CLF-C02 Practice Test 2 — 10 Questions

Question 1

A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations allows the company to consolidate multiple AWS accounts under a single management account, enabling consolidated billing for a single monthly invoice and volume pricing discounts. Service Control Policies (SCPs) provide centralized governance by restricting the AWS services and Regions that member accounts can use, such as preventing EC2 instances from being launched outside us-east-1 and eu-west-1. This combination directly addresses both the CFO's billing consolidation needs and the security team's data residency compliance requirements.

Answer

AWS Budgets

Answer

AWS Identity and Access Management (IAM) cross-account roles

Answer

AWS Cost and Usage Reports

Question 2

A global company has employees who work from various locations and use different devices such as laptops, tablets, and smartphones to access corporate applications. The company plans to migrate its applications to AWS and wants all employees to access these applications directly from the internet using standard web browsers without requiring any dedicated hardware or software at each branch. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes employees accessing corporate applications from various devices and locations using only standard web browsers, without dedicated hardware or software. This directly aligns with the cloud computing characteristic of broad network access, which mandates that resources are accessible over the network by standard mechanisms (e.g., HTTPS, TLS 1.2/1.3) from heterogeneous client platforms (laptops, tablets, smartphones). The key is that no site-to-site VPN appliances or thick client software are required—just a browser and an internet connection.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 3

A company wants to deploy a static website with global low-latency delivery and automatic SSL/TLS certificates. Which combination of AWS services best satisfies both requirements?

Accepted Answer

Amazon S3 + Amazon CloudFront. Amazon S3 provides durable, cost-effective storage for static website content, while Amazon CloudFront acts as a global content delivery network (CDN) that caches content at edge locations for low-latency delivery. CloudFront also integrates with AWS Certificate Manager (ACM) to automatically provision and renew SSL/TLS certificates at no additional cost, enabling HTTPS without manual certificate management.

Answer

Amazon EC2 + Elastic Load Balancing

Answer

AWS Amplify only

Answer

Amazon Lightsail + Route 53

Question 4

Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS’s compliance reports, such as PCI DSS, HIPAA, and SOC 2, as well as the AWS Service Organization Controls (SOC) reports. It allows customers to download and review the specific certifications and attestations that AWS has been validated against, directly supporting audit and compliance needs.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Security Hub

Question 5

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed CI/CD service that orchestrates the build, test, and deploy phases of a release process. It integrates with services like AWS CodeBuild for building and testing, and AWS CodeDeploy for deployment, providing a single pipeline to automate the entire workflow.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 6

A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides a secure, centralized service for storing configuration data and feature flags, with built-in version history for each parameter. It allows applications to read configuration values at runtime via the AWS SDK or CLI without hard-coding, and supports encryption using AWS KMS for sensitive data.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 7

A company has a compliance requirement that all Amazon S3 buckets must have server-side encryption (SSE) enabled and must block all public access. The company has hundreds of existing S3 buckets and creates new ones regularly. The security team needs a centralized AWS service that can continuously evaluate all buckets against these two rules, automatically detect noncompliant buckets, and then automatically remediate them by enabling SSE and blocking public access. Additionally, the team wants to receive notifications when compliance changes occur. Which AWS service should the security team use?

Accepted Answer

AWS Config with managed rules and automatic remediation. AWS Config with managed rules such as 's3-bucket-server-side-encryption-enabled' and 's3-bucket-public-read-prohibited' can continuously evaluate all S3 buckets against these compliance requirements. When a noncompliant bucket is detected, AWS Config can automatically remediate it using SSM Automation documents (e.g., enabling SSE-S3 or SSE-KMS and applying bucket policies to block public access). Additionally, AWS Config can send notifications via Amazon SNS when compliance changes occur, meeting all stated requirements.

Answer

AWS Security Hub

Answer

AWS IAM Access Analyzer

Answer

Amazon Macie

Question 8

A company's compliance team needs to enforce a policy that all Amazon S3 buckets must have 'Block all public access' enabled. If a bucket is created without this setting, the company wants the policy to be automatically remediated within minutes without manual intervention. The solution must check for compliance continuously and apply the fix automatically. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with an AWS Config rule and an automatic remediation action. AWS Config can continuously evaluate the configuration of S3 buckets against a managed rule like 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited'. When a noncompliant bucket is detected, AWS Config can automatically trigger a remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-DisableS3BucketPublicReadWrite') to enable 'Block all public access' within minutes, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)

Question 9

A company is migrating its on-premises data center to AWS. The Chief Financial Officer (CFO) wants to understand how this migration will change the company's financial structure. Historically, the company purchased servers, networking equipment, and software licenses upfront, with costs depreciating over several years. The CFO notes that the move to AWS will replace these large upfront capital expenditures with smaller, recurring operational expenses based on actual usage. Which essential characteristic of cloud computing enables this shift from capital expenditure (CAPEX) to operational expenditure (OPEX)?

Accepted Answer

Measured service. Measured service is the cloud characteristic that allows providers to track and bill customers for actual resource usage (e.g., compute hours, storage GB-months, data transfer). This pay-as-you-go model directly replaces the need for large upfront capital purchases (CAPEX) with variable, usage-based operational expenses (OPEX), as the CFO requires. Without measured service, AWS would have no mechanism to meter consumption and charge proportionally, making the financial shift impossible.

Answer

Elasticity

Answer

High availability

Answer

Resource pooling

Question 10

A company processes large amounts of data with Amazon EC2 and exports the results to customers globally via the internet. Which AWS cost component will be their largest variable cost?

Accepted Answer

Data transfer out of AWS to the internet (outbound). Data transfer out of AWS to the internet (outbound) is typically the largest variable cost for workloads that export large results to global customers. AWS charges per GB for outbound data transfer, and rates increase with volume, while inbound data transfer is free. For a company processing large datasets on EC2 and sending results to customers via the internet, outbound traffic dominates the data transfer bill.

Answer

Data transfer into AWS (inbound)

Answer

Data transfer between EC2 instances in the same Availability Zone

Answer

API calls to AWS services