CLF-C02 Practice Test 17 — 15 Questions

Question 1

Which AWS database service is best suited for storing and querying data with complex relationships using structured query language?

Accepted Answer

Amazon RDS. Amazon RDS is the correct choice because it provides managed relational database services (e.g., MySQL, PostgreSQL, Oracle, SQL Server) that use structured query language (SQL) and are designed to handle complex relationships through foreign keys, joins, and normalized schemas. This makes it ideal for applications requiring ACID transactions and complex queries across multiple tables.

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache

Answer

Amazon Neptune

Question 2

A company has a two-tier web application. The front-end web servers run on Amazon EC2 instances in a public subnet. The back-end application servers process jobs that are submitted by the front end. The company wants to decouple the front-end and back-end tiers so that the back-end servers can process jobs as they are submitted, even if the front-end servers experience a spike in traffic. The solution must be durable and fully managed, and must allow the front-end servers to send job requests without waiting for the back-end servers to be available. Which AWS service should the company use to send the job requests from the front end to the back end?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed, durable, and decoupled message queue that allows front-end EC2 instances to send job requests as messages. The back-end application servers can then poll and process these messages asynchronously, ensuring that spikes in front-end traffic do not overwhelm the back-end, and the front-end does not need to wait for back-end availability.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 3

A company runs an application with variable workloads. During business hours, they need 10 EC2 instances; overnight they only need 2. Which combination minimizes cost while meeting this requirement?

Accepted Answer

2 Reserved Instances + Auto Scaling with On-Demand for variable demand. It uses 2 Reserved Instances to cover the baseline workload (overnight) at a lower cost, and Auto Scaling with On-Demand Instances to dynamically add capacity during business hours. Reserved Instances provide a significant discount over On-Demand for steady-state usage, while On-Demand instances handle variable demand without upfront commitment, minimizing total cost.

Answer

10 On-Demand Instances running 24/7

Answer

10 Reserved Instances

Answer

10 Spot Instances with Auto Scaling

Question 4

A company has unpredictable, short-lived batch processing workloads that can be interrupted. Which EC2 purchasing option would provide the lowest cost for these workloads?

Accepted Answer

Spot Instances. Spot Instances (Option C) are the correct choice because they offer unused EC2 capacity at steep discounts (up to 90% off On-Demand) and are ideal for fault-tolerant, flexible, short-lived, or interruptible workloads. Since the company's batch processing jobs are unpredictable and can be interrupted, Spot Instances provide the lowest cost while tolerating the risk of termination when AWS needs the capacity back.

Answer

On-Demand Instances

Answer

Reserved Instances (1-year, No Upfront)

Answer

Dedicated Hosts

Question 5

A company must encrypt all data at rest stored in Amazon S3 and wants AWS to manage the encryption keys. Which S3 encryption option requires the least operational overhead?

Accepted Answer

SSE-S3 (Amazon S3-Managed Keys). SSE-S3 uses Amazon S3-managed keys, where AWS fully handles key creation, management, and rotation with no configuration required from the user. This option provides the least operational overhead because you simply enable server-side encryption on the bucket or object, and AWS manages the entire encryption process transparently.

Answer

SSE-C (Customer-Provided Keys)

Answer

SSE-KMS (AWS KMS-Managed Keys)

Answer

Client-side encryption

Question 6

Which AWS service provides a managed way to create, control, and rotate encryption keys used to protect your data?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct answer because it is a fully managed service that allows you to create, control, and rotate encryption keys used to protect your data. KMS integrates with other AWS services to encrypt data at rest and provides centralized key management, including automatic annual rotation for customer-managed keys. It uses hardware security modules (HSMs) to protect key material, but the service itself handles the management and rotation lifecycle.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 7

A company uses multiple AWS accounts managed under AWS Organizations. Which service allows them to share Reserved Instance discounts and Savings Plans across all accounts in the organization?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing enables you to aggregate usage across all member accounts, allowing Reserved Instance (RI) discounts and Savings Plans to be shared. This means that unused capacity from one account can be applied to reduce costs in another account within the same organization, maximizing overall savings.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Question 8

A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized security policy management across multiple AWS accounts and regions. It allows an administrator to define and enforce AWS WAF rules, security group rules, and Shield Advanced protections from a single administrator account, ensuring consistent compliance across all accounts in an AWS Organization.

Answer

AWS WAF

Answer

AWS Security Hub

Answer

AWS Shield Advanced

Question 9

Which AWS service provides a concierge-like experience for navigating AWS services and finding the right resources, primarily available to Enterprise Support customers?

Accepted Answer

AWS Support Concierge (Account Team). AWS Support Concierge (Account Team) is a dedicated service provided to Enterprise Support customers that offers a concierge-like experience for navigating AWS services and finding the right resources. It acts as a single point of contact for account-level inquiries, such as billing, account management, and service limit increases, rather than providing technical troubleshooting.

Answer

AWS IQ

Answer

AWS Marketplace

Answer

AWS re:Post

Question 10

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action using an AWS Systems Manager Automation document. AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` continuously evaluates S3 buckets against the encryption requirement. When a non-compliant bucket is detected, an automatic remediation action can invoke an AWS Systems Manager Automation document to enable default encryption (SSE-S3 or SSE-KMS). AWS Config also provides a compliance score dashboard and allows the security team to review non-compliant resources, meeting all stated requirements.

Answer

Amazon GuardDuty with a finding type for S3 bucket encryption

Answer

AWS Trusted Advisor with the S3 Bucket Permissions check

Answer

AWS CloudTrail with a trail that logs S3 API calls and an Amazon CloudWatch alarm

Question 11

A company is evaluating whether to use AWS Compute Savings Plans or EC2 Instance Savings Plans. Which statement correctly describes when EC2 Instance Savings Plans provide the highest discount?

Accepted Answer

When the workload uses a consistent instance family within a single Region. EC2 Instance Savings Plans offer the highest discount (up to 72% compared to On-Demand) because they require a commitment to a specific instance family within a single AWS Region. This allows AWS to optimize capacity planning and pass greater savings to the customer, whereas Compute Savings Plans are more flexible but provide lower discounts (up to 66%).

Answer

When the workload spans multiple AWS Regions

Answer

When the workload uses multiple instance families

Answer

When the workload runs on AWS Fargate

Question 12

Which Amazon EC2 pricing option allows customers to bid for unused EC2 capacity with potential savings of up to 90%, while accepting that instances may be interrupted?

Accepted Answer

Spot Instances. Spot Instances allow customers to bid for unused EC2 capacity, offering potential savings of up to 90% compared to On-Demand pricing. However, these instances can be interrupted (terminated or hibernated) by AWS when the Spot price exceeds the customer's bid or when capacity is needed for On-Demand or Reserved Instance customers, making them ideal for fault-tolerant and flexible workloads.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 13

Which cloud computing benefit allows a company's development team to spin up a testing environment in 5 minutes instead of waiting 6 weeks for hardware procurement and data center provisioning?

Accepted Answer

Increase speed and agility. One of the core benefits of cloud computing is the ability to rapidly provision and release resources with minimal management effort. Instead of waiting weeks for hardware procurement and data center provisioning, a development team can spin up a testing environment in minutes using Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) offerings like Amazon EC2 or AWS Elastic Beanstalk. This agility directly reduces time-to-market and enables faster iteration cycles.

Answer

Economies of scale

Answer

High availability

Answer

Pay-as-you-go pricing

Question 14

A company wants to adopt AWS and is performing a readiness assessment. The AWS Cloud Adoption Framework (CAF) identifies which two areas that most cloud migrations fail to address adequately?

Accepted Answer

People and Governance perspectives. The AWS Cloud Adoption Framework (CAF) identifies that most cloud migrations fail because organizations inadequately address the People and Governance perspectives (Option B). These perspectives focus on organizational change management, training, and compliance. The Common Misconception: Business and Operations perspectives (Option C) are important for overall cloud adoption, but the CAF specifically notes that People and Governance are the most underaddressed root causes. Therefore, only Option B is correct.

Answer

Platform and Security perspectives

Answer

Business and Operations perspectives

Answer

Platform and Operations perspectives

Question 15

A company wants to centralize backup management across multiple AWS services (EC2, RDS, EFS, DynamoDB) from a single place. Which AWS service provides centralized backup management with policy-based scheduling?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, centralized backup solution that supports multiple AWS services including EC2, RDS, EFS, and DynamoDB. It allows you to define backup policies with schedule-based automation, retention rules, and lifecycle management from a single console, eliminating the need for custom scripts or per-service manual snapshots.

Answer

Amazon S3 Lifecycle policies

Answer

AWS DataSync

Answer

Amazon EBS Snapshots