CLF-C02 Practice Test 5 — 25 Questions

Question 1

A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The application must comply with a security standard that requires encryption in transit for all web traffic. The company needs a service to centrally manage SSL/TLS certificates, automatically renew them, and deploy them to the ALB without manual intervention. Which AWS service should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provides centralized management of SSL/TLS certificates, supports automatic renewal for certificates issued by ACM, and can seamlessly deploy these certificates to an Application Load Balancer (ALB) without any manual intervention. This directly meets the requirement for encryption in transit and compliance with the security standard.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 2

A company is launching a new application and expects user demand to grow gradually over the next 12 months. To control upfront costs, the company plans to start with a small number of Amazon EC2 instances and manually add more instances each month as the user base increases. The operations team will monitor usage and adjust capacity based on observed trends. Which cloud computing concept does this approach BEST illustrate?

Accepted Answer

Scalability. The scenario describes manually adding EC2 instances over time to match growing demand, which is a classic example of scalability—the ability to increase or decrease resources to handle changing workloads. Scalability focuses on planned capacity adjustments, whereas elasticity involves automatic, real-time scaling in response to demand fluctuations. Here, the manual, monthly additions based on observed trends align with scalability, not the automated provisioning that defines elasticity.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 3

A company uses AWS Organizations to manage multiple accounts. The operations team runs hundreds of Amazon EC2 instances across these accounts for various applications. The security team requires that all EC2 instances be patched with the latest security updates within 7 days of release. Currently, the operations team manually applies patches by logging into each account and using Systems Manager Patch Manager individually. The team wants to centralize patch compliance management so that a single operations team can define patch baselines, schedule patching, and view compliance status across all accounts from a single pane of glass, without needing to switch between accounts. Which AWS service or feature should the team use to meet these requirements?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is the correct choice because it allows the operations team to centrally define patch baselines, schedule patching across multiple AWS accounts, and view compliance status from a single pane of glass using AWS Systems Manager Quick Setup or multi-account management features. By integrating with AWS Organizations, Patch Manager can target EC2 instances across all accounts without requiring the team to switch between accounts, meeting the requirement for centralized patch compliance management.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 4

A development team wants to deploy a Python web application to AWS without managing load balancers, auto scaling groups, or the underlying EC2 instance operating systems. They want to upload their code and have AWS handle the infrastructure. Which cloud service model does this represent?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a managed platform where developers can upload code and AWS handles the underlying infrastructure, including load balancing, auto scaling, and OS patching. AWS Elastic Beanstalk is a PaaS service that abstracts EC2 instances, load balancers, and auto scaling groups, allowing the team to focus solely on their Python web application code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Serverless

Question 5

A company runs a nightly batch processing job on AWS that takes exactly 2 hours to complete. The company uses a fixed set of Amazon EC2 instances for the job. AWS automatically tracks the number of instance-hours consumed each month and bills the company precisely for that usage. The company does not need to sign a long-term contract or pay for idle resources. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Measured service. The scenario describes AWS automatically tracking and billing precisely for the number of instance-hours consumed each month, without requiring a long-term contract or payment for idle resources. This directly illustrates the 'measured service' characteristic, where cloud resource usage is metered, monitored, and reported transparently, enabling pay-as-you-go billing. The fixed 2-hour nightly job and exact billing per instance-hour confirm that usage is measured and charged accordingly.

Answer

Resource pooling

Answer

Rapid elasticity

Answer

Broad network access

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a consistent set of security group rules across all accounts. For example, they want to ensure that no security group in any account allows inbound SSH (port 22) from the internet (0.0.0.0/0). If a non-compliant security group is created, the service should automatically remediate by removing the offending rule or by applying a corrective policy. The company wants a managed AWS service that centrally applies these rules and requires no custom scripting. Which AWS service should the security team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized, managed way to apply security group rules across all accounts in an AWS Organization. It can automatically detect non-compliant security groups (e.g., those allowing SSH from 0.0.0.0/0) and remediate them by removing the offending rule or applying a corrective policy, all without custom scripting.

Answer

AWS Config

Answer

AWS Organizations

Answer

AWS Shield Advanced

Question 7

A company uses multiple AWS accounts managed through AWS Organizations. The finance team wants to see a consolidated view of all costs across accounts, and also wants to filter costs by specific projects using custom tags that are applied to resources. The team has already created tag keys and applied them to resources in all accounts. What additional step must the team take in the Management Account to ensure these tags appear as cost allocation dimensions in AWS Cost Explorer?

Accepted Answer

Activate the tag keys for cost allocation tracking.. In AWS Organizations, custom tags must be explicitly activated for cost allocation tracking in the Management Account's Billing and Cost Management console. Without this activation, the tags exist on resources but are not recognized as cost allocation dimensions in AWS Cost Explorer, so the finance team cannot filter costs by those tags. Activating the tag keys enables Cost Explorer to ingest the tag key-value pairs and present them as filtering dimensions in cost reports.

Answer

Enable the AWS Cost Explorer default reports.

Answer

Create a budget using AWS Budgets with the tag filters.

Answer

Configure the AWS Support plan to include cost analysis.

Question 8

A gaming company launches a new online multiplayer game. During peak hours (evenings and weekends), the player count spikes dramatically, requiring dozens of Amazon EC2 instances to handle the load. During off-peak hours, the player count drops to near zero. The company configures an Amazon EC2 Auto Scaling group that automatically adds instances when CPU utilization exceeds 70% and removes instances when utilization drops below 30%. Which characteristic of cloud computing does this configuration best demonstrate?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the Auto Scaling group dynamically adds EC2 instances when CPU utilization exceeds 70% and removes them when it drops below 30%, directly matching the fluctuating player load. This demonstrates elasticity because resources are provisioned and de-provisioned in real-time to match the exact workload, minimizing cost during low usage and ensuring performance during spikes.

Answer

High availability

Answer

Fault tolerance

Answer

Global reach

Question 9

A company is building a web application that requires a fully managed NoSQL database with single-digit millisecond latency at any scale. The application will experience unpredictable traffic spikes, and the database must automatically scale throughput capacity up and down without manual intervention. The developers want to focus on application code rather than database management tasks. Which AWS database service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports automatic scaling of read/write throughput capacity via Auto Scaling policies, eliminating the need for manual intervention. This makes it ideal for web applications with unpredictable traffic spikes, as it offloads all database management tasks to AWS.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 10

A company needs to run a data processing job that typically takes 2 hours to complete. The job is stateless and can be parallelized across multiple workers. The company wants to minimize operational overhead and only pay for the compute time consumed. The job runs only once a month. Which AWS compute service should the company use?

Accepted Answer

AWS Batch. AWS Batch is the correct choice because it is designed for running batch computing workloads that are stateless, parallelizable, and can run on a schedule. It automatically provisions and manages the underlying compute resources (EC2 or Fargate), scales to the required number of workers, and only charges for the compute time consumed. The 2-hour, once-a-month job fits perfectly within AWS Batch's capabilities, and it minimizes operational overhead by handling job queuing, retries, and dependency management.

Answer

AWS Lambda

Answer

Amazon EC2 Spot Instances

Answer

AWS Fargate

Question 11

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 12

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 13

A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and records AWS resource configurations, evaluates them against custom rules (like 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'), and provides a compliance dashboard that shows historical compliance status over time. It directly addresses the need for automated, ongoing evaluation of resource configurations against internal security policies.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 14

AWS can offer lower pay-as-you-go pricing than a single company could achieve operating its own data centre because AWS aggregates usage from hundreds of thousands of customers. Which cloud computing benefit does this describe?

Accepted Answer

Benefit from massive economies of scale. The scenario describes AWS aggregating usage from hundreds of thousands of customers to achieve lower per-unit costs than a single company could achieve operating its own data center. This is the direct definition of economies of scale, where the massive scale of AWS's infrastructure (e.g., purchasing power for hardware, optimized data center design) reduces the average cost per customer, enabling lower pay-as-you-go pricing.

Answer

Trade capital expense for variable expense

Answer

Increase speed and agility

Answer

Go global in minutes

Question 15

A company runs an e-commerce website on Amazon EC2 instances. The website experiences unpredictable traffic spikes during flash sales and returns to normal traffic levels afterward. To handle this, the company configures an Auto Scaling group that adds EC2 instances when the average CPU utilization exceeds 70% and removes instances when it drops below 30%. Which essential characteristic of cloud computing does this configuration primarily demonstrate?

Accepted Answer

Elasticity. This configuration demonstrates elasticity because it automatically scales EC2 instances up during flash sales (when CPU exceeds 70%) and scales them down when traffic normalizes (CPU below 30%). Elasticity is the ability to dynamically provision and de-provision resources to match demand, which is exactly what Auto Scaling groups with CPU utilization thresholds achieve.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 16

A company uses AWS Organizations with consolidated billing across multiple member accounts. The finance team requires that only the management account (payer account) can view and modify payment methods and receive invoices. Member accounts must be prevented from accessing billing and payment information in the AWS Billing and Cost Management console. Which AWS feature should be configured to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) to deny billing-related actions for all member accounts.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict the AWS services and actions that member accounts can use. By applying an SCP that denies billing-related actions (e.g., `aws-portal:*` or `awsbilling:*`) to all member accounts, the management account can enforce that only the payer account can view and modify payment methods and receive invoices. This directly meets the requirement without affecting the management account, which is not subject to SCPs.

Answer

Enable all features in AWS Organizations, including consolidated billing.

Answer

Enable AWS CloudTrail to log billing events for all accounts.

Answer

Configure AWS Cost Explorer to grant cross-account access only to the management account.

Question 17

A media company runs a website that serves video content globally. Users request video previews, which require the generation of thumbnail images on-the-fly. The company wants to generate these thumbnails at AWS edge locations so that the processing occurs close to users, reducing latency and offloading the origin servers. The solution must run custom code in response to CloudFront events without provisioning any servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Lambda@Edge. AWS Lambda@Edge is the correct service because it allows you to run custom code in response to CloudFront events (such as viewer request, origin request, viewer response, and origin response) at AWS edge locations, enabling on-the-fly thumbnail generation close to users without provisioning any servers. This reduces latency and offloads origin servers, meeting the requirement for serverless edge processing.

Answer

AWS Lambda

Answer

Amazon EC2 instances in an Auto Scaling group

Answer

Amazon ElastiCache

Question 18

A company runs a multi-tier web application on Amazon EC2 instances across multiple Availability Zones. The application has separate backend services for serving images and handling API requests, each running on different sets of EC2 instances. The company needs a load balancer that can inspect incoming HTTP/HTTPS requests and route them to the correct target group based on the URL path (e.g., /images to one group, /api to another). The solution must also offload SSL/TLS termination and perform health checks on the instances. Which AWS service should the company use?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model, allowing it to inspect HTTP/HTTPS headers and route traffic based on URL path patterns (e.g., /images vs /api). It natively supports SSL/TLS termination and can perform health checks on target instances, making it the correct choice for this multi-tier web application.

Answer

Network Load Balancer

Answer

Classic Load Balancer

Answer

AWS CloudFront

Question 19

A company is refactoring its monolithic e-commerce application into multiple microservices. The order-processing service must send messages to the inventory service to reserve stock. The company needs a fully managed service that can durably store these messages, handle high throughput, and allow the inventory service to poll for messages at its own pace. The company wants to avoid any message loss. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon SQS is the correct choice because it is a fully managed message queuing service that durably stores messages across multiple Availability Zones, ensuring no message loss. It supports high throughput and allows the inventory service to poll for messages at its own pace using long or short polling, decoupling the order-processing and inventory services.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 20

A company runs a mix of Amazon EC2 instances, AWS Fargate containers, and AWS Lambda functions across multiple AWS Regions. The company wants to reduce costs by making a 1-year commitment for compute usage. The company needs a flexible purchasing option that automatically applies the discounted rate to any EC2 instance, Fargate, or Lambda usage, regardless of region, instance family, or size. Which AWS purchasing option should the company use?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan is the correct choice because it offers the most flexibility, automatically applying discounted rates to any EC2 instance, Fargate, or Lambda usage across any AWS Region, instance family, or size. This matches the company's requirement for a 1-year commitment that covers diverse compute services without regional or instance constraints.

Answer

EC2 Instance Savings Plan

Answer

Standard Reserved Instance

Answer

Convertible Reserved Instance