CLF-C02 Practice Test 4 — 25 Questions

Question 1

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they allow AWS Organizations to centrally define permission guardrails that apply to all IAM users and roles across member accounts. SCPs can explicitly deny actions like s3:PutBucketPolicy to prevent any account administrator from modifying S3 bucket policies to grant public access, and these restrictions cannot be overridden by any IAM entity within the member account.

Answer

IAM permissions boundaries

Answer

AWS Config conformance packs

Answer

AWS CloudTrail Insights

Question 2

A company is planning to migrate its on-premises data center to AWS. The finance team needs to compare the current on-premises infrastructure costs (including servers, storage, networking, and personnel) against the projected costs of running identical workloads on AWS over a three-year period. The team wants to input detailed specifications of their existing hardware and get a comprehensive report that highlights potential savings and provides a total cost of ownership (TCO) comparison. Which AWS tool should the finance team use?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of on-premises infrastructure with AWS, allowing users to input detailed hardware specifications (servers, storage, networking) and generate a comprehensive report that highlights potential savings over a chosen period (e.g., three years). This tool directly addresses the finance team's need for a TCO comparison, including personnel costs, which is not a feature of other AWS calculators.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Simple Monthly Calculator

Question 3

A retail company runs a legacy application on a single on-premises server. The application experiences unpredictable traffic surges that degrade performance. The company is considering migrating to the AWS Cloud. Which cloud computing characteristic MOST directly addresses the ability to automatically adjust resources to meet changing demand without manual intervention?

Accepted Answer

Elasticity. Elasticity is the cloud computing characteristic that enables automatic resource provisioning and de-provisioning to match demand in real time, without manual intervention. For the retail company's legacy application with unpredictable traffic surges, elasticity directly addresses the need to dynamically scale resources up during spikes and down during lulls, which is distinct from the planned, manual scaling of scalability.

Answer

Scalability

Answer

High availability

Answer

Durability

Question 4

A company runs its primary database on an Amazon RDS for MySQL DB instance in the us-east-1 Region. The company's disaster recovery policy requires that the database be recoverable in a different AWS Region within 1 hour of a region-wide failure, with a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour. Which AWS feature should the company use to meet these requirements?

Accepted Answer

Create a cross-region read replica of the DB instance in us-west-2.. A cross-region read replica in us-west-2 meets the RPO of less than 5 minutes because replication is asynchronous with a lag typically under 1 minute, and the RTO of less than 1 hour is achievable by promoting the replica to a standalone primary in the event of a region-wide failure. This approach provides a ready-to-use database copy in another region without the need for manual snapshot restoration.

Answer

Deploy a Multi-AZ RDS DB instance in us-east-1.

Answer

Take manual DB snapshots daily and copy them to us-west-2.

Answer

Enable termination protection on the RDS instance.

Question 5

A startup is planning to build and launch a new mobile application on AWS. The team expects very low initial traffic but hopes to scale rapidly. They have a limited budget and want to avoid any upfront costs. They are unsure which AWS services they will need and want to estimate their monthly AWS charges before committing to an architecture. Additionally, they need access to technical support to help troubleshoot issues that arise during development and production, with a guaranteed response time of less than 12 hours for production-impacting issues. Which combination of AWS tool and support plan should the startup choose to meet these requirements?

Accepted Answer

AWS Pricing Calculator + Developer Support. The AWS Pricing Calculator allows the startup to estimate monthly costs without any upfront commitment, which aligns with their need to avoid upfront costs and predict charges before architecting. The Developer Support plan provides a response time of less than 12 hours for production-impacting issues (specifically, a response time of 12 hours for impaired production systems under the Developer plan), meeting their support requirement while keeping costs low for a startup with limited budget.

Answer

AWS Cost Explorer + Basic Support

Answer

AWS Budgets + Business Support

Answer

AWS Total Cost of Ownership (TCO) Calculator + Enterprise Support

Question 6

A company is deploying a three-tier web application on AWS. The security team requires a network-level firewall that operates at the subnet level and can evaluate both inbound and outbound traffic using stateless rules. Which AWS feature should the company use to meet this requirement?

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a stateless, subnet-level firewall that evaluates both inbound and outbound traffic based on numbered rules. Unlike security groups, NACLs do not maintain connection state, so rules must be explicitly defined for both directions, meeting the requirement for stateless inspection at the subnet boundary.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield

Question 7

A startup is deploying a web application on Amazon EC2 instances across multiple Availability Zones (AZs). The architecture must ensure that the application remains fully operational and available to users even if one entire AZ fails. Which cloud computing concept does this requirement MOST directly represent?

Accepted Answer

Fault tolerance. Fault tolerance is the correct concept because the requirement specifies that the application must remain fully operational and available even if an entire Availability Zone fails. By deploying EC2 instances across multiple AZs and using an Elastic Load Balancer to distribute traffic, the architecture can withstand the failure of one AZ without any interruption in service, which is the essence of fault tolerance.

Answer

Elasticity

Answer

Scalability

Answer

Resource pooling

Question 8

A company has a serverless architecture on AWS for its order processing system. The system uses AWS Lambda functions to validate payment, check inventory, update the database, and send email notifications. The company needs a managed service to coordinate these functions into a workflow, implement retry logic in case of failures, and manage the execution of each step sequentially. Which AWS service should the company use?

Accepted Answer

AWS Step Functions. AWS Step Functions is a fully managed service designed to coordinate multiple AWS services into a serverless workflow. It allows you to define state machines that execute Lambda functions sequentially, implement built-in retry logic with exponential backoff, and handle error conditions, making it the ideal choice for orchestrating the order processing steps (payment validation, inventory check, database update, and email notification).

Answer

Amazon Simple Workflow Service (Amazon SWF)

Answer

Amazon Simple Queue Service (Amazon SQS)

Answer

AWS AppSync

Question 9

A company is designing a cloud architecture for a critical customer-facing application. The CTO requires that the architecture automatically recover from infrastructure failures without manual intervention. The solution must be able to withstand the failure of individual components, such as an Amazon EC2 instance or an entire Availability Zone. Which design principle from the AWS Well-Architected Framework's Reliability pillar should the company implement to meet this requirement?

Accepted Answer

Scale horizontally to increase aggregate system availability.. Scaling horizontally (adding more EC2 instances behind a load balancer) increases aggregate system availability because if one instance fails, traffic is redistributed to the remaining healthy instances. This design also supports multi-AZ deployments, allowing the application to survive an entire Availability Zone failure without manual intervention, which directly meets the CTO's requirement for automatic recovery.

Answer

Implement a monolithic architecture to reduce complexity and minimize points of failure.

Answer

Use a single large EC2 instance to minimize the number of components that could fail.

Answer

Test recovery procedures by simulating infrastructure failures in a staging environment.

Question 10

A company has migrated its customer-facing web application to AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer. The company's customers access the application from various devices—desktop computers, laptops, tablets, and smartphones—using standard web browsers without any additional configuration or proprietary software. The ability for customers to reach the application over the internet from any device with a standard browser best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes customers accessing the application from various devices (desktops, laptops, tablets, smartphones) using standard web browsers over the internet without any proprietary software. This directly matches the NIST definition of broad network access: resources are available over the network and accessed through standard mechanisms (e.g., HTTP/HTTPS) that promote use by heterogeneous thin or thick client platforms.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 11

A startup is running a pilot application on AWS and wants to control costs strictly. The finance team sets a monthly budget of $1,000. They need to receive an email notification when actual or forecasted spending reaches 80% of the budget. Additionally, if the budget is exceeded, they want to automatically stop a non-critical Amazon EC2 instance to prevent further cost overruns. Which combination of AWS services should they use to meet all these requirements with minimal operational overhead?

Accepted Answer

AWS Budgets with a budget action configured to stop the EC2 instance when the budget limit is exceeded. AWS Budgets natively supports budget actions that can automatically stop an EC2 instance when the actual or forecasted spending exceeds a defined threshold. This eliminates the need for custom scripting or additional services, meeting the requirements with minimal operational overhead. The budget alert at 80% can be configured via AWS Budgets' notification feature to send an email through Amazon SNS.

Answer

AWS Cost Explorer with Amazon SNS notifications to send alerts at 80% spending, and an AWS Lambda function to stop the EC2 instance

Answer

AWS Budgets with a budget alert set at 80% of the $1,000 limit, and an AWS Trusted Advisor check to stop the instance when costs exceed the budget

Answer

Amazon CloudWatch cost metric alarms combined with AWS Auto Scaling to reduce instance capacity when spending exceeds the budget

Question 12

A gaming company is preparing to launch a new online multiplayer game. The company expects the player traffic to be extremely high on the first few days after launch, but then stabilize at a much lower level. The IT team wants to provision sufficient server capacity to handle the launch spike without over-provisioning and wasting money during the quieter periods. Which benefit of cloud computing most directly addresses this requirement?

Accepted Answer

Stop guessing capacity. The requirement is to provision enough capacity for a launch spike without over-provisioning for lower steady-state traffic. AWS Auto Scaling with Elastic Load Balancing directly addresses this by automatically adjusting the number of EC2 instances based on real-time demand, eliminating the need to guess peak capacity. This is the core benefit of 'Stop guessing capacity' — cloud elasticity allows you to match resources to actual usage, not predictions.

Answer

Trade capital expense for variable expense

Answer

Increase speed and agility

Answer

Benefit from massive economies of scale

Question 13

A company runs a critical web application on Amazon EC2 instances in the us-east-1 Region, with a secondary standby deployment in us-west-2 for disaster recovery. The application requires that user traffic be directed to the nearest healthy endpoint, automatically failover to the secondary region if the primary region becomes unavailable, and the company needs two static IP addresses that remain fixed regardless of infrastructure changes. The application uses TCP and UDP protocols. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it provides two static anycast IP addresses that remain fixed regardless of infrastructure changes, directs traffic to the nearest healthy endpoint using the AWS global network, and supports automatic failover between regions for both TCP and UDP traffic. It also integrates with Network Load Balancers, Application Load Balancers, or EC2 instances to route traffic to the closest healthy endpoint, meeting all stated requirements.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Elastic Load Balancing

Question 14

A company runs a monolithic web application on Amazon EC2 that processes user-uploaded files synchronously. During peak hours, the application experiences slow response times because the file processing blocks the web server. The company wants to decouple the upload process from the file processing to improve responsiveness and allow each component to scale independently. The file processing backend must poll for new work and handle failures gracefully by retrying failed messages. Which AWS service should the company use to implement this decoupling?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the upload process from the file processing backend. The web server can immediately return a response after placing a message in the SQS queue, while the backend workers poll the queue for new work. SQS also supports dead-letter queues and configurable redrive policies to handle failures gracefully by retrying failed messages.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 15

A company operates multiple AWS accounts under AWS Organizations. The security team needs to record all management events (for example, creating Amazon EC2 instances, modifying security groups, and deleting Amazon S3 buckets) across all accounts. The logs must be delivered to a single Amazon S3 bucket that is encrypted with an AWS KMS key and protected from modification. Which AWS feature should the team enable to achieve this centralized logging requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all management events (API calls) across AWS accounts, and when configured as an organization trail in AWS Organizations, it automatically logs events from all member accounts to a single S3 bucket. This meets the requirement for centralized logging with encryption using AWS KMS and protection from modification via S3 bucket policies and versioning.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Audit Manager

Question 16

A company is evaluating a migration of its on-premises virtualized workloads to AWS. The CFO wants to understand the potential cost savings over a three-year period by shifting from capital expenditure (hardware purchases) to operational expenditure (pay-as-you-go). The team needs a tool that can provide a detailed comparison of the total cost of ownership (TCO) for the current on-premises environment versus running the same workloads on AWS, including hardware, software, labor, and facilities costs. Which AWS tool should the team use?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of running workloads on-premises versus on AWS. It allows users to input details about their current on-premises infrastructure—including hardware, software, labor, and facilities—and generates a detailed side-by-side cost comparison over a specified period (e.g., three years). This directly addresses the CFO's need to understand potential savings from shifting from capital expenditure (CapEx) to operational expenditure (OpEx).

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 17

A company's website serves static content—such as images, videos, and CSS files—to a global audience. The company wants to reduce load times for users located far from the primary AWS Region where the application is hosted. Which component of the AWS global infrastructure is specifically designed to cache and deliver this content with low latency from locations close to end users?

Accepted Answer

Edge Locations. Edge Locations are part of AWS CloudFront, a content delivery network (CDN) that caches static content (e.g., images, videos, CSS) at geographically distributed points of presence (PoPs). When a user requests content, CloudFront serves it from the nearest Edge Location, reducing latency and improving load times for global audiences. This makes Edge Locations the correct choice for caching and delivering static content with low latency.

Answer

Regional Edge Caches

Answer

Availability Zones

Answer

AWS Outposts

Question 18

A company is planning to deploy a multi-tier web application on AWS. The architecture includes Amazon EC2 instances, an Application Load Balancer, an Amazon RDS database, and security groups. The company wants to define and provision these resources as reusable, version-controlled infrastructure so they can consistently deploy the same environment to development, testing, and production accounts. The solution should allow the team to use JSON or YAML templates to describe the resources and their dependencies. Which AWS service should the company use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define and provision AWS infrastructure as code using JSON or YAML templates. This enables version-controlled, repeatable deployments across multiple accounts (development, testing, production) by describing resources like EC2 instances, ALBs, RDS databases, and security groups along with their dependencies in a declarative template.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 19

A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to record every GetObject and PutObject API call made against the bucket, including the identity of the caller, the source IP address, and the time of the request. They need to store these records in a separate centralized S3 bucket and analyze them using Amazon Athena for security audits. Which AWS feature should the security team enable?

Accepted Answer

AWS CloudTrail data events. AWS CloudTrail data events (Option C) are the correct choice because they capture detailed information about S3 object-level API operations such as GetObject and PutObject, including the caller identity, source IP address, and request time. These logs can be delivered to a centralized S3 bucket and queried using Amazon Athena for security audits, meeting all stated requirements.

Answer

AWS Config managed rules

Answer

Amazon S3 server access logging

Answer

Amazon GuardDuty

Question 20

A company uses Amazon S3 to store raw data files for a data analytics platform. The company requires that files remain immediately accessible for the first 30 days after upload. After 30 days, files must be automatically moved to a lower-cost storage class for archival access. After 7 years, files must be automatically deleted. The company wants to implement this data management strategy with minimal ongoing effort. Which AWS S3 feature should the company use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Glacier Deep Archive) and expire (delete) objects based on object age. This directly meets the requirement to keep files immediately accessible for 30 days, move them to a lower-cost archival class after 30 days, and delete them after 7 years, all with minimal ongoing effort.

Answer

S3 Intelligent-Tiering

Answer

S3 Object Lock

Answer

S3 Versioning