CLF-C02 Practice Test 15 — 15 Questions

Question 1

A company operates its own data center with physical servers that are purchased outright every three years. The company is migrating its entire infrastructure to AWS. The CFO notes that the company will no longer need to make large upfront purchases of hardware and instead will pay monthly for the compute and storage resources used. Which cloud computing benefit does this scenario best illustrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shifting capital expense to variable operational expense. This scenario illustrates the shift from capital expenditure (CapEx) to variable operational expenditure (OpEx). In the on-premises model, the company makes large upfront purchases of physical servers every three years, which is a capital expense. By migrating to AWS, the company pays only for the compute and storage resources it consumes on a monthly basis, converting that fixed, upfront cost into a variable operating cost that scales with usage.

Answer

High availability

Answer

Resource elasticity

Answer

Security compliance

Question 2

A company's compliance team is preparing documentation for a third-party audit. The auditor requires a copy of the AWS SOC 3 report, which provides an overview of AWS's security controls and is intended for public distribution. The team needs to securely download the most recent version of this report directly from AWS. Which AWS service should the team use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The SOC 3 report is specifically designed for public distribution, and AWS Artifact allows users to securely download the most recent version directly from AWS without needing to contact support or navigate third-party sites.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A company runs containerised microservices using Amazon ECS. The operations team wants to stop managing EC2 instances, including patching and capacity planning for the container hosts. Which option allows them to run containers on ECS without managing servers?

Accepted Answer

Use AWS Fargate as the ECS launch type. AWS Fargate is a serverless compute engine for containers that works with Amazon ECS. When you use Fargate as the launch type, you no longer need to provision, patch, or manage EC2 instances; AWS handles the underlying infrastructure, including capacity planning and OS patching. This directly meets the operations team's requirement to stop managing servers.

Answer

Run ECS tasks on On-Demand EC2 instances

Answer

Use AWS Lambda to run the containers

Answer

Run ECS tasks on Reserved EC2 instances

Question 4

A company stores log files in Amazon S3 Standard. After 30 days, the logs are rarely accessed. After 365 days, they should be archived and almost never retrieved. The company wants to automatically move objects between storage classes to minimise cost. Which S3 feature enables this automated transition?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes based on age or other criteria. In this scenario, a lifecycle rule can move logs from S3 Standard to a lower-cost infrequent access class after 30 days, and then to S3 Glacier Deep Archive after 365 days, minimizing storage costs without manual intervention.

Answer

S3 Versioning

Answer

S3 Intelligent-Tiering

Answer

S3 Event Notification

Question 5

A company runs a payment processing application on AWS that must comply with the Payment Card Industry Data Security Standard (PCI DSS). An external auditor requests a copy of the AWS SOC 2 report and the PCI DSS Attestation of Compliance (AOC) to verify the security controls of the underlying AWS infrastructure. The company needs to obtain these documents directly from AWS. Which AWS service should the company use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS Attestations of Compliance (AOC). These documents are published directly by AWS and can be downloaded from the AWS Artifact console without needing to contact AWS support, meeting the auditor's requirement for direct retrieval.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor

Question 6

Which AWS storage class is optimized for long-term archival where data is rarely accessed and retrieval time of several hours is acceptable?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is designed for long-term archival of data that is accessed rarely, with retrieval times ranging from 12 to 48 hours. This makes it the most cost-effective storage class for scenarios where retrieval latency of several hours is acceptable, such as compliance or regulatory archives.

Answer

S3 Standard-IA

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 7

A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is correct because it provides managed rules like 'iam-user-mfa-enabled' that can continuously evaluate whether all IAM users have MFA enabled. When a new user is created without MFA, AWS Config can trigger an Amazon SNS notification via its compliance change event, meeting both the verification and notification requirements automatically.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 8

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides configuration history of AWS resources, tracks changes to security groups (including last modification time), and allows you to define rules—such as requiring encryption on all EBS volumes attached to EC2 instances—and evaluate resources against those rules. It records configuration changes as configuration items and can trigger evaluations against managed or custom rules, making it ideal for compliance auditing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 9

A company needs an AWS support plan that provides access to online training, use case guidance, and architectural support for non-production environments. Which is the minimum plan that provides direct technical guidance from AWS engineers (not just documentation)?

Accepted Answer

Developer Support. Developer Support is the minimum AWS support plan that provides direct technical guidance from AWS engineers, including online training, use case guidance, and architectural support for non-production environments. Basic Support only offers documentation and community forums, while Business and Enterprise plans include these features but are higher tiers, making Developer the correct minimum.

Answer

Basic Support

Answer

Business Support

Answer

Enterprise Support

Question 10

Which AWS service provides a simple way to deploy, manage, and scale containerized applications without requiring Kubernetes or deep container expertise?

Accepted Answer

AWS App Runner. AWS App Runner is the correct answer because it provides a fully managed service that automatically builds, deploys, and scales containerized web applications and APIs from source code or a container image, without requiring any knowledge of Kubernetes or container orchestration. It abstracts away the underlying infrastructure, making it ideal for developers who want to deploy containers quickly without managing clusters or control planes.

Answer

Amazon ECS

Answer

Amazon EKS

Answer

AWS Lambda

Question 11

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 12

Which Amazon S3 feature protects against accidental deletion by maintaining multiple versions of every object in a bucket?

Accepted Answer

S3 Versioning. S3 Versioning is the correct answer because it is the specific S3 feature designed to protect against accidental deletion by preserving multiple versions of every object in a bucket. When versioning is enabled, deleting an object does not permanently remove it; instead, S3 inserts a delete marker, and the previous versions remain recoverable. This directly addresses the scenario of preventing permanent data loss from accidental deletions.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

S3 Lifecycle policies

Question 13

Which AWS service provides a serverless, fully managed Apache Spark processing engine for big data analytics without managing clusters?

Accepted Answer

AWS Glue (serverless Apache Spark ETL). AWS Glue provides a fully managed, serverless Apache Spark environment for ETL (extract, transform, load) workloads. It automatically provisions, configures, and scales the Spark cluster behind the scenes, so you don't need to manage any infrastructure. This makes it the correct choice for a serverless Apache Spark processing engine for big data analytics.

Answer

Amazon EMR on EC2

Answer

Amazon Redshift

Answer

Amazon Kinesis Data Analytics

Question 14

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

Accepted Answer

Attach an IAM role to the EC2 instance. An IAM role can be attached to an EC2 instance, allowing the instance to obtain temporary security credentials from AWS STS via the instance metadata service. This eliminates the need to store long-term access keys on the instance, satisfying the security team's requirement. The EC2 instance automatically rotates these temporary credentials before they expire, providing secure, programmatic access to the S3 bucket.

Answer

Create an IAM user and embed the access key in the application code

Answer

Store the access key in an EC2 environment variable

Answer

Use an IAM group to assign the permissions to the EC2 instance

Question 15

A company has 20 AWS accounts managed under AWS Organizations. The finance team wants to centralize billing so that the company receives volume discounts for the aggregated usage across all accounts. Additionally, the team needs to set monthly budgets for each department and automatically receive email notifications when a department's spending reaches 80% of its budget threshold. Which combination of AWS features or services should the company use to meet these requirements?

Accepted Answer

Consolidated Billing with AWS Budgets. Consolidated Billing aggregates usage across all accounts in AWS Organizations, enabling volume discounts. AWS Budgets allows setting monthly budgets per department and configuring alerts (e.g., at 80% threshold) to send email notifications via Amazon SNS. Together, they meet both centralization and notification requirements.

Answer

AWS Cost Explorer with AWS Budgets

Answer

AWS Trusted Advisor with Consolidated Billing

Answer

AWS Cost Explorer with AWS Organizations