CLF-C02 Practice Test 26 — 15 Questions

Question 1

A company is migrating its on-premises application to AWS. The application currently runs on a single server and experiences occasional traffic spikes that cause performance degradation. The company wants to take advantage of cloud computing benefits to handle these spikes automatically without manual intervention. Which AWS Cloud concept would directly address this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Elasticity. Elasticity is the correct concept because it refers to the ability of an AWS infrastructure to automatically scale resources up or down based on demand. In this scenario, the company needs to handle occasional traffic spikes without manual intervention, which is directly addressed by AWS Auto Scaling groups and services like Amazon EC2 Auto Scaling or AWS Lambda's concurrency scaling. This ensures that additional compute capacity is provisioned during spikes and released when demand decreases, optimizing both performance and cost.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 2

A company is migrating its customer-facing web application to AWS. The Chief Information Security Officer (CISO) is reviewing the division of security responsibilities. The CISO understands that AWS is responsible for the security of the physical data centers, hardware, and network infrastructure. The company, as the customer, is responsible for securing the application code, customer data, and operating system patches on Amazon EC2 instances. This division of security responsibilities is an example of which fundamental cloud computing concept?

Accepted Answer

Shared responsibility model. The shared responsibility model. This model delineates security obligations between AWS and the customer: AWS secures the cloud infrastructure (physical data centers, hardware, network), while the customer secures what is in the cloud (application code, customer data, OS patches on EC2 instances). The scenario directly describes this division, making it a textbook example of the shared responsibility model.

Answer

Resource pooling

Answer

Elasticity

Answer

Measured service

Question 3

A company hosts a critical e-commerce web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team is concerned about Layer 7 attacks, such as SQL injection and cross-site scripting (XSS). They also want to automatically block traffic from known malicious IP addresses. The company needs a managed web application firewall that integrates directly with the ALB. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common Layer 7 attacks, such as SQL injection and cross-site scripting (XSS), by inspecting HTTP/HTTPS requests. It integrates directly with an Application Load Balancer (ALB) to allow you to create custom rules that block or allow traffic based on request patterns, including automatically blocking traffic from known malicious IP addresses using managed IP reputation lists.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 4

A company is planning to migrate its on-premises data center to AWS. The Chief Financial Officer wants to compare the total cost of ownership (TCO) of the current on-premises infrastructure against running equivalent workloads on AWS. The company needs a tool that allows them to input details about their existing servers, storage, and network usage to generate a detailed cost comparison report. Which AWS tool should the company use to meet this requirement?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of on-premises infrastructure with AWS by allowing users to input details about their existing servers, storage, and network usage. It generates a detailed report that highlights potential savings from migrating to AWS, directly addressing the CFO's requirement for a cost comparison.

Answer

AWS Pricing Calculator

Answer

AWS Budgets

Answer

AWS Cost Explorer

Question 5

A gaming company wants to deploy its multiplayer game to players in North America, Europe, and Asia. The company needs to ensure that players in all three regions experience low latency when connecting to game servers, and the game servers must be located as close as possible to the players. The company chooses AWS to host the game servers. Which benefit of cloud computing does this scenario best illustrate?

Accepted Answer

Global reach – because AWS has regions around the world, allowing the company to deploy game servers geographically close to players.. This scenario best illustrates global reach because AWS operates multiple geographic regions worldwide, enabling the gaming company to deploy game servers in North America, Europe, and Asia. By placing infrastructure close to players, the company minimizes network latency and improves the real-time multiplayer experience. This is a core benefit of cloud computing that on-premises solutions cannot easily replicate without significant investment.

Answer

Rapid elasticity – because AWS can automatically scale the number of game servers based on player demand.

Answer

Pay-as-you-go – because the company only pays for game server compute hours used.

Answer

Resource pooling – because multiple players share the same underlying server resources.

Question 6

A company's security policy prohibits opening SSH (port 22) or RDP (port 3389) to the internet for any Amazon EC2 instance. The operations team needs a way to establish secure shell sessions to manage instances directly from the AWS Management Console without managing bastion hosts or SSH keys. Which AWS service provides this capability?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager enables secure shell access to EC2 instances directly from the AWS Management Console without opening inbound ports (22 or 3389) or managing bastion hosts. It uses the SSM Agent and AWS Identity and Access Management (IAM) policies to establish a bidirectional connection over HTTPS (port 443), eliminating the need for SSH keys or public IP addresses. This fully satisfies the security policy requirement while providing the desired management capability.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Question 7

A company runs an e-commerce web application on Amazon EC2 instances. During flash sales, the backend order processing service becomes overloaded and drops requests, causing customer failures. The company needs a durable, scalable, and fully managed service to buffer incoming order requests and decouple the web tier from the backend processing tier. Orders must be stored reliably and processed in the order they were received. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples application components. It provides durable, scalable storage for incoming order requests and supports FIFO (First-In-First-Out) queues to guarantee that messages are processed exactly once and in the order they were sent, meeting the requirement for ordered processing.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 8

A company stores financial reports in Amazon S3. The security team needs to automatically detect whether any of these reports contain sensitive data, such as personally identifiable information (PII) like credit card numbers or social security numbers. The team wants a fully managed service that continuously scans the S3 buckets and reports findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as PII (e.g., credit card numbers, social security numbers) stored in Amazon S3. It continuously scans S3 buckets and provides a centralized dashboard for findings, meeting the requirement for automated detection and reporting without manual intervention.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Security Hub

Question 9

A company tags all Amazon EC2 instances with a 'Project' tag to track costs. The finance team reviews cost data in AWS Cost Explorer but cannot filter or group by the 'Project' tag. The tags are visible in the EC2 console. What is the most likely reason the tags are not appearing in Cost Explorer?

Accepted Answer

The tags have not been activated as cost allocation tags in the Billing and Cost Management console.. B is correct because cost allocation tags must be explicitly activated in the Billing and Cost Management console before they appear in AWS Cost Explorer. Even though the 'Project' tag is applied to EC2 instances and visible in the EC2 console, AWS does not automatically treat resource tags as cost allocation tags; activation is a separate, required step. Without activation, Cost Explorer cannot filter or group by that tag.

Answer

The tags are not applied to the root volumes of the EC2 instances.

Answer

Cost Explorer requires at least 30 days of tag usage data before tags become available.

Answer

The finance team does not have the iam:ListAccountAliases permission.

Question 10

A company runs a customer-facing web application on AWS. To ensure the application remains available if a fire or flood destroys one of the company's data centers, the IT team deploys the application across multiple physically separate facilities within the same AWS Region. Each facility has independent power, cooling, and physical security. Which component of the AWS global infrastructure does this deployment strategy primarily use?

Accepted Answer

Availability Zones. Availability Zones are distinct, physically separated locations within an AWS Region, each with independent power, cooling, and physical security. Deploying across multiple Availability Zones protects against data center-level failures like fires or floods, ensuring high availability for the application.

Answer

AWS Regions

Answer

Edge Locations

Answer

Local Zones

Question 11

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

Accepted Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.. It uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

Answer

Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

Question 12

A healthcare company is migrating patient records to Amazon S3. The company must comply with HIPAA and needs to automatically identify any S3 buckets that contain protected health information (PHI) and generate alerts. The solution must be fully managed and require no manual effort to scan the data. Which AWS service should the company use?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in Amazon S3. It automatically identifies protected health information (PHI) such as medical record numbers, diagnosis codes, and patient names, and can generate alerts when such data is found in S3 buckets, meeting HIPAA compliance requirements without any manual scanning effort.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Security Hub

Question 13

A company uses a continuous integration and continuous deployment (CI/CD) pipeline to deploy applications on AWS. The development teams frequently create feature branches in the code repository. The company wants to automatically provision a complete, isolated environment (including compute, storage, and networking) for each new feature branch, with no manual intervention. The environment must be ready within minutes of the branch creation. Which characteristic of cloud computing does this requirement primarily demonstrate?

Accepted Answer

On-demand self-service. The requirement to automatically provision a complete, isolated environment for each new feature branch without manual intervention directly demonstrates the on-demand self-service characteristic of cloud computing. This characteristic allows users to provision computing resources automatically as needed, without requiring human interaction with service providers. In this scenario, the CI/CD pipeline triggers the creation of compute, storage, and networking resources via AWS APIs (e.g., CloudFormation, AWS CDK, or Terraform) the moment a branch is created, fulfilling the 'no manual intervention' and 'ready within minutes' conditions.

Answer

Rapid elasticity

Answer

High availability

Answer

Measured service

Question 14

A company runs a batch processing job on a single Amazon EC2 instance. The job takes 10 hours to complete. The company needs to reduce the processing time to under 1 hour to meet a new business requirement. The data can be split into independent chunks that can be processed in parallel. Which cloud computing concept would most directly enable the company to achieve this goal?

Accepted Answer

Scalability. Scalability is the correct answer because it refers to the ability to increase resources to handle increased load. By scaling horizontally (adding more EC2 instances) and processing the independent data chunks in parallel, the batch job can be completed in under 1 hour instead of 10 hours.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 15

A company uses Amazon EC2 instances and Amazon S3 for its workloads. The finance team reviews the monthly AWS bill and notices it includes line items for EC2 instance hours, data transfer out from EC2, and S3 storage usage. The bill shows exactly how many hours each instance ran and how much data was transferred. The company uses this detailed usage data to allocate costs to different departments and to optimize resource utilization. This scenario best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Measured service. (Measured service) because the scenario explicitly describes how the company uses detailed usage data—EC2 instance hours, data transfer out, and S3 storage—to allocate costs and optimize resource utilization. This aligns with the cloud computing characteristic where resource usage is metered, monitored, and reported transparently, enabling pay-per-use billing and cost allocation.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling