Auto Scaling groups with CPU utilization thresholds achieve.

Answer

High availability

Answer

Fault tolerance

Answer

Durability