CLF-C02 Practice Exam 1 — 20 Questions

Question 1

A media company produces video content and stores all videos in Amazon S3. New videos are accessed frequently for the first 30 days after release. After that, access drops significantly, but the company must retain all videos for 5 years for archival purposes. The company wants to minimize storage costs without compromising retrieval speed for the frequently accessed period. Which S3 storage class strategy should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store newly uploaded videos in S3 Standard, then use an S3 Lifecycle policy to transition them to S3 Glacier Deep Archive after 30 days.. It uses S3 Standard for the first 30 days to ensure low-latency retrieval for frequently accessed content, then an S3 Lifecycle policy automatically transitions objects to S3 Glacier Deep Archive, which offers the lowest storage cost for long-term archival data. This balances cost and performance by matching the storage class to the access pattern, and the lifecycle transition is seamless with no manual intervention required.

Answer

Store all videos in S3 Standard for the entire 5-year retention period.

Answer

Store all videos in S3 Glacier Deep Archive immediately upon upload.

Answer

Store newly uploaded videos in S3 One Zone-IA, then transition to S3 Glacier Flexible Retrieval after 30 days.

Question 2

A company moves its infrastructure to AWS. The company's IT team notices that they have no control over which specific physical server their virtual machines run on, and they are unaware of the exact hardware location except at the regional level. The underlying physical resources are shared across multiple AWS customers. Which essential characteristic of cloud computing does this scenario BEST describe?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to customer demand. The scenario describes the customer having no control over the exact physical server or hardware location beyond the regional level, which is the essence of resource pooling. This allows AWS to achieve economies of scale while abstracting the underlying hardware from the customer.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 3

Which AWS service provides managed Microsoft Windows file storage that supports SMB protocol, Active Directory integration, and Windows ACL permissions?

Accepted Answer

Amazon FSx for Windows File Server. Amazon FSx for Windows File Server provides fully managed native Microsoft Windows file storage that supports the Server Message Block (SMB) protocol, integrates with Active Directory for identity-based access, and enforces Windows NTFS ACL permissions. This makes it the only AWS service designed specifically to offer these Windows-native features out of the box.

Answer

Amazon EFS

Answer

Amazon S3

Answer

AWS Storage Gateway

Question 4

A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations allows the company to consolidate multiple AWS accounts under a single management account, enabling consolidated billing for a single monthly invoice and volume pricing discounts. Service Control Policies (SCPs) provide centralized governance by restricting the AWS services and Regions that member accounts can use, such as preventing EC2 instances from being launched outside us-east-1 and eu-west-1. This combination directly addresses both the CFO's billing consolidation needs and the security team's data residency compliance requirements.

Answer

AWS Budgets

Answer

AWS Identity and Access Management (IAM) cross-account roles

Answer

AWS Cost and Usage Reports

Question 5

A gaming company runs a multiplayer game backend on Amazon EC2 instances. The game experiences variable traffic patterns: low usage during weekday mornings and high usage during evenings and weekends. The company uses an Auto Scaling group to automatically add instances during peak hours and remove them during low traffic. The company is billed only for the compute capacity actually consumed during each hour. Which characteristic of cloud computing does this usage-based billing model best illustrate?

Accepted Answer

Measured service. The usage-based billing model, where the company pays only for the compute capacity consumed each hour, is a direct example of measured service. This characteristic of cloud computing involves metering resource usage (e.g., CPU hours, data transfer) and charging based on that consumption, which is exactly what the Auto Scaling group enables by dynamically adjusting instance count and billing only for active hours.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 6

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 7

A company uses AWS Organizations with separate accounts for development, testing, and production. The finance team wants to track monthly spending by internal project, but a single project may use resources across multiple accounts. The team has applied a 'Project' tag to all resources. They need a detailed billing report that shows costs grouped by this Project tag, combining data from all accounts. Which AWS feature should they enable to meet this requirement?

Accepted Answer

AWS Cost and Usage Reports with cost allocation tags activated. AWS Cost and Usage Reports (CUR) with cost allocation tags activated is the correct choice because it provides the most detailed billing data, including all tags, and can be delivered to an S3 bucket for analysis. This allows the finance team to group costs by the 'Project' tag across all accounts in the AWS Organization, meeting the requirement for a detailed, combined report.

Answer

AWS Consolidated Billing

Answer

AWS Cost Explorer with tag filtering

Answer

AWS Budgets with tag-based alerts

Question 8

A company runs a monthly data processing job that requires 100 Amazon EC2 instances to complete within 4 hours. The job is not needed at any other time. The company previously ran this job on its on-premises servers, which required maintaining enough capacity to handle the peak load year-round, leading to low average utilization. The company has now migrated the job to AWS. Each month, the company automatically provisions the 100 instances, runs the job, and then terminates the instances. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Rapid elasticity. This scenario best illustrates rapid elasticity because the company provisions 100 EC2 instances only when needed for the monthly job, scaling up from zero to 100 instances in minutes and then scaling back down to zero after the job completes. Rapid elasticity allows cloud resources to be quickly scaled out (increased) and scaled in (decreased) to match demand, eliminating the need to maintain idle capacity for peak loads.

Answer

Resource pooling

Answer

Measured service

Answer

On-demand self-service

Question 9

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Accepted Answer

Attach an IAM role with the appropriate S3 permissions to the EC2 instance. Attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.

Answer

Hardcode the IAM user access keys in the application code

Answer

Store IAM access keys in environment variables on the EC2 instance

Answer

Create an IAM user and configure the instance with its credentials

Question 10

A company uses multiple AWS accounts. The security team wants to enforce two requirements for all Amazon S3 buckets: first, server-side encryption must be enabled using AWS KMS; second, no bucket can be publicly accessible. The team needs a service that continuously monitors the configuration of S3 buckets across all accounts, detects when a bucket violates either requirement, and automatically applies corrective actions (such as enabling default encryption or removing public access). Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, evaluation, and automated remediation of resource configurations across multiple accounts. With AWS Config rules (e.g., managed rules like `s3-bucket-server-side-encryption-enabled` and `s3-bucket-public-read-prohibited`), you can detect noncompliant S3 buckets and trigger AWS Systems Manager Automation documents or Lambda functions to automatically enable default encryption or remove public access. AWS Config also supports multi-account aggregation via an aggregator, allowing the security team to enforce these requirements across all accounts from a single management account.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 11

A company's cloud finance team wants to implement cloud financial management (FinOps) on AWS. Which combination of AWS services provides the most comprehensive cost visibility, budgeting, and optimization capabilities?

Accepted Answer

CUR + Cost Explorer + Budgets + Cost Allocation Tags + Savings Plans. It combines AWS Cost and Usage Reports (CUR) for granular cost data, Cost Explorer for visualization and analysis, Budgets for proactive alerts, Cost Allocation Tags for cost attribution, and Savings Plans for discounted rates. This integrated set provides end-to-end FinOps capabilities—visibility, budgeting, and optimization—that no single service or partial combination can achieve.

Answer

AWS Cost Explorer only

Answer

AWS Pricing Calculator + CloudWatch Billing Alarms

Answer

AWS Trusted Advisor only

Question 12

A company runs a web application on Amazon EC2 instances. The finance team wants to set a monthly spending limit for the application and receive email alerts when the actual cost exceeds 80% of that limit. Additionally, they want the system to automatically stop non-critical EC2 instances if the cost exceeds the limit. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set a monthly spending limit (budget) and configure cost alerts that trigger when actual or forecasted costs exceed a specified threshold (e.g., 80% of the limit). It also integrates with AWS Actions to automatically stop non-critical EC2 instances when the budget limit is exceeded, meeting both the alert and automated remediation requirements.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 13

A global company has employees who work from various locations and use different devices such as laptops, tablets, and smartphones to access corporate applications. The company plans to migrate its applications to AWS and wants all employees to access these applications directly from the internet using standard web browsers without requiring any dedicated hardware or software at each branch. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes employees accessing corporate applications from various devices and locations using only standard web browsers, without dedicated hardware or software. This directly aligns with the cloud computing characteristic of broad network access, which mandates that resources are accessible over the network by standard mechanisms (e.g., HTTPS, TLS 1.2/1.3) from heterogeneous client platforms (laptops, tablets, smartphones). The key is that no site-to-site VPN appliances or thick client software are required—just a browser and an internet connection.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 14

A company wants to deploy a static website with global low-latency delivery and automatic SSL/TLS certificates. Which combination of AWS services best satisfies both requirements?

Accepted Answer

Amazon S3 + Amazon CloudFront. Amazon S3 provides durable, cost-effective storage for static website content, while Amazon CloudFront acts as a global content delivery network (CDN) that caches content at edge locations for low-latency delivery. CloudFront also integrates with AWS Certificate Manager (ACM) to automatically provision and renew SSL/TLS certificates at no additional cost, enabling HTTPS without manual certificate management.

Answer

Amazon EC2 + Elastic Load Balancing

Answer

AWS Amplify only

Answer

Amazon Lightsail + Route 53

Question 15

Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS’s compliance reports, such as PCI DSS, HIPAA, and SOC 2, as well as the AWS Service Organization Controls (SOC) reports. It allows customers to download and review the specific certifications and attestations that AWS has been validated against, directly supporting audit and compliance needs.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Security Hub

Question 16

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed CI/CD service that orchestrates the build, test, and deploy phases of a release process. It integrates with services like AWS CodeBuild for building and testing, and AWS CodeDeploy for deployment, providing a single pipeline to automate the entire workflow.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 17

A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides a secure, centralized service for storing configuration data and feature flags, with built-in version history for each parameter. It allows applications to read configuration values at runtime via the AWS SDK or CLI without hard-coding, and supports encryption using AWS KMS for sensitive data.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 18

A company has a compliance requirement that all Amazon S3 buckets must have server-side encryption (SSE) enabled and must block all public access. The company has hundreds of existing S3 buckets and creates new ones regularly. The security team needs a centralized AWS service that can continuously evaluate all buckets against these two rules, automatically detect noncompliant buckets, and then automatically remediate them by enabling SSE and blocking public access. Additionally, the team wants to receive notifications when compliance changes occur. Which AWS service should the security team use?

Accepted Answer

AWS Config with managed rules and automatic remediation. AWS Config with managed rules such as 's3-bucket-server-side-encryption-enabled' and 's3-bucket-public-read-prohibited' can continuously evaluate all S3 buckets against these compliance requirements. When a noncompliant bucket is detected, AWS Config can automatically remediate it using SSM Automation documents (e.g., enabling SSE-S3 or SSE-KMS and applying bucket policies to block public access). Additionally, AWS Config can send notifications via Amazon SNS when compliance changes occur, meeting all stated requirements.

Answer

AWS Security Hub

Answer

AWS IAM Access Analyzer

Answer

Amazon Macie

Question 19

A company's compliance team needs to enforce a policy that all Amazon S3 buckets must have 'Block all public access' enabled. If a bucket is created without this setting, the company wants the policy to be automatically remediated within minutes without manual intervention. The solution must check for compliance continuously and apply the fix automatically. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with an AWS Config rule and an automatic remediation action. AWS Config can continuously evaluate the configuration of S3 buckets against a managed rule like 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited'. When a noncompliant bucket is detected, AWS Config can automatically trigger a remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-DisableS3BucketPublicReadWrite') to enable 'Block all public access' within minutes, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)

Question 20

A company processes large amounts of data with Amazon EC2 and exports the results to customers globally via the internet. Which AWS cost component will be their largest variable cost?

Accepted Answer

Data transfer out of AWS to the internet (outbound). Data transfer out of AWS to the internet (outbound) is typically the largest variable cost for workloads that export large results to global customers. AWS charges per GB for outbound data transfer, and rates increase with volume, while inbound data transfer is free. For a company processing large datasets on EC2 and sending results to customers via the internet, outbound traffic dominates the data transfer bill.

Answer

Data transfer into AWS (inbound)

Answer

Data transfer between EC2 instances in the same Availability Zone

Answer

API calls to AWS services