CLF-C02 Practice Test 2 — 25 Questions

Question 1

A financial services company runs a high-frequency stock trading platform on AWS. The platform must continue processing trades without any interruption, even if an entire AWS Availability Zone experiences a complete outage. The architecture is designed with duplicate infrastructure in multiple Availability Zones, and all components are active simultaneously. The system is engineered so that if one AZ fails, the remaining AZs continue processing trades instantly, with zero downtime for end users. Which cloud computing concept does this requirement BEST represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fault tolerance. This requirement describes a system that continues to operate without any interruption even when an entire AWS Availability Zone fails. That is the definition of fault tolerance: the system is designed to survive component failures with zero impact on service. The architecture uses duplicate active infrastructure in multiple AZs so that if one AZ fails, the remaining AZs instantly take over with no downtime, which is fault tolerance, not just high availability.

Answer

Elasticity

Answer

High availability

Answer

Durability

Question 2

A company runs a production workload on AWS and needs technical support that includes phone and email access with a response time of less than 1 hour for critical system failures. The company also wants architectural guidance for cost optimization and performance improvement. The company currently has an AWS account with the Basic Support plan. Which AWS Support plan should the company choose to meet these requirements at the most cost-effective price?

Accepted Answer

Business Support. The Business Support plan is the most cost-effective option that provides phone and email support with a response time of under 1 hour for critical system failures, along with architectural guidance for cost optimization and performance improvement. The Basic and Developer plans lack phone support and the required response time SLA, while the Enterprise plan offers additional features (e.g., a Technical Account Manager) that are not needed here, making it more expensive than necessary.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise Support

Question 3

A company runs a data-intensive workload in a colocation facility and wants to establish a dedicated, private network connection to its Amazon VPC. The connection must bypass the public internet to provide consistent high throughput and low latency. The company also wants to avoid data transfer costs associated with internet-based connections. Which AWS service should the company use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private network connection from an on-premises or colocation facility directly to an Amazon VPC, bypassing the public internet entirely. This ensures consistent high throughput, low latency, and eliminates data transfer costs associated with internet-based connections, as traffic flows over a private physical link.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

AWS Transit Gateway

Question 4

A company is migrating a legacy monolithic e-commerce application to AWS. The application has three tightly integrated modules: user authentication, payment processing, and inventory management. In the current design, a failure in the payment processing module often causes the entire application to crash. The company wants to redesign the application so that each module runs independently, and a failure in one module does not cascade to other modules. Which cloud computing concept should the company apply to achieve this goal?

Accepted Answer

Loose coupling. Loose coupling. Loose coupling is a cloud computing concept where components are designed to have minimal dependencies on each other, communicating through well-defined interfaces or APIs. By decoupling the user authentication, payment processing, and inventory management modules, a failure in one module (e.g., payment processing) will not cascade and crash the entire application, as each module can operate independently and handle its own failures gracefully.

Answer

Elasticity

Answer

High availability

Answer

Disaster recovery

Question 5

A developer needs to launch a test server for a new application prototype. The developer logs into the AWS Management Console, selects an Amazon EC2 instance type, configures the security group, and starts the instance. The instance is running within two minutes, and the developer did not need to submit a formal request to the company's IT procurement team or wait for approval from a cloud administrator. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

On-demand self-service. The scenario demonstrates on-demand self-service because the developer was able to provision and launch an EC2 instance directly through the AWS Management Console without any human interaction with IT procurement or a cloud administrator. This characteristic, defined by NIST as a core pillar of cloud computing, allows users to unilaterally provision computing capabilities as needed automatically, which is exactly what happened when the instance was running within two minutes of the console action.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 6

A company uses a variety of AWS services and wants to automatically detect unexpected cost spikes that might indicate resource misuse, billing errors, or unauthorized activity. The company needs a managed service that uses machine learning to analyze spending patterns and provide alerts when costs deviate from expected trends. The finance team does not want to manually define thresholds for every service. Which AWS service should the finance team use?

Accepted Answer

AWS Cost Anomaly Detection. AWS Cost Anomaly Detection is a managed service that uses machine learning to continuously monitor your cost and usage patterns, automatically detecting anomalous spending without requiring manual threshold definitions. It analyzes historical data to establish a baseline and alerts you when costs deviate from expected trends, making it ideal for identifying unexpected spikes from resource misuse, billing errors, or unauthorized activity.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 7

A company runs a batch processing workload on an on-premises data center. The servers are powerful machines that are used at maximum capacity only for a few days each month during financial reporting periods. For the rest of the month, the servers run at very low utilization. The CFO wants to migrate this workload to AWS to reduce costs. Which characteristic of AWS cloud computing is most directly aligned with the CFO's goal of paying only for the compute capacity actually used?

Accepted Answer

Pay-as-you-go pricing model. The pay-as-you-go pricing model (Option C) directly aligns with the CFO's goal because it allows the company to pay only for the compute capacity they actually consume, with no upfront costs or long-term commitments. In this scenario, the batch processing workload runs at maximum capacity only a few days per month, so the company can provision resources during those peaks and stop them during low-utilization periods, avoiding the cost of idle on-premises servers. This model eliminates the need to pay for unused capacity, directly reducing costs as the CFO desires.

Answer

High availability across multiple Availability Zones

Answer

Elasticity to automatically scale resources up and down

Answer

The ability to choose from a wide variety of instance types

Question 8

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.

Answer

IAM policies with a Deny effect for CloudTrail actions

Answer

AWS Config rules with an auto-remediation action

Answer

AWS CloudTrail trails with multi-region and organization trail enabled

Question 9

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that allows you to create rules to inspect HTTP/HTTPS requests and block common attack patterns, such as SQL injection and cross-site scripting. By associating a WAF web ACL with the Application Load Balancer, the company can filter incoming traffic and block malicious payloads before they reach the EC2 instances.

Answer

AWS Shield Standard

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 10

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-kms-encryption-specific-key) that can evaluate whether S3 buckets are encrypted with the required KMS customer-managed key. When a noncompliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule to automatically apply the correct encryption configuration, enabling automated remediation without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 11

A company runs a web application across multiple Amazon EC2 instances that are distributed across several Availability Zones. The application needs to share a common set of configuration files and static assets that must be accessible concurrently and consistently from all instances. The company wants a fully managed, scalable file storage solution that does not require provisioning or managing underlying storage hardware. Which AWS service should the company use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It uses the NFSv4.1 protocol, ensuring consistent access to configuration files and static assets without any provisioning or management of underlying storage hardware.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon Relational Database Service (RDS)

Question 12

A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

Accepted Answer

Configure the S3 bucket to use SSE-KMS encryption with the customer-managed key, and modify the KMS key policy to grant the kms:Decrypt permission only to the 'Auditors' role.. SSE-KMS with a customer-managed key separates encryption key management from S3 bucket policies. The KMS key policy is the authoritative access control for decryption operations. By granting kms:Decrypt only to the 'Auditors' role, even if the S3 bucket policy allows s3:GetObject to other users, they cannot decrypt the objects without the key permission. This enforces the security requirement that only the Auditors role can decrypt the sensitive financial reports.

Answer

Configure an S3 bucket policy that denies s3:GetObject requests unless the request is encrypted in transit using HTTPS.

Answer

Enable S3 Block Public Access on the bucket and attach an IAM policy to the 'Auditors' role that allows s3:GetObject.

Answer

Use S3 object-level logging to monitor access and revoke permissions for any role that attempts to decrypt objects without authorization.

Question 13

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Amazon CloudFront and Application Load Balancers (ALB) to inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. This makes it the correct choice for the security team's requirement to filter and block specific attack patterns at the application layer.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

Amazon Inspector

Question 14

A company runs a diverse workload on AWS that includes Amazon EC2 instances of various families and sizes across multiple regions, Amazon RDS databases, and a serverless application using AWS Lambda and AWS Fargate. The finance team wants to reduce compute costs by making a 1-year hourly spend commitment, but they need the flexibility to change instance families, sizes, regions, or switch between EC2, Fargate, and Lambda without losing the discount. Which AWS pricing model should the finance team choose to meet these requirements?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan is the correct choice because it offers a 1-year hourly spend commitment with the flexibility to change instance families, sizes, regions, and even switch between EC2, Fargate, and Lambda while still receiving the discount. This plan applies to any compute usage across these services, automatically adjusting the discount to the most cost-effective instance type or compute option, meeting the finance team's need for both cost reduction and operational flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

On-Demand

Question 15

A retail company runs a web application on Amazon EC2 instances behind an Application Load Balancer. During a promotional event, traffic spikes to 10 times the normal level. The company configured an Amazon EC2 Auto Scaling group with a scaling policy that adds instances when CPU utilization exceeds 70% and removes instances when it drops below 30%. The application handles the spike without any manual intervention, and after the event ends, the number of instances automatically decreases to the original count, saving costs. This scenario best demonstrates which cloud computing concept?

Accepted Answer

Elasticity. The scenario describes the system automatically scaling out to 10 times the normal capacity during a traffic spike and then scaling back down when the spike ends, which is the definition of elasticity—the ability to dynamically provision and de-provision resources to match demand. The use of an EC2 Auto Scaling group with a CPU-based scaling policy (70% threshold to add, 30% to remove) directly demonstrates this cloud computing concept, as it handles variable workloads without manual intervention and optimizes cost by reducing resources when they are no longer needed.

Answer

Scalability

Answer

High availability

Answer

Fault tolerance

Question 16

A company wants to review its AWS spending for the past six months to identify which services and business units are driving costs. The finance team needs to interactively examine cost trends, filter by service and account, and visualize the data without setting up complex reports. Which AWS service or tool should the company use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, interactive dashboard that allows you to visualize and analyze your AWS cost and usage data over the past 12 months. You can filter by service, linked account (business unit), and time range, and drill down into trends without needing to set up complex reports or queries. This directly meets the requirement for interactive examination of cost trends by service and account.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Reports

Question 17

A company hosts an e-commerce website on Amazon EC2 instances in the us-east-1 Region. The website serves static assets (images, CSS, and JavaScript) to a global user base. Users in Europe and Asia report slow page load times. The company needs to improve the performance of delivering these static assets to all users without modifying the application code or provisioning additional origin servers. Which AWS service should the company use?

Accepted Answer

Use Amazon CloudFront to distribute the static assets from AWS edge locations.. Amazon CloudFront is a content delivery network (CDN) that caches static assets at AWS edge locations worldwide, reducing latency for global users without requiring code changes or additional origin servers. It integrates seamlessly with EC2 origins and automatically serves content from the nearest edge location, directly addressing the slow page load times reported in Europe and Asia.

Answer

Deploy the website on additional Amazon EC2 instances in the eu-west-1 and ap-southeast-1 Regions, and use a Network Load Balancer to distribute traffic across all Regions.

Answer

Use Amazon Route 53 with geolocation routing policies to route users to the nearest AWS Region for the website.

Answer

Enable S3 Transfer Acceleration on the Amazon S3 bucket that stores the static assets.

Question 18

A company has a mobile application that allows users to upload profile photos. When a new photo is uploaded to an Amazon S3 bucket, the application must automatically create a thumbnail version and store it in another S3 bucket. The company wants a solution that runs only when needed, scales automatically, and requires no management of underlying servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 PUT object event. It automatically scales from zero to thousands of concurrent executions based on the number of incoming uploads, and requires no server management, perfectly meeting the requirement for an on-demand, auto-scaling thumbnail generation solution.

Answer

AWS Batch

Answer

Amazon EC2

Answer

Amazon ECS with EC2 launch type

Question 19

A company publishes a message each time a new product is added to its catalogue. Three services need to receive this message simultaneously: an email notification service, an inventory update service, and an analytics service. Which AWS service should the company use to deliver the message to all three services at the same time?

Accepted Answer

Amazon SNS. Amazon SNS is the correct choice because it is a fully managed pub/sub messaging service designed to deliver messages to multiple subscribers simultaneously. When a new product is added, the company can publish a single message to an SNS topic, and SNS will fan out that message to all three subscribed endpoints (email, inventory, and analytics) in parallel, ensuring they receive it at the same time.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Streams

Answer

AWS EventBridge

Question 20

A company is planning to migrate its on-premises infrastructure to AWS. The operations team wants to compare the total cost of ownership (TCO) between running workloads on-premises and running them on AWS. They need a tool that can accept details about their current on-premises servers (number of servers, CPU, memory, storage) and produce a detailed report comparing costs over a specified period, including savings from avoided hardware purchases, IT labor, and data center costs. Which AWS tool should the operations team use?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of running on-premises infrastructure versus AWS. It accepts detailed inputs about existing on-premises servers (such as CPU, memory, and storage) and generates a comprehensive report that includes savings from avoided hardware purchases, IT labor, and data center costs over a user-specified period. This directly matches the operations team's requirement for a detailed TCO comparison.

Answer

AWS Cost Explorer

Answer

AWS Pricing Calculator

Answer

AWS Cost and Usage Report