CLF-C02 Practice Exam 4 — 20 Questions

Question 1

A company migrates their self-managed MySQL database running on a virtual machine to Amazon RDS for MySQL, taking advantage of managed backups and Multi-AZ without changing the database schema or application code. Which migration strategy does this represent?

Accepted Answer

Replatform. This is a Replatform (also called 'lift and reshape' or 'platform modernization') migration because the company moves the MySQL database from a self-managed VM to Amazon RDS without changing the database schema or application code. They gain managed backups and Multi-AZ, which are RDS-specific features, but the core database engine and application interface remain unchanged, so no refactoring of the application is required.

Answer

Rehost

Answer

Refactor

Answer

Repurchase

Question 2

A company wants to centralise backup management for all their AWS resources — EC2, EBS, RDS, DynamoDB, and EFS — under a single policy, automate backup schedules, and ensure cross-region backup copies for disaster recovery. Which AWS service provides this?

Accepted Answer

AWS Backup. AWS Backup is the correct choice because it provides a fully managed, centralized backup service that supports EC2, EBS, RDS, DynamoDB, and EFS. It allows you to define a single backup policy, automate backup schedules, and configure cross-region copies for disaster recovery, meeting all the stated requirements.

Answer

Amazon S3 versioning

Answer

AWS Snapshot Manager

Answer

AWS CloudFormation

Question 3

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS WAF logs

Question 4

A small business owner wants to host a simple WordPress website on AWS with a predictable flat monthly price, without learning about VPCs, security groups, instance types, or other AWS complexity. Which AWS service is designed for this simplified use case?

Accepted Answer

Amazon Lightsail. Amazon Lightsail is designed specifically for users who need a simple, predictable monthly pricing model without managing underlying AWS infrastructure like VPCs, security groups, or instance types. It provides pre-configured virtual private servers (VPS) with a fixed monthly cost, including a one-click WordPress deployment, making it ideal for a small business owner who wants to avoid AWS complexity.

Answer

Amazon EC2 with a t3.micro

Answer

AWS Elastic Beanstalk

Answer

AWS Lambda

Question 5

A company has bring-your-own-license (BYOL) server software that is licensed per physical CPU socket. They need to run this software on AWS and require visibility into and control over the physical host their instances run on. Which EC2 option meets this requirement?

Accepted Answer

Dedicated Hosts. Dedicated Hosts provide you with a physical server fully dedicated to your use, allowing you to see and control the physical host's CPU sockets and cores. This is essential for bring-your-own-license (BYOL) software that is licensed per physical CPU socket, as you must ensure compliance with the license terms by managing the exact hardware configuration.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 6

A data team needs to extract data from S3 and RDS, transform it (clean, enrich, join), and load it into Amazon Redshift for analytics. They want a serverless service that discovers and catalogues data schemas automatically and runs the ETL jobs without provisioning servers. Which AWS service provides this?

Accepted Answer

AWS Glue. AWS Glue is a fully managed, serverless ETL service that automatically discovers and catalogs data schemas using its Crawler feature, which populates the AWS Glue Data Catalog. It can extract data from S3 and RDS, transform it (clean, enrich, join), and load it into Amazon Redshift without any server provisioning or management.

Answer

Amazon EMR

Answer

AWS Data Pipeline

Answer

Amazon Kinesis Data Firehose

Question 7

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 8

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS SSO

Question 9

A company wants to deploy a static website with global low-latency delivery and automatic SSL/TLS certificates. Which combination of AWS services best satisfies both requirements?

Accepted Answer

Amazon S3 + Amazon CloudFront. Amazon S3 provides durable, cost-effective storage for static website content, while Amazon CloudFront acts as a global content delivery network (CDN) that caches content at edge locations for low-latency delivery. CloudFront also integrates with AWS Certificate Manager (ACM) to automatically provision and renew SSL/TLS certificates at no additional cost, enabling HTTPS without manual certificate management.

Answer

Amazon EC2 + Elastic Load Balancing

Answer

AWS Amplify only

Answer

Amazon Lightsail + Route 53

Question 10

A retail company wants to implement a recommendation engine based on customer purchase history. Which AWS service is designed to provide ML-based personalized recommendations with no ML experience required?

Accepted Answer

Amazon Personalize. Amazon Personalize is a fully managed AWS service that enables developers to build applications with real-time personalized recommendations without requiring any prior machine learning experience. It uses the same technology that powers Amazon.com's recommendation engine, processing customer purchase history to deliver tailored product suggestions.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 11

Which AWS service provides a fully managed NoSQL database designed for single-digit millisecond performance at any scale?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers consistent single-digit millisecond latency at any scale. It achieves this through its distributed architecture, automatic partitioning, and SSD-backed storage, making it ideal for high-traffic web applications, gaming, and IoT workloads.

Answer

Amazon RDS

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 12

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is the correct choice because it provides managed clusters for Elasticsearch and OpenSearch, enabling log analytics, full-text search, and real-time application monitoring. It integrates with Logstash and Kibana (the ELK stack) and supports the OpenSearch API, making it the direct AWS offering for this use case.

Answer

Amazon CloudSearch

Answer

Amazon Athena

Answer

Amazon Redshift

Question 13

A company needs a managed message queue service that guarantees each message is delivered at least once and supports unlimited message retention. Which AWS service should they use?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is a fully managed message queuing service that guarantees at-least-once delivery by default and supports unlimited message retention (up to 14 days for standard queues, but retention can be extended indefinitely using a dead-letter queue or custom re-queuing logic). This makes it the correct choice for a service that must ensure each message is delivered at least once and can be retained for an unlimited duration.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 14

A solutions architect is planning a new web application on AWS. The workload will include 3 Amazon EC2 instances (t3.medium) running 24/7, an Application Load Balancer, and an Amazon RDS for MySQL db.t3.small database. The architect needs to estimate the monthly cost for the first year, considering different purchasing options (On-Demand, 1-year All Upfront Reserved Instance, and Compute Savings Plan). Which AWS tool should the architect use to create this estimate?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly Simple Monthly Calculator) is the correct tool for estimating monthly costs for specific AWS resources like EC2 instances, ALB, and RDS under different purchasing options (On-Demand, Reserved Instances, Savings Plans). It allows you to input exact instance types, quantities, and commitment terms to generate a detailed cost estimate for the first year.

Answer

AWS Total Cost of Ownership (TCO) Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 15

A company needs to transfer petabytes of data from an on-premises data center to Amazon S3. The network connection is too slow for online transfer and the data must arrive within two weeks. Which AWS service is most appropriate?

Accepted Answer

AWS Snowball Edge. AWS Snowball Edge is the most appropriate service because it provides physical storage devices that can be shipped to the on-premises data center, allowing petabyte-scale data to be loaded locally and shipped back to AWS, bypassing slow network connections entirely. This meets the two-week deadline since network transfer would be infeasible at that scale over a slow link.

Answer

AWS DataSync

Answer

AWS Direct Connect

Answer

Amazon S3 Transfer Acceleration

Question 16

Which AWS pricing model provides the largest discount compared to On-Demand pricing in exchange for a 1 or 3-year commitment with full upfront payment?

Accepted Answer

Reserved Instances (All Upfront, 3-year). Reserved Instances (All Upfront, 3-year) provide the largest discount compared to On-Demand pricing because the customer commits to a 1- or 3-year term and pays the entire amount upfront, which gives AWS predictable capacity planning and reduces billing overhead. This model can offer discounts of up to 72% off On-Demand rates, significantly more than partial upfront or no upfront options, and is the most cost-effective for steady-state workloads.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Compute Savings Plans (1-year, No Upfront)

Question 17

Which AWS service enables developers to add user sign-up, sign-in, and access control to web and mobile applications quickly?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct AWS service for adding user sign-up, sign-in, and access control to web and mobile applications. It provides identity pools and user pools that handle authentication, authorization, and user management, including social identity providers (e.g., Google, Facebook) and enterprise federation via SAML 2.0 or OIDC. This allows developers to quickly integrate these features without building custom backend infrastructure.

Answer

AWS Directory Service

Answer

AWS IAM Identity Center

Answer

AWS IAM

Question 18

Which AWS service is used to send emails, SMS messages, and push notifications to subscribers in a publish/subscribe pattern?

Accepted Answer

Amazon SNS. Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers via multiple protocols, including email (JSON/plain text), SMS (text messages), and push notifications to mobile devices. It decouples message producers from consumers by using topics, where each topic can have multiple subscriber endpoints that receive messages asynchronously.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

Amazon SQS

Question 19

Which AWS service allows you to build, train, and deploy machine learning models at scale?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is the correct answer because it is a fully managed service that provides every component needed for the machine learning lifecycle, including building, training, and deploying models at scale. It offers integrated Jupyter notebooks for development, built-in algorithms, automatic model tuning, and one-click deployment to a production endpoint with auto-scaling. This makes it the single AWS service designed specifically for end-to-end ML workflows, unlike the other options which serve narrower AI/ML functions.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

AWS DeepLens

Question 20

A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?

Accepted Answer

Immediately deactivate or delete the exposed IAM access keys. The immediate priority when IAM access keys are exposed is to revoke their validity to prevent unauthorized use. Deactivating or deleting the keys ensures that any malicious actor who obtained them from the public repository can no longer authenticate as the IAM user, stopping potential data breaches or resource abuse. This aligns with the AWS security best practice of rotating credentials upon suspected compromise.

Answer

Delete the GitHub repository

Answer

Enable MFA for the IAM user

Answer

Move the credentials to a private repository