CLF-C02 Practice Test 19 — 15 Questions

Question 1

A company has a hybrid cloud environment with both on-premises servers and AWS. They want a consistent management experience across both environments. Which AWS service extends the same AWS Systems Manager capabilities to non-AWS servers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Systems Manager with hybrid activations. AWS Systems Manager with hybrid activations allows you to manage on-premises servers and other non-AWS compute resources using the same Systems Manager capabilities (e.g., Run Command, Patch Manager, Inventory) as you use for EC2 instances. By installing the SSM Agent on the non-AWS server and registering it via a hybrid activation, the server appears as a managed instance in Systems Manager, providing a consistent management plane across hybrid environments.

Answer

AWS Outposts

Answer

AWS Direct Connect

Answer

Amazon EC2 Systems Manager

Question 2

A company uses AWS Support and wants to know which plan provides the fastest response time for a business-critical system outage causing complete service disruption.

Accepted Answer

Enterprise Support (15-minute response). AWS Support plans define response times based on severity. For a business-critical system outage (severity-critical, complete service disruption), Enterprise Support provides a 15-minute response time, which is the fastest available. This is explicitly documented in AWS Support plan details, making option C correct.

Answer

Business Support (1-hour response)

Answer

Enterprise On-Ramp (30-minute response)

Answer

Developer Support (12-hour response)

Question 3

Drag and drop the steps to set up a cross-region read replica for Amazon RDS in the correct order.

Accepted Answer

Enable automatic backups on the source DB instance, then create the read replica in the target region, then wait for the replica to be created and synchronized, then optionally promote the replica to a standalone DB instance.. Cross-region read replica: enable backups, configure, create replica, wait, and optionally promote.

Answer

Create the read replica in the target region, then enable automatic backups on the source DB instance, then wait for the replica to be created and synchronized, then optionally promote the replica to a standalone DB instance.

Answer

Enable automatic backups on the source DB instance, then wait for the replica to be created and synchronized, then create the read replica in the target region, then optionally promote the replica to a standalone DB instance.

Answer

Create the read replica in the target region, then wait for the replica to be created and synchronized, then enable automatic backups on the source DB instance, then optionally promote the replica to a standalone DB instance.

Question 4

Which AWS service provides a fully managed NoSQL database with single-digit millisecond latency at any scale?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers consistent single-digit millisecond latency at any scale. It achieves this through its distributed architecture, automatic partitioning, and SSD-backed storage, making it ideal for high-traffic applications like gaming, ad tech, and IoT.

Answer

Amazon RDS

Answer

Amazon ElastiCache

Answer

Amazon Redshift

Question 5

A customer is evaluating moving to AWS and asks about the total cost of ownership (TCO) benefits. Which of the following is NOT a factor that reduces TCO when migrating to AWS?

Accepted Answer

Staff training costs for cloud technologies. Staff training costs for cloud technologies are an additional investment required when migrating to AWS, not a factor that reduces total cost of ownership (TCO). While AWS reduces hardware and facility costs, training represents a new expense for upskilling teams on cloud services like EC2, S3, and IAM, which increases rather than decreases TCO.

Answer

Eliminating hardware refresh cycles

Answer

Reducing data center facility costs

Answer

Pay-as-you-go pricing model

Question 6

Which AWS service provides a managed graph database for storing and querying highly connected data?

Accepted Answer

Amazon Neptune. Amazon Neptune is a fully managed graph database service optimized for storing and querying highly connected data. It supports both property graph models (using Apache TinkerPop Gremlin) and RDF models (using SPARQL), making it ideal for use cases like social networks, fraud detection, and knowledge graphs.

Answer

Amazon DocumentDB

Answer

Amazon Keyspaces

Answer

Amazon QLDB

Question 7

Match each AWS pricing concept to its definition.

Accepted Answer

On-Demand: Pay for compute capacity by the hour or second with no long-term commitments.. On-Demand is pay-as-you-go, Reserved Instances require a term commitment, Spot Instances are interruptible, and Savings Plans offer flexibility. Common confusions include mixing up On-Demand with Spot Instances.

Answer

On-Demand: Pay a low price but instances can be terminated.

Answer

Reserved Instances: Pay only for resources used per second.

Question 8

A company runs a nightly batch processing job on a single on-premises server. The job takes 4 hours to complete, and if the server fails during processing, the job must start over from the beginning. The company is migrating this workload to AWS. The solutions architect proposes running the job across multiple Amazon EC2 instances that process different chunks of data simultaneously. The architect also plans to configure the system so that if any single instance fails, its chunk is automatically reprocessed by another instance, ensuring the overall job still completes. Which benefit of cloud computing does this architecture primarily demonstrate?

Accepted Answer

Horizontal scaling. The architecture distributes the workload across multiple EC2 instances, each processing a separate chunk of data. This is the definition of horizontal scaling (scaling out). If an instance fails, its chunk is automatically reprocessed by another instance, which demonstrates the fault tolerance and parallelism that horizontal scaling enables, not just adding more capacity.

Answer

Elasticity

Answer

High availability

Answer

Global reach

Question 9

A company runs a multi-tier web application on Amazon EC2 instances. The security team wants to continuously monitor the configuration of the EC2 security groups to ensure that no security group allows inbound SSH (port 22) access from the entire internet (0.0.0.0/0). If a security group is modified to allow such access, the company must be automatically notified and provided with a detailed record of the change, including the user who made the change. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule to check for unrestricted SSH access, and Amazon Simple Notification Service (Amazon SNS) to send notifications when the rule is non-compliant.. AWS Config continuously monitors the configuration of AWS resources, including security groups, and can evaluate them against managed rules such as 'restricted-ssh' (which checks that inbound SSH traffic is not allowed from 0.0.0.0/0). When a security group becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the security team, and the detailed configuration history (including the user who made the change via CloudTrail integration) is available in the AWS Config timeline. This combination directly meets the requirements for continuous monitoring, automatic notification, and a detailed record of the change.

Answer

AWS CloudTrail to log all API calls, and Amazon CloudWatch Logs to analyze the logs for security group modifications and trigger a notification.

Answer

AWS Trusted Advisor to check for security groups with unrestricted SSH access on a periodic basis, and Amazon Simple Email Service (Amazon SES) to send email alerts.

Answer

AWS Systems Manager Inventory to collect configuration data from EC2 instances, and Amazon CloudWatch Events to trigger a Lambda function that checks security group rules.

Question 10

A company's sales team uses a cloud-based CRM application hosted on AWS. Sales representatives access the application from various devices—office desktops, company-issued laptops, and personal smartphones—using only standard web browsers and internet connections. No special client software or dedicated network connections are required. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. The scenario describes sales representatives accessing the CRM application from various devices (desktops, laptops, smartphones) using only standard web browsers and internet connections, without requiring special client software or dedicated network connections. This directly illustrates 'broad network access,' which is the ability for resources to be accessed over the network by a wide range of client platforms (e.g., mobile phones, laptops, workstations) using standard protocols (HTTP/HTTPS). The key is that the service is available from anywhere with an internet connection, not limited to a specific location or device type.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 11

A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources shared with external principals by analyzing resource-based policies (such as S3 bucket policies). It can be configured to use a trusted zone (e.g., the AWS Organizations management account or a specific OU) so that any policy granting access to an AWS account outside that zone generates a finding. These findings are aggregated in the IAM Access Analyzer console, providing a centralized dashboard for review.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Service Catalog

Question 12

A company runs an e-commerce website on Amazon EC2 instances behind an Application Load Balancer. The marketing team plans to run flash sales several times a year, which cause unpredictable but massive traffic spikes. The operations team wants the infrastructure to automatically add new EC2 instances when traffic increases and remove them when traffic decreases, without any manual intervention. Which cloud computing concept does this requirement MOST directly represent?

Accepted Answer

Elasticity. The requirement to automatically add EC2 instances during traffic spikes and remove them when traffic decreases directly represents elasticity. Elasticity is the ability to dynamically scale resources up or down based on real-time demand, which is precisely what the operations team needs for unpredictable flash sales. AWS Auto Scaling groups, integrated with the Application Load Balancer, automatically launch or terminate EC2 instances based on CloudWatch alarms (e.g., CPU utilization or request count), matching capacity to load without manual intervention.

Answer

Scalability

Answer

High availability

Answer

Fault tolerance

Question 13

A developer at a company is working on a new feature. The developer needs a test server running a specific version of Linux with certain software pre-installed. Without waiting for approval from the IT team or filling out a request form, the developer logs into the AWS Management Console, chooses an Amazon EC2 instance type, configures the security group, and launches the instance. The instance is fully operational within minutes. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning an EC2 instance directly through the AWS Management Console without any human interaction with the IT team. This is the defining characteristic of on-demand self-service, where a customer can provision computing resources as needed automatically without requiring human interaction with each service provider. The ability to configure the instance type, security group, and launch it in minutes without a request form or approval chain directly maps to this essential cloud characteristic.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Question 14

A company's security team needs to receive near-real-time notifications whenever an IAM user in their AWS account performs an action that violates a defined baseline of expected behavior. Examples include launching an Amazon EC2 instance in an unauthorized AWS Region or modifying a security group to allow public SSH access from the internet. The solution must analyze continuous streams of AWS API activity to identify suspicious patterns and known malicious IP addresses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors AWS API activity, including CloudTrail management events, VPC Flow Logs, and DNS logs, to identify suspicious patterns and known malicious IP addresses. It uses machine learning and integrated threat intelligence to detect anomalous behavior such as launching EC2 instances in unauthorized regions or modifying security groups for public SSH access, and can deliver near-real-time notifications via Amazon EventBridge or SNS. This makes it the correct choice for analyzing continuous streams of API activity and alerting on violations of a defined baseline.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 15

A company has deployed a customer relationship management (CRM) application on AWS. Sales representatives use the application from their office laptops, company-issued tablets, and personal smartphones. They access the application securely through a web browser using HTTPS from any location, including client sites and home offices. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes the ability to access the CRM application from various devices (laptops, tablets, smartphones) over the network using standard protocols (HTTPS). This aligns with the NIST definition of broad network access, which states that capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling