CLF-C02 Practice Exam 1 — 20 Questions

Question 1

A company publishes a message each time a new product is added to its catalogue. Three services need to receive this message simultaneously: an email notification service, an inventory update service, and an analytics service. Which AWS service should the company use to deliver the message to all three services at the same time?

Accepted Answer

Amazon SNS. Amazon SNS is the correct choice because it is a fully managed pub/sub messaging service designed to deliver messages to multiple subscribers simultaneously. When a new product is added, the company can publish a single message to an SNS topic, and SNS will fan out that message to all three subscribed endpoints (email, inventory, and analytics) in parallel, ensuring they receive it at the same time.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Streams

Answer

AWS EventBridge

Question 2

A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every day and must be highly available and durable. Which S3 storage class is most appropriate for this workload?

Accepted Answer

S3 Standard. S3 Standard is the most appropriate storage class because it offers high durability (99.999999999%) and high availability (99.99%) with low-latency access, making it ideal for frequently accessed, critical data like video thumbnails that are read multiple times daily. It provides automatic replication across a minimum of three Availability Zones, ensuring both high availability and durability without retrieval fees or minimum storage duration penalties.

Answer

S3 One Zone-IA

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard-IA

Question 3

A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their web servers, and automatically redirect traffic to a healthy backup server if the primary server fails. Which AWS service provides all of these capabilities?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a DNS web service that translates domain names to IP addresses. It also offers health checks that monitor the availability of web servers and can automatically route traffic away from unhealthy endpoints to healthy ones using DNS failover routing policies.

Answer

Amazon VPC

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Question 4

A startup runs an application on AWS and receives a monthly bill that charges exactly for the number of compute hours used, the gigabytes of data stored, and the gigabytes of data transferred. The company pays nothing for resources they did not use. Which cloud computing characteristic does this represent?

Accepted Answer

Measured service. This scenario describes a pay-per-use model where costs directly correlate with actual consumption of compute hours, storage, and data transfer. Measured service is the cloud characteristic that enables this by automatically monitoring, controlling, and reporting resource usage, providing transparency for both the provider and consumer. AWS implements this through services like AWS CloudTrail and detailed billing reports, ensuring customers are charged only for what they consume.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Resource pooling

Question 5

A financial institution runs its core banking application on-premises due to regulatory requirements. It has connected its data centre to AWS using AWS Direct Connect and runs analytics workloads on AWS that access data from the on-premises systems. Which cloud deployment model does this describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud deployment because the financial institution maintains its core banking application on an on-premises data center (private infrastructure) while also running analytics workloads on AWS (public cloud). The two environments are connected via AWS Direct Connect, a dedicated network link that enables secure, low-latency data transfer between the on-premises systems and AWS, allowing the analytics workloads to access on-premises data. Hybrid cloud specifically refers to the integration of on-premises private infrastructure with public cloud services, which matches this setup.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 6

A company wants to run a MySQL database in AWS without managing database software installation, applying patches, setting up backups, or configuring replication for high availability. Which AWS service meets these requirements?

Accepted Answer

Amazon RDS. Amazon RDS is a managed database service that automates database software installation, patching, backup, and replication for high availability. By choosing RDS for MySQL, the company offloads these administrative tasks to AWS, meeting the requirement to avoid manual management of the database software, patches, backups, and replication configuration.

Answer

Amazon EC2 with a self-managed MySQL installation

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 7

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

A development team wants to deploy a Python web application to AWS without managing load balancers, auto scaling groups, or the underlying EC2 instance operating systems. They want to upload their code and have AWS handle the infrastructure. Which cloud service model does this represent?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a managed platform where developers can upload code and AWS handles the underlying infrastructure, including load balancing, auto scaling, and OS patching. AWS Elastic Beanstalk is a PaaS service that abstracts EC2 instances, load balancers, and auto scaling groups, allowing the team to focus solely on their Python web application code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Serverless

Question 9

An operations team documents all operational procedures as runbooks, deploys infrastructure using AWS CloudFormation templates stored in version control, and continuously refines their processes based on lessons learned from incidents. Which pillar of the AWS Well-Architected Framework does this represent?

Accepted Answer

Operational Excellence. Operational Excellence focuses on running and monitoring systems to deliver business value, and continually improving processes and procedures. Documenting runbooks, using infrastructure as code (CloudFormation) with version control, and refining processes from incident lessons are core practices of this pillar, as they enable repeatable, auditable, and continuously improving operations.

Answer

Reliability

Answer

Security

Answer

Cost Optimisation

Question 10

A startup's development team wants to deploy their Node.js web application to AWS without learning about load balancers, auto scaling, or EC2 configuration. They want to simply upload their application code and have AWS handle everything else. Which AWS service is designed for this use case?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct service because it is a Platform as a Service (PaaS) offering that automatically handles capacity provisioning, load balancing, auto scaling, and application health monitoring. The development team can simply upload their Node.js application code, and Elastic Beanstalk deploys it on pre-configured EC2 instances without requiring any manual configuration of infrastructure components.

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Answer

Amazon ECS

Question 11

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

Accepted Answer

Attach an IAM role to the EC2 instance. Option C is correct because an IAM role can be attached to an EC2 instance, allowing the instance to obtain temporary security credentials from AWS STS via the instance metadata service. This eliminates the need to store long-term access keys on the instance, satisfying the security team's requirement. The EC2 instance automatically rotates these temporary credentials before they expire, providing secure, programmatic access to the S3 bucket.

Answer

Create an IAM user and embed the access key in the application code

Answer

Store the access key in an EC2 environment variable

Answer

Use an IAM group to assign the permissions to the EC2 instance

Question 12

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans (including CVEs) and network reachability assessments on EC2 instances. It uses a combination of AWS security best practices and common vulnerability databases to identify software vulnerabilities and unintended network access paths, such as open ports or overly permissive security groups.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Shield

Question 13

A company wants to monitor the CPU utilisation of their EC2 instances and automatically send an email alert when utilisation exceeds 80% for more than 5 consecutive minutes. Which AWS service provides this monitoring and alerting capability?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides both monitoring of EC2 CPU utilization metrics and the ability to create CloudWatch Alarms that trigger actions, such as sending an email via Amazon SNS, when a metric like CPUUtilization exceeds a threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 5 minutes). This directly fulfills the requirement for monitoring and alerting on CPU utilization.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS X-Ray

Question 14

A company's public-facing web application is being attacked with SQL injection and cross-site scripting (XSS) attempts. Which AWS service should they deploy to detect and block these web application attacks?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules to filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, or request body patterns, and can block malicious traffic before it reaches your application.

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 15

A company operates 8 separate AWS accounts for different departments. They want to receive one consolidated monthly bill and benefit from combined usage discounts across all accounts for services like S3 and data transfer. Which AWS feature provides this?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows you to combine usage across all accounts in the organization to receive a single monthly bill and aggregate usage for volume discounts on services like S3 and data transfer. This feature enables you to centrally manage billing and take advantage of tiered pricing based on combined usage, which is exactly what the company needs.

Answer

AWS Cost Explorer across all accounts

Answer

AWS Budgets across all accounts

Answer

AWS Support Plan upgrade to Enterprise tier

Question 16

A company wants to analyse petabytes of historical sales data using standard SQL queries and connect their existing business intelligence (BI) tools to the data store. The workload is analytical (OLAP), not transactional (OLTP). Which AWS service is designed for this use case?

Accepted Answer

Amazon Redshift. Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed for analytical (OLAP) workloads. It uses standard SQL and integrates directly with popular BI tools via JDBC/ODBC connections, making it ideal for querying large historical datasets and connecting existing business intelligence tools.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Aurora

Question 17

A company wants all IAM users to verify their identity with both a password and a one-time code from an authenticator app before accessing the AWS Management Console. Which security control should the company enable?

Accepted Answer

Multi-Factor Authentication (MFA). Multi-Factor Authentication (MFA) is the correct security control because it requires users to present two independent factors: something they know (password) and something they have (a one-time code from an authenticator app). This satisfies the company's requirement for both a password and a one-time code before accessing the AWS Management Console, significantly reducing the risk of unauthorized access even if a password is compromised.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Cognito

Question 18

A healthcare company stores patient records in Amazon S3 buckets across multiple accounts and needs to automatically discover and classify any objects containing personally identifiable information (PII) or protected health information (PHI). Which AWS service provides this capability?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is specifically designed to identify personally identifiable information (PII) and protected health information (PHI) by analyzing object metadata and content, making it the correct choice for this healthcare compliance use case.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 19

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the central resource for downloading AWS compliance reports, including SOC 2 Type II reports and ISO 27001 certifications. It provides on-demand access to these documents, which auditors require as evidence of AWS's adherence to regulatory standards. This service is specifically designed for compliance and audit use cases, making it the correct choice.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 20

A company runs non-critical batch analytics jobs that can be paused and restarted if interrupted. The jobs are flexible regarding when they run. Which EC2 purchasing option offers the lowest possible cost for this workload?

Accepted Answer

Spot Instances. Spot Instances offer the lowest possible cost because they use spare AWS EC2 capacity at a steep discount (up to 90% off On-Demand). Since the batch analytics jobs are non-critical, can be paused and restarted, and are flexible regarding when they run, they are an ideal fit for Spot Instances, which can be interrupted with a 2-minute warning when capacity is reclaimed.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances