CLF-C02 Practice Test 18 — 15 Questions

Question 1

A company runs an e-commerce website on AWS and expects a high volume of traffic during Black Friday. The security team is concerned about potential DDoS attacks overwhelming the infrastructure. The company wants a managed service that provides always-on detection and automatic inline mitigation of DDoS attacks at the network and transport layers (layer 3 and 4), as well as cost protection against scaling charges due to DDoS attacks. Which AWS service should the company use?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides always-on detection and automatic inline mitigation of DDoS attacks at layers 3 and 4 (network and transport layers), such as SYN floods and UDP reflection attacks. Additionally, it offers cost protection against scaling charges incurred due to DDoS-related usage spikes, which directly addresses the company's concern about financial impact from attack-induced scaling.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 2

A company spends over $75,000 per month on AWS services and needs ongoing, proactive cost optimization guidance from a designated AWS expert. The company also requires a 15-minute response time for their most critical production incidents. Which AWS Support plan should the company choose?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the correct choice because it provides a designated Technical Account Manager (TAM) for proactive cost optimization guidance and a 15-minute response time for critical production incidents. The company's monthly spend of over $75,000 and need for ongoing, expert-led cost optimization align with the Enterprise-level support features, which include a TAM who conducts regular business reviews and cost optimization workshops.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 3

According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?

Accepted Answer

Physical security of data center facilities. AWS is responsible for the physical security of data center facilities, including access controls, surveillance, and environmental systems. This is a foundational component of the Shared Responsibility Model, where AWS secures the infrastructure that runs all AWS services, while the customer secures their data and configurations within those services.

Answer

Encrypting customer data stored in Amazon S3

Answer

Configuring security groups for EC2 instances

Answer

Managing IAM user access policies

Question 4

A company runs separate AWS accounts for development, testing, and production workloads. The finance team wants a single view that shows the total spending across all accounts. Additionally, the team wants to benefit from volume discount pricing by aggregating usage across all accounts. The team also needs to allocate costs to individual projects based on custom tags applied to resources. Which AWS feature should the finance team use to meet all these requirements?

Accepted Answer

AWS Organizations consolidated billing. AWS Organizations consolidated billing allows you to aggregate usage across all linked accounts, enabling volume discount pricing (e.g., lower S3 storage rates or EC2 Reserved Instance tiers) based on combined usage. It also provides a single payer account that can view total spending across all accounts, and supports cost allocation using custom tags (e.g., Project or CostCenter) via AWS Cost Explorer or AWS Cost and Usage Reports. This directly meets the finance team's requirements for unified spending visibility, volume discounts, and tag-based cost allocation.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 5

A company's website serves static content—such as images, videos, and CSS files—to a global audience. The company wants to reduce load times for users located far from the primary AWS Region where the application is hosted. Which component of the AWS global infrastructure is specifically designed to cache and deliver this content with low latency from locations close to end users?

Accepted Answer

Edge Locations. Edge Locations are part of AWS CloudFront, a content delivery network (CDN) that caches static content (e.g., images, videos, CSS) at geographically distributed points of presence (PoPs). When a user requests content, CloudFront serves it from the nearest Edge Location, reducing latency and improving load times for global audiences. This makes Edge Locations the correct choice for caching and delivering static content with low latency.

Answer

Regional Edge Caches

Answer

Availability Zones

Answer

AWS Outposts

Question 6

Which AWS service provides a serverless, fully managed Apache Kafka-compatible data streaming service?

Accepted Answer

Amazon MSK (Managed Streaming for Apache Kafka). Amazon MSK (Managed Streaming for Apache Kafka) is the correct answer because it is a fully managed, serverless service that provides Apache Kafka-compatible data streaming. It handles cluster provisioning, scaling, and maintenance, allowing you to run Kafka workloads without managing infrastructure. This directly matches the question's requirement for a serverless, fully managed Apache Kafka-compatible service.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 7

A company runs multiple workloads in separate Amazon VPCs within the same AWS Region. The networking team needs to enable connectivity between all VPCs using private IP addresses. Additionally, the team must connect all VPCs to the company's on-premises data center through a single AWS Site-to-Site VPN connection to minimize costs and simplify management. The solution must support transitive routing so that any VPC can communicate with any other VPC and with the on-premises network. Which AWS service should the networking team use to meet these requirements?

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks through a single VPN attachment, supporting transitive routing between all connected networks. This meets the requirements for private IP connectivity, cost minimization, and simplified management by avoiding the need for full-mesh VPC peering or multiple VPN connections.

Answer

VPC Peering with a VPN attachment to a Virtual Private Gateway

Answer

AWS Direct Connect gateway with VPC associations

Answer

A Network Load Balancer with VPN endpoints

Question 8

A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS environments for suspicious activity, such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior. It integrates natively with AWS Organizations to enable multi-account monitoring and with Amazon CloudWatch Events to trigger automated remediation workflows, directly matching all requirements in the question.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 9

A company runs a web application that allows users to upload images. After each upload, the application must perform several background processing tasks (e.g., resizing, generating thumbnails) that take up to 30 seconds each. Users should receive an immediate response and the processing should continue asynchronously. The company wants a solution that scales automatically with the number of uploads and requires no server management. Which AWS service should the company use to run these background processing tasks?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to events, such as an image upload to Amazon S3. It scales automatically with the number of uploads, requires no server management, and can run background tasks like resizing and thumbnail generation within its 15-minute maximum execution time, easily accommodating the 30-second processing requirement. Users receive an immediate response because the upload triggers Lambda asynchronously, decoupling the frontend from the processing.

Answer

Amazon EC2 with Auto Scaling

Answer

Amazon ECS with AWS Fargate

Answer

AWS Batch

Question 10

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

Accepted Answer

AWS Organizations with Service Control Policies. AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.

Answer

AWS IAM policies

Answer

AWS Config rules

Answer

Amazon GuardDuty

Question 11

A company runs development and test environments on Amazon EC2 instances in separate AWS accounts. The finance team wants to automatically stop all non-production EC2 instances if the monthly development account costs exceed $1,000. The team needs a solution that requires no manual intervention and uses only AWS-native features. Which AWS feature should the team configure to meet these requirements?

Accepted Answer

AWS Budgets with a cost action. AWS Budgets allows you to set a cost budget with a cost action that automatically stops EC2 instances when the threshold is exceeded. This meets the requirement for no manual intervention and uses only AWS-native features, as the cost action can be configured to trigger an IAM policy or a service control policy (SCP) to stop instances in the development account.

Answer

AWS Cost Explorer with a cost allocation tag filter

Answer

AWS Trusted Advisor with the cost optimization check

Answer

Amazon CloudWatch with a billing metric alarm

Question 12

A company stores sensitive financial data in an Amazon S3 bucket. The security policy requires that all data must be encrypted in transit. The security administrator discovers that some automated scripts are using HTTP instead of HTTPS to upload files. The administrator must enforce that any request that does not use HTTPS is denied by the S3 bucket policy. Which condition key should the administrator include in the bucket policy to enforce this requirement?

Accepted Answer

aws:SecureTransport. Option C is correct because the `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). Setting it to `false` denies any request that uses HTTP, enforcing encryption in transit as required by the security policy.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 13

Which Amazon S3 storage class is most cost-effective for data that is accessed frequently?

Accepted Answer

S3 Standard. S3 Standard is the most cost-effective storage class for frequently accessed data because it offers low latency and high throughput with no retrieval costs or minimum storage duration charges. For data accessed often, the per-GB storage cost of S3 Standard is lower than the combined storage plus retrieval costs of infrequent access classes like S3 Standard-IA or One Zone-IA.

Answer

S3 Standard-IA

Answer

S3 Glacier Instant Retrieval

Answer

S3 One Zone-IA

Question 14

A company runs its production web application on a single Amazon EC2 instance located in one Availability Zone. Recently, a power outage in that data center caused the instance to become unavailable, resulting in application downtime. The company wants to redesign the architecture so that the application automatically continues serving users even if a single data center fails, without requiring manual intervention. Which cloud computing concept does this scenario BEST illustrate?

Accepted Answer

High availability. High availability (B) is the correct concept because the scenario describes designing an architecture that automatically continues serving users even if a single data center (Availability Zone) fails, without manual intervention. This is achieved by deploying the application across multiple Availability Zones, using an Elastic Load Balancer to distribute traffic, and configuring Auto Scaling groups to maintain instance health, ensuring the application remains accessible despite a zonal failure.

Answer

Elasticity

Answer

On-demand self-service

Answer

Broad network access

Question 15

A company runs a web application across multiple Amazon EC2 instances that are distributed across several Availability Zones. The application needs to share a common set of configuration files and static assets that must be accessible concurrently and consistently from all instances. The company wants a fully managed, scalable file storage solution that does not require provisioning or managing underlying storage hardware. Which AWS service should the company use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It uses the NFSv4.1 protocol, ensuring consistent access to configuration files and static assets without any provisioning or management of underlying storage hardware.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon Relational Database Service (RDS)