CLF-C02 Practice Test 11 — 15 Questions

Question 1

A company has a web application that processes customer orders. The frontend web servers run on Amazon EC2 instances and receive order requests from users. The backend order processing system runs on a separate fleet of EC2 instances. The company wants to decouple these two tiers so that order requests are stored reliably until the backend is ready to process them. The solution must handle occasional traffic spikes without losing any messages and must allow the backend to scale independently. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS reliably stores messages in a queue until the backend order processing system retrieves and processes them, ensuring no messages are lost even during traffic spikes. The backend can independently scale based on the queue depth, and SQS offers at-least-once delivery and exactly-once processing with FIFO queues if needed.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 2

A company archives compliance records that must be retained for 7 years but will almost never be accessed. They need the absolute lowest storage cost with retrieval times of several hours being acceptable. Which S3 storage class should they use?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is designed for long-term retention of data that is accessed rarely, with retrieval times of 12 hours or more, making it the lowest-cost S3 storage class. For compliance records that must be retained for 7 years and almost never accessed, with acceptable retrieval times of several hours, this class provides the absolute minimum storage cost while meeting the retrieval time requirement.

Answer

S3 Glacier Instant Retrieval

Answer

S3 Standard-IA

Answer

S3 Glacier Flexible Retrieval

Question 3

A company has a strict data residency policy that requires all customer data to remain stored on-premises at all times. However, the company experiences unpredictable spikes in compute demand and wants to use an AWS cloud environment to handle this additional workload during peak periods. The company needs a solution that allows them to seamlessly run applications across their on-premises infrastructure and AWS, using consistent management tools and APIs. The company also needs a dedicated, private network connection between the two environments for low latency and security. Which cloud deployment model best describes this architecture?

Accepted Answer

Hybrid cloud. Option C is correct because the architecture described combines on-premises infrastructure with AWS cloud resources, connected via a dedicated private network (likely AWS Direct Connect or VPN), while using consistent management tools and APIs. This is the defining characteristic of a hybrid cloud model, which enables workload portability and unified operations across both environments.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 4

A company has been running multiple workloads on AWS for several months. The finance team notices that monthly costs have increased significantly but cannot identify which services or linked accounts are driving the increase. The team needs a tool that provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies the top cost contributors. They also need to create custom reports that can be emailed on a weekly schedule. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies top cost contributors. It also supports creating custom reports that can be scheduled and emailed weekly, directly meeting all the stated requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 5

A company has been running multiple workloads on AWS for the past six months. The finance team needs to analyze historical spending to identify month-over-month trends by AWS service and by individual linked accounts. The team requires a graphical, interactive tool that allows them to apply custom date ranges and filters, and view the results as customizable charts and graphs. Which AWS service should the finance team use to meet this requirement?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a graphical interface with pre-built charts and graphs that allow users to visualize historical spending trends. It supports filtering by AWS service and linked accounts, and enables custom date ranges for month-over-month analysis, making it the correct choice for the finance team's requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 6

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

Accepted Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.. Option A is correct because it uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

Answer

Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

Question 7

A company has multiple AWS accounts used by different departments (Finance, Marketing, Engineering). The finance team wants to see a single monthly bill that aggregates charges from all accounts. Additionally, they want to track costs by department using custom cost allocation tags that each department applies to its resources. Which AWS feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows the company to aggregate charges from all member accounts into a single monthly bill for the finance team. Additionally, it enables the use of cost allocation tags, including custom tags applied by each department, to track and filter costs by department in AWS Cost Explorer and cost reports.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Cost Explorer

Question 8

A company ingests sensor data from IoT devices into an Amazon S3 bucket. The data is accessed frequently for the first 30 days, but after that, it is rarely queried. The company’s compliance policy requires all data to be retained for 7 years. The company wants to minimize storage costs by automatically moving data to more cost-effective storage classes as it ages, without any manual intervention. Which Amazon S3 feature should the company configure to meet these requirements?

Accepted Answer

S3 Lifecycle policy. An S3 Lifecycle policy automates the transition of objects between storage classes based on age. By configuring a lifecycle rule to move objects to S3 Standard-IA or S3 One Zone-IA after 30 days, and then to S3 Glacier Deep Archive after a longer period, the company can meet the 7-year retention requirement while minimizing costs without manual intervention.

Answer

S3 Object Lock

Answer

S3 Replication

Answer

S3 Transfer Acceleration

Question 9

A media company stores video files in Amazon S3 and needs to transcode them into multiple formats for different devices. Which AWS service is purpose-built for this workflow?

Accepted Answer

Amazon Elastic Transcoder. Amazon Elastic Transcoder is a purpose-built media transcoding service that converts video files stored in Amazon S3 into the formats required by various devices. It handles the complexities of transcoding, including format conversion, resolution scaling, and bitrate adjustment, without requiring you to manage underlying infrastructure.

Answer

Amazon Kinesis Video Streams

Answer

AWS Lambda

Answer

Amazon Rekognition

Question 10

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 11

A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, compliance auditing, and historical recording of configuration changes for AWS resources. It allows you to define rules (e.g., 's3-bucket-public-read-prohibited' and 'restricted-ssh') that automatically evaluate your S3 bucket policies and EC2 security group rules against your security policies, and it offers a compliance dashboard showing pass/fail status for each resource. AWS Config also maintains a configuration history that can be used for auditing and troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 12

Which AWS Cost Management tool provides daily forecasts and allows customers to track Reserved Instance and Savings Plans utilization and coverage?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides daily cost and usage forecasts for up to 12 months ahead and includes dedicated views for Reserved Instance (RI) and Savings Plans utilization and coverage. This allows customers to monitor how much of their reserved capacity is being used and whether their commitments are adequately covering actual usage.

Answer

AWS Pricing Calculator

Answer

AWS Cost and Usage Report

Answer

AWS Budgets

Question 13

A company has been running multiple workloads on AWS for over six months. The finance team needs to gain visibility into historical cost and usage data, identify which services are driving the most spend, forecast future monthly costs, and receive recommendations for purchasing Reserved Instances to achieve the highest savings. The team wants to use a native AWS tool that provides this functionality without requiring any third-party software. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a native interface for visualizing historical cost and usage data, identifying top spend drivers, forecasting future costs up to 12 months, and generating Reserved Instance (RI) purchase recommendations based on actual usage patterns. It meets all the finance team's requirements without any third-party software.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Question 14

A company has multiple departments (HR, Finance, Engineering) sharing a single AWS account. Each department tags its resources with a 'Department' tag (e.g., Department:HR). The finance team wants to set monthly spending limits for each department and receive email alerts when a department's spending reaches 80% of its limit. They also want a visual dashboard to compare actual spending against the budgeted amounts. Which combination of AWS services should the finance team use?

Accepted Answer

AWS Budgets and AWS Cost Explorer. AWS Budgets allows the finance team to set monthly spending limits per department (using the 'Department' tag) and configure alerts at 80% of the budget. AWS Cost Explorer provides a visual dashboard to compare actual spending against budgeted amounts, enabling trend analysis and cost allocation tracking. Together, they fulfill both the alerting and visualization requirements.

Answer

AWS Cost Explorer and AWS Trusted Advisor

Answer

AWS Budgets and Amazon QuickSight

Answer

AWS Pricing Calculator and AWS Cost Explorer

Question 15

Which AWS service provides a domain name system (DNS) that routes end-user requests to AWS infrastructure and external resources?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to route end-user requests to AWS infrastructure (such as EC2 instances, ELBs, and S3 buckets) and to external resources by translating human-readable domain names into IP addresses. This directly matches the question's requirement for a DNS-based routing service.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Answer

Elastic Load Balancing