CLF-C02 Practice Test 13 — 15 Questions

Question 1

A company is currently running its IT infrastructure in an on-premises data center. The finance department wants to understand how moving to the AWS Cloud would change the company's cost structure. In particular, they want to avoid large upfront hardware purchases and instead pay only for the resources they consume on a monthly basis. Which key cloud computing concept does this shift represent?

Accepted Answer

Pay-as-you-go pricing. Option C is correct because pay-as-you-go pricing is the cloud computing model that allows a company to avoid large upfront capital expenditures on hardware and instead pay only for the resources they consume on a monthly basis. This directly aligns with the finance department's goal of shifting from a capital expenditure (CapEx) model to an operational expenditure (OpEx) model, where costs are incurred based on actual usage rather than upfront purchases.

Answer

Elasticity

Answer

Economies of scale

Answer

High availability

Question 2

A company is deploying a mission-critical application on AWS. The application requires the highest level of support available, including a designated Technical Account Manager (TAM) and a response time of 15 minutes or less for production system down cases. Which AWS Support plan should the company choose?

Accepted Answer

Enterprise. The Enterprise support plan is the only AWS Support plan that includes a designated Technical Account Manager (TAM) and a 15-minute response time for production system down cases. The company's requirement for the highest level of support with these specific features directly maps to the Enterprise plan, which is designed for mission-critical workloads.

Answer

Developer

Answer

Business

Answer

Enterprise On-Ramp

Question 3

A company is migrating a critical database to Amazon RDS. The database must run continuously for the next 3 years to support the company's operations. The finance team wants to minimize compute costs for this database. However, they have a limited budget and cannot make large upfront payments. They want to commit to a 3-year term to receive the highest possible discount without paying anything upfront. Which pricing option should the finance team select for the DB instance?

Accepted Answer

3-Year No Upfront Reserved DB instances. The finance team wants to commit to a 3-year term to receive the highest possible discount without paying anything upfront. AWS Reserved Instances offer three payment options: All Upfront, Partial Upfront, and No Upfront. The No Upfront option provides a significant discount over On-Demand pricing (typically around 40-60% for a 3-year term) while requiring no upfront payment, making it the most cost-effective choice given the budget constraint. Option D (3-Year No Upfront Reserved DB instances) satisfies both the requirement for a 3-year commitment and the inability to make large upfront payments.

Answer

On-Demand DB instances

Answer

1-Year All Upfront Reserved DB instances

Answer

3-Year Partial Upfront Reserved DB instances

Question 4

A company must store sensitive financial records in Amazon S3. The compliance policy mandates that the encryption key for data at rest must be generated and stored on the company's own on-premises hardware security module (HSM). The company must never allow AWS to have access to the plaintext encryption key. Which Amazon S3 encryption option should the company use?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C allows the customer to provide their own encryption key, which is used by S3 to encrypt data at rest. AWS temporarily stores the key in memory during the encryption/decryption process but immediately discards it after use, and the key is never stored persistently on AWS infrastructure. This satisfies the compliance requirement that the key must be generated and stored on the company's own on-premises HSM, and AWS never has access to the plaintext key.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS Key Management Service (SSE-KMS) using a customer managed key

Answer

Client-side encryption using the AWS Encryption SDK

Question 5

A company hosts its corporate website entirely as static content (HTML, CSS, JavaScript, images) in an Amazon S3 bucket. The website currently has no authentication requirements and is accessible to the public. The company wants to serve this content to users around the world with low latency. Additionally, the company wants to enforce HTTPS for all traffic using a custom domain name (www.example.com). The company does not want to manage SSL/TLS certificates on any servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It supports custom domain names and can enforce HTTPS by using AWS Certificate Manager (ACM) to provision and renew SSL/TLS certificates automatically, eliminating the need for server-side certificate management. CloudFront integrates directly with an S3 bucket as the origin, allowing the bucket to remain private while serving content securely via HTTPS.

Answer

AWS Global Accelerator

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Lambda@Edge

Question 6

A company is migrating a business-critical workload to AWS. The company wants to ensure it has access to a dedicated Technical Account Manager (TAM) who will provide proactive guidance, architectural reviews, and operational support. Additionally, the company requires the Infrastructure Event Management (IEM) service to assist with the migration launch, and it wants the full set of AWS Trusted Advisor best practice checks across all categories (cost optimization, performance, security, fault tolerance, service limits). Which AWS Support plan should the company select?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the only plan that provides a dedicated Technical Account Manager (TAM) for proactive guidance, architectural reviews, and operational support. It also includes Infrastructure Event Management (IEM) for migration launches and full access to all AWS Trusted Advisor best practice checks across all categories, including cost optimization, performance, security, fault tolerance, and service limits. Lower-tier plans lack one or more of these critical features.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 7

A company is building a web application that requires a fully managed NoSQL database with single-digit millisecond latency at any scale. The application will experience unpredictable traffic spikes, and the database must automatically scale throughput capacity up and down without manual intervention. The developers want to focus on application code rather than database management tasks. Which AWS database service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports automatic scaling of read/write throughput capacity via Auto Scaling policies, eliminating the need for manual intervention. This makes it ideal for web applications with unpredictable traffic spikes, as it offloads all database management tasks to AWS.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 8

A company is planning to migrate a legacy application to AWS and wants to estimate the monthly cost of running the new workload. The company needs to compare costs across different Amazon EC2 instance types, regions, and pricing models (On-Demand, Reserved, and Spot). The team also wants to include estimated costs for related services such as Amazon EBS storage and data transfer. Which AWS tool should the company use to generate this cost estimate?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly the Simple Monthly Calculator) is the correct tool because it allows users to estimate monthly costs by selecting specific EC2 instance types, regions, and pricing models (On-Demand, Reserved, Spot), and it also includes estimates for related services like EBS storage and data transfer. This tool provides a detailed, upfront cost comparison before any resources are deployed, which directly matches the company's requirement to compare costs across different configurations.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 9

A company hosts its website on a single Amazon EC2 instance in the us-east-1 Region. The website includes static assets such as images, CSS, and JavaScript files. Users in Europe and Asia report that the website loads slowly because the static assets must travel from the us-east-1 Region. The company wants to reduce latency for global users and decrease the load on the EC2 instance by serving static content from locations that are closer to the users. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static assets (images, CSS, JavaScript) at edge locations worldwide. By serving content from edge locations closer to users in Europe and Asia, CloudFront reduces latency and offloads requests from the origin EC2 instance, decreasing its load. This directly meets the requirements for global latency reduction and reduced EC2 load.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 with latency-based routing

Answer

Amazon S3 Transfer Acceleration

Question 10

Which AWS Well-Architected Framework pillar focuses on protecting information, systems, and assets while delivering business value through risk assessments and mitigation strategies?

Accepted Answer

Security. The Security pillar of the AWS Well-Architected Framework is specifically designed to protect information, systems, and assets through the implementation of risk assessments and mitigation strategies. It encompasses practices such as identity and access management (IAM), detective controls (e.g., AWS CloudTrail, Amazon GuardDuty), infrastructure protection (e.g., AWS WAF, security groups), data protection (e.g., encryption at rest and in transit), and incident response. This pillar directly aligns with the question's focus on delivering business value while managing security risks.

Answer

Reliability

Answer

Operational Excellence

Answer

Performance Efficiency

Question 11

A company is migrating its on-premises infrastructure to AWS. The operations team needs a managed service that allows them to define their entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—as a reusable template stored in version control. The service must automatically handle resource dependencies, such as creating the database before launching the application servers, and ensure that the infrastructure is provisioned consistently across multiple environments (e.g., development, staging, production). Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it provides Infrastructure as Code (IaC) capabilities, allowing you to define your entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—in a reusable JSON or YAML template stored in version control. It automatically manages resource dependencies using the DependsOn attribute and intrinsic functions like Ref and Fn::GetAtt, ensuring resources are created in the correct order (e.g., database before application servers). CloudFormation also supports consistent provisioning across multiple environments by using parameters, mappings, and stacksets, making it ideal for the operations team's requirements.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 12

A company is building a global e-commerce application that requires a database with single-digit millisecond latency, seamless scaling to handle millions of requests per second, and the ability to replicate data across multiple AWS Regions for disaster recovery and low-latency reads. The database must be fully managed with automatic backup and restores. Which AWS service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, supports automatic multi-Region replication via DynamoDB Global Tables for disaster recovery and low-latency reads, and provides built-in backup and restore capabilities. This combination of performance, seamless scaling to millions of requests per second, and global replication aligns perfectly with the requirements of a global e-commerce application.

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Question 13

A company is expanding its AWS environment from a single account to multiple accounts using AWS Organizations. The security team wants to enforce a baseline set of permissions across all accounts, ensuring that users in any account cannot disable AWS CloudTrail or modify Amazon S3 bucket policies that prevent public access. Which feature of AWS Organizations should the security team use to achieve this control?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce baseline permissions across all accounts in an AWS Organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrative privileges within their own account. By creating an SCP that explicitly denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:PutBucketPolicy` actions (or similar), the security team can prevent disabling CloudTrail and modifying S3 bucket policies that block public access across the entire organization.

Answer

Consolidated Billing

Answer

AWS Config rules

Answer

IAM roles

Question 14

A company manages user access to AWS resources using IAM users. The security team wants to automatically detect if an IAM user's access key is being used from a geographic location that is unusual for that user, which could indicate a compromised credential. The team needs a managed threat detection service that monitors API activity and raises alerts for such anomalies. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS API activity, including IAM user access key usage, and uses machine learning to establish baseline behavior. When it detects access from an unusual geographic location, it generates a finding alerting the security team to a potentially compromised credential. This directly meets the requirement for automated anomaly detection without manual configuration.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 15

A company operates 10 AWS accounts, each managed by a different department. The finance team wants to combine the usage of all accounts to qualify for lower volume-based pricing tiers for services such as Amazon S3 and Amazon EC2. Additionally, they want a single monthly bill that aggregates charges from all accounts. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing is the correct feature because it allows the company to combine usage across all 10 AWS accounts into a single aggregated bill. This enables the finance team to qualify for lower volume-based pricing tiers for services like Amazon S3 and Amazon EC2, as AWS aggregates usage across all accounts in the organization. Consolidated billing also provides a single monthly bill that itemizes charges from each account, meeting both requirements.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor