CLF-C02 Practice Test 22 — 15 Questions

Question 1

A company's security team manages AWS accounts for multiple business units using AWS Organizations. The security team needs a single place to view and prioritize all security alerts, including findings from Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. The team also wants to automatically run continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark. The solution must provide a consolidated dashboard with automated findings aggregation and compliance score tracking. Which AWS service should the security team choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct choice because it provides a single, consolidated dashboard that aggregates security findings from multiple AWS services, including Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. It also performs automated continuous compliance checks against industry standards like the CIS AWS Foundations Benchmark and tracks compliance scores over time, meeting all the stated requirements.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 2

A company runs a production workload on Amazon EC2 and Amazon RDS. The operations team needs technical support with a guaranteed response time of less than 1 hour for critical system issues. They also require access to the full set of AWS Trusted Advisor best practice checks, including cost optimization, security, and fault tolerance recommendations. The company does not want to pay for a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

Accepted Answer

AWS Business Support. The AWS Business Support plan provides a guaranteed response time of less than 1 hour for critical system issues and grants access to the full set of AWS Trusted Advisor best practice checks, including cost optimization, security, and fault tolerance. This plan meets the company's requirements without the need for a dedicated Technical Account Manager (TAM), which is only included in higher-tier plans like Enterprise On-Ramp or Enterprise Support.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise On-Ramp Support

Question 3

Which AWS service is used to distribute incoming application traffic across multiple EC2 instances to improve availability and fault tolerance?

Accepted Answer

Elastic Load Balancing. Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple Amazon EC2 instances in one or more Availability Zones. By doing so, it increases the fault tolerance of your application because if one instance fails, the load balancer routes traffic to the remaining healthy instances, ensuring high availability. ELB supports multiple types (Application, Network, and Gateway Load Balancers) to handle different traffic patterns and protocols.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Auto Scaling

Question 4

A company uses AWS Organizations with multiple accounts for different departments. The finance team applies tags to resources to track costs by department (e.g., Marketing, Engineering) and environment (e.g., Production, Development). However, many resources lack the required tags. The team needs a tool that can automatically allocate costs for untagged resources to specific departments and environments based on rules, and then generate reports that show cost breakdowns by these custom dimensions. The solution must not require custom scripts or manual allocation. Which AWS feature should the finance team use?

Accepted Answer

AWS Cost Categories. AWS Cost Categories is the correct choice because it allows you to automatically allocate costs for untagged or mis-tagged resources to specific departments and environments based on customizable rules (e.g., using resource tags, account IDs, or even chargeback rules). It then generates detailed cost breakdown reports by these custom dimensions without requiring any custom scripts or manual allocation, directly addressing the need for automated cost allocation and reporting.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Resource Groups

Question 5

A media company processes user-uploaded images to generate thumbnails and metadata. The current solution runs a script on a single Amazon EC2 instance, which becomes overloaded during peak hours, causing delays. The company wants a solution that automatically scales to handle spikes in upload volume, requires no server management, and charges only for the processing time consumed. Which AWS service should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it provides a serverless compute service that automatically scales with incoming upload volume, requires no server management, and charges only for the actual processing time (in 1ms increments). The media company's need for automatic scaling, zero server management, and pay-per-use billing aligns perfectly with Lambda's event-driven architecture, where each image upload can trigger a Lambda function to generate thumbnails and metadata without provisioning or managing any underlying infrastructure.

Answer

Amazon EC2 Auto Scaling

Answer

AWS Batch

Answer

Amazon Lightsail

Question 6

A company runs a critical e-commerce application in a single AWS Region. The architecture team wants to ensure the application remains available even if an entire data center fails. They plan to deploy the application across multiple physically separate and independent locations within that Region. Which component of the AWS global infrastructure should the team use to achieve this goal?

Accepted Answer

Availability Zones. Availability Zones (AZs) are physically separate and independent data centers within an AWS Region, each with isolated power, cooling, and networking. By deploying the application across multiple AZs, the architecture ensures that if one entire data center fails, the application continues to run in the other AZs, meeting the goal of high availability within a single Region.

Answer

Edge Locations

Answer

AWS Local Zones

Answer

AWS Regions

Question 7

A company runs a monthly batch data analytics job that requires 50 compute instances for exactly 2 hours. On AWS, the company launches 50 Amazon EC2 instances, runs the job, and then terminates all instances. The company's AWS bill shows a charge for only 100 instance-hours (50 instances × 2 hours). Which essential characteristic of cloud computing does this billing model best demonstrate?

Accepted Answer

Measured service. The billing model charges only for the actual compute time consumed (100 instance-hours), which is a direct application of the 'measured service' characteristic. Measured service means cloud providers meter and bill customers based on actual resource usage (e.g., EC2 instance-hours, storage GB-months), enabling pay-as-you-go pricing. In this scenario, the company is charged precisely for the 50 instances × 2 hours of runtime, with no upfront or fixed costs, demonstrating usage-based metering.

Answer

Resource pooling

Answer

On-demand self-service

Answer

Rapid elasticity

Question 8

A company runs a web application on Amazon EC2 instances that accepts user uploads. The uploads need to be processed by a backend service that performs virus scanning and thumbnail generation. The backend processing can take up to 30 seconds per upload. Users should not experience delays when submitting their files. The company wants to decouple the web tier from the processing tier so that the web application can immediately return a response to the user while the processing happens asynchronously. The solution must be fully managed, durable, and scale automatically with demand. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon SQS is the correct choice because it provides a fully managed, durable, and scalable message queue that decouples the web tier from the processing tier. When a user uploads a file, the web application can immediately return a response after sending a message to an SQS queue, while the backend service polls the queue and processes the upload asynchronously, handling the up-to-30-second processing time without blocking the user.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 9

A company runs a web application that connects to an Amazon RDS for MySQL database. The security policy requires that the database password be rotated every 30 days. The development team wants a fully managed solution that automatically rotates the password, handles the update in RDS, and provides the application with the latest credentials without any code changes. The application should also continue to work during the rotation process. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it provides a fully managed service for automatic password rotation every 30 days, directly integrates with Amazon RDS for MySQL to update the database credentials, and supplies the latest credentials to the application via the Secrets Manager API without requiring any code changes. The rotation process is designed to ensure application availability by using a staged rotation strategy (e.g., creating a new credential while the old one remains valid) so the application continues to work during the rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)

Question 10

A company operates an e-commerce website that sends transactional emails such as order confirmations, password reset links, and shipping updates to customers. The company expects email volume to grow significantly during promotional events. The development team wants a fully managed AWS service that can reliably send high volumes of transactional emails, provide real-time tracking of bounces and complaints, and allow integration through a simple API. The team does not want to manage any email servers. Which AWS service should the team use?

Accepted Answer

Amazon Simple Email Service (Amazon SES). Amazon Simple Email Service (Amazon SES) is a fully managed, cloud-based email sending service designed specifically for sending transactional and marketing emails at high volume. It provides a simple API for integration, real-time tracking of bounces, complaints, and deliveries via Amazon CloudWatch and Amazon SNS notifications, and eliminates the need to manage any email servers. This makes it the ideal choice for the e-commerce company's requirements.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Simple Queue Service (Amazon SQS)

Answer

Amazon Pinpoint

Question 11

A company operates in three separate AWS accounts: one for development, one for testing, and one for production. The company wants to take advantage of volume pricing discounts across all accounts for services such as Amazon S3 and Amazon EC2. The finance team also wants to view a single, consolidated monthly bill that aggregates charges from all accounts. Which AWS feature should the company implement?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing is the correct feature because it allows the company to combine all three AWS accounts (development, testing, production) into a single organization, enabling volume pricing discounts across accounts for services like Amazon S3 and Amazon EC2. It also aggregates usage from all accounts into a single monthly bill, which the finance team can view. This is the only AWS feature that directly provides both consolidated billing and aggregated usage for pricing benefits.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 12

A company is currently running its IT infrastructure in an on-premises data center. The finance department wants to understand how moving to the AWS Cloud would change the company's cost structure. In particular, they want to avoid large upfront hardware purchases and instead pay only for the resources they consume on a monthly basis. Which key cloud computing concept does this shift represent?

Accepted Answer

Pay-as-you-go pricing. Pay-as-you-go pricing is the cloud computing model that allows a company to avoid large upfront capital expenditures on hardware and instead pay only for the resources they consume on a monthly basis. This directly aligns with the finance department's goal of shifting from a capital expenditure (CapEx) model to an operational expenditure (OpEx) model, where costs are incurred based on actual usage rather than upfront purchases.

Answer

Elasticity

Answer

Economies of scale

Answer

High availability

Question 13

A company runs a data processing job once per month. The job takes approximately 3 hours to complete when run on a single server. The company wants to minimize operational overhead and pay only for the compute time used during the job. The job does not require user interaction and must be able to automatically retry if a task fails. Which AWS service should the company use?

Accepted Answer

AWS Batch. AWS Batch is designed for batch computing workloads that run to completion without user interaction. It automatically provisions the necessary compute resources (e.g., EC2 instances or Fargate), scales them to zero when idle, and provides built-in retry logic for failed tasks. This matches the requirement of a monthly 3-hour job with minimal operational overhead and pay-per-use billing.

Answer

AWS Lambda

Answer

Amazon EC2

Answer

AWS Elastic Beanstalk

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any user or role in any member account from disabling AWS CloudTrail or deleting CloudTrail log files from Amazon S3. The team needs a solution that is centrally managed from the management account and applies to all current and future member accounts automatically. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts within an organization. By attaching an SCP that explicitly denies the actions to disable CloudTrail or delete CloudTrail log files from S3, the security team can enforce this policy across all current and future member accounts from the management account, as SCPs automatically apply to new accounts added to the organization.

Answer

AWS Config conformance packs

Answer

IAM permissions boundaries

Answer

AWS CloudTrail data events

Question 15

A company has been using AWS for several months. The finance team wants to view a graphical dashboard of their monthly spending trends for the past 6 months and also obtain a forecast of their expected costs for the next month. The team needs an AWS managed service that provides this visualization and forecasting without requiring any additional data export or third-party tools. Which AWS service should the team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, managed graphical dashboard that visualizes historical spending trends and generates cost forecasts for the next month without requiring any data export or third-party tools. It allows filtering by time range (e.g., past 6 months) and automatically computes a forecast based on historical usage patterns using AWS's internal machine learning models.

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Answer

AWS Trusted Advisor