CLF-C02 Practice Test 24 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled. An SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.

Answer

AWS Key Management Service (AWS KMS) with automatic key rotation

Answer

Amazon EBS encryption by default at the account level, configured via the EC2 console in each account

Answer

AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation

Question 2

A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized dashboard that aggregates findings from multiple AWS security services, including GuardDuty, Inspector, and Macie. It also offers a consolidated security score and supports automated compliance checks against standards like CIS AWS Foundations, making it the ideal choice for this use case.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 3

A company is designing a highly available application that must remain operational even if a single physical data center fails. The application will be deployed in the us-east-1 Region. The company wants to distribute the application across multiple physical locations within the Region, where each location has independent power, cooling, and networking. Which AWS Global Infrastructure component should the company use to meet this requirement?

Accepted Answer

Availability Zone. Availability Zones (AZs) are distinct physical locations within an AWS Region, each with independent power, cooling, and networking, and are interconnected through low-latency links. By deploying the application across multiple AZs, the company ensures high availability and fault tolerance against the failure of a single physical data center. This directly meets the requirement to remain operational even if one physical data center fails.

Answer

AWS Region

Answer

Edge Location

Answer

Local Zone

Question 4

A company's finance team wants to receive an email alert when monthly AWS costs exceed 80% of the budgeted amount. Additionally, they want to automatically apply a specific IAM policy to restrict further resource provisioning if costs exceed 100% of the budget. Which AWS feature should the team configure to meet both requirements?

Accepted Answer

AWS Budgets with budget actions. AWS Budgets allows you to set cost budgets and configure budget actions that trigger when actual or forecasted costs exceed a threshold. In this scenario, you can create a budget with an alert action to send an email when costs reach 80% of the budget, and a separate budget action (using an IAM policy) to automatically restrict resource provisioning when costs hit 100%. This meets both requirements natively without additional services.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations Service Control Policies (SCPs)

Question 5

A development team needs to create a new Amazon RDS MySQL database for a temporary testing environment. A developer logs into the AWS Management Console, selects the desired instance type, storage, and network settings, and clicks 'Create database'. The database is available within 10 minutes, and the developer did not need to submit a request or wait for IT approval. Which essential characteristic of cloud computing does this process best demonstrate?

Accepted Answer

On-demand self-service. The developer was able to create and provision the RDS MySQL database entirely through the AWS Management Console without any human interaction or approval from IT. This is the core definition of on-demand self-service: a user can provision computing resources as needed automatically, without requiring service provider interaction. The process took only 10 minutes and required no ticket submission, which directly aligns with the NIST definition of on-demand self-service.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 6

A company stores historical sales data in Amazon S3. The data is accessed only once a month for generating quarterly reports. When accessed, the data must be available for retrieval within seconds. The company wants to minimize storage costs while meeting the retrieval latency requirement. Which S3 storage class should the company use?

Accepted Answer

S3 Standard-IA (Infrequent Access). S3 Standard-IA (Infrequent Access) is the correct choice because it offers the same low-latency retrieval (milliseconds) as S3 Standard but at a lower storage cost, making it ideal for data accessed infrequently (e.g., once a month) yet requiring immediate availability. The company's requirement of 'within seconds' is fully met by S3 Standard-IA, which provides the same first-byte latency as S3 Standard, while minimizing storage costs for data that is not accessed frequently.

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Deep Archive

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct AWS Organizations feature because they allow you to centrally control the maximum available permissions for all accounts within an OU. By attaching an SCP that denies all actions in regions other than us-east-1 and eu-west-1, the security team can enforce this restriction across all 'Development' accounts, even if IAM policies within those accounts allow broader access.

Answer

IAM permission boundaries

Answer

Resource-based policies attached to each S3 bucket

Answer

AWS Config rules across all accounts

Question 8

A company hosts a static website on Amazon S3. Users in different geographic locations experience high latency when accessing the website. The company wants to reduce latency for all users and also minimize the number of direct requests to the S3 bucket. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, significantly reducing latency for users regardless of their geographic location. By serving content from the edge, CloudFront also offloads direct requests to the S3 bucket, reducing the load on the origin and potentially lowering costs.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 9

A solutions architect is reviewing an application design to ensure the system can automatically recover from failures, scale horizontally to increase availability, and prevent failures from cascading to other components. Which pillar of the AWS Well-Architected Framework is the architect applying?

Accepted Answer

Reliability. The question focuses on automatic recovery from failures, horizontal scaling for availability, and preventing cascading failures. These are core design principles of the Reliability pillar, which ensures a workload performs its intended function correctly and consistently when expected. The Reliability pillar specifically addresses foundations like distributed system design, recovery procedures, and change management to handle and recover from infrastructure or service disruptions.

Answer

Performance Efficiency

Answer

Operational Excellence

Answer

Security

Question 10

A company has been running workloads on AWS for over a year. The finance team needs to analyze historical spending patterns. They want a graphical dashboard that shows costs by service (e.g., EC2, S3), by AWS Region, and by custom cost allocation tags over the last 12 months. Additionally, they need to generate a 3-month cost forecast based on this historical data. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built graphical dashboard that allows you to visualize, understand, and manage AWS costs and usage over time. It supports filtering by service (e.g., EC2, S3), AWS Region, and custom cost allocation tags, and it includes a built-in forecasting feature that can generate a 3-month cost forecast based on historical data. This directly meets all the requirements for analyzing historical spending patterns and generating a forecast.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 11

A development team needs to spin up a new Amazon RDS database instance for a proof-of-concept application. The team can log into the AWS Management Console, select the database engine, configure settings, and launch the instance within minutes, without needing to submit a ticket or wait for IT operations to provision hardware. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a user independently provisioning an RDS instance through the AWS Management Console without any human interaction with IT operations. This directly aligns with the on-demand self-service characteristic of cloud computing, where users can provision computing resources automatically as needed without requiring service provider interaction.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 12

A company has deployed a web application on Amazon EC2 instances. The company's security team wants to ensure that the underlying host operating system is patched against a newly discovered vulnerability. According to the AWS Shared Responsibility Model, who is responsible for applying the patch to the host operating system?

Accepted Answer

AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes the physical infrastructure, hypervisor, and host operating system that runs EC2 instances. When a vulnerability is discovered in the host OS (the OS that runs the hypervisor and manages the physical hardware), AWS must apply the patch because the customer has no access to or control over the host OS. The customer is only responsible for patching the guest OS (the OS running inside the EC2 instance) and any applications deployed on it.

Answer

The company, because patches for underlying infrastructure are always the customer's responsibility in EC2.

Answer

The company, because EC2 is an Infrastructure as a Service (IaaS) offering and the customer manages the OS.

Answer

Both the company and AWS share responsibility equally for host OS patching.

Question 13

A company runs a web application on a fleet of Amazon EC2 instances. The application experiences unpredictable traffic patterns with sudden spikes. The company configures an Auto Scaling group with dynamic scaling policies to automatically add instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This design is an example of which key characteristic of cloud computing?

Accepted Answer

Elasticity. The Auto Scaling group's dynamic scaling policy, which adds instances when CPU utilization exceeds 70% and removes them when it drops below 30%, directly demonstrates elasticity. Elasticity is the ability to automatically provision and de-provision resources in response to real-time demand, matching capacity to workload without manual intervention. This contrasts with static provisioning, where resources are fixed regardless of load.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 14

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

Amazon Detective

Question 15

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie