CLF-C02 Practice Test 5 — 25 Questions

Question 1

A company has been running multiple workloads on AWS for several months. The finance team notices that monthly costs have increased significantly but cannot identify which services or linked accounts are driving the increase. The team needs a tool that provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies the top cost contributors. They also need to create custom reports that can be emailed on a weekly schedule. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies top cost contributors. It also supports creating custom reports that can be scheduled and emailed weekly, directly meeting all the stated requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 2

A company has been running multiple workloads on AWS for the past six months. The finance team needs to analyze historical spending to identify month-over-month trends by AWS service and by individual linked accounts. The team requires a graphical, interactive tool that allows them to apply custom date ranges and filters, and view the results as customizable charts and graphs. Which AWS service should the finance team use to meet this requirement?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a graphical interface with pre-built charts and graphs that allow users to visualize historical spending trends. It supports filtering by AWS service and linked accounts, and enables custom date ranges for month-over-month analysis, making it the correct choice for the finance team's requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 3

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

Accepted Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.. Option A is correct because it uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

Answer

Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

Question 4

A company has multiple AWS accounts used by different departments (Finance, Marketing, Engineering). The finance team wants to see a single monthly bill that aggregates charges from all accounts. Additionally, they want to track costs by department using custom cost allocation tags that each department applies to its resources. Which AWS feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows the company to aggregate charges from all member accounts into a single monthly bill for the finance team. Additionally, it enables the use of cost allocation tags, including custom tags applied by each department, to track and filter costs by department in AWS Cost Explorer and cost reports.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Cost Explorer

Question 5

A company ingests sensor data from IoT devices into an Amazon S3 bucket. The data is accessed frequently for the first 30 days, but after that, it is rarely queried. The company’s compliance policy requires all data to be retained for 7 years. The company wants to minimize storage costs by automatically moving data to more cost-effective storage classes as it ages, without any manual intervention. Which Amazon S3 feature should the company configure to meet these requirements?

Accepted Answer

S3 Lifecycle policy. An S3 Lifecycle policy automates the transition of objects between storage classes based on age. By configuring a lifecycle rule to move objects to S3 Standard-IA or S3 One Zone-IA after 30 days, and then to S3 Glacier Deep Archive after a longer period, the company can meet the 7-year retention requirement while minimizing costs without manual intervention.

Answer

S3 Object Lock

Answer

S3 Replication

Answer

S3 Transfer Acceleration

Question 6

A media company stores video files in Amazon S3 and needs to transcode them into multiple formats for different devices. Which AWS service is purpose-built for this workflow?

Accepted Answer

Amazon Elastic Transcoder. Amazon Elastic Transcoder is a purpose-built media transcoding service that converts video files stored in Amazon S3 into the formats required by various devices. It handles the complexities of transcoding, including format conversion, resolution scaling, and bitrate adjustment, without requiring you to manage underlying infrastructure.

Answer

Amazon Kinesis Video Streams

Answer

AWS Lambda

Answer

Amazon Rekognition

Question 7

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 8

A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, compliance auditing, and historical recording of configuration changes for AWS resources. It allows you to define rules (e.g., 's3-bucket-public-read-prohibited' and 'restricted-ssh') that automatically evaluate your S3 bucket policies and EC2 security group rules against your security policies, and it offers a compliance dashboard showing pass/fail status for each resource. AWS Config also maintains a configuration history that can be used for auditing and troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 9

Which AWS Cost Management tool provides daily forecasts and allows customers to track Reserved Instance and Savings Plans utilization and coverage?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides daily cost and usage forecasts for up to 12 months ahead and includes dedicated views for Reserved Instance (RI) and Savings Plans utilization and coverage. This allows customers to monitor how much of their reserved capacity is being used and whether their commitments are adequately covering actual usage.

Answer

AWS Pricing Calculator

Answer

AWS Cost and Usage Report

Answer

AWS Budgets

Question 10

A company has been running multiple workloads on AWS for over six months. The finance team needs to gain visibility into historical cost and usage data, identify which services are driving the most spend, forecast future monthly costs, and receive recommendations for purchasing Reserved Instances to achieve the highest savings. The team wants to use a native AWS tool that provides this functionality without requiring any third-party software. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a native interface for visualizing historical cost and usage data, identifying top spend drivers, forecasting future costs up to 12 months, and generating Reserved Instance (RI) purchase recommendations based on actual usage patterns. It meets all the finance team's requirements without any third-party software.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Question 11

A company has multiple departments (HR, Finance, Engineering) sharing a single AWS account. Each department tags its resources with a 'Department' tag (e.g., Department:HR). The finance team wants to set monthly spending limits for each department and receive email alerts when a department's spending reaches 80% of its limit. They also want a visual dashboard to compare actual spending against the budgeted amounts. Which combination of AWS services should the finance team use?

Accepted Answer

AWS Budgets and AWS Cost Explorer. AWS Budgets allows the finance team to set monthly spending limits per department (using the 'Department' tag) and configure alerts at 80% of the budget. AWS Cost Explorer provides a visual dashboard to compare actual spending against budgeted amounts, enabling trend analysis and cost allocation tracking. Together, they fulfill both the alerting and visualization requirements.

Answer

AWS Cost Explorer and AWS Trusted Advisor

Answer

AWS Budgets and Amazon QuickSight

Answer

AWS Pricing Calculator and AWS Cost Explorer

Question 12

Which AWS service provides a domain name system (DNS) that routes end-user requests to AWS infrastructure and external resources?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to route end-user requests to AWS infrastructure (such as EC2 instances, ELBs, and S3 buckets) and to external resources by translating human-readable domain names into IP addresses. This directly matches the question's requirement for a DNS-based routing service.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Answer

Elastic Load Balancing

Question 13

Which AWS service automatically moves S3 objects between storage classes based on access patterns without requiring upfront knowledge of how frequently data will be accessed?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct answer because it is the only AWS service that automatically moves objects between storage classes based on changing access patterns, without requiring any upfront knowledge or lifecycle rules. It monitors access at the object level and moves data between two access tiers (frequent and infrequent) and an optional archive tier, charging a small monitoring fee but no retrieval costs.

Answer

S3 Lifecycle policies

Answer

S3 Standard-IA

Answer

S3 Replication

Question 14

A company has multiple AWS accounts managed under AWS Organizations with consolidated billing enabled. The company purchases a 3-year Compute Savings Plan to reduce costs on Amazon EC2, AWS Fargate, and AWS Lambda usage. The finance team wants the discount from the Savings Plan to apply to eligible usage across all accounts in the organization. What configuration is required to achieve this?

Accepted Answer

The Savings Plan must be purchased in the management account, and the discount automatically applies to all accounts in the organization.. When a Compute Savings Plan is purchased in the management account of an AWS Organization with consolidated billing enabled, the discount is automatically shared across all member accounts. This is because consolidated billing aggregates all usage across the organization, and Savings Plans apply discounts to the combined eligible usage, regardless of which account incurred the cost.

Answer

The Savings Plan must be purchased separately in each account where the discount is needed.

Answer

The finance team must create custom cost allocation tags to distribute the Savings Plan discount across accounts.

Answer

The Savings Plan must be linked to each member account using the AWS Billing Conductor.

Question 15

A company hosts a file-sharing platform on Amazon S3. The application bucket is in the us-west-2 (Oregon) Region. Users in Europe and Asia experience slow upload speeds when transferring large files. The company wants to improve upload performance by using AWS edge locations to accelerate data transfers to the bucket. The solution must work with standard S3 PUT operations and require minimal application changes. Which AWS feature should the company enable?

Accepted Answer

Amazon S3 Transfer Acceleration. Amazon S3 Transfer Acceleration (C) uses AWS edge locations to route uploads over the optimized AWS network backbone, reducing latency for geographically distant clients. It works with standard S3 PUT operations and requires only enabling the feature on the bucket and updating the endpoint URL, minimizing application changes.

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Question 16

A company wants to use AWS free tier for testing new services. Which statement about the AWS Free Tier is accurate?

Accepted Answer

The Free Tier includes a mix of 12-month free, always free, and short-term trial offers. Option B is correct because the AWS Free Tier is structured into three categories: 12-month free offers (e.g., 750 hours of EC2 t2.micro per month), always free offers (e.g., 1 million Lambda requests per month), and short-term trials (e.g., 30-day free trial of Amazon Inspector). This mix allows customers to test services without incurring costs for the specified limits and durations.

Answer

The Free Tier is available indefinitely for all AWS services

Answer

The Free Tier applies equally to all AWS accounts including Enterprise support customers

Answer

AWS does not charge if you stay within Free Tier limits for any service

Question 17

A company has multiple AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost budget of $5,000 for the 'Project Alpha' account. They want to receive an email notification when the actual costs reach 80% of the budget and again when the forecasted costs are expected to exceed the budget. The team also needs to centrally manage these budgets from the management account. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and configure threshold-based alerts via Amazon SNS (email or other notifications). In this scenario, the finance team can create a monthly cost budget of $5,000 for the 'Project Alpha' account, then set an alert at 80% of actual costs and another alert when forecasted costs are expected to exceed the budget. Because the company uses AWS Organizations, budgets can be centrally managed from the management account, enabling the finance team to view and control budgets across member accounts without logging into each one individually.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 18

A company manages multiple AWS accounts under a single AWS Organizations organization. The security team wants to implement a preventive control that blocks any action that would disable AWS CloudTrail or delete CloudTrail log files across all accounts, including the management account. The solution must be centrally managed and must not require changes to individual account permissions. Which AWS feature should the security team use?

Accepted Answer

AWS Service Control Policies (SCPs). AWS Service Control Policies (SCPs) are the correct choice because they allow the security team to define preventive guardrails at the AWS Organizations root, OU, or account level that apply to all principals, including the management account. An SCP can explicitly deny any action that would disable CloudTrail (e.g., cloudtrail:StopLogging, cloudtrail:DeleteTrail) or delete log files (e.g., s3:DeleteObject on the CloudTrail S3 bucket), and because SCPs are inherited by all accounts in the organization, no individual account permission changes are required.

Answer

IAM permission boundaries

Answer

AWS Identity and Access Management (IAM) roles with a trust policy

Answer

AWS Config conformance packs

Question 19

A company needs to provide business users with self-service business intelligence dashboards and visualizations of data from multiple AWS data sources. Which AWS service enables this?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a fully managed, serverless business intelligence (BI) service designed specifically for creating interactive dashboards and visualizations. It natively integrates with multiple AWS data sources (e.g., Amazon S3, Amazon RDS, Amazon Redshift, Amazon Athena) and provides self-service capabilities for business users via a web-based interface, without requiring any infrastructure management.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon EMR

Question 20

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

Amazon Detective