CLF-C02 Practice Test 20 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API calls in their AWS account for compliance and security auditing. Their compliance officer needs to prove to an external auditor that the CloudTrail log files have not been altered or deleted after they were created. The company must use the most cost-effective and built-in AWS feature to detect any tampering with the log files. What should the company enable?

Accepted Answer

Enable CloudTrail log file integrity validation. CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that is signed with a private key, allowing you to verify that log files have not been modified, deleted, or tampered with after delivery. This is a built-in, no-cost feature that directly meets the compliance officer's requirement to prove log integrity to an external auditor without additional services or costs.

Answer

Enable server-side encryption for the CloudTrail log file S3 bucket using SSE-KMS

Answer

Configure CloudTrail to send logs to CloudWatch Logs and set a metric filter for changes

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket

Question 2

A company runs a retail website on AWS. During a promotional event, the website's traffic spikes from 1,000 concurrent users to 100,000 concurrent users in under 5 minutes. The AWS infrastructure automatically provisions additional Amazon EC2 instances to handle the increased load and terminates them when the event ends. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Rapid elasticity. The scenario describes the automatic scaling of EC2 instances from 1,000 to 100,000 concurrent users in under 5 minutes, and then terminating them when the event ends. This directly demonstrates rapid elasticity, which is the ability to provision and release cloud resources quickly and automatically in response to demand, a core characteristic defined by the NIST SP 800-145 standard.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 3

A company uses an Amazon RDS for PostgreSQL database for its production application. The security policy requires that database passwords be rotated automatically every 90 days. The database credentials are currently stored in a configuration file on an Amazon EC2 instance. The company wants a fully managed AWS service that can securely store the credentials, automatically rotate them on a schedule, and update the RDS instance without requiring code changes to the application. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service designed specifically to securely store database credentials, automatically rotate them on a defined schedule (e.g., every 90 days), and natively integrate with Amazon RDS to update the password without requiring any application code changes. The application can retrieve the current credentials at runtime using the Secrets Manager API, eliminating the need for hardcoded or file-based credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 4

A company wants to review its AWS spending for the past six months to identify which services and business units are driving costs. The finance team needs to interactively examine cost trends, filter by service and account, and visualize the data without setting up complex reports. Which AWS service or tool should the company use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, interactive dashboard that allows you to visualize and analyze your AWS cost and usage data over the past 12 months. You can filter by service, linked account (business unit), and time range, and drill down into trends without needing to set up complex reports or queries. This directly meets the requirement for interactive examination of cost trends by service and account.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Reports

Question 5

A company runs a web application on AWS that experiences unpredictable traffic spikes. The company wants to configure its infrastructure to automatically increase compute capacity during peak times and decrease it during low traffic, minimizing costs. Which cloud computing concept does this scenario BEST represent?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically provision and de-provision compute resources in response to real-time demand. In this scenario, AWS Auto Scaling groups can dynamically launch EC2 instances during traffic spikes and terminate them when demand drops, directly matching capacity to load while minimizing cost. This contrasts with static provisioning, which would either over-provision (wasting money) or under-provision (causing outages).

Answer

High availability

Answer

Fault tolerance

Answer

Vertical scaling

Question 6

A company uses AWS for multiple projects. Each project's resources have been tagged with 'Project' and 'Team' tags. The finance team wants to view a cost breakdown in AWS Cost Explorer using these tags. The tags are already applied to existing resources. However, when the finance team opens Cost Explorer, the tags are not available for filtering. What must the finance team do to see costs by these tags?

Accepted Answer

Activate the cost allocation tags in the Billing and Cost Management console.. Cost allocation tags must be explicitly activated in the Billing and Cost Management console before they appear in AWS Cost Explorer. Even though tags are already applied to resources, AWS does not automatically make them available for cost filtering until they are activated as cost allocation tags. This activation process enables the tags to be recognized by billing and cost management services.

Answer

Enable detailed billing reports in the Billing console.

Answer

Create a budget in AWS Budgets and set tag-based filters.

Answer

Use AWS Organizations to create separate accounts per project.

Question 7

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application connects to an Amazon RDS for MySQL database. The database password is currently hardcoded in the application configuration file, and the security team is concerned about the risk of exposure. The company wants to remove the hardcoded credential and instead have the application retrieve the database password securely at runtime. Additionally, the security team requires that the password be automatically rotated every 90 days without any manual intervention or custom scripting. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including RDS for MySQL) without custom code. It supports native, automatic rotation of secrets every 90 days via a built-in Lambda rotation function, meeting the security team's requirement for zero manual intervention. Unlike Parameter Store, Secrets Manager provides automatic rotation out of the box, which is the key differentiator here.

Answer

AWS Systems Manager Parameter Store (SecureString parameters)

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM) roles for Amazon EC2

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

Accepted Answer

Service Control Policies (SCPs) in AWS Organizations. Service Control Policies (SCPs) in AWS Organizations are the correct choice because they allow the security team to centrally define a policy that denies the creation of publicly accessible S3 buckets across all accounts in the organization. SCPs apply to all users, including account administrators, and cannot be overridden by any IAM policy or local account permissions, ensuring organization-wide enforcement.

Answer

AWS Config rules with auto-remediation

Answer

AWS Identity and Access Management (IAM) policies with a Deny effect

Answer

Amazon Macie with automated response

Question 9

A company uses AWS CloudFormation to define and manage its production infrastructure as code. The operations team wants to ensure that any proposed changes to the stack are reviewed and explicitly approved before being applied. Which AWS CloudFormation feature should the company use?

Accepted Answer

AWS CloudFormation Change Sets. AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the operations team to review and explicitly approve changes, ensuring that modifications are not applied automatically without oversight.

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation Stack Policies

Question 10

A company uses AWS for multiple workloads across several linked accounts under AWS Organizations. The finance team needs to analyze historical cost and usage data to identify monthly spending trends by service (e.g., Amazon EC2, Amazon S3) and by linked account. They also need to filter the data by date range and view the top cost drivers. The team prefers a built-in AWS tool that provides an interactive interface with graphs and tables, without requiring them to download or process raw data. Which AWS service or tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a built-in, interactive interface with pre-built graphs and tables that allow the finance team to analyze historical cost and usage data without downloading or processing raw data. It supports filtering by service (e.g., Amazon EC2, Amazon S3), linked account, and date range, and can identify top cost drivers through customizable views and filtering options.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Reports

Question 11

A developer wants to send real-time notifications to mobile app users when new content is available. Which AWS service enables push notifications to iOS and Android devices?

Accepted Answer

Amazon SNS. Amazon SNS (Simple Notification Service) is the correct choice because it provides a fully managed pub/sub messaging service that supports push notifications to mobile endpoints via platform application endpoints for iOS (APNs) and Android (FCM). It enables real-time delivery of messages directly to mobile apps without requiring polling or additional infrastructure.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

AWS AppSync

Question 12

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS Config managed rules with automatic remediation

Answer

IAM Access Analyzer

Question 13

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-kms-encryption-specific-key) that can evaluate whether S3 buckets are encrypted with the required KMS customer-managed key. When a noncompliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule to automatically apply the correct encryption configuration, enabling automated remediation without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to continuously monitor the configurations of all AWS resources across the organization and receive alerts when a resource violates a compliance rule. For example, they want to ensure that all Amazon RDS databases are not publicly accessible, and that any new RDS instance created with public access enabled is automatically flagged. The team does not want to build custom scripts for monitoring. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and recording of AWS resource configurations, and it can evaluate those configurations against custom or managed rules (e.g., 'rds-instance-public-access-check'). When a resource like an RDS instance violates a rule (e.g., being publicly accessible), AWS Config can automatically flag it and trigger an alert via Amazon SNS, all without requiring custom scripts.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

A company uses multiple AWS accounts within AWS Organizations. The security team needs to automatically check that no Amazon S3 bucket in any account has public read or write access. They want to define a security rule once and have it evaluated continuously across all accounts. The team also needs to view the overall compliance status from a single dashboard. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited') that can be defined once in a delegated administrator account and automatically evaluated across all member accounts in AWS Organizations. It continuously monitors S3 bucket configurations and aggregates compliance results into a single dashboard (the AWS Config aggregator), meeting the requirement for a unified view of overall compliance status.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Shield