CLF-C02 Practice Test 24 — 15 Questions

Question 1

A company has multiple AWS accounts that are consolidated under AWS Organizations. The finance team receives a single monthly bill for all accounts. The team needs to allocate costs to individual departments based on which department owns each resource. They want to see a breakdown of costs by department in the monthly cost report without manually combining data from each account. Which action should the finance team take to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate cost allocation tags, tag all resources with a department identifier, and use Cost Explorer to filter and group costs by the tag.. Activating cost allocation tags and tagging all resources with a department identifier allows the finance team to use Cost Explorer to filter and group costs by that tag. This provides a per-department cost breakdown in the consolidated monthly bill without manual aggregation, leveraging AWS Organizations' consolidated billing and tag-based cost tracking.

Answer

Set up separate payment methods for each department's AWS account so that each department receives its own bill.

Answer

Create a dedicated AWS account for each department and manually sum the charges from each account's monthly bill.

Answer

Use AWS Budgets to set a spending threshold for each department and review the alerts to estimate departmental costs.

Question 2

A company expects a steady baseline usage of AWS compute services (Amazon EC2, AWS Lambda, and AWS Fargate) over the next three years. They want to reduce costs compared to On-Demand pricing while maintaining the flexibility to change instance families, regions, or even switch between compute services (e.g., from EC2 to Lambda) without losing their discount. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plan. The Compute Savings Plan offers the highest flexibility, automatically applying discounts to any compute usage across EC2, Lambda, and Fargate, regardless of instance family, region, or compute service. It provides up to 66% savings over On-Demand while allowing the company to change instance types, regions, or switch between compute services without losing the discount. This matches the requirement for steady baseline usage with maximum flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

EC2 Instance Savings Plan

Question 3

A company has been running multiple workloads on AWS for over six months. The finance team needs to gain visibility into historical cost and usage data, identify which services are driving the most spend, forecast future monthly costs, and receive recommendations for purchasing Reserved Instances to achieve the highest savings. The team wants to use a native AWS tool that provides this functionality without requiring any third-party software. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a native interface for visualizing historical cost and usage data, identifying top spend drivers, forecasting future costs up to 12 months, and generating Reserved Instance (RI) purchase recommendations based on actual usage patterns. It meets all the finance team's requirements without any third-party software.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Question 4

A company runs a mix of Amazon EC2 instances (different instance families) and AWS Fargate tasks across multiple AWS Regions. The cloud operations team wants to reduce costs while retaining maximum flexibility to change instance families, operating systems, and compute platforms (EC2 or Fargate) without losing the discount. They are willing to commit to a consistent amount of compute usage (measured in $/hour) for a 1-year term. Which AWS pricing model should they choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans provide the most flexibility, applying to any EC2 instance family, any operating system, and any compute platform (including Fargate) across any region, as long as the hourly spend commitment is met. This matches the team's requirement to retain maximum flexibility to change instance families, OS, and compute platforms without losing the discount, for a 1-year term.

Answer

EC2 Instance Savings Plans

Answer

Reserved Instances (Standard)

Answer

Dedicated Hosts

Question 5

A hospital is evaluating a move of its patient records system to the AWS Cloud. The hospital's compliance officer is concerned that the underlying physical servers in the cloud are shared with other customers, which could potentially expose sensitive patient data. The hospital wants a clear explanation of how AWS prevents one customer from accessing another customer's data even though they reside on the same physical hardware. Which essential characteristic of cloud computing best describes the mechanism that achieves this isolation?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes how AWS multi-tenancy works: physical resources like servers and storage are pooled to serve multiple customers, but strict logical isolation is enforced through hypervisor-level virtualization. The hypervisor (e.g., Xen or Nitro) ensures each customer's virtual machines operate in separate memory spaces and cannot access another customer's data, even on the same physical host. This isolation is a fundamental design of cloud computing, not a security flaw.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 6

A company runs a web application on multiple Amazon EC2 instances that are behind an Application Load Balancer. The operations team wants to ensure that if any EC2 instance fails, a new instance is automatically launched to replace it and maintain a minimum number of running instances. Which AWS service should the company use to meet this requirement?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is the correct service because it automatically launches new EC2 instances to replace failed ones and maintains a specified minimum number of running instances. It integrates with the Application Load Balancer to register new instances and deregister failed ones, ensuring the web application remains available. This directly meets the requirement for automatic instance replacement and capacity maintenance.

Answer

AWS Elastic Load Balancing

Answer

AWS Lambda

Answer

AWS Auto Scaling

Question 7

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled. An SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.

Answer

AWS Key Management Service (AWS KMS) with automatic key rotation

Answer

Amazon EBS encryption by default at the account level, configured via the EC2 console in each account

Answer

AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation

Question 8

A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized dashboard that aggregates findings from multiple AWS security services, including GuardDuty, Inspector, and Macie. It also offers a consolidated security score and supports automated compliance checks against standards like CIS AWS Foundations, making it the ideal choice for this use case.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 9

A company is designing a highly available application that must remain operational even if a single physical data center fails. The application will be deployed in the us-east-1 Region. The company wants to distribute the application across multiple physical locations within the Region, where each location has independent power, cooling, and networking. Which AWS Global Infrastructure component should the company use to meet this requirement?

Accepted Answer

Availability Zone. Availability Zones (AZs) are distinct physical locations within an AWS Region, each with independent power, cooling, and networking, and are interconnected through low-latency links. By deploying the application across multiple AZs, the company ensures high availability and fault tolerance against the failure of a single physical data center. This directly meets the requirement to remain operational even if one physical data center fails.

Answer

AWS Region

Answer

Edge Location

Answer

Local Zone

Question 10

A company's finance team wants to receive an email alert when monthly AWS costs exceed 80% of the budgeted amount. Additionally, they want to automatically apply a specific IAM policy to restrict further resource provisioning if costs exceed 100% of the budget. Which AWS feature should the team configure to meet both requirements?

Accepted Answer

AWS Budgets with budget actions. AWS Budgets allows you to set cost budgets and configure budget actions that trigger when actual or forecasted costs exceed a threshold. In this scenario, you can create a budget with an alert action to send an email when costs reach 80% of the budget, and a separate budget action (using an IAM policy) to automatically restrict resource provisioning when costs hit 100%. This meets both requirements natively without additional services.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations Service Control Policies (SCPs)

Question 11

A development team needs to create a new Amazon RDS MySQL database for a temporary testing environment. A developer logs into the AWS Management Console, selects the desired instance type, storage, and network settings, and clicks 'Create database'. The database is available within 10 minutes, and the developer did not need to submit a request or wait for IT approval. Which essential characteristic of cloud computing does this process best demonstrate?

Accepted Answer

On-demand self-service. The developer was able to create and provision the RDS MySQL database entirely through the AWS Management Console without any human interaction or approval from IT. This is the core definition of on-demand self-service: a user can provision computing resources as needed automatically, without requiring service provider interaction. The process took only 10 minutes and required no ticket submission, which directly aligns with the NIST definition of on-demand self-service.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 12

A company stores historical sales data in Amazon S3. The data is accessed only once a month for generating quarterly reports. When accessed, the data must be available for retrieval within seconds. The company wants to minimize storage costs while meeting the retrieval latency requirement. Which S3 storage class should the company use?

Accepted Answer

S3 Standard-IA (Infrequent Access). S3 Standard-IA (Infrequent Access) is the correct choice because it offers the same low-latency retrieval (milliseconds) as S3 Standard but at a lower storage cost, making it ideal for data accessed infrequently (e.g., once a month) yet requiring immediate availability. The company's requirement of 'within seconds' is fully met by S3 Standard-IA, which provides the same first-byte latency as S3 Standard, while minimizing storage costs for data that is not accessed frequently.

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Deep Archive

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct AWS Organizations feature because they allow you to centrally control the maximum available permissions for all accounts within an OU. By attaching an SCP that denies all actions in regions other than us-east-1 and eu-west-1, the security team can enforce this restriction across all 'Development' accounts, even if IAM policies within those accounts allow broader access.

Answer

IAM permission boundaries

Answer

Resource-based policies attached to each S3 bucket

Answer

AWS Config rules across all accounts

Question 14

A company hosts a static website on Amazon S3. Users in different geographic locations experience high latency when accessing the website. The company wants to reduce latency for all users and also minimize the number of direct requests to the S3 bucket. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, significantly reducing latency for users regardless of their geographic location. By serving content from the edge, CloudFront also offloads direct requests to the S3 bucket, reducing the load on the origin and potentially lowering costs.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 15

A solutions architect is reviewing an application design to ensure the system can automatically recover from failures, scale horizontally to increase availability, and prevent failures from cascading to other components. Which pillar of the AWS Well-Architected Framework is the architect applying?

Accepted Answer

Reliability. The question focuses on automatic recovery from failures, horizontal scaling for availability, and preventing cascading failures. These are core design principles of the Reliability pillar, which ensures a workload performs its intended function correctly and consistently when expected. The Reliability pillar specifically addresses foundations like distributed system design, recovery procedures, and change management to handle and recover from infrastructure or service disruptions.

Answer

Performance Efficiency

Answer

Operational Excellence

Answer

Security