CLF-C02 Practice Test 15 — 15 Questions

Question 1

A company runs containerised microservices using Amazon ECS. The operations team wants to stop managing EC2 instances, including patching and capacity planning for the container hosts. Which option allows them to run containers on ECS without managing servers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Fargate as the ECS launch type. AWS Fargate is a serverless compute engine for containers that works with Amazon ECS. When you use Fargate as the launch type, you no longer need to provision, patch, or manage EC2 instances; AWS handles the underlying infrastructure, including capacity planning and OS patching. This directly meets the operations team's requirement to stop managing servers.

Answer

Run ECS tasks on On-Demand EC2 instances

Answer

Use AWS Lambda to run the containers

Answer

Run ECS tasks on Reserved EC2 instances

Question 2

A company stores log files in Amazon S3 Standard. After 30 days, the logs are rarely accessed. After 365 days, they should be archived and almost never retrieved. The company wants to automatically move objects between storage classes to minimise cost. Which S3 feature enables this automated transition?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes based on age or other criteria. In this scenario, a lifecycle rule can move logs from S3 Standard to a lower-cost infrequent access class after 30 days, and then to S3 Glacier Deep Archive after 365 days, minimizing storage costs without manual intervention.

Answer

S3 Versioning

Answer

S3 Intelligent-Tiering

Answer

S3 Event Notification

Question 3

A company runs a payment processing application on AWS that must comply with the Payment Card Industry Data Security Standard (PCI DSS). An external auditor requests a copy of the AWS SOC 2 report and the PCI DSS Attestation of Compliance (AOC) to verify the security controls of the underlying AWS infrastructure. The company needs to obtain these documents directly from AWS. Which AWS service should the company use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS Attestations of Compliance (AOC). These documents are published directly by AWS and can be downloaded from the AWS Artifact console without needing to contact AWS support, meeting the auditor's requirement for direct retrieval.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor

Question 4

Which AWS storage class is optimized for long-term archival where data is rarely accessed and retrieval time of several hours is acceptable?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is designed for long-term archival of data that is accessed rarely, with retrieval times ranging from 12 to 48 hours. This makes it the most cost-effective storage class for scenarios where retrieval latency of several hours is acceptable, such as compliance or regulatory archives.

Answer

S3 Standard-IA

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 5

A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is correct because it provides managed rules like 'iam-user-mfa-enabled' that can continuously evaluate whether all IAM users have MFA enabled. When a new user is created without MFA, AWS Config can trigger an Amazon SNS notification via its compliance change event, meeting both the verification and notification requirements automatically.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 6

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides configuration history of AWS resources, tracks changes to security groups (including last modification time), and allows you to define rules—such as requiring encryption on all EBS volumes attached to EC2 instances—and evaluate resources against those rules. It records configuration changes as configuration items and can trigger evaluations against managed or custom rules, making it ideal for compliance auditing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 7

A company needs an AWS support plan that provides access to online training, use case guidance, and architectural support for non-production environments. Which is the minimum plan that provides direct technical guidance from AWS engineers (not just documentation)?

Accepted Answer

Developer Support. Developer Support is the minimum AWS support plan that provides direct technical guidance from AWS engineers, including online training, use case guidance, and architectural support for non-production environments. Basic Support only offers documentation and community forums, while Business and Enterprise plans include these features but are higher tiers, making Developer the correct minimum.

Answer

Basic Support

Answer

Business Support

Answer

Enterprise Support

Question 8

Which AWS service provides a simple way to deploy, manage, and scale containerized applications without requiring Kubernetes or deep container expertise?

Accepted Answer

AWS App Runner. AWS App Runner is the correct answer because it provides a fully managed service that automatically builds, deploys, and scales containerized web applications and APIs from source code or a container image, without requiring any knowledge of Kubernetes or container orchestration. It abstracts away the underlying infrastructure, making it ideal for developers who want to deploy containers quickly without managing clusters or control planes.

Answer

Amazon ECS

Answer

Amazon EKS

Answer

AWS Lambda

Question 9

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 10

Which Amazon S3 feature protects against accidental deletion by maintaining multiple versions of every object in a bucket?

Accepted Answer

S3 Versioning. S3 Versioning is the correct answer because it is the specific S3 feature designed to protect against accidental deletion by preserving multiple versions of every object in a bucket. When versioning is enabled, deleting an object does not permanently remove it; instead, S3 inserts a delete marker, and the previous versions remain recoverable. This directly addresses the scenario of preventing permanent data loss from accidental deletions.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

S3 Lifecycle policies

Question 11

Which AWS service provides a serverless, fully managed Apache Spark processing engine for big data analytics without managing clusters?

Accepted Answer

AWS Glue (serverless Apache Spark ETL). AWS Glue provides a fully managed, serverless Apache Spark environment for ETL (extract, transform, load) workloads. It automatically provisions, configures, and scales the Spark cluster behind the scenes, so you don't need to manage any infrastructure. This makes it the correct choice for a serverless Apache Spark processing engine for big data analytics.

Answer

Amazon EMR on EC2

Answer

Amazon Redshift

Answer

Amazon Kinesis Data Analytics

Question 12

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

Accepted Answer

Attach an IAM role to the EC2 instance. An IAM role can be attached to an EC2 instance, allowing the instance to obtain temporary security credentials from AWS STS via the instance metadata service. This eliminates the need to store long-term access keys on the instance, satisfying the security team's requirement. The EC2 instance automatically rotates these temporary credentials before they expire, providing secure, programmatic access to the S3 bucket.

Answer

Create an IAM user and embed the access key in the application code

Answer

Store the access key in an EC2 environment variable

Answer

Use an IAM group to assign the permissions to the EC2 instance

Question 13

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 14

A company runs an e-commerce application on Amazon EC2 instances in the us-east-1 Region. The application serves static assets (images, CSS files) and dynamic API responses. Users in Europe and Asia report that the website loads slowly, especially for images. The company needs a solution that reduces latency for both static and dynamic content by caching static assets at edge locations and accelerating dynamic API calls using optimized network paths. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static assets (images, CSS files) at edge locations worldwide, reducing latency for users in Europe and Asia. It also supports dynamic API acceleration by using optimized network paths (AWS global network backbone) and features like origin shield and TCP optimizations, making it the correct choice for both static and dynamic content.

Answer

AWS Global Accelerator

Answer

Amazon S3 Transfer Acceleration

Answer

Application Load Balancer

Question 15

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the central resource for downloading AWS compliance reports, including SOC 2 Type II reports and ISO 27001 certifications. It provides on-demand access to these documents, which auditors require as evidence of AWS's adherence to regulatory standards. This service is specifically designed for compliance and audit use cases, making it the correct choice.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config