CLF-C02 Practice Test 21 — 15 Questions

Question 1

A startup is planning to migrate its web application to AWS. The CTO wants to estimate the monthly cost of running the application on Amazon EC2 and Amazon RDS, including data transfer costs. The team has not yet created any AWS accounts or resources. They need a tool that allows them to input assumptions about instance types, storage, and data transfer to generate a detailed cost estimate. Which AWS tool should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator (option C) is the correct tool because it allows users to input assumptions about EC2 instance types, RDS configurations, storage, and data transfer to generate a detailed monthly cost estimate before any AWS resources are created. Unlike Cost Explorer, which requires existing usage data, the Pricing Calculator is designed for upfront cost modeling and planning.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 2

A healthcare company is subject to HIPAA regulations and must record all AWS API calls made in its account for auditing. The logs must be retained for 7 years and must be protected from any modification or deletion, including by the account root user. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with S3 Object Lock enabled in compliance mode. AWS CloudTrail with log file validation enabled ensures the integrity of the API call logs by using a digital signature (SHA-256 hash) to detect any tampering. Storing these logs in an Amazon S3 bucket with S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting the objects for the specified retention period (7 years), meeting HIPAA's immutable audit log requirements.

Answer

AWS Config with a HIPAA conformance pack, and store the configuration history in an Amazon S3 bucket with versioning enabled

Answer

Amazon GuardDuty with findings exported to an Amazon S3 bucket, and enable MFA Delete on the bucket

Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with MFA Delete enabled

Question 3

A startup is using the AWS Free Tier for the first time. They have launched an Amazon EC2 t2.micro instance and are storing 10 GB of data in Amazon S3 Standard. The startup wants to ensure they do not incur any charges beyond the Free Tier limits. They need a managed AWS service that can automatically monitor their usage against the Free Tier allowances and send them a notification if they are approaching or exceeding those limits. Which AWS service should the startup use?

Accepted Answer

AWS Budgets. AWS Budgets is the correct service because it allows you to create a cost budget that monitors your actual and forecasted AWS spend against a specified threshold (e.g., the Free Tier limits). You can configure an alert action to send an SNS notification when usage approaches or exceeds the budgeted amount, ensuring proactive notification without manual oversight.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Billing Conductor

Question 4

A company hosts its primary web application on Amazon EC2 instances in the us-east-1 AWS Region. To meet disaster recovery requirements, the company has launched an identical set of EC2 instances in the eu-west-1 Region. The company wants to direct all user traffic to the us-east-1 endpoints under normal conditions. If us-east-1 becomes unhealthy due to a regional outage, traffic must be automatically redirected to the eu-west-1 endpoints. The company uses Amazon Route 53 as its DNS service. Which Route 53 routing policy should the company use to meet these requirements?

Accepted Answer

Failover routing. Failover routing is the correct choice because it allows you to configure an active-passive setup where Route 53 health checks monitor the primary endpoint (us-east-1). If the health check fails, Route 53 automatically routes traffic to the secondary (eu-west-1) endpoint, meeting the disaster recovery requirement.

Answer

Geolocation routing

Answer

Latency routing

Answer

Weighted routing

Question 5

A company has a web application that processes customer orders. The frontend web servers run on Amazon EC2 instances and receive order requests from users. The backend order processing system runs on a separate fleet of EC2 instances. The company wants to decouple these two tiers so that order requests are stored reliably until the backend is ready to process them. The solution must handle occasional traffic spikes without losing any messages and must allow the backend to scale independently. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS reliably stores messages in a queue until the backend order processing system retrieves and processes them, ensuring no messages are lost even during traffic spikes. The backend can independently scale based on the queue depth, and SQS offers at-least-once delivery and exactly-once processing with FIFO queues if needed.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 6

A company wants to deliver its web application content to users across North America, Europe, and Asia with minimal latency. The application runs on Amazon EC2 instances and serves static and dynamic content. Which AWS Cloud concept is most directly supported by using AWS Regions and edge locations to meet this requirement?

Accepted Answer

Global reach. AWS Regions and edge locations are geographically distributed infrastructure components that enable global reach. By deploying the application in multiple Regions (e.g., us-east-1, eu-west-1, ap-southeast-1) and using edge locations via Amazon CloudFront, the company can serve static and dynamic content from locations closer to users, reducing latency across North America, Europe, and Asia. This directly supports the concept of global reach, which is the ability to serve a worldwide user base with low latency.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 7

A startup runs its web application on a few Amazon EC2 instances. Over time, the company scales its infrastructure, adding hundreds more instances to support a growing user base. The company notices that the per-hour cost per instance does not increase as it uses more resources. In fact, AWS has steadily lowered prices for compute and storage services over the years. Which cloud computing concept does this scenario best illustrate?

Accepted Answer

Economies of scale. The scenario describes how AWS's per-hour cost per instance does not increase as usage scales, and AWS has steadily lowered prices over time. This directly illustrates economies of scale, where AWS's massive infrastructure investments and operational efficiencies allow it to pass cost savings to customers as usage grows. The key is that the cost per unit (instance-hour) decreases or remains stable at scale, which is the hallmark of economies of scale, not just the ability to scale resources.

Answer

Elasticity

Answer

Pay-as-you-go pricing

Answer

High availability

Question 8

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Accepted Answer

Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag.. The condition key 'aws:PrincipalTag' in an IAM policy allows you to control access based on tags attached to the IAM principal (the role). By adding a condition that requires 'aws:PrincipalTag/Environment' to equal 'Production', the 'kms:Decrypt' permission is only effective when the IAM role has that specific tag. This directly enforces the security team's requirement at the IAM policy level, which is the appropriate place to restrict permissions based on principal attributes.

Answer

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Answer

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Answer

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Question 9

A multinational company hosts its customer relationship management (CRM) application on AWS. Sales team members access the CRM from various locations using desktop computers, laptops, tablets, and smartphones. They connect over the internet through standard web browsers. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. This scenario best illustrates broad network access because the CRM application is accessed over the internet by sales team members using a variety of devices (desktops, laptops, tablets, smartphones) through standard web browsers. Broad network access is the cloud computing characteristic that defines the ability to access resources via standard protocols (e.g., HTTPS, TLS) from heterogeneous client platforms, which is exactly what is described here.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 10

A company's security team manages AWS accounts for multiple business units using AWS Organizations. The security team needs a single place to view and prioritize all security alerts, including findings from Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. The team also wants to automatically run continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark. The solution must provide a consolidated dashboard with automated findings aggregation and compliance score tracking. Which AWS service should the security team choose?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct choice because it provides a single, consolidated dashboard that aggregates security findings from multiple AWS services, including Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. It also performs automated continuous compliance checks against industry standards like the CIS AWS Foundations Benchmark and tracks compliance scores over time, meeting all the stated requirements.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 11

A company runs a production workload on Amazon EC2 and Amazon RDS. The operations team needs technical support with a guaranteed response time of less than 1 hour for critical system issues. They also require access to the full set of AWS Trusted Advisor best practice checks, including cost optimization, security, and fault tolerance recommendations. The company does not want to pay for a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

Accepted Answer

AWS Business Support. The AWS Business Support plan provides a guaranteed response time of less than 1 hour for critical system issues and grants access to the full set of AWS Trusted Advisor best practice checks, including cost optimization, security, and fault tolerance. This plan meets the company's requirements without the need for a dedicated Technical Account Manager (TAM), which is only included in higher-tier plans like Enterprise On-Ramp or Enterprise Support.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise On-Ramp Support

Question 12

Which AWS service is used to distribute incoming application traffic across multiple EC2 instances to improve availability and fault tolerance?

Accepted Answer

Elastic Load Balancing. Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple Amazon EC2 instances in one or more Availability Zones. By doing so, it increases the fault tolerance of your application because if one instance fails, the load balancer routes traffic to the remaining healthy instances, ensuring high availability. ELB supports multiple types (Application, Network, and Gateway Load Balancers) to handle different traffic patterns and protocols.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Auto Scaling

Question 13

A company uses AWS Organizations with multiple accounts for different departments. The finance team applies tags to resources to track costs by department (e.g., Marketing, Engineering) and environment (e.g., Production, Development). However, many resources lack the required tags. The team needs a tool that can automatically allocate costs for untagged resources to specific departments and environments based on rules, and then generate reports that show cost breakdowns by these custom dimensions. The solution must not require custom scripts or manual allocation. Which AWS feature should the finance team use?

Accepted Answer

AWS Cost Categories. AWS Cost Categories is the correct choice because it allows you to automatically allocate costs for untagged or mis-tagged resources to specific departments and environments based on customizable rules (e.g., using resource tags, account IDs, or even chargeback rules). It then generates detailed cost breakdown reports by these custom dimensions without requiring any custom scripts or manual allocation, directly addressing the need for automated cost allocation and reporting.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Resource Groups

Question 14

A media company processes user-uploaded images to generate thumbnails and metadata. The current solution runs a script on a single Amazon EC2 instance, which becomes overloaded during peak hours, causing delays. The company wants a solution that automatically scales to handle spikes in upload volume, requires no server management, and charges only for the processing time consumed. Which AWS service should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it provides a serverless compute service that automatically scales with incoming upload volume, requires no server management, and charges only for the actual processing time (in 1ms increments). The media company's need for automatic scaling, zero server management, and pay-per-use billing aligns perfectly with Lambda's event-driven architecture, where each image upload can trigger a Lambda function to generate thumbnails and metadata without provisioning or managing any underlying infrastructure.

Answer

Amazon EC2 Auto Scaling

Answer

AWS Batch

Answer

Amazon Lightsail

Question 15

A company runs a critical e-commerce application in a single AWS Region. The architecture team wants to ensure the application remains available even if an entire data center fails. They plan to deploy the application across multiple physically separate and independent locations within that Region. Which component of the AWS global infrastructure should the team use to achieve this goal?

Accepted Answer

Availability Zones. Availability Zones (AZs) are physically separate and independent data centers within an AWS Region, each with isolated power, cooling, and networking. By deploying the application across multiple AZs, the architecture ensures that if one entire data center fails, the application continues to run in the other AZs, meeting the goal of high availability within a single Region.

Answer

Edge Locations

Answer

AWS Local Zones

Answer

AWS Regions