CLF-C02 Practice Test 14 — 15 Questions

Question 1

Which AWS IAM feature allows you to set the maximum permissions that IAM entities in an account can have, regardless of what their identity-based policies allow?

Accepted Answer

Permission Boundaries. Permission Boundaries are an AWS IAM feature that sets the maximum permissions an IAM entity (user or role) can have. They act as a guardrail, limiting the effective permissions to the intersection of the identity-based policy and the boundary, regardless of what the identity-based policy allows. This ensures that even if a policy grants broad access, the boundary caps it at a defined maximum.

Answer

IAM Conditions

Answer

Service Control Policies (SCPs)

Answer

Resource-based policies

Question 2

A company runs a batch processing workload on Amazon EC2 instances. The finance team has set a monthly budget of $10,000 for this workload. They want to automatically stop the batch processing instances if the accumulated costs for the month exceed $8,000, to prevent overspending. The company needs a native AWS solution that can monitor the costs and take corrective action automatically. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Budgets with budget actions configured to stop EC2 instances. AWS Budgets allows you to set a cost budget of $8,000 and attach a budget action that triggers an AWS Systems Manager (SSM) automation document to stop EC2 instances when actual or forecasted costs exceed the threshold. This provides a native, automated, and serverless solution to enforce cost controls without manual intervention.

Answer

AWS Cost Explorer with a custom cost threshold report

Answer

AWS Trusted Advisor with a cost optimization check

Answer

AWS Organizations with a service control policy (SCP)

Question 3

A company operates three separate AWS accounts: development, testing, and production. Each account independently incurs Amazon S3 data transfer charges. The company signs up for AWS Organizations and enables consolidated billing. How does consolidated billing affect the S3 data transfer pricing for the company?

Accepted Answer

It aggregates the data transfer usage across all accounts, allowing the company to benefit from lower pricing tiers that are based on total usage.. Consolidated billing in AWS Organizations aggregates usage across all linked accounts. For S3 data transfer, AWS applies tiered pricing based on total monthly data transfer volume. By combining usage from the development, testing, and production accounts, the company can reach higher volume tiers, reducing the per-GB cost for all accounts. This is the primary benefit of consolidated billing for data transfer charges.

Answer

It applies a flat 20% discount to all S3 data transfer charges across accounts.

Answer

It allows the company to use a single payment method and automatically applies Reserved Instance pricing to data transfer.

Answer

It creates a single combined bill and automatically applies an enterprise discount negotiated with AWS.

Question 4

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

Accepted Answer

AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements. AWS does not have a blanket HIPAA certification; instead, it provides a Business Associate Agreement (BAA) for specific services listed in its HIPAA Eligible Services Reference. Customers must sign a BAA with AWS and then configure those eligible services (e.g., enabling encryption, access controls, logging) to meet their own HIPAA compliance obligations. This shared responsibility model means AWS is responsible for the security of the cloud, while the customer is responsible for security in the cloud.

Answer

AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA

Answer

PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA

Answer

HIPAA compliance is automatic once a BAA is signed with AWS

Question 5

A company wants to use AWS for a short-term proof-of-concept project lasting one month. They need EC2 instances and RDS databases but don't want any long-term commitment. Which pricing model is most appropriate?

Accepted Answer

On-Demand pricing. On-Demand pricing is the most appropriate for a short-term proof-of-concept lasting only one month because it requires no upfront payment or long-term commitment. You pay for compute and database capacity by the hour or second, and you can stop or terminate resources at any time without penalty. This aligns perfectly with the temporary, flexible nature of a one-month project.

Answer

Reserved Instances (1-year, All Upfront)

Answer

Savings Plans (3-year commitment)

Answer

Spot Instances for all workloads

Question 6

A company runs a multi-step order fulfilment process that includes payment verification, inventory check, warehouse notification, and shipping label generation. Each step is implemented as a Lambda function. They need a service to coordinate these steps, handle retries on failure, and visualise workflow state. Which AWS service should they use?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services, including Lambda functions, into a visual workflow. It natively supports sequential execution, parallel branches, retries on failure, and state visualization, making it the ideal choice for a multi-step order fulfillment process.

Answer

Amazon SQS

Answer

Amazon EventBridge

Answer

Amazon SNS

Question 7

A company has multiple AWS accounts managed under AWS Organizations with consolidated billing enabled. The company purchases a 3-year Compute Savings Plan to reduce costs on Amazon EC2, AWS Fargate, and AWS Lambda usage. The finance team wants the discount from the Savings Plan to apply to eligible usage across all accounts in the organization. What configuration is required to achieve this?

Accepted Answer

The Savings Plan must be purchased in the management account, and the discount automatically applies to all accounts in the organization.. When a Compute Savings Plan is purchased in the management account of an AWS Organization with consolidated billing enabled, the discount is automatically shared across all member accounts. This is because consolidated billing aggregates all usage across the organization, and Savings Plans apply discounts to the combined eligible usage, regardless of which account incurred the cost.

Answer

The Savings Plan must be purchased separately in each account where the discount is needed.

Answer

The finance team must create custom cost allocation tags to distribute the Savings Plan discount across accounts.

Answer

The Savings Plan must be linked to each member account using the AWS Billing Conductor.

Question 8

A company is migrating a three-tier web application to AWS. The application will run on Amazon EC2 instances using a custom Linux distribution, and a self-managed MySQL database will be installed on the same instances. The company's security team needs to understand which security responsibilities belong to AWS and which belong to the company under the AWS Shared Responsibility Model. According to this model, who is responsible for applying operating system security patches to the EC2 instances and for updating the MySQL database software?

Accepted Answer

The company is responsible for both the operating system patches and the MySQL database updates.. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor), while the customer is responsible for security in the cloud (e.g., guest OS, applications, and data). Since the company is using a custom Linux distribution on EC2 instances and installing a self-managed MySQL database, both the operating system patches and the MySQL database updates fall under the customer's responsibility. AWS does not manage or patch the guest operating system or any software installed by the customer on EC2 instances.

Answer

AWS is responsible for both the operating system patches and the MySQL database updates.

Answer

AWS is responsible for the operating system patches, and the company is responsible for the MySQL database updates.

Answer

The company is responsible for the operating system patches, and AWS is responsible for the MySQL database updates.

Question 9

A company runs an e-commerce application using Amazon RDS for MySQL. The database stores order and customer information. To achieve high availability, the company configures a Multi-AZ deployment. Which of the following describes a benefit of this configuration?

Accepted Answer

It automatically fails over to a standby instance in a different Availability Zone if the primary instance fails.. A Multi-AZ deployment for Amazon RDS automatically synchronously replicates data to a standby instance in a different Availability Zone. If the primary instance fails (due to hardware failure, AZ outage, or patching), Amazon RDS automatically performs a failover to the standby, promoting it to become the new primary. This provides high availability by minimizing downtime without requiring manual intervention.

Answer

It automatically scales the database read capacity to handle traffic spikes.

Answer

It creates read replicas in multiple Regions to reduce latency for global users.

Answer

It encrypts data at rest using AWS KMS without any additional configuration.

Question 10

A company manages a fleet of hundreds of EC2 instances and needs to automate patching across all instances, run commands remotely without SSH, and store configuration parameters centrally. Which AWS service provides these operational management capabilities?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct choice because it provides a unified interface for operational management tasks, including automated patching via Patch Manager, remote command execution without SSH using Run Command, and centralized parameter storage with Parameter Store. These capabilities directly address the need to manage fleets of EC2 instances at scale without requiring direct network access to each instance.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

AWS CloudFormation

Question 11

A company wants to deploy their application to users in North America, Europe, and Asia Pacific to reduce latency. Using AWS, they can provision infrastructure in new geographic regions within minutes using the same tools and templates. Which cloud benefit does this illustrate?

Accepted Answer

Go global in minutes. The scenario describes deploying infrastructure across multiple geographic regions (North America, Europe, Asia Pacific) using the same tools and templates, which directly illustrates the 'Go global in minutes' benefit of AWS. This benefit leverages AWS's global infrastructure—such as Regions, Availability Zones, and CloudFront edge locations—to reduce latency for users worldwide without the need to negotiate with data center providers or build physical facilities.

Answer

Increased agility

Answer

Trade capital expense for variable expense

Answer

Stop guessing about capacity

Question 12

A solutions architect is planning a new web application on AWS. The workload will include 3 Amazon EC2 instances (t3.medium) running 24/7, an Application Load Balancer, and an Amazon RDS for MySQL db.t3.small database. The architect needs to estimate the monthly cost for the first year, considering different purchasing options (On-Demand, 1-year All Upfront Reserved Instance, and Compute Savings Plan). Which AWS tool should the architect use to create this estimate?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly Simple Monthly Calculator) is the correct tool for estimating monthly costs for specific AWS resources like EC2 instances, ALB, and RDS under different purchasing options (On-Demand, Reserved Instances, Savings Plans). It allows you to input exact instance types, quantities, and commitment terms to generate a detailed cost estimate for the first year.

Answer

AWS Total Cost of Ownership (TCO) Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 13

A company wants to purchase EC2 capacity that provides a discount over On-Demand pricing and is available only when AWS has excess capacity, with the option of interruption with a 2-minute warning. Which option is this?

Accepted Answer

Spot Instances. Spot Instances (Option C) are correct because they offer a significant discount over On-Demand pricing but can be interrupted by AWS with a 2-minute warning when AWS needs the capacity back. This matches the scenario of purchasing EC2 capacity that is available only when AWS has excess capacity and includes the risk of interruption.

Answer

Reserved Instances

Answer

On-Demand Instances

Answer

Dedicated Instances

Question 14

A company operates its own data center with physical servers that are purchased outright every three years. The company is migrating its entire infrastructure to AWS. The CFO notes that the company will no longer need to make large upfront purchases of hardware and instead will pay monthly for the compute and storage resources used. Which cloud computing benefit does this scenario best illustrate?

Accepted Answer

Shifting capital expense to variable operational expense. This scenario illustrates the shift from capital expenditure (CapEx) to variable operational expenditure (OpEx). In the on-premises model, the company makes large upfront purchases of physical servers every three years, which is a capital expense. By migrating to AWS, the company pays only for the compute and storage resources it consumes on a monthly basis, converting that fixed, upfront cost into a variable operating cost that scales with usage.

Answer

High availability

Answer

Resource elasticity

Answer

Security compliance

Question 15

A company's compliance team is preparing documentation for a third-party audit. The auditor requires a copy of the AWS SOC 3 report, which provides an overview of AWS's security controls and is intended for public distribution. The team needs to securely download the most recent version of this report directly from AWS. Which AWS service should the team use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The SOC 3 report is specifically designed for public distribution, and AWS Artifact allows users to securely download the most recent version directly from AWS without needing to contact support or navigate third-party sites.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail