CLF-C02 Practice Test 2 — 10 Questions

Question 1

A company's cloud finance team wants to implement cloud financial management (FinOps) on AWS. Which combination of AWS services provides the most comprehensive cost visibility, budgeting, and optimization capabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CUR + Cost Explorer + Budgets + Cost Allocation Tags + Savings Plans. It combines AWS Cost and Usage Reports (CUR) for granular cost data, Cost Explorer for visualization and analysis, Budgets for proactive alerts, Cost Allocation Tags for cost attribution, and Savings Plans for discounted rates. This integrated set provides end-to-end FinOps capabilities—visibility, budgeting, and optimization—that no single service or partial combination can achieve.

Answer

AWS Cost Explorer only

Answer

AWS Pricing Calculator + CloudWatch Billing Alarms

Answer

AWS Trusted Advisor only

Question 2

A company runs a web application on Amazon EC2 instances. The finance team wants to set a monthly spending limit for the application and receive email alerts when the actual cost exceeds 80% of that limit. Additionally, they want the system to automatically stop non-critical EC2 instances if the cost exceeds the limit. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set a monthly spending limit (budget) and configure cost alerts that trigger when actual or forecasted costs exceed a specified threshold (e.g., 80% of the limit). It also integrates with AWS Actions to automatically stop non-critical EC2 instances when the budget limit is exceeded, meeting both the alert and automated remediation requirements.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 3

A global company has employees who work from various locations and use different devices such as laptops, tablets, and smartphones to access corporate applications. The company plans to migrate its applications to AWS and wants all employees to access these applications directly from the internet using standard web browsers without requiring any dedicated hardware or software at each branch. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes employees accessing corporate applications from various devices and locations using only standard web browsers, without dedicated hardware or software. This directly aligns with the cloud computing characteristic of broad network access, which mandates that resources are accessible over the network by standard mechanisms (e.g., HTTPS, TLS 1.2/1.3) from heterogeneous client platforms (laptops, tablets, smartphones). The key is that no site-to-site VPN appliances or thick client software are required—just a browser and an internet connection.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 4

A company wants to deploy a static website with global low-latency delivery and automatic SSL/TLS certificates. Which combination of AWS services best satisfies both requirements?

Accepted Answer

Amazon S3 + Amazon CloudFront. Amazon S3 provides durable, cost-effective storage for static website content, while Amazon CloudFront acts as a global content delivery network (CDN) that caches content at edge locations for low-latency delivery. CloudFront also integrates with AWS Certificate Manager (ACM) to automatically provision and renew SSL/TLS certificates at no additional cost, enabling HTTPS without manual certificate management.

Answer

Amazon EC2 + Elastic Load Balancing

Answer

AWS Amplify only

Answer

Amazon Lightsail + Route 53

Question 5

Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS’s compliance reports, such as PCI DSS, HIPAA, and SOC 2, as well as the AWS Service Organization Controls (SOC) reports. It allows customers to download and review the specific certifications and attestations that AWS has been validated against, directly supporting audit and compliance needs.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Security Hub

Question 6

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed CI/CD service that orchestrates the build, test, and deploy phases of a release process. It integrates with services like AWS CodeBuild for building and testing, and AWS CodeDeploy for deployment, providing a single pipeline to automate the entire workflow.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 7

A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides a secure, centralized service for storing configuration data and feature flags, with built-in version history for each parameter. It allows applications to read configuration values at runtime via the AWS SDK or CLI without hard-coding, and supports encryption using AWS KMS for sensitive data.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 8

A company has a compliance requirement that all Amazon S3 buckets must have server-side encryption (SSE) enabled and must block all public access. The company has hundreds of existing S3 buckets and creates new ones regularly. The security team needs a centralized AWS service that can continuously evaluate all buckets against these two rules, automatically detect noncompliant buckets, and then automatically remediate them by enabling SSE and blocking public access. Additionally, the team wants to receive notifications when compliance changes occur. Which AWS service should the security team use?

Accepted Answer

AWS Config with managed rules and automatic remediation. AWS Config with managed rules such as 's3-bucket-server-side-encryption-enabled' and 's3-bucket-public-read-prohibited' can continuously evaluate all S3 buckets against these compliance requirements. When a noncompliant bucket is detected, AWS Config can automatically remediate it using SSM Automation documents (e.g., enabling SSE-S3 or SSE-KMS and applying bucket policies to block public access). Additionally, AWS Config can send notifications via Amazon SNS when compliance changes occur, meeting all stated requirements.

Answer

AWS Security Hub

Answer

AWS IAM Access Analyzer

Answer

Amazon Macie

Question 9

A company's compliance team needs to enforce a policy that all Amazon S3 buckets must have 'Block all public access' enabled. If a bucket is created without this setting, the company wants the policy to be automatically remediated within minutes without manual intervention. The solution must check for compliance continuously and apply the fix automatically. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with an AWS Config rule and an automatic remediation action. AWS Config can continuously evaluate the configuration of S3 buckets against a managed rule like 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited'. When a noncompliant bucket is detected, AWS Config can automatically trigger a remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-DisableS3BucketPublicReadWrite') to enable 'Block all public access' within minutes, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)

Question 10

A company processes large amounts of data with Amazon EC2 and exports the results to customers globally via the internet. Which AWS cost component will be their largest variable cost?

Accepted Answer

Data transfer out of AWS to the internet (outbound). Data transfer out of AWS to the internet (outbound) is typically the largest variable cost for workloads that export large results to global customers. AWS charges per GB for outbound data transfer, and rates increase with volume, while inbound data transfer is free. For a company processing large datasets on EC2 and sending results to customers via the internet, outbound traffic dominates the data transfer bill.

Answer

Data transfer into AWS (inbound)

Answer

Data transfer between EC2 instances in the same Availability Zone

Answer

API calls to AWS services