CLF-C02 Practice Test 16 — 15 Questions

Question 1

A company requires all IAM users to have multi-factor authentication (MFA) enabled for AWS Management Console access. The security team needs an automated way to continuously detect any IAM user without an MFA device and generate a compliance report. The solution must not require custom code. Which AWS service should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed, rules-based evaluation of AWS resource configurations. By enabling the 'iam-user-mfa-enabled' managed rule, AWS Config continuously checks all IAM users for the presence of an MFA device and can automatically trigger remediation actions or generate compliance reports via AWS Config aggregators, all without any custom code.

Answer

IAM Access Analyzer

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 2

A company wants to automatically detect anomalies in their application metrics, such as unusual spikes in error rates, without manually setting thresholds. Which AWS service provides ML-powered anomaly detection for CloudWatch metrics?

Accepted Answer

Amazon CloudWatch Anomaly Detection. Amazon CloudWatch Anomaly Detection applies machine learning algorithms to analyze historical CloudWatch metric data and establish a baseline of expected values. It then continuously evaluates new data points against this baseline to automatically detect anomalies, such as unusual spikes in error rates, without requiring manual threshold configuration. This makes it the correct choice for the described use case.

Answer

Amazon GuardDuty

Answer

Amazon DevOps Guru

Answer

AWS X-Ray

Question 3

A company wants to create a hybrid cloud architecture where their on-premises applications can access AWS services as if they were running locally. Which AWS service extends AWS infrastructure and services to on-premises locations?

Accepted Answer

AWS Outposts. AWS Outposts is the correct answer because it is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises or edge location. This allows customers to run AWS services locally, enabling a true hybrid cloud experience where on-premises applications can access AWS services with low latency and local data processing, as if they were running in an AWS Region.

Answer

AWS Direct Connect

Answer

AWS VPN

Answer

AWS Local Zones

Question 4

A company wants to automatically receive an email alert whenever their monthly AWS spend is forecasted to exceed $10,000, or if it actually exceeds $10,000. Which AWS service provides this capability?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set a custom budget (e.g., monthly cost budget of $10,000) and configure alert thresholds (actual or forecasted) that trigger an Amazon SNS notification, which can send an email alert. This directly meets the requirement to be notified when the forecasted or actual spend exceeds $10,000.

Answer

AWS Cost Explorer

Answer

AWS Pricing Calculator

Answer

Amazon CloudWatch

Question 5

A company is adopting the cloud and wants to improve operational efficiency by treating their infrastructure as code. Which AWS service allows them to define and provision AWS infrastructure using JSON or YAML templates?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define and provision AWS infrastructure as code using JSON or YAML templates. This enables repeatable, version-controlled deployments, directly supporting the goal of improving operational efficiency through infrastructure as code.

Answer

AWS Systems Manager

Answer

AWS OpsWorks

Answer

AWS Config

Question 6

A company needs to replicate their Amazon S3 data to a different AWS Region automatically to meet disaster recovery requirements. Which S3 feature enables this?

Accepted Answer

S3 Cross-Region Replication (CRR). Amazon S3 Cross-Region Replication (CRR) is the correct feature because it automatically and asynchronously replicates objects across S3 buckets in different AWS Regions, meeting disaster recovery requirements by ensuring data is available in a secondary geographic location. CRR requires versioning to be enabled on both source and destination buckets, and it replicates new objects and object metadata by default, with optional configuration for replicating delete markers or objects from specific prefixes.

Answer

S3 Intelligent-Tiering

Answer

S3 Lifecycle policies

Answer

S3 Transfer Acceleration

Question 7

A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their web servers, and automatically redirect traffic to a healthy backup server if the primary server fails. Which AWS service provides all of these capabilities?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a DNS web service that translates domain names to IP addresses. It also offers health checks that monitor the availability of web servers and can automatically route traffic away from unhealthy endpoints to healthy ones using DNS failover routing policies.

Answer

Amazon VPC

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Question 8

A company needs to manage multiple Kubernetes clusters across different AWS Regions and on-premises environments from a single control plane. Which AWS service provides this?

Accepted Answer

Amazon EKS with EKS Connector. Amazon EKS with EKS Connector allows you to register and connect any Kubernetes cluster—whether running in AWS, on-premises, or in other clouds—to the AWS EKS console. This provides a single control plane view for managing multiple clusters across different AWS Regions and on-premises environments, fulfilling the requirement exactly.

Answer

Amazon ECS

Answer

AWS Fargate

Answer

Amazon EC2 with self-managed Kubernetes

Question 9

A company wants to identify all resources in their AWS account that are accessible from outside the account — such as S3 buckets with public access or IAM roles with external trust. Which AWS service provides this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it analyzes resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) to identify resources shared with an external entity outside the AWS account. It uses a policy analysis engine that evaluates the principal, action, and condition elements to determine if a policy grants access to an external AWS account, an IAM user in another account, or a public principal (e.g., `"Principal": "*"`). This directly matches the requirement to find resources accessible from outside the account.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

Which statement best describes 'high availability' in the context of AWS cloud architecture?

Accepted Answer

A design that minimizes downtime by eliminating single points of failure and enabling automatic recovery. High availability in AWS is achieved by designing architectures that eliminate single points of failure and enable automatic recovery, typically using services like Elastic Load Balancing (ELB) to distribute traffic across multiple Availability Zones (AZs) and Auto Scaling to replace failed instances. This ensures that if one component fails, another takes over seamlessly, minimizing downtime. Option B correctly captures this core principle of fault tolerance and automated failover.

Answer

The ability to handle any amount of traffic by adding more resources

Answer

Using the largest available instance types for maximum performance

Answer

Storing multiple copies of data in Amazon S3

Question 11

Which AWS service provides a private connection from an on-premises network to AWS that bypasses the public internet and provides consistent network performance?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, completely bypassing the public internet. This ensures consistent network performance, lower latency, and higher bandwidth, as the connection is established through a standard 1 Gbps or 10 Gbps Ethernet fiber-optic cable linked to an AWS Direct Connect location.

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 12

A company's microservices application consists of 10 services. When a user request is slow, the development team cannot determine which service in the chain is the bottleneck. Which AWS service provides distributed tracing so they can see the full path of a request and identify the slow component?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end distributed tracing, allowing developers to trace a request as it travels through multiple microservices. It generates a service map that shows the full path of a request, including latency breakdowns for each service, enabling identification of the slow component. This directly addresses the need to pinpoint bottlenecks in a chain of 10 services.

Answer

Amazon CloudWatch Metrics

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 13

A multi-national company needs to ensure their AWS resources in Europe comply with GDPR by keeping all data within EU regions. Which approach ensures data remains in Europe?

Accepted Answer

Deploy resources only in EU AWS Regions and use SCPs to prevent deployment outside EU. Deploying resources only in EU AWS Regions (such as eu-west-1, eu-central-1) combined with Service Control Policies (SCPs) that explicitly deny actions outside those regions ensures data residency. SCPs are organization-level policies in AWS Organizations that can restrict member accounts from launching resources in non-EU regions, providing a preventive control to enforce GDPR data localization requirements.

Answer

AWS automatically keeps EU customer data in EU regions without any configuration

Answer

Enable CloudTrail in all regions to monitor data movement

Answer

GDPR compliance requires using only AWS GovCloud Regions

Question 14

Which AWS database service is best suited for storing and querying data with complex relationships using structured query language?

Accepted Answer

Amazon RDS. Amazon RDS is the correct choice because it provides managed relational database services (e.g., MySQL, PostgreSQL, Oracle, SQL Server) that use structured query language (SQL) and are designed to handle complex relationships through foreign keys, joins, and normalized schemas. This makes it ideal for applications requiring ACID transactions and complex queries across multiple tables.

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache

Answer

Amazon Neptune

Question 15

A company has a two-tier web application. The front-end web servers run on Amazon EC2 instances in a public subnet. The back-end application servers process jobs that are submitted by the front end. The company wants to decouple the front-end and back-end tiers so that the back-end servers can process jobs as they are submitted, even if the front-end servers experience a spike in traffic. The solution must be durable and fully managed, and must allow the front-end servers to send job requests without waiting for the back-end servers to be available. Which AWS service should the company use to send the job requests from the front end to the back end?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed, durable, and decoupled message queue that allows front-end EC2 instances to send job requests as messages. The back-end application servers can then poll and process these messages asynchronously, ensuring that spikes in front-end traffic do not overwhelm the back-end, and the front-end does not need to wait for back-end availability.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions