CLF-C02 Practice Test 21 — 15 Questions

Question 1

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates with Application Load Balancers (ALBs) and allows you to use pre-built, AWS-managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) to quickly enable protection at the edge, before traffic reaches the EC2 instances. This meets the requirement for a serverless, managed solution with no infrastructure to maintain.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 2

A company runs a web application on multiple Amazon EC2 instances across two Availability Zones. The application processes user-uploaded documents and must store them in a shared file system that all instances can access simultaneously. The file system must be scalable to petabytes, durable, and fully managed. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, scalable, and durable NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up to petabytes as files are added or removed, and it provides high durability by replicating data across multiple AZs within a region. This makes it the ideal choice for a shared file system that must be accessed simultaneously by all instances.

Answer

Amazon EBS with Multi-Attach enabled

Answer

Amazon S3

Answer

Amazon EC2 Instance Store

Question 3

A company is preparing for a third-party security audit. The auditors require the company to provide up-to-date AWS compliance reports, such as the SOC 2 report and the ISO 27001 certificate, as part of the evidence. The company needs to access these documents from a centralized, self-service portal within their AWS account. They also need to accept the terms and conditions for the reports. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for accessing AWS compliance reports, such as SOC 2 and ISO 27001 certificates, directly within the AWS Management Console. It also allows users to accept the terms and conditions for these reports, fulfilling the audit requirements without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 4

A company runs hundreds of Amazon EC2 instances for its application. The operations team manually reviews instance utilization metrics once a month to identify instances that are over-provisioned (e.g., using only 10% of CPU) or under-provisioned. They want to automate this analysis and receive rightsizing recommendations to optimize costs and performance. The solution must be natively provided by AWS and must use historical utilization data to generate recommendations. Which AWS service should the company use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct choice because it is a native AWS service that uses machine learning to analyze historical utilization metrics (such as CPU, memory, and network) across EC2 instances and automatically generates rightsizing recommendations. It specifically identifies over-provisioned and under-provisioned instances to optimize both cost and performance, meeting the requirement for automated analysis based on historical data.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Systems Manager

Question 5

A company is planning to migrate a legacy application to AWS and wants to estimate the monthly cost of running the new workload. The company needs to compare costs across different Amazon EC2 instance types, regions, and pricing models (On-Demand, Reserved, and Spot). The team also wants to include estimated costs for related services such as Amazon EBS storage and data transfer. Which AWS tool should the company use to generate this cost estimate?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly the Simple Monthly Calculator) is the correct tool because it allows users to estimate monthly costs by selecting specific EC2 instance types, regions, and pricing models (On-Demand, Reserved, Spot), and it also includes estimates for related services like EBS storage and data transfer. This tool provides a detailed, upfront cost comparison before any resources are deployed, which directly matches the company's requirement to compare costs across different configurations.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 6

A company is migrating its IT operations to AWS. Previously, when a developer needed a new server for a project, the developer had to submit a formal request to the IT department. The request would be reviewed, approved, and then a physical server would be procured, configured, and deployed—a process that often took several weeks. After migrating to AWS, the developer can log in to the AWS Management Console and launch a new Amazon EC2 instance with the exact required configuration within minutes, without any interaction with IT staff. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning an EC2 instance directly via the AWS Management Console without any human intervention from IT staff. This aligns with the NIST-defined characteristic of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 7

A startup is planning to migrate its web application to AWS. The CTO wants to estimate the monthly cost of running the application on Amazon EC2 and Amazon RDS, including data transfer costs. The team has not yet created any AWS accounts or resources. They need a tool that allows them to input assumptions about instance types, storage, and data transfer to generate a detailed cost estimate. Which AWS tool should they use?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator (option C) is the correct tool because it allows users to input assumptions about EC2 instance types, RDS configurations, storage, and data transfer to generate a detailed monthly cost estimate before any AWS resources are created. Unlike Cost Explorer, which requires existing usage data, the Pricing Calculator is designed for upfront cost modeling and planning.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 8

A healthcare company is subject to HIPAA regulations and must record all AWS API calls made in its account for auditing. The logs must be retained for 7 years and must be protected from any modification or deletion, including by the account root user. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with S3 Object Lock enabled in compliance mode. AWS CloudTrail with log file validation enabled ensures the integrity of the API call logs by using a digital signature (SHA-256 hash) to detect any tampering. Storing these logs in an Amazon S3 bucket with S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting the objects for the specified retention period (7 years), meeting HIPAA's immutable audit log requirements.

Answer

AWS Config with a HIPAA conformance pack, and store the configuration history in an Amazon S3 bucket with versioning enabled

Answer

Amazon GuardDuty with findings exported to an Amazon S3 bucket, and enable MFA Delete on the bucket

Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with MFA Delete enabled

Question 9

A startup is using the AWS Free Tier for the first time. They have launched an Amazon EC2 t2.micro instance and are storing 10 GB of data in Amazon S3 Standard. The startup wants to ensure they do not incur any charges beyond the Free Tier limits. They need a managed AWS service that can automatically monitor their usage against the Free Tier allowances and send them a notification if they are approaching or exceeding those limits. Which AWS service should the startup use?

Accepted Answer

AWS Budgets. AWS Budgets is the correct service because it allows you to create a cost budget that monitors your actual and forecasted AWS spend against a specified threshold (e.g., the Free Tier limits). You can configure an alert action to send an SNS notification when usage approaches or exceeds the budgeted amount, ensuring proactive notification without manual oversight.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Billing Conductor

Question 10

A company hosts its primary web application on Amazon EC2 instances in the us-east-1 AWS Region. To meet disaster recovery requirements, the company has launched an identical set of EC2 instances in the eu-west-1 Region. The company wants to direct all user traffic to the us-east-1 endpoints under normal conditions. If us-east-1 becomes unhealthy due to a regional outage, traffic must be automatically redirected to the eu-west-1 endpoints. The company uses Amazon Route 53 as its DNS service. Which Route 53 routing policy should the company use to meet these requirements?

Accepted Answer

Failover routing. Failover routing is the correct choice because it allows you to configure an active-passive setup where Route 53 health checks monitor the primary endpoint (us-east-1). If the health check fails, Route 53 automatically routes traffic to the secondary (eu-west-1) endpoint, meeting the disaster recovery requirement.

Answer

Geolocation routing

Answer

Latency routing

Answer

Weighted routing

Question 11

A company has a web application that processes customer orders. The frontend web servers run on Amazon EC2 instances and receive order requests from users. The backend order processing system runs on a separate fleet of EC2 instances. The company wants to decouple these two tiers so that order requests are stored reliably until the backend is ready to process them. The solution must handle occasional traffic spikes without losing any messages and must allow the backend to scale independently. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS reliably stores messages in a queue until the backend order processing system retrieves and processes them, ensuring no messages are lost even during traffic spikes. The backend can independently scale based on the queue depth, and SQS offers at-least-once delivery and exactly-once processing with FIFO queues if needed.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 12

A company wants to deliver its web application content to users across North America, Europe, and Asia with minimal latency. The application runs on Amazon EC2 instances and serves static and dynamic content. Which AWS Cloud concept is most directly supported by using AWS Regions and edge locations to meet this requirement?

Accepted Answer

Global reach. AWS Regions and edge locations are geographically distributed infrastructure components that enable global reach. By deploying the application in multiple Regions (e.g., us-east-1, eu-west-1, ap-southeast-1) and using edge locations via Amazon CloudFront, the company can serve static and dynamic content from locations closer to users, reducing latency across North America, Europe, and Asia. This directly supports the concept of global reach, which is the ability to serve a worldwide user base with low latency.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 13

A startup runs its web application on a few Amazon EC2 instances. Over time, the company scales its infrastructure, adding hundreds more instances to support a growing user base. The company notices that the per-hour cost per instance does not increase as it uses more resources. In fact, AWS has steadily lowered prices for compute and storage services over the years. Which cloud computing concept does this scenario best illustrate?

Accepted Answer

Economies of scale. The scenario describes how AWS's per-hour cost per instance does not increase as usage scales, and AWS has steadily lowered prices over time. This directly illustrates economies of scale, where AWS's massive infrastructure investments and operational efficiencies allow it to pass cost savings to customers as usage grows. The key is that the cost per unit (instance-hour) decreases or remains stable at scale, which is the hallmark of economies of scale, not just the ability to scale resources.

Answer

Elasticity

Answer

Pay-as-you-go pricing

Answer

High availability

Question 14

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Accepted Answer

Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag.. The condition key 'aws:PrincipalTag' in an IAM policy allows you to control access based on tags attached to the IAM principal (the role). By adding a condition that requires 'aws:PrincipalTag/Environment' to equal 'Production', the 'kms:Decrypt' permission is only effective when the IAM role has that specific tag. This directly enforces the security team's requirement at the IAM policy level, which is the appropriate place to restrict permissions based on principal attributes.

Answer

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Answer

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Answer

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Question 15

A multinational company hosts its customer relationship management (CRM) application on AWS. Sales team members access the CRM from various locations using desktop computers, laptops, tablets, and smartphones. They connect over the internet through standard web browsers. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. This scenario best illustrates broad network access because the CRM application is accessed over the internet by sales team members using a variety of devices (desktops, laptops, tablets, smartphones) through standard web browsers. Broad network access is the cloud computing characteristic that defines the ability to access resources via standard protocols (e.g., HTTPS, TLS) from heterogeneous client platforms, which is exactly what is described here.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity