CLF-C02 Practice Test 23 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum available permissions for all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action when the request includes a public IP address assignment (using the ec2:AssociatePublicIpAddress condition key), you can prevent any EC2 instance from being launched with a public IPv4 address. This control applies automatically to all existing and future member accounts without requiring per-account configuration.

Answer

AWS Config rule with an automatic remediation action that terminates the instance after launch

Answer

IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned

Answer

AWS Firewall Manager security group policy

Question 2

A company runs a critical e-commerce application that uses an Amazon RDS for MySQL database deployed in a single Availability Zone. The company needs to ensure that the database remains available if the underlying hardware or the entire Availability Zone fails. The solution must provide automatic failover with minimal downtime and must not require any changes to the application's database connection string. Which Amazon RDS feature should the company use to meet these requirements?

Accepted Answer

Configure a Multi-AZ deployment for the Amazon RDS database instance. A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, and the DNS record for the database endpoint is updated to point to the standby, so the application's connection string remains unchanged. This provides automatic failover with minimal downtime without requiring any manual intervention or application changes.

Answer

Deploy a Read Replica in another Availability Zone and configure the application to use it as a failover target

Answer

Enable automated backups with point-in-time recovery

Answer

Manually provision a standby database instance in another Availability Zone and configure a custom failover script

Question 3

A company hosts a web application on an Application Load Balancer in the us-east-1 AWS Region. Users are distributed across North America, Europe, and Asia. The company wants to improve application performance and availability for global users by using the AWS global network. The solution must provide two static anycast IP addresses that do not change over time and automatically route incoming traffic to the nearest healthy endpoint in the region. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator with the Application Load Balancer configured as an endpoint. AWS Global Accelerator provides two static anycast IP addresses that serve as fixed entry points to the application. It uses the AWS global network to route traffic to the nearest healthy Application Load Balancer endpoint in us-east-1, automatically rerouting in case of endpoint failure. This meets the requirement for static IPs and performance improvement via the AWS backbone.

Answer

Amazon CloudFront with the Application Load Balancer configured as a custom origin

Answer

Amazon Route 53 with latency-based routing policy

Answer

Amazon S3 Transfer Acceleration

Question 4

A company is developing a mobile application that requires a database to store user session data and preferences. The data is accessed very frequently with low-latency requirements, and the access patterns are unpredictable – the application experiences sudden spikes in read and write traffic. The company wants a fully managed database service that automatically scales to handle the workload, requires no patching or server administration, and charges based on the throughput consumed rather than on provisioned capacity. Which AWS service meets these requirements?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports on-demand capacity mode, which automatically scales to handle unpredictable traffic spikes and charges based on the actual reads and writes consumed, not on pre-provisioned throughput. This eliminates the need for patching, server administration, or capacity planning, matching all the stated requirements exactly.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon EBS

Question 5

A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?

Accepted Answer

IAM Access Analyzer. IAM Access Analyzer is designed to continuously analyze resource-based policies (such as S3 bucket policies and IAM role trust policies) and generate findings when access is granted to principals outside of the trusted AWS Organization. It uses zone of trust logic to identify policies that allow access to external AWS accounts, making it the correct service for this security requirement.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 6

A company runs a web application on AWS that experiences unpredictable traffic spikes. The operations team wants the infrastructure to automatically add compute capacity when demand increases and remove it when demand decreases, without manual intervention. The team also wants to pay only for the compute resources they actually use. Which cloud computing concept does this scenario best describe?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, AWS services like Auto Scaling groups and Amazon EC2 can add instances during traffic spikes and terminate them when demand drops, ensuring the infrastructure matches workload requirements without manual intervention.

Answer

High availability

Answer

Fault tolerance

Answer

Pay-as-you-go

Question 7

A company manages multiple AWS accounts under a single AWS Organizations structure with consolidated billing. The finance team needs to analyze historical cost and usage data across all accounts for the past six months. They want to filter the data by service (e.g., Amazon EC2, Amazon S3), AWS Region, and individual account. Additionally, they want to generate a line chart showing monthly trends and a forecast of future costs based on historical usage patterns. Which AWS tool should the finance team use to meet all of these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides a pre-built dashboard with historical cost and usage data for up to the last 12 months, supports filtering by service (e.g., Amazon EC2, Amazon S3), AWS Region, and linked account (individual account), and can generate line charts showing monthly trends. It also includes a forecasting feature that uses machine learning to predict future costs based on historical usage patterns, meeting all the finance team's requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 8

A company's development team regularly creates temporary test environments. Each time, they log into the AWS Management Console, select the required Amazon EC2 instance types and storage, and launch the resources without needing to contact AWS support or their IT department. The team also terminates the resources when testing is complete. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

On-demand self-service. The scenario describes the development team provisioning and terminating EC2 instances and storage directly through the AWS Management Console without requiring human intervention from AWS support or their IT department. This is the precise definition of on-demand self-service, one of the five essential characteristics of cloud computing as defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 9

A company uses multiple AWS accounts within AWS Organizations. The security team needs to automatically check that no Amazon S3 bucket in any account has public read or write access. They want to define a security rule once and have it evaluated continuously across all accounts. The team also needs to view the overall compliance status from a single dashboard. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited') that can be defined once in a delegated administrator account and automatically evaluated across all member accounts in AWS Organizations. It continuously monitors S3 bucket configurations and aggregates compliance results into a single dashboard (the AWS Config aggregator), meeting the requirement for a unified view of overall compliance status.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Shield

Question 10

A company has multiple AWS accounts that are consolidated under AWS Organizations. The finance team receives a single monthly bill for all accounts. The team needs to allocate costs to individual departments based on which department owns each resource. They want to see a breakdown of costs by department in the monthly cost report without manually combining data from each account. Which action should the finance team take to meet these requirements?

Accepted Answer

Activate cost allocation tags, tag all resources with a department identifier, and use Cost Explorer to filter and group costs by the tag.. Activating cost allocation tags and tagging all resources with a department identifier allows the finance team to use Cost Explorer to filter and group costs by that tag. This provides a per-department cost breakdown in the consolidated monthly bill without manual aggregation, leveraging AWS Organizations' consolidated billing and tag-based cost tracking.

Answer

Set up separate payment methods for each department's AWS account so that each department receives its own bill.

Answer

Create a dedicated AWS account for each department and manually sum the charges from each account's monthly bill.

Answer

Use AWS Budgets to set a spending threshold for each department and review the alerts to estimate departmental costs.

Question 11

A company expects a steady baseline usage of AWS compute services (Amazon EC2, AWS Lambda, and AWS Fargate) over the next three years. They want to reduce costs compared to On-Demand pricing while maintaining the flexibility to change instance families, regions, or even switch between compute services (e.g., from EC2 to Lambda) without losing their discount. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plan. The Compute Savings Plan offers the highest flexibility, automatically applying discounts to any compute usage across EC2, Lambda, and Fargate, regardless of instance family, region, or compute service. It provides up to 66% savings over On-Demand while allowing the company to change instance types, regions, or switch between compute services without losing the discount. This matches the requirement for steady baseline usage with maximum flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

EC2 Instance Savings Plan

Question 12

A company has been running multiple workloads on AWS for over six months. The finance team needs to gain visibility into historical cost and usage data, identify which services are driving the most spend, forecast future monthly costs, and receive recommendations for purchasing Reserved Instances to achieve the highest savings. The team wants to use a native AWS tool that provides this functionality without requiring any third-party software. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a native interface for visualizing historical cost and usage data, identifying top spend drivers, forecasting future costs up to 12 months, and generating Reserved Instance (RI) purchase recommendations based on actual usage patterns. It meets all the finance team's requirements without any third-party software.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Question 13

A company runs a mix of Amazon EC2 instances (different instance families) and AWS Fargate tasks across multiple AWS Regions. The cloud operations team wants to reduce costs while retaining maximum flexibility to change instance families, operating systems, and compute platforms (EC2 or Fargate) without losing the discount. They are willing to commit to a consistent amount of compute usage (measured in $/hour) for a 1-year term. Which AWS pricing model should they choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans provide the most flexibility, applying to any EC2 instance family, any operating system, and any compute platform (including Fargate) across any region, as long as the hourly spend commitment is met. This matches the team's requirement to retain maximum flexibility to change instance families, OS, and compute platforms without losing the discount, for a 1-year term.

Answer

EC2 Instance Savings Plans

Answer

Reserved Instances (Standard)

Answer

Dedicated Hosts

Question 14

A hospital is evaluating a move of its patient records system to the AWS Cloud. The hospital's compliance officer is concerned that the underlying physical servers in the cloud are shared with other customers, which could potentially expose sensitive patient data. The hospital wants a clear explanation of how AWS prevents one customer from accessing another customer's data even though they reside on the same physical hardware. Which essential characteristic of cloud computing best describes the mechanism that achieves this isolation?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes how AWS multi-tenancy works: physical resources like servers and storage are pooled to serve multiple customers, but strict logical isolation is enforced through hypervisor-level virtualization. The hypervisor (e.g., Xen or Nitro) ensures each customer's virtual machines operate in separate memory spaces and cannot access another customer's data, even on the same physical host. This isolation is a fundamental design of cloud computing, not a security flaw.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 15

A company runs a web application on multiple Amazon EC2 instances that are behind an Application Load Balancer. The operations team wants to ensure that if any EC2 instance fails, a new instance is automatically launched to replace it and maintain a minimum number of running instances. Which AWS service should the company use to meet this requirement?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is the correct service because it automatically launches new EC2 instances to replace failed ones and maintains a specified minimum number of running instances. It integrates with the Application Load Balancer to register new instances and deregister failed ones, ensuring the web application remains available. This directly meets the requirement for automatic instance replacement and capacity maintenance.

Answer

AWS Elastic Load Balancing

Answer

AWS Lambda

Answer

AWS Auto Scaling