CLF-C02 Practice Test 25 — 15 Questions

Question 1

A company has been running workloads on AWS for over a year. The finance team needs to analyze historical spending patterns. They want a graphical dashboard that shows costs by service (e.g., EC2, S3), by AWS Region, and by custom cost allocation tags over the last 12 months. Additionally, they need to generate a 3-month cost forecast based on this historical data. Which AWS tool should the finance team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built graphical dashboard that allows you to visualize, understand, and manage AWS costs and usage over time. It supports filtering by service (e.g., EC2, S3), AWS Region, and custom cost allocation tags, and it includes a built-in forecasting feature that can generate a 3-month cost forecast based on historical data. This directly meets all the requirements for analyzing historical spending patterns and generating a forecast.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 2

A development team needs to spin up a new Amazon RDS database instance for a proof-of-concept application. The team can log into the AWS Management Console, select the database engine, configure settings, and launch the instance within minutes, without needing to submit a ticket or wait for IT operations to provision hardware. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a user independently provisioning an RDS instance through the AWS Management Console without any human interaction with IT operations. This directly aligns with the on-demand self-service characteristic of cloud computing, where users can provision computing resources automatically as needed without requiring service provider interaction.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 3

A company has deployed a web application on Amazon EC2 instances. The company's security team wants to ensure that the underlying host operating system is patched against a newly discovered vulnerability. According to the AWS Shared Responsibility Model, who is responsible for applying the patch to the host operating system?

Accepted Answer

AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes the physical infrastructure, hypervisor, and host operating system that runs EC2 instances. When a vulnerability is discovered in the host OS (the OS that runs the hypervisor and manages the physical hardware), AWS must apply the patch because the customer has no access to or control over the host OS. The customer is only responsible for patching the guest OS (the OS running inside the EC2 instance) and any applications deployed on it.

Answer

The company, because patches for underlying infrastructure are always the customer's responsibility in EC2.

Answer

The company, because EC2 is an Infrastructure as a Service (IaaS) offering and the customer manages the OS.

Answer

Both the company and AWS share responsibility equally for host OS patching.

Question 4

A company runs a web application on a fleet of Amazon EC2 instances. The application experiences unpredictable traffic patterns with sudden spikes. The company configures an Auto Scaling group with dynamic scaling policies to automatically add instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This design is an example of which key characteristic of cloud computing?

Accepted Answer

Elasticity. The Auto Scaling group's dynamic scaling policy, which adds instances when CPU utilization exceeds 70% and removes them when it drops below 30%, directly demonstrates elasticity. Elasticity is the ability to automatically provision and de-provision resources in response to real-time demand, matching capacity to workload without manual intervention. This contrasts with static provisioning, where resources are fixed regardless of load.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 5

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

Amazon Detective

Question 6

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 7

A company runs a web application on a single Amazon EC2 instance. As the application gains popularity, the instance frequently reaches 100% CPU utilization during peak hours, causing slow response times. The operations team is evaluating two approaches: (1) migrate the application to a larger EC2 instance type with more CPU and memory, or (2) add multiple smaller EC2 instances behind a load balancer and distribute the traffic. Which cloud computing concept does approach (1) represent?

Accepted Answer

Vertical scaling. Approach (1) involves moving the application to a larger EC2 instance type with more CPU and memory, which is the definition of vertical scaling (scaling up). This increases the capacity of a single resource rather than adding more instances.

Answer

Elasticity

Answer

High availability

Answer

Horizontal scaling

Question 8

A company spends over $75,000 per month on AWS services and needs ongoing, proactive cost optimization guidance from a designated AWS expert. The company also requires a 15-minute response time for their most critical production incidents. Which AWS Support plan should the company choose?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the correct choice because it provides a designated Technical Account Manager (TAM) for proactive cost optimization guidance and a 15-minute response time for critical production incidents. The company's monthly spend of over $75,000 and need for ongoing, expert-led cost optimization align with the Enterprise-level support features, which include a TAM who conducts regular business reviews and cost optimization workshops.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 9

A company operates over 100 AWS accounts consolidated under AWS Organizations. The finance team needs to analyze the company's historical AWS spending across all accounts for the past 6 months. They want to understand which services and regions drive the most costs, and they also need a 3-month forecast of future spending to inform budget planning. The team needs a visual dashboard that allows interactive filtering by account, service, and region without requiring custom scripts. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, interactive dashboard that visualizes historical cost data (up to 12 months) and generates forecasts (up to 12 months) without requiring custom scripts. It supports filtering by account, service, and region, making it ideal for the finance team's requirements. This tool directly meets the need for a visual, filterable dashboard with built-in forecasting.

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Answer

AWS Trusted Advisor

Question 10

A company runs several Amazon EC2 instances for development and testing purposes. The finance team wants to identify any instances that have been running with very low CPU utilization (less than 10%) over the past two weeks so they can stop or resize them to reduce costs. Which AWS tool provides this specific recommendation as part of its cost optimization checks?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor provides cost optimization checks that include identifying Amazon EC2 instances with low utilization. Specifically, the 'Low Utilization Amazon EC2 Instances' check flags instances that have had a CPU utilization of 10% or less for the past 14 days, enabling the finance team to stop or resize them to reduce costs.

Answer

AWS Compute Optimizer

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 11

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

Accepted Answer

Amazon Detective. Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 12

A company uses separate AWS accounts for development, testing, and production. The finance team wants to receive a single monthly invoice that covers all accounts and to benefit from volume pricing discounts across the entire organization. Which AWS feature should the company use to achieve this?

Accepted Answer

Enable Consolidated Billing in AWS Organizations. AWS Organizations with Consolidated Billing allows a company to combine usage across multiple accounts into a single monthly invoice, enabling the organization to aggregate usage and benefit from volume pricing discounts (e.g., tiered pricing for EC2, S3, or data transfer). The management account pays for all member accounts, and the consolidated view simplifies cost tracking while maximizing savings from AWS's graduated pricing model.

Answer

Set up an AWS Budget to track all account costs

Answer

Use Cost Explorer to generate a combined cost report

Answer

Activate AWS Trusted Advisor on the management account

Question 13

A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Certificate Manager (ACM)

Question 14

A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Accepted Answer

Managing network access control lists (ACLs) for the customer's VPC. Managing network access control lists (ACLs) for a customer's VPC is explicitly a customer responsibility under the AWS Shared Responsibility Model. Customers control inbound and outbound traffic at the subnet level by configuring NACLs, which are stateless firewall rules. AWS provides the infrastructure and the VPC service, but the customer must define and manage the ACL rules to enforce network segmentation and security.

Answer

Ensuring the physical security of AWS data centers

Answer

Patching the hypervisor layer that runs Amazon EC2 instances

Answer

Replacing defective hardware components in the AWS global infrastructure

Question 15

A company operates 10 AWS accounts, each managed by a separate team. Each account runs its own Amazon EC2 instances and stores data in Amazon S3. The CFO wants to minimize overall costs by taking advantage of volume discount pricing tiers that AWS offers (e.g., lower per-GB storage costs as total S3 usage increases). Which AWS feature should the company use to combine usage from all accounts so they benefit from the highest possible volume discounts?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows you to aggregate usage from all member accounts into a single payer account. This combined usage qualifies for volume discount pricing tiers (e.g., lower S3 per-GB storage costs as total usage increases), enabling the company to benefit from the highest possible discounts across all 10 accounts.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor