CLF-C02 Practice Test 3 — 25 Questions

Question 1

A company's leadership team wants a structured framework for planning their AWS cloud migration that addresses organisational change management, skills development, governance, platform, security, and operations. Which AWS framework provides guidance across these perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud migration journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. This framework directly addresses the leadership team's requirements for organizational change management, skills development, governance, platform, security, and operations, making it the correct choice.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor

Question 2

A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it is designed to centralize log storage from multiple sources, including EC2 instances, via the CloudWatch agent. It provides built-in querying with Logs Insights, supports real-time monitoring, and offers configurable retention policies for long-term storage, meeting all requirements for searching, analysis, and retention.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 3

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

Accepted Answer

AWS, because RDS is a managed service that abstracts OS and engine management. Amazon RDS is a fully managed database service that automates the patching of the underlying database engine software. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes managing the host operating system and the database engine patches. The customer is responsible for data, access management, and application-level security, not the engine software patching.

Answer

The customer, because they chose to run a relational database

Answer

A shared responsibility where AWS and the customer each patch different components

Answer

A third-party DBA contracted by the customer

Question 4

A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for OS updates) while preventing the internet from initiating inbound connections to those instances. It resides in a public subnet with an Elastic IP and uses Source Network Address Translation (SNAT) to replace the private source IP with the gateway's public IP, making the response traffic routable back without exposing the private instances.

Answer

Internet Gateway

Answer

VPN Gateway

Answer

VPC Endpoint

Question 5

A company has workloads that must remain on-premises due to data residency regulations but want to use the same AWS APIs, tools, and services they use in the cloud — including EC2, RDS, and S3 — on their on-premises hardware. Which AWS service enables this?

Accepted Answer

AWS Outposts. AWS Outposts is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises data center or co-location space. It allows customers to run EC2, RDS, and S3 locally on Outposts hardware while maintaining the same AWS control plane and APIs, satisfying data residency requirements without sacrificing cloud-native tooling.

Answer

AWS Direct Connect

Answer

AWS Snow Family

Answer

AWS Local Zones

Question 6

A company has two separate VPCs — one for development workloads and one for a shared services environment — and wants EC2 instances in both VPCs to communicate with each other using private IP addresses without traffic traversing the public internet. Which AWS feature enables this?

Accepted Answer

VPC Peering. VPC Peering enables direct network connectivity between two VPCs using private IP addresses, with traffic routed entirely within the AWS network backbone. This allows EC2 instances in the development VPC and the shared services VPC to communicate without traversing the public internet, as traffic stays within the AWS global infrastructure.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Direct Connect

Question 7

A financial institution needs a private, dedicated, high-bandwidth network connection from their on-premises data centre to AWS that does not traverse the public internet, provides consistent low latency, and supports up to 100 Gbps bandwidth. Which AWS service provides this?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a private, dedicated network connection from an on-premises data center to AWS that bypasses the public internet, ensuring consistent low latency and supporting bandwidths up to 100 Gbps (via 100 Gbps dedicated connections or link aggregation). This meets all the specified requirements for a high-bandwidth, private, and low-latency link.

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 8

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a cloud-native, serverless business intelligence (BI) service that enables users to create interactive dashboards and visualizations from data sources such as Amazon S3, Amazon RDS, and Amazon Redshift. It requires no BI server infrastructure management, supports SPICE (Super-fast, Parallel, In-memory Calculation Engine) for high-performance data caching, and allows sharing dashboards with business users across an organization via a web browser or mobile app.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon CloudWatch

Question 9

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

Accepted Answer

Amazon Detective. Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 10

A company migrates their self-managed MySQL database running on a virtual machine to Amazon RDS for MySQL, taking advantage of managed backups and Multi-AZ without changing the database schema or application code. Which migration strategy does this represent?

Accepted Answer

Replatform. This is a Replatform (also called 'lift and reshape' or 'platform modernization') migration because the company moves the MySQL database from a self-managed VM to Amazon RDS without changing the database schema or application code. They gain managed backups and Multi-AZ, which are RDS-specific features, but the core database engine and application interface remain unchanged, so no refactoring of the application is required.

Answer

Rehost

Answer

Refactor

Answer

Repurchase

Question 11

A company wants to centralise backup management for all their AWS resources — EC2, EBS, RDS, DynamoDB, and EFS — under a single policy, automate backup schedules, and ensure cross-region backup copies for disaster recovery. Which AWS service provides this?

Accepted Answer

AWS Backup. AWS Backup is the correct choice because it provides a fully managed, centralized backup service that supports EC2, EBS, RDS, DynamoDB, and EFS. It allows you to define a single backup policy, automate backup schedules, and configure cross-region copies for disaster recovery, meeting all the stated requirements.

Answer

Amazon S3 versioning

Answer

AWS Snapshot Manager

Answer

AWS CloudFormation

Question 12

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS WAF logs

Question 13

A small business owner wants to host a simple WordPress website on AWS with a predictable flat monthly price, without learning about VPCs, security groups, instance types, or other AWS complexity. Which AWS service is designed for this simplified use case?

Accepted Answer

Amazon Lightsail. Amazon Lightsail is designed specifically for users who need a simple, predictable monthly pricing model without managing underlying AWS infrastructure like VPCs, security groups, or instance types. It provides pre-configured virtual private servers (VPS) with a fixed monthly cost, including a one-click WordPress deployment, making it ideal for a small business owner who wants to avoid AWS complexity.

Answer

Amazon EC2 with a t3.micro

Answer

AWS Elastic Beanstalk

Answer

AWS Lambda

Question 14

A company has bring-your-own-license (BYOL) server software that is licensed per physical CPU socket. They need to run this software on AWS and require visibility into and control over the physical host their instances run on. Which EC2 option meets this requirement?

Accepted Answer

Dedicated Hosts. Dedicated Hosts provide you with a physical server fully dedicated to your use, allowing you to see and control the physical host's CPU sockets and cores. This is essential for bring-your-own-license (BYOL) software that is licensed per physical CPU socket, as you must ensure compliance with the license terms by managing the exact hardware configuration.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 15

A data team needs to extract data from S3 and RDS, transform it (clean, enrich, join), and load it into Amazon Redshift for analytics. They want a serverless service that discovers and catalogues data schemas automatically and runs the ETL jobs without provisioning servers. Which AWS service provides this?

Accepted Answer

AWS Glue. AWS Glue is a fully managed, serverless ETL service that automatically discovers and catalogs data schemas using its Crawler feature, which populates the AWS Glue Data Catalog. It can extract data from S3 and RDS, transform it (clean, enrich, join), and load it into Amazon Redshift without any server provisioning or management.

Answer

Amazon EMR

Answer

AWS Data Pipeline

Answer

Amazon Kinesis Data Firehose

Question 16

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 17

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS SSO

Question 18

A retail company wants to implement a recommendation engine based on customer purchase history. Which AWS service is designed to provide ML-based personalized recommendations with no ML experience required?

Accepted Answer

Amazon Personalize. Amazon Personalize is a fully managed AWS service that enables developers to build applications with real-time personalized recommendations without requiring any prior machine learning experience. It uses the same technology that powers Amazon.com's recommendation engine, processing customer purchase history to deliver tailored product suggestions.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 19

Which AWS service provides a fully managed NoSQL database designed for single-digit millisecond performance at any scale?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers consistent single-digit millisecond latency at any scale. It achieves this through its distributed architecture, automatic partitioning, and SSD-backed storage, making it ideal for high-traffic web applications, gaming, and IoT workloads.

Answer

Amazon RDS

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 20

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is the correct choice because it provides managed clusters for Elasticsearch and OpenSearch, enabling log analytics, full-text search, and real-time application monitoring. It integrates with Logstash and Kibana (the ELK stack) and supports the OpenSearch API, making it the direct AWS offering for this use case.

Answer

Amazon CloudSearch

Answer

Amazon Athena

Answer

Amazon Redshift