CLF-C02 Practice Test 12 — 15 Questions

Question 1

A company uses AWS Organizations with consolidated billing across multiple member accounts. The finance team requires that only the management account (payer account) can view and modify payment methods and receive invoices. Member accounts must be prevented from accessing billing and payment information in the AWS Billing and Cost Management console. Which AWS feature should be configured to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a Service Control Policy (SCP) to deny billing-related actions for all member accounts.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict the AWS services and actions that member accounts can use. By applying an SCP that denies billing-related actions (e.g., `aws-portal:*` or `awsbilling:*`) to all member accounts, the management account can enforce that only the payer account can view and modify payment methods and receive invoices. This directly meets the requirement without affecting the management account, which is not subject to SCPs.

Answer

Enable all features in AWS Organizations, including consolidated billing.

Answer

Enable AWS CloudTrail to log billing events for all accounts.

Answer

Configure AWS Cost Explorer to grant cross-account access only to the management account.

Question 2

A media company runs a website that serves video content globally. Users request video previews, which require the generation of thumbnail images on-the-fly. The company wants to generate these thumbnails at AWS edge locations so that the processing occurs close to users, reducing latency and offloading the origin servers. The solution must run custom code in response to CloudFront events without provisioning any servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Lambda@Edge. AWS Lambda@Edge is the correct service because it allows you to run custom code in response to CloudFront events (such as viewer request, origin request, viewer response, and origin response) at AWS edge locations, enabling on-the-fly thumbnail generation close to users without provisioning any servers. This reduces latency and offloads origin servers, meeting the requirement for serverless edge processing.

Answer

AWS Lambda

Answer

Amazon EC2 instances in an Auto Scaling group

Answer

Amazon ElastiCache

Question 3

A company runs a multi-tier web application on Amazon EC2 instances across multiple Availability Zones. The application has separate backend services for serving images and handling API requests, each running on different sets of EC2 instances. The company needs a load balancer that can inspect incoming HTTP/HTTPS requests and route them to the correct target group based on the URL path (e.g., /images to one group, /api to another). The solution must also offload SSL/TLS termination and perform health checks on the instances. Which AWS service should the company use?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model, allowing it to inspect HTTP/HTTPS headers and route traffic based on URL path patterns (e.g., /images vs /api). It natively supports SSL/TLS termination and can perform health checks on target instances, making it the correct choice for this multi-tier web application.

Answer

Network Load Balancer

Answer

Classic Load Balancer

Answer

AWS CloudFront

Question 4

A company is refactoring its monolithic e-commerce application into multiple microservices. The order-processing service must send messages to the inventory service to reserve stock. The company needs a fully managed service that can durably store these messages, handle high throughput, and allow the inventory service to poll for messages at its own pace. The company wants to avoid any message loss. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon SQS is the correct choice because it is a fully managed message queuing service that durably stores messages across multiple Availability Zones, ensuring no message loss. It supports high throughput and allows the inventory service to poll for messages at its own pace using long or short polling, decoupling the order-processing and inventory services.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 5

A company runs a mix of Amazon EC2 instances, AWS Fargate containers, and AWS Lambda functions across multiple AWS Regions. The company wants to reduce costs by making a 1-year commitment for compute usage. The company needs a flexible purchasing option that automatically applies the discounted rate to any EC2 instance, Fargate, or Lambda usage, regardless of region, instance family, or size. Which AWS purchasing option should the company use?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan is the correct choice because it offers the most flexibility, automatically applying discounted rates to any EC2 instance, Fargate, or Lambda usage across any AWS Region, instance family, or size. This matches the company's requirement for a 1-year commitment that covers diverse compute services without regional or instance constraints.

Answer

EC2 Instance Savings Plan

Answer

Standard Reserved Instance

Answer

Convertible Reserved Instance

Question 6

A company wants to test a new version of their application by sending 10% of user traffic to the new version and 90% to the existing version, gradually increasing traffic to the new version as confidence grows. Which Amazon Route 53 routing policy supports this?

Accepted Answer

Weighted routing. Weighted routing (C) is correct because it allows you to assign a percentage of traffic to each resource, such as 10% to the new version and 90% to the existing version. As confidence grows, you can adjust the weights to gradually shift more traffic to the new version. This policy is specifically designed for load balancing between multiple endpoints in a controlled, proportional manner.

Answer

Failover routing

Answer

Geolocation routing

Answer

Latency routing

Question 7

A company's security team needs to investigate a potential security incident. They want to determine which IAM user launched a new, unauthorized Amazon EC2 instance two days ago. The team needs to see the exact timestamp, the source IP address, and the instance type that was launched. Which AWS service should the security team use to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including the exact timestamp, source IP address, and details (such as instance type) for every RunInstances API call. This allows the security team to trace the unauthorized EC2 launch back to the specific IAM user who made the request, as CloudTrail logs include the user identity, request parameters, and response elements.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 8

A company runs a fleet of 100 EC2 instances and needs to remotely execute commands, apply patches, and collect inventory data across all instances without opening SSH ports. Which AWS service enables this?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct service because it provides a unified interface to remotely execute commands, apply patches, and collect inventory data across EC2 instances without requiring SSH access. It uses the Systems Manager Agent (SSM Agent) installed on the instances and communicates over HTTPS (port 443), eliminating the need to open inbound SSH ports (port 22). This aligns directly with the requirement to manage a fleet of 100 instances securely and at scale.

Answer

AWS CloudShell

Answer

Amazon EC2 Instance Connect

Answer

AWS Config

Question 9

A company's internal audit team needs to download the latest AWS SOC 2 Type II report and ISO 27001 certificate to include in their compliance documentation for an upcoming external audit. The team requires a centralized, self-service portal where they can access these reports and any other relevant AWS compliance artifacts. They do not want to contact AWS Support or manage any infrastructure to obtain these documents. Which AWS service should the audit team use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, such as SOC 2 Type II and ISO 27001 certificates, without requiring any infrastructure management or contacting AWS Support. The audit team can simply log in, browse the available artifacts, and download the latest versions directly, meeting their requirement for a no-touch, self-service solution.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor

Question 10

A financial services company is undergoing an external audit. The auditor requests copies of AWS SOC 2, ISO 27001, and PCI DSS compliance reports to validate the company's cloud infrastructure controls. Where can the company's compliance team obtain these reports in a centralized manner?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, including SOC 2, ISO 27001, and PCI DSS. The compliance team can download these reports directly without needing to contact AWS support, making it the single source of truth for audit evidence.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Security Hub

Question 11

A startup runs an e-commerce website on AWS. During flash sales, traffic can increase 10x in a few minutes. The startup uses an Auto Scaling group to automatically launch additional EC2 instances when CPU utilization exceeds 70% and terminate them when utilization drops below 30%. This approach ensures that the application always has enough capacity to handle the load without manual intervention, and they only pay for what they use. Which cloud computing concept does this scenario BEST illustrate?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. The Auto Scaling group dynamically adds EC2 instances when CPU utilization exceeds 70% and terminates them when it drops below 30%, ensuring capacity matches load without manual intervention. This pay-per-use model is a hallmark of elasticity, not just high availability or fault tolerance.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 12

A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for OS updates) while preventing the internet from initiating inbound connections to those instances. It resides in a public subnet with an Elastic IP and uses Source Network Address Translation (SNAT) to replace the private source IP with the gateway's public IP, making the response traffic routable back without exposing the private instances.

Answer

Internet Gateway

Answer

VPN Gateway

Answer

VPC Endpoint

Question 13

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 14

A company hosts a file-sharing platform on Amazon S3. The application bucket is in the us-west-2 (Oregon) Region. Users in Europe and Asia experience slow upload speeds when transferring large files. The company wants to improve upload performance by using AWS edge locations to accelerate data transfers to the bucket. The solution must work with standard S3 PUT operations and require minimal application changes. Which AWS feature should the company enable?

Accepted Answer

Amazon S3 Transfer Acceleration. Amazon S3 Transfer Acceleration (C) uses AWS edge locations to route uploads over the optimized AWS network backbone, reducing latency for geographically distant clients. It works with standard S3 PUT operations and requires only enabling the feature on the bucket and updating the endpoint URL, minimizing application changes.

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Question 15

A company has 50 TB of on-premises file server data that must be transferred to Amazon S3. The company's internet connection is limited to 100 Mbps, and the data transfer must not impact daily business operations. The company needs a physical device to securely copy the data and then ship it to AWS for ingestion. Which AWS service should the company use?

Accepted Answer

AWS Snowball. AWS Snowball is a physical data transport solution designed for large-scale data transfers when network bandwidth is limited or unreliable. With 50 TB of data and a 100 Mbps connection, transferring over the network would take approximately 46 days and saturate the link, impacting business operations. Snowball provides a rugged, secure device that you copy data to locally and ship to AWS, bypassing the network entirely.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Direct Connect