CLF-C02 Practice Test 20 — 15 Questions

Question 1

A company runs an e-commerce website on AWS and expects a high volume of traffic during Black Friday. The security team is concerned about potential DDoS attacks overwhelming the infrastructure. The company wants a managed service that provides always-on detection and automatic inline mitigation of DDoS attacks at the network and transport layers (layer 3 and 4), as well as cost protection against scaling charges due to DDoS attacks. Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides always-on detection and automatic inline mitigation of DDoS attacks at layers 3 and 4 (network and transport layers), such as SYN floods and UDP reflection attacks. Additionally, it offers cost protection against scaling charges incurred due to DDoS-related usage spikes, which directly addresses the company's concern about financial impact from attack-induced scaling.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 2

A company traditionally operated an on-premises data center and purchased all server hardware and software licenses with upfront capital expenditure. After migrating its workloads to AWS, the company now receives a monthly invoice that reflects only the compute hours, storage, and data transfer that it actually used. The company can also stop paying for resources when they are no longer needed. Which key characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Pay-as-you-go pricing (variable expense). The scenario describes a shift from upfront capital expenditure (buying hardware and licenses) to a model where the company pays only for the compute hours, storage, and data transfer it actually uses, and can stop paying when resources are no longer needed. This directly illustrates the pay-as-you-go pricing characteristic of cloud computing, where costs are variable expenses based on consumption rather than fixed, upfront investments. This model is a fundamental aspect of AWS's pricing philosophy, enabling customers to align costs directly with usage.

Answer

Elasticity

Answer

Global reach

Answer

Security

Question 3

A company runs a customer-facing web application on a single Amazon EC2 instance. To ensure the application remains accessible if the instance fails, the company launches a second EC2 instance in a different Availability Zone and configures an Application Load Balancer to distribute traffic. The application continues to serve users with minimal downtime during the failure of any single instance. This scenario best demonstrates which cloud computing concept?

Accepted Answer

High availability. High availability is the correct concept because the architecture uses redundant EC2 instances in separate Availability Zones behind an Application Load Balancer to eliminate a single point of failure. If one instance fails, the load balancer automatically routes traffic to the healthy instance, ensuring the application remains accessible with minimal downtime. This design specifically addresses fault tolerance and uptime, not the ability to handle variable load or scale resources.

Answer

Elasticity

Answer

Scalability

Answer

Fault tolerance

Question 4

A development team is building a serverless application that processes image uploads to Amazon S3. The application needs to automatically generate a thumbnail version of each uploaded image and store it in a separate S3 bucket. The team wants to minimize operational overhead and only pay for the compute time used during thumbnail generation. Which AWS service should the team use to execute the thumbnail generation code in response to S3 upload events?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that can be triggered directly by S3 events (e.g., s3:ObjectCreated:*). This allows the thumbnail generation code to run automatically in response to each image upload, with no servers to manage and billing based only on the compute time consumed during execution.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate

Answer

Amazon Elastic Beanstalk

Question 5

A company is developing a mobile application backend. The backend needs to process REST API requests that are triggered by user actions in the app. Usage is expected to start low but may spike unpredictably. The development team wants to focus solely on writing code and does not want to manage any servers or containers. The team also wants to only pay for compute time when requests are being processed. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to REST API requests via Amazon API Gateway, automatically scaling from zero to thousands of concurrent executions. The team pays only for the compute time consumed while requests are being processed, with no charges when idle, and they never need to manage servers or containers.

Answer

Amazon EC2 Auto Scaling

Answer

AWS Fargate

Answer

Amazon API Gateway

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to continuously monitor the configurations of all AWS resources across the organization and receive alerts when a resource violates a compliance rule. For example, they want to ensure that all Amazon RDS databases are not publicly accessible, and that any new RDS instance created with public access enabled is automatically flagged. The team does not want to build custom scripts for monitoring. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and recording of AWS resource configurations, and it can evaluate those configurations against custom or managed rules (e.g., 'rds-instance-public-access-check'). When a resource like an RDS instance violates a rule (e.g., being publicly accessible), AWS Config can automatically flag it and trigger an alert via Amazon SNS, all without requiring custom scripts.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 7

A small e-commerce company currently hosts its website on a single physical server in a colocation facility. The company pays a fixed monthly fee for the server, power, and bandwidth, regardless of actual usage. The CTO is evaluating AWS and notes that AWS operates millions of servers across multiple data centers, allowing it to negotiate lower prices for hardware and pass those savings to customers. The CTO expects that migrating to AWS will reduce the company's per-unit costs. Which benefit of cloud computing does this scenario BEST describe?

Accepted Answer

Economy of scale. The scenario describes how AWS leverages its massive scale of operations—millions of servers across multiple data centers—to negotiate lower hardware prices from suppliers and pass those savings to customers. This is the definition of economy of scale: as the volume of production increases, the cost per unit decreases. The CTO expects that migrating to AWS will reduce the company's per-unit costs, which directly aligns with this cloud computing benefit.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 8

A company runs a multi-region application on AWS with separate VPCs in us-east-1 and eu-west-1. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the routing topology so that traffic between all VPCs and the on-premises network flows through a central hub. They need a service that can manage many VPC attachments and provide transitive routing across all connected networks. Which AWS service should the network team use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks via a single gateway, enabling transitive routing between all attached networks. It supports many VPC attachments (up to thousands per gateway) and simplifies routing topology by eliminating the need for complex peering or VPN mesh configurations. This directly meets the requirement for a service that manages many VPC attachments and provides transitive routing across all connected networks.

Answer

Amazon Route 53

Answer

AWS Direct Connect Gateway

Answer

AWS PrivateLink

Question 9

A media company processes user-uploaded images. When a user uploads a high-resolution image to an Amazon S3 bucket, the company must automatically generate three resized thumbnail versions (small, medium, large) within seconds. The company wants a solution that requires no infrastructure management and scales automatically to handle thousands of concurrent uploads. Which AWS service should the company use to execute the thumbnail generation code?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to S3 events (e.g., object creation) without provisioning or managing servers. It scales automatically to handle thousands of concurrent uploads, and the 15-minute execution timeout is sufficient for generating three thumbnail versions within seconds. This meets the requirement for no infrastructure management and automatic scaling.

Answer

Run the thumbnailing code on Amazon EC2 instances behind an Application Load Balancer

Answer

Amazon ECS with AWS Fargate launch type

Answer

AWS Elastic Beanstalk

Question 10

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates with Application Load Balancers (ALBs) and allows you to use pre-built, AWS-managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) to quickly enable protection at the edge, before traffic reaches the EC2 instances. This meets the requirement for a serverless, managed solution with no infrastructure to maintain.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 11

A company runs a web application on multiple Amazon EC2 instances across two Availability Zones. The application processes user-uploaded documents and must store them in a shared file system that all instances can access simultaneously. The file system must be scalable to petabytes, durable, and fully managed. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, scalable, and durable NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up to petabytes as files are added or removed, and it provides high durability by replicating data across multiple AZs within a region. This makes it the ideal choice for a shared file system that must be accessed simultaneously by all instances.

Answer

Amazon EBS with Multi-Attach enabled

Answer

Amazon S3

Answer

Amazon EC2 Instance Store

Question 12

A company is preparing for a third-party security audit. The auditors require the company to provide up-to-date AWS compliance reports, such as the SOC 2 report and the ISO 27001 certificate, as part of the evidence. The company needs to access these documents from a centralized, self-service portal within their AWS account. They also need to accept the terms and conditions for the reports. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for accessing AWS compliance reports, such as SOC 2 and ISO 27001 certificates, directly within the AWS Management Console. It also allows users to accept the terms and conditions for these reports, fulfilling the audit requirements without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 13

A company runs hundreds of Amazon EC2 instances for its application. The operations team manually reviews instance utilization metrics once a month to identify instances that are over-provisioned (e.g., using only 10% of CPU) or under-provisioned. They want to automate this analysis and receive rightsizing recommendations to optimize costs and performance. The solution must be natively provided by AWS and must use historical utilization data to generate recommendations. Which AWS service should the company use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct choice because it is a native AWS service that uses machine learning to analyze historical utilization metrics (such as CPU, memory, and network) across EC2 instances and automatically generates rightsizing recommendations. It specifically identifies over-provisioned and under-provisioned instances to optimize both cost and performance, meeting the requirement for automated analysis based on historical data.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Systems Manager

Question 14

A company is planning to migrate a legacy application to AWS and wants to estimate the monthly cost of running the new workload. The company needs to compare costs across different Amazon EC2 instance types, regions, and pricing models (On-Demand, Reserved, and Spot). The team also wants to include estimated costs for related services such as Amazon EBS storage and data transfer. Which AWS tool should the company use to generate this cost estimate?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly the Simple Monthly Calculator) is the correct tool because it allows users to estimate monthly costs by selecting specific EC2 instance types, regions, and pricing models (On-Demand, Reserved, Spot), and it also includes estimates for related services like EBS storage and data transfer. This tool provides a detailed, upfront cost comparison before any resources are deployed, which directly matches the company's requirement to compare costs across different configurations.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 15

A company is migrating its IT operations to AWS. Previously, when a developer needed a new server for a project, the developer had to submit a formal request to the IT department. The request would be reviewed, approved, and then a physical server would be procured, configured, and deployed—a process that often took several weeks. After migrating to AWS, the developer can log in to the AWS Management Console and launch a new Amazon EC2 instance with the exact required configuration within minutes, without any interaction with IT staff. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning an EC2 instance directly via the AWS Management Console without any human intervention from IT staff. This aligns with the NIST-defined characteristic of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service