CLF-C02 Practice Test 23 — 15 Questions

Question 1

A company is planning to migrate its on-premises workloads to AWS. The cloud architect needs to create a detailed estimate of the monthly AWS bill based on specific configuration details, such as the number of Amazon EC2 instances with particular instance types, storage volumes, data transfer amounts, and Amazon RDS database instances. The architect wants to input these known specifications and obtain an estimated monthly cost breakdown before launching any resources. Which AWS tool should the architect use to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly AWS Simple Monthly Calculator) allows users to input specific configuration details such as EC2 instance types, storage volumes, data transfer amounts, and RDS database instances to generate a detailed monthly cost estimate before launching any resources. This tool is designed for upfront cost planning and provides a breakdown of estimated charges based on the user's exact specifications, making it the correct choice for the architect's requirement.

Answer

AWS TCO Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 2

A company migrates its workloads to AWS. After the migration, the company receives a monthly invoice that shows precise charges for each service used, such as the exact number of Amazon EC2 instance hours consumed and the amount of data stored in Amazon S3. The company uses this detailed usage data to allocate costs to different departments. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Measured service. The scenario describes how the cloud provider meters and reports usage (e.g., EC2 instance hours, S3 storage amounts) and then bills precisely based on that consumption. This is the definition of 'measured service' — one of the five essential characteristics of cloud computing (NIST SP 800-145), where resource usage is monitored, controlled, and reported, providing transparency for both the provider and consumer.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 3

A company runs a global gaming application on Amazon EC2 instances behind an Application Load Balancer in the us-east-1 Region. Players in Europe and Asia report high latency and intermittent connection drops. The company wants to improve the application's performance for global users by routing traffic over the AWS global network. The company also needs two static IP addresses that users can whitelist in their firewalls for consistent access, and the solution must provide health checks to automatically route traffic away from unhealthy endpoints. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is correct because it uses the AWS global network to route traffic from users to the application, reducing latency and jitter by avoiding the public internet. It provides two static anycast IP addresses that remain consistent for firewall whitelisting, and it integrates with health checks to automatically reroute traffic away from unhealthy EC2 endpoints behind the Application Load Balancer.

Answer

Amazon CloudFront

Answer

AWS WAF

Answer

Amazon Route 53

Question 4

A company stores sensitive audit reports in an Amazon S3 bucket. An external auditor needs to download a specific report for a compliance review. The auditor does not have an AWS account and will only need access for 48 hours. The company wants to provide a secure, time-limited link that allows the auditor to download the file directly from S3 without making the bucket public or requiring the auditor to authenticate with AWS. Which AWS feature should the company use to meet these requirements?

Accepted Answer

S3 presigned URL generated with a 48-hour expiration. An S3 presigned URL allows the company to grant temporary, time-limited access to a specific object in a private S3 bucket without requiring the auditor to have AWS credentials. By generating the URL with a 48-hour expiration, the company meets the exact requirement for secure, time-bound access. The auditor can download the file directly via HTTPS using the presigned URL, which embeds the necessary authentication information.

Answer

S3 bucket policy with a condition that restricts access by IP address

Answer

IAM role with cross-account access for the auditor's AWS account

Answer

CloudFront signed URL using a trusted key group

Question 5

A healthcare company needs to store patient medical records that must be retained for 10 years to comply with regulatory requirements. These records are accessed very rarely, only in the event of an audit or legal request. Which Amazon S3 storage class is the MOST cost-effective choice for this data?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective choice because it is designed for long-term retention of rarely accessed data with a retrieval time of 12–48 hours. The 10-year retention requirement and infrequent access pattern (only during audits or legal requests) align perfectly with this storage class, offering the lowest storage cost among S3 classes while still meeting compliance needs.

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-IA

Question 6

A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It supports automatic rotation every 90 days for Amazon RDS, Aurora, Redshift, and DocumentDB with built-in Lambda rotation functions, and it integrates with IAM for fine-grained access control via resource-based and identity-based policies.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)

Question 7

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum available permissions for all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action when the request includes a public IP address assignment (using the ec2:AssociatePublicIpAddress condition key), you can prevent any EC2 instance from being launched with a public IPv4 address. This control applies automatically to all existing and future member accounts without requiring per-account configuration.

Answer

AWS Config rule with an automatic remediation action that terminates the instance after launch

Answer

IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned

Answer

AWS Firewall Manager security group policy

Question 8

A company runs a critical e-commerce application that uses an Amazon RDS for MySQL database deployed in a single Availability Zone. The company needs to ensure that the database remains available if the underlying hardware or the entire Availability Zone fails. The solution must provide automatic failover with minimal downtime and must not require any changes to the application's database connection string. Which Amazon RDS feature should the company use to meet these requirements?

Accepted Answer

Configure a Multi-AZ deployment for the Amazon RDS database instance. A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, and the DNS record for the database endpoint is updated to point to the standby, so the application's connection string remains unchanged. This provides automatic failover with minimal downtime without requiring any manual intervention or application changes.

Answer

Deploy a Read Replica in another Availability Zone and configure the application to use it as a failover target

Answer

Enable automated backups with point-in-time recovery

Answer

Manually provision a standby database instance in another Availability Zone and configure a custom failover script

Question 9

A company hosts a web application on an Application Load Balancer in the us-east-1 AWS Region. Users are distributed across North America, Europe, and Asia. The company wants to improve application performance and availability for global users by using the AWS global network. The solution must provide two static anycast IP addresses that do not change over time and automatically route incoming traffic to the nearest healthy endpoint in the region. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator with the Application Load Balancer configured as an endpoint. AWS Global Accelerator provides two static anycast IP addresses that serve as fixed entry points to the application. It uses the AWS global network to route traffic to the nearest healthy Application Load Balancer endpoint in us-east-1, automatically rerouting in case of endpoint failure. This meets the requirement for static IPs and performance improvement via the AWS backbone.

Answer

Amazon CloudFront with the Application Load Balancer configured as a custom origin

Answer

Amazon Route 53 with latency-based routing policy

Answer

Amazon S3 Transfer Acceleration

Question 10

A company is developing a mobile application that requires a database to store user session data and preferences. The data is accessed very frequently with low-latency requirements, and the access patterns are unpredictable – the application experiences sudden spikes in read and write traffic. The company wants a fully managed database service that automatically scales to handle the workload, requires no patching or server administration, and charges based on the throughput consumed rather than on provisioned capacity. Which AWS service meets these requirements?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports on-demand capacity mode, which automatically scales to handle unpredictable traffic spikes and charges based on the actual reads and writes consumed, not on pre-provisioned throughput. This eliminates the need for patching, server administration, or capacity planning, matching all the stated requirements exactly.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon EBS

Question 11

A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?

Accepted Answer

IAM Access Analyzer. IAM Access Analyzer is designed to continuously analyze resource-based policies (such as S3 bucket policies and IAM role trust policies) and generate findings when access is granted to principals outside of the trusted AWS Organization. It uses zone of trust logic to identify policies that allow access to external AWS accounts, making it the correct service for this security requirement.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 12

A company runs a web application on AWS that experiences unpredictable traffic spikes. The operations team wants the infrastructure to automatically add compute capacity when demand increases and remove it when demand decreases, without manual intervention. The team also wants to pay only for the compute resources they actually use. Which cloud computing concept does this scenario best describe?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, AWS services like Auto Scaling groups and Amazon EC2 can add instances during traffic spikes and terminate them when demand drops, ensuring the infrastructure matches workload requirements without manual intervention.

Answer

High availability

Answer

Fault tolerance

Answer

Pay-as-you-go

Question 13

A company manages multiple AWS accounts under a single AWS Organizations structure with consolidated billing. The finance team needs to analyze historical cost and usage data across all accounts for the past six months. They want to filter the data by service (e.g., Amazon EC2, Amazon S3), AWS Region, and individual account. Additionally, they want to generate a line chart showing monthly trends and a forecast of future costs based on historical usage patterns. Which AWS tool should the finance team use to meet all of these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides a pre-built dashboard with historical cost and usage data for up to the last 12 months, supports filtering by service (e.g., Amazon EC2, Amazon S3), AWS Region, and linked account (individual account), and can generate line charts showing monthly trends. It also includes a forecasting feature that uses machine learning to predict future costs based on historical usage patterns, meeting all the finance team's requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 14

A company's development team regularly creates temporary test environments. Each time, they log into the AWS Management Console, select the required Amazon EC2 instance types and storage, and launch the resources without needing to contact AWS support or their IT department. The team also terminates the resources when testing is complete. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

On-demand self-service. The scenario describes the development team provisioning and terminating EC2 instances and storage directly through the AWS Management Console without requiring human intervention from AWS support or their IT department. This is the precise definition of on-demand self-service, one of the five essential characteristics of cloud computing as defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 15

A company uses multiple AWS accounts within AWS Organizations. The security team needs to automatically check that no Amazon S3 bucket in any account has public read or write access. They want to define a security rule once and have it evaluated continuously across all accounts. The team also needs to view the overall compliance status from a single dashboard. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited') that can be defined once in a delegated administrator account and automatically evaluated across all member accounts in AWS Organizations. It continuously monitors S3 bucket configurations and aggregates compliance results into a single dashboard (the AWS Config aggregator), meeting the requirement for a unified view of overall compliance status.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Shield