CLF-C02 Practice Test 12 — 15 Questions

Question 1

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP(S) requests. It provides managed rules to block common web exploits such as SQL injection and cross-site scripting (XSS), and allows you to define custom rules using conditions like IP addresses, HTTP headers, and URI strings. This makes it the correct choice for protecting the ALB-hosted application against these specific threats.

Answer

AWS Shield Advanced

Answer

Security Groups

Answer

AWS Firewall Manager

Question 2

Which AWS service automatically moves S3 objects between storage classes based on access patterns without requiring upfront knowledge of how frequently data will be accessed?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct answer because it is the only AWS service that automatically moves objects between storage classes based on changing access patterns, without requiring any upfront knowledge or lifecycle rules. It monitors access at the object level and moves data between two access tiers (frequent and infrequent) and an optional archive tier, charging a small monitoring fee but no retrieval costs.

Answer

S3 Lifecycle policies

Answer

S3 Standard-IA

Answer

S3 Replication

Question 3

A company has multiple AWS accounts managed under AWS Organizations with consolidated billing enabled. The company purchases a 3-year Compute Savings Plan to reduce costs on Amazon EC2, AWS Fargate, and AWS Lambda usage. The finance team wants the discount from the Savings Plan to apply to eligible usage across all accounts in the organization. What configuration is required to achieve this?

Accepted Answer

The Savings Plan must be purchased in the management account, and the discount automatically applies to all accounts in the organization.. When a Compute Savings Plan is purchased in the management account of an AWS Organization with consolidated billing enabled, the discount is automatically shared across all member accounts. This is because consolidated billing aggregates all usage across the organization, and Savings Plans apply discounts to the combined eligible usage, regardless of which account incurred the cost.

Answer

The Savings Plan must be purchased separately in each account where the discount is needed.

Answer

The finance team must create custom cost allocation tags to distribute the Savings Plan discount across accounts.

Answer

The Savings Plan must be linked to each member account using the AWS Billing Conductor.

Question 4

A company hosts a file-sharing platform on Amazon S3. The application bucket is in the us-west-2 (Oregon) Region. Users in Europe and Asia experience slow upload speeds when transferring large files. The company wants to improve upload performance by using AWS edge locations to accelerate data transfers to the bucket. The solution must work with standard S3 PUT operations and require minimal application changes. Which AWS feature should the company enable?

Accepted Answer

Amazon S3 Transfer Acceleration. Amazon S3 Transfer Acceleration (C) uses AWS edge locations to route uploads over the optimized AWS network backbone, reducing latency for geographically distant clients. It works with standard S3 PUT operations and requires only enabling the feature on the bucket and updating the endpoint URL, minimizing application changes.

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Question 5

A company wants to use AWS free tier for testing new services. Which statement about the AWS Free Tier is accurate?

Accepted Answer

The Free Tier includes a mix of 12-month free, always free, and short-term trial offers. Option B is correct because the AWS Free Tier is structured into three categories: 12-month free offers (e.g., 750 hours of EC2 t2.micro per month), always free offers (e.g., 1 million Lambda requests per month), and short-term trials (e.g., 30-day free trial of Amazon Inspector). This mix allows customers to test services without incurring costs for the specified limits and durations.

Answer

The Free Tier is available indefinitely for all AWS services

Answer

The Free Tier applies equally to all AWS accounts including Enterprise support customers

Answer

AWS does not charge if you stay within Free Tier limits for any service

Question 6

A company has multiple AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost budget of $5,000 for the 'Project Alpha' account. They want to receive an email notification when the actual costs reach 80% of the budget and again when the forecasted costs are expected to exceed the budget. The team also needs to centrally manage these budgets from the management account. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and configure threshold-based alerts via Amazon SNS (email or other notifications). In this scenario, the finance team can create a monthly cost budget of $5,000 for the 'Project Alpha' account, then set an alert at 80% of actual costs and another alert when forecasted costs are expected to exceed the budget. Because the company uses AWS Organizations, budgets can be centrally managed from the management account, enabling the finance team to view and control budgets across member accounts without logging into each one individually.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 7

A company manages multiple AWS accounts under a single AWS Organizations organization. The security team wants to implement a preventive control that blocks any action that would disable AWS CloudTrail or delete CloudTrail log files across all accounts, including the management account. The solution must be centrally managed and must not require changes to individual account permissions. Which AWS feature should the security team use?

Accepted Answer

AWS Service Control Policies (SCPs). AWS Service Control Policies (SCPs) are the correct choice because they allow the security team to define preventive guardrails at the AWS Organizations root, OU, or account level that apply to all principals, including the management account. An SCP can explicitly deny any action that would disable CloudTrail (e.g., cloudtrail:StopLogging, cloudtrail:DeleteTrail) or delete log files (e.g., s3:DeleteObject on the CloudTrail S3 bucket), and because SCPs are inherited by all accounts in the organization, no individual account permission changes are required.

Answer

IAM permission boundaries

Answer

AWS Identity and Access Management (IAM) roles with a trust policy

Answer

AWS Config conformance packs

Question 8

A company needs to provide business users with self-service business intelligence dashboards and visualizations of data from multiple AWS data sources. Which AWS service enables this?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a fully managed, serverless business intelligence (BI) service designed specifically for creating interactive dashboards and visualizations. It natively integrates with multiple AWS data sources (e.g., Amazon S3, Amazon RDS, Amazon Redshift, Amazon Athena) and provides self-service capabilities for business users via a web-based interface, without requiring any infrastructure management.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon EMR

Question 9

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

Amazon Detective

Question 10

A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is the correct choice because it provides automatic, always-on protection against common network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP reflection attacks, at no additional cost. It is integrated with Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53, making it ideal for protecting a public-facing web application behind an Application Load Balancer without requiring any configuration or extra fees.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Question 11

A company is building a real-time chat application that relies on long-lived WebSocket connections between clients and backend servers. The application runs on Amazon EC2 instances across multiple Availability Zones. The company needs a load balancer that can distribute incoming WebSocket traffic while preserving the connection and supporting sticky sessions. Which AWS load balancing solution should the company use?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) supports WebSocket connections natively at the application layer (Layer 7) and can maintain persistent connections via its built-in sticky session (session affinity) feature, which uses a cookie to bind a client to a specific target for the duration of the WebSocket session. This makes ALB the correct choice for a real-time chat application requiring long-lived WebSocket connections and sticky sessions across multiple Availability Zones.

Answer

Network Load Balancer

Answer

Classic Load Balancer

Answer

Amazon Route 53

Question 12

A company hosts a static website on Amazon S3. The website serves product images and documents to customers around the world. Users in distant regions report slow load times. The company wants to reduce latency for all users without changing the existing S3 bucket configuration. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., images, documents) at edge locations worldwide. By distributing content from the nearest edge location to the user, CloudFront significantly reduces latency without requiring any changes to the existing S3 bucket configuration. The origin remains the S3 bucket, and CloudFront handles the global distribution automatically.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

AWS Global Accelerator

Question 13

A company is designing a cloud architecture for a critical customer-facing application. The CTO requires that the architecture automatically recover from infrastructure failures without manual intervention. The solution must be able to withstand the failure of individual components, such as an Amazon EC2 instance or an entire Availability Zone. Which design principle from the AWS Well-Architected Framework's Reliability pillar should the company implement to meet this requirement?

Accepted Answer

Scale horizontally to increase aggregate system availability.. Scaling horizontally (adding more EC2 instances behind a load balancer) increases aggregate system availability because if one instance fails, traffic is redistributed to the remaining healthy instances. This design also supports multi-AZ deployments, allowing the application to survive an entire Availability Zone failure without manual intervention, which directly meets the CTO's requirement for automatic recovery.

Answer

Implement a monolithic architecture to reduce complexity and minimize points of failure.

Answer

Use a single large EC2 instance to minimize the number of components that could fail.

Answer

Test recovery procedures by simulating infrastructure failures in a staging environment.

Question 14

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The application serves users worldwide, and the company wants to optimize both performance and availability for all users. The solution should use the AWS global network to route traffic from users to the nearest edge location and then over the AWS backbone to the ALB, without caching content at edge locations. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route user traffic to the nearest edge location via Anycast IP addresses, then forwards it over the AWS backbone directly to the Application Load Balancer (ALB) in us-east-1. This optimizes performance by reducing latency and jitter, and improves availability by providing static IP addresses and health-check-based traffic shifting, without caching any content at edge locations.

Answer

Amazon CloudFront

Answer

AWS Shield

Answer

Amazon Route 53 latency-based routing

Question 15

A company hosts an e-commerce website on Amazon EC2 instances behind an Application Load Balancer in the us-east-1 Region. The website includes both static assets (product images, CSS files) and dynamic content (user-specific cart data). The company has customers all over the world who complain about slow page load times. The company wants to reduce latency by caching static content closer to users while still allowing dynamic requests to reach the origin. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon CloudFront with Application Load Balancer as the origin. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., images, CSS) at edge locations worldwide, reducing latency for users. By configuring the Application Load Balancer as the origin, CloudFront forwards dynamic requests (e.g., cart data) to the ALB, which then routes them to the EC2 instances. This hybrid approach meets the requirement to cache static assets globally while allowing dynamic content to be processed by the origin servers.

Answer

Amazon Route 53 with latency-based routing

Answer

AWS Global Accelerator with static IP addresses

Answer

Amazon S3 Transfer Acceleration