CLF-C02 Practice Test 21 — 15 Questions

Question 1

A company uses three separate AWS accounts for development, testing, and production workloads. The security team needs to enforce a policy that prevents users in any account from disabling AWS CloudTrail or deleting CloudTrail log files. The team also wants to consolidate billing and have a single payment method for all accounts. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Organizations. AWS Organizations is the correct service because it allows the security team to create a multi-account structure with a single consolidated billing method and a single payment method across all accounts. Additionally, Organizations supports service control policies (SCPs), which can be applied to the root or individual accounts to explicitly deny actions such as disabling CloudTrail or deleting CloudTrail log files, ensuring enforcement across the development, testing, and production accounts.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. Using a managed rule like 's3-bucket-server-side-encryption-enabled', AWS Config can automatically detect S3 buckets that lack server-side encryption and, through AWS Config rules with auto-remediation (via Systems Manager Automation or Lambda), automatically apply the encryption setting to bring non-compliant buckets into compliance.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 3

A company wants its employees to access cloud applications and manage cloud resources from anywhere using a variety of devices, including laptops, smartphones, and tablets. Which essential characteristic of cloud computing does this requirement directly represent?

Accepted Answer

Broad network access. The requirement for employees to access cloud applications and manage resources from anywhere using laptops, smartphones, and tablets directly represents broad network access. This essential characteristic means that cloud services are available over standard network protocols (e.g., HTTP/HTTPS, SSH) and can be accessed by heterogeneous client platforms, including mobile devices, workstations, and tablets, without requiring location-specific infrastructure.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 4

Which AWS service provides a fully managed message broker supporting ActiveMQ and RabbitMQ protocols for migrating on-premises messaging systems to the cloud?

Accepted Answer

Amazon MQ. Amazon MQ is a fully managed message broker service that supports industry-standard protocols like AMQP (ActiveMQ) and MQTT/STOMP (RabbitMQ), making it ideal for migrating on-premises messaging systems without rewriting code. Unlike Amazon SQS or SNS, which are proprietary AWS services, Amazon MQ provides compatibility with existing ActiveMQ and RabbitMQ-based applications, enabling a seamless lift-and-shift migration to the cloud.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Question 5

A startup is building a prototype web application on AWS and is eligible for the AWS Free Tier. They plan to use a single t2.micro Amazon EC2 instance running continuously (24 hours per day, 7 days per week), 10 GB of Amazon S3 Standard storage, and 1 GB of Amazon RDS for MySQL storage. Which of the following statements accurately describes how these services will be billed during the first 12 months under the Free Tier, assuming they stay within the Free Tier limits for each service?

Accepted Answer

The EC2 instance usage will be free for up to 750 hours per month; the S3 storage will be free for the first 5 GB, with standard charges for the additional 5 GB; the RDS storage will be free for the first 20 GB.. Option B is correct because the AWS Free Tier for EC2 provides 750 hours of t2.micro instance usage per month, not total over 12 months. S3 Standard storage is free for the first 5 GB, so the additional 5 GB incurs standard charges. RDS for MySQL storage is free for the first 20 GB, so the 1 GB used is fully covered.

Answer

All three services are completely free for the entire 12-month period because the startup is using the Free Tier.

Answer

The EC2 instance usage will be free for up to 750 hours per month; the S3 storage will be free for up to 10 GB; the RDS storage will be free for up to 20 GB.

Answer

The EC2 instance usage will be free for the first 750 hours total over the 12-month period; the S3 storage will be free for the first 5 GB; the RDS storage will be free for the first 20 GB.

Question 6

A developer at a company is working on a new feature. The developer needs a test server running a specific version of Linux with certain software pre-installed. Without waiting for approval from the IT team or filling out a request form, the developer logs into the AWS Management Console, chooses an Amazon EC2 instance type, configures the security group, and launches the instance. The instance is fully operational within minutes. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning an EC2 instance directly through the AWS Management Console without any human interaction with the IT team. This is the defining characteristic of on-demand self-service, where a customer can provision computing resources as needed automatically without requiring human interaction with each service provider. The ability to configure the instance type, security group, and launch it in minutes without a request form or approval chain directly maps to this essential cloud characteristic.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Question 7

A company wants to automate the deployment of its infrastructure across multiple AWS environments (development, staging, production). The operations team needs to define all AWS resources (such as Amazon EC2 instances, security groups, and load balancers) in a declarative JSON or YAML template. They want to version control these templates, quickly replicate the entire infrastructure in a new region, and ensure that each deployment is consistent and repeatable. Which AWS service should the company use to achieve this?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it allows you to define all AWS resources (EC2 instances, security groups, load balancers) in a declarative JSON or YAML template. These templates can be version-controlled, enabling you to replicate the entire infrastructure in a new region by simply reusing the same template, ensuring consistent and repeatable deployments across environments.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodePipeline

Question 8

A company uses multiple AWS accounts managed through AWS Organizations. The finance team wants to see a consolidated view of all costs across accounts, and also wants to filter costs by specific projects using custom tags that are applied to resources. The team has already created tag keys and applied them to resources in all accounts. What additional step must the team take in the Management Account to ensure these tags appear as cost allocation dimensions in AWS Cost Explorer?

Accepted Answer

Activate the tag keys for cost allocation tracking.. Option A is correct because in AWS Organizations, custom tags must be explicitly activated for cost allocation tracking in the Management Account's Billing and Cost Management console. Without this activation, the tags exist on resources but are not recognized as cost allocation dimensions in AWS Cost Explorer, so the finance team cannot filter costs by those tags. Activating the tag keys enables Cost Explorer to ingest the tag key-value pairs and present them as filtering dimensions in cost reports.

Answer

Enable the AWS Cost Explorer default reports.

Answer

Create a budget using AWS Budgets with the tag filters.

Answer

Configure the AWS Support plan to include cost analysis.

Question 9

A development team needs to deploy a web application on AWS quickly. The team wants a fully managed service that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring. The team does not want to manage the underlying Amazon EC2 instances or the application stack manually. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a fully managed Platform as a Service (PaaS) that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring without requiring the team to manage the underlying EC2 instances or application stack. It abstracts away infrastructure management, allowing developers to simply upload their code and have the service handle deployment, scaling, and monitoring out of the box.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

Amazon EC2 Auto Scaling

Question 10

A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and records AWS resource configurations, evaluates them against custom rules (like 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'), and provides a compliance dashboard that shows historical compliance status over time. It directly addresses the need for automated, ongoing evaluation of resource configurations against internal security policies.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 11

A development team needs to create a temporary Amazon RDS database for testing a new feature. The team uses the AWS Management Console to launch a db.t3.micro MySQL instance, configures the security group, and connects the application within minutes. When the testing is complete, they terminate the instance without any interaction with AWS support or IT administrators. This ability to provision and manage resources entirely through self-service interfaces best describes which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. Option A is correct because the scenario describes the development team provisioning and terminating an RDS instance entirely through the AWS Management Console without requiring any human interaction with AWS support or IT administrators. This aligns with the NIST definition of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Rapid elasticity

Answer

Measured service

Question 12

A development team wants to deploy a containerized microservices application on AWS. The team wants to minimize operational overhead by not managing any servers or container orchestration control plane. They also want to pay only for the compute and memory resources their containers consume, without needing to provision or scale underlying infrastructure. Which AWS compute service should the team use?

Accepted Answer

Amazon ECS with the AWS Fargate launch type. Amazon ECS with the AWS Fargate launch type is the correct choice because Fargate is a serverless compute engine that removes the need to manage servers or the container orchestration control plane. With Fargate, you define your containerized microservices and pay only for the vCPU and memory resources consumed at the task level, without provisioning or scaling underlying EC2 instances. This directly meets the team's requirement for zero operational overhead and pay-per-consumption billing.

Answer

Amazon EC2 with Amazon ECS using the EC2 launch type

Answer

AWS Elastic Beanstalk with a Docker platform

Answer

AWS Lambda

Question 13

A company has unpredictable, short-lived batch processing workloads that can be interrupted. Which EC2 purchasing option would provide the lowest cost for these workloads?

Accepted Answer

Spot Instances. Spot Instances (Option C) are the correct choice because they offer unused EC2 capacity at steep discounts (up to 90% off On-Demand) and are ideal for fault-tolerant, flexible, short-lived, or interruptible workloads. Since the company's batch processing jobs are unpredictable and can be interrupted, Spot Instances provide the lowest cost while tolerating the risk of termination when AWS needs the capacity back.

Answer

On-Demand Instances

Answer

Reserved Instances (1-year, No Upfront)

Answer

Dedicated Hosts

Question 14

A startup runs an e-commerce website on AWS. During flash sales, traffic can increase 10x in a few minutes. The startup uses an Auto Scaling group to automatically launch additional EC2 instances when CPU utilization exceeds 70% and terminate them when utilization drops below 30%. This approach ensures that the application always has enough capacity to handle the load without manual intervention, and they only pay for what they use. Which cloud computing concept does this scenario BEST illustrate?

Accepted Answer

Elasticity. Option B is correct because elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. The Auto Scaling group dynamically adds EC2 instances when CPU utilization exceeds 70% and terminates them when it drops below 30%, ensuring capacity matches load without manual intervention. This pay-per-use model is a hallmark of elasticity, not just high availability or fault tolerance.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 15

A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated hardware security modules (HSMs) that are under the customer's sole control, meeting PCI DSS requirements for storing encryption keys in a dedicated HSM. It allows you to generate and manage your own encryption keys within a single-tenant, FIPS 140-2 Level 3 validated device, ensuring compliance with the mandate for dedicated hardware.

Answer

AWS KMS with automatic key rotation

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager