CLF-C02 Practice Test 25 — 15 Questions

Question 1

A company wants to create a hybrid cloud architecture where their on-premises applications can access AWS services as if they were running locally. Which AWS service extends AWS infrastructure and services to on-premises locations?

Accepted Answer

AWS Outposts. AWS Outposts is the correct answer because it is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises or edge location. This allows customers to run AWS services locally, enabling a true hybrid cloud experience where on-premises applications can access AWS services with low latency and local data processing, as if they were running in an AWS Region.

Answer

AWS Direct Connect

Answer

AWS VPN

Answer

AWS Local Zones

Question 2

A company wants to deploy AWS services in a specific geographic location within a metropolitan area to reduce latency for end users in that city, while still using standard AWS APIs. Which AWS infrastructure type addresses this?

Accepted Answer

AWS Local Zones. AWS Local Zones are an infrastructure type that places compute, storage, and other select AWS services closer to end users in a specific metropolitan area, enabling single-digit millisecond latency for latency-sensitive applications while using the same AWS APIs and tools as in an AWS Region. This directly meets the requirement of reducing latency within a city without requiring custom APIs or on-premises hardware.

Answer

AWS Outposts

Answer

CloudFront Edge Locations

Answer

AWS Wavelength Zones

Question 3

A company needs to integrate their on-premises Active Directory with AWS to enable SSO for employees accessing AWS services. Which AWS service provides this federation capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service for integrating on-premises Active Directory with AWS to enable single sign-on (SSO) for employees accessing AWS services. It supports federation via SAML 2.0 or SCIM protocols, allowing you to connect your existing AD identity source and centrally manage user access to multiple AWS accounts and business applications.

Answer

Amazon Cognito

Answer

AWS Directory Service AD Connector

Answer

AWS IAM roles

Question 4

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Config

Question 5

Which Amazon EC2 instance family is optimized for memory-intensive workloads such as in-memory databases, real-time big data analytics, and high-performance computing?

Accepted Answer

Memory-optimized instances (R and X family). Memory-optimized instances (R and X families) are designed for workloads that require large amounts of RAM and high memory bandwidth, such as in-memory databases (e.g., Redis, Memcached), real-time big data analytics (e.g., Apache Spark), and high-performance computing (HPC) tasks. These instances offer a high memory-to-vCPU ratio and support for large instance sizes, enabling efficient processing of data sets that reside primarily in memory.

Answer

Compute-optimized instances (C family)

Answer

Storage-optimized instances (I and D family)

Answer

Accelerated computing instances (P and G family)

Question 6

A company is evaluating the AWS Sustainability pillar in the Well-Architected Framework. Which action aligns with AWS cloud sustainability best practices?

Accepted Answer

Right-sizing instances and using managed services to maximize resource utilization. Option C is correct because right-sizing instances and using managed services directly aligns with the AWS Sustainability pillar, which focuses on minimizing the environmental impact of cloud workloads. By matching instance capacity to actual demand and leveraging services like AWS Lambda or Amazon RDS, you reduce wasted compute cycles and energy consumption, improving resource utilization and lowering carbon footprint.

Answer

Provisioning maximum instance sizes to ensure peak performance at all times

Answer

Running workloads 24/7 even when not needed to maintain warm state

Answer

Replicating all data to multiple regions for maximum redundancy

Question 7

A company needs to connect multiple VPCs and on-premises networks through a single hub, simplifying network management. Which AWS service acts as a cloud router to interconnect these networks?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a cloud router, using a hub-and-spoke model to interconnect multiple VPCs and on-premises networks through a single gateway. It simplifies network management by centralizing routing, supporting transitive routing between all attached networks, and integrating with AWS Direct Connect and VPN connections.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 8

A company needs to implement DevOps practices and wants a fully managed service to store their application source code with version control. Which AWS service provides managed Git repositories?

Accepted Answer

AWS CodeCommit. AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own source control system by providing managed Git repositories that integrate with other AWS services, making it the correct choice for storing application source code with version control.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeArtifact

Question 9

Which AWS support feature provides a dedicated technical contact who provides proactive guidance, acts as an advocate for the customer, and helps with architectural reviews?

Accepted Answer

Technical Account Manager (TAM). The Technical Account Manager (TAM) is the correct answer because it is a dedicated AWS support resource, available only with the Enterprise Support plan, that provides proactive guidance, acts as a customer advocate, and conducts architectural reviews. Unlike other support roles, the TAM is assigned to a specific customer to help optimize their AWS environment, coordinate with AWS teams, and ensure the customer gets the most value from their investment.

Answer

AWS Solutions Architect

Answer

AWS IQ Expert

Answer

AWS Support Engineer

Question 10

A company wants to migrate their on-premises applications to AWS but is concerned about losing visibility into their infrastructure. Which AWS service provides a centralized inventory of all AWS resources and tracks configuration changes over time?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides a centralized inventory of all AWS resources and continuously tracks configuration changes over time. It enables you to assess, audit, and evaluate the configurations of your AWS resources against desired policies, giving you full visibility into infrastructure state and history.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

AWS Systems Manager Inventory

Question 11

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed CI/CD service that orchestrates the build, test, and deploy phases of a release process. It integrates with services like AWS CodeBuild for building and testing, and AWS CodeDeploy for deployment, providing a single pipeline to automate the entire workflow.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 12

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 13

A company is using Amazon EC2 and wants to understand the difference between Compute Savings Plans and EC2 Instance Savings Plans. Which statement is accurate?

Accepted Answer

Compute Savings Plans apply to any EC2 instance, Fargate, and Lambda usage, while EC2 Instance Savings Plans apply to a specific instance family and region. Option C is correct because Compute Savings Plans offer the broadest flexibility, automatically applying to any EC2 instance (regardless of family, size, or region), as well as AWS Fargate and AWS Lambda usage. In contrast, EC2 Instance Savings Plans are restricted to a specific instance family within a chosen region, providing a narrower scope of coverage. This distinction is fundamental to understanding how each plan optimizes costs based on workload flexibility.

Answer

Compute Savings Plans provide higher discounts than EC2 Instance Savings Plans

Answer

EC2 Instance Savings Plans are more flexible and apply across all instance families

Answer

Both Savings Plans types require specifying the exact instance size at purchase

Question 14

A company is running their application on EC2 instances behind an Application Load Balancer. They want to ensure the application remains available during an AZ outage. What is the minimum architecture configuration required?

Accepted Answer

EC2 instances distributed across at least two Availability Zones behind an ALB. To remain available during an Availability Zone outage, the application must be resilient to the failure of an entire AZ. An Application Load Balancer distributes traffic across healthy targets, but it cannot route to instances in a failed AZ. Therefore, EC2 instances must be deployed in at least two separate Availability Zones, and the ALB must be configured with subnets in those same AZs to route traffic and perform health checks, ensuring continuous availability if one AZ goes down.

Answer

Multiple EC2 instances in a single Availability Zone

Answer

A single large EC2 instance with enhanced networking

Answer

EC2 instances in a single Region across multiple subnets in the same AZ

Question 15

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Accepted Answer

Attach an IAM role with the appropriate S3 permissions to the EC2 instance. Option C is correct because attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.

Answer

Hardcode the IAM user access keys in the application code

Answer

Store IAM access keys in environment variables on the EC2 instance

Answer

Create an IAM user and configure the instance with its credentials