CLF-C02 Practice Test 27 — 15 Questions

Question 1

A company runs an e-commerce platform on AWS. The platform experiences unpredictable traffic, with occasional large spikes. The company wants to automatically adjust compute capacity to match demand exactly, ensuring consistent performance while only paying for the resources consumed. Which benefit of the AWS Cloud does this scenario primarily describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Elasticity. Elasticity is the ability of AWS to automatically scale compute resources up or down based on demand. In this scenario, the e-commerce platform experiences unpredictable traffic spikes, and elasticity ensures that EC2 instances or Auto Scaling groups adjust capacity in real time, matching demand exactly while only charging for resources consumed. This directly aligns with the 'pay-as-you-grow' model and the operational benefit of scaling without manual intervention.

Answer

High availability

Answer

Disaster recovery

Answer

Resource pooling

Question 2

A company runs its production web application on a single Amazon EC2 instance located in one Availability Zone. Recently, a power outage in that data center caused the instance to become unavailable, resulting in application downtime. The company wants to redesign the architecture so that the application automatically continues serving users even if a single data center fails, without requiring manual intervention. Which cloud computing concept does this scenario BEST illustrate?

Accepted Answer

High availability. High availability (B) is the correct concept because the scenario describes designing an architecture that automatically continues serving users even if a single data center (Availability Zone) fails, without manual intervention. This is achieved by deploying the application across multiple Availability Zones, using an Elastic Load Balancer to distribute traffic, and configuring Auto Scaling groups to maintain instance health, ensuring the application remains accessible despite a zonal failure.

Answer

Elasticity

Answer

On-demand self-service

Answer

Broad network access

Question 3

A company's finance team receives a detailed monthly report from AWS that shows the exact number of Amazon EC2 instance hours used, the amount of Amazon S3 storage consumed, and the volume of data transferred out to the internet over the month. The team uses this report to analyze usage trends, allocate costs to different departments, and plan future budgets. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

Measured service. Measured service. This characteristic means cloud providers automatically meter and report resource usage (e.g., EC2 instance hours, S3 storage, data transfer) for billing, optimization, and planning. The finance team's ability to analyze exact usage data and allocate costs directly demonstrates this metering capability.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 4

A startup is building a photo-sharing application on AWS. The startup expects to store billions of photos over time. The CEO is surprised that the per-GB price for Amazon S3 storage is the same for the startup as it is for a multinational corporation with petabytes of data. Which characteristic of cloud computing does this pricing model best demonstrate?

Accepted Answer

Economies of scale. The pricing model where the per-GB cost for Amazon S3 is the same for a small startup as for a large enterprise demonstrates economies of scale. AWS aggregates demand from millions of customers, allowing it to negotiate lower prices for hardware, power, and bandwidth, then passes those savings on to all customers equally. This means the startup benefits from the same low unit cost as a multinational corporation, without needing to invest in its own infrastructure.

Answer

Elasticity

Answer

High availability

Answer

Global reach

Question 5

A company runs a production application on a mix of Amazon EC2 instance families (e.g., M5, C5, R5) across two AWS Regions. The application runs 24/7 and is expected to continue for the next three years. The company wants to minimize compute costs while retaining the flexibility to change instance families, sizes, or Regions if needed. The company also prefers to avoid any upfront payment to preserve cash flow. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plans (no upfront, 3-year term). Compute Savings Plans (no upfront, 3-year term) provide the highest discount (up to 66%) while allowing flexibility to change instance families (e.g., M5 to C5), sizes, and AWS Regions. This matches the company’s requirement to minimize costs over three years without upfront payment, and the plan automatically applies to any EC2 instance usage within the chosen commitment, preserving the ability to switch instance types or Regions as needed.

Answer

On-Demand instances

Answer

Standard Reserved Instances (no upfront, 3-year term)

Answer

Spot Instances

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application connects to an Amazon RDS for MySQL database. The database password is currently hardcoded in the application configuration file, and the security team is concerned about the risk of exposure. The company wants to remove the hardcoded credential and instead have the application retrieve the database password securely at runtime. Additionally, the security team requires that the password be automatically rotated every 90 days without any manual intervention or custom scripting. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including RDS for MySQL) without custom code. It supports native, automatic rotation of secrets every 90 days via a built-in Lambda rotation function, meeting the security team's requirement for zero manual intervention. Unlike Parameter Store, Secrets Manager provides automatic rotation out of the box, which is the key differentiator here.

Answer

AWS Systems Manager Parameter Store (SecureString parameters)

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM) roles for Amazon EC2

Question 7

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 8

A company uses AWS Organizations to manage over 50 AWS accounts. The security team has identified a high-priority requirement to prevent any security group rule in any account from allowing inbound RDP (port 3389) access from the internet (0.0.0.0/0). If a rule is created that violates this policy, the team wants it to be automatically removed. The team needs a centralized service that can enforce this policy across all current and new accounts without requiring manual setup in each account. Which AWS service should the team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across all accounts in an AWS Organization. It can enforce a security group policy that automatically removes any inbound RDP rule allowing 0.0.0.0/0, and it applies this policy to both existing and newly created accounts without manual intervention.

Answer

AWS Config

Answer

AWS IAM Access Analyzer

Answer

AWS Security Hub

Question 9

A company runs a global e-commerce website hosted on Amazon EC2 instances in the us-west-2 Region. The website includes static assets (product images, CSS, JavaScript) and dynamic content generated by the application. The company wants to improve page load times for users in Europe and Asia by caching static content at edge locations, while also reducing the direct load on the EC2 instances. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static assets (images, CSS, JavaScript) at edge locations worldwide, reducing latency for users in Europe and Asia. By offloading static content delivery from the origin EC2 instances, CloudFront directly reduces the load on those servers, improving overall performance and scalability.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 10

A company stores sensitive financial data in Amazon S3 and must encrypt it at rest. The compliance team mandates that the encryption key must be rotated at least once per year, and the key material must be generated and managed by the company within AWS. The company wants a fully automated solution that requires no manual intervention for key rotation. Which AWS service or feature should the company use?

Accepted Answer

Create an AWS KMS customer managed key and enable automatic annual rotation.. AWS KMS customer managed keys support automatic annual rotation, which satisfies the compliance requirement for key rotation without manual intervention. The company retains control over the key material since it is generated and managed within AWS KMS, meeting the mandate that the company manages the keys within AWS.

Answer

Use Amazon S3 server-side encryption with customer-provided encryption keys (SSE-C).

Answer

Use an AWS KMS AWS managed key (aws/s3) which automatically rotates the key every year.

Answer

Use AWS CloudHSM to generate and manage the key, and implement a custom cron job to rotate the key.

Question 11

A company is refactoring its legacy application into a microservices architecture using Docker containers. The operations team wants to deploy and manage these containers on AWS without the need to provision, patch, or manage the underlying servers. The solution must automatically scale containers based on demand and integrate with services like Application Load Balancer and Amazon RDS. Which AWS compute service should the company use?

Accepted Answer

Amazon ECS with AWS Fargate launch type. Amazon ECS with AWS Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, patch, or manage underlying servers. Fargate automatically scales containers based on demand and integrates natively with services like Application Load Balancer and Amazon RDS, meeting all the stated requirements.

Answer

Amazon ECS with Amazon EC2 launch type

Answer

AWS Lambda

Answer

Amazon EC2 instances with Docker installed

Question 12

A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is the correct choice because it provides automatic, always-on protection against common network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP reflection attacks, at no additional cost. It is integrated with Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53, making it ideal for protecting a public-facing web application behind an Application Load Balancer without requiring any configuration or extra fees.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Question 13

A company operates a global e-commerce website behind Amazon CloudFront. Security analysts have noticed a pattern of SQL injection attempts and cross-site scripting attacks targeting the web application. The company needs a fully managed service that can inspect incoming HTTP(S) requests and block these common web exploits before they reach the application origin. The solution must integrate with CloudFront and allow the security team to author custom rules. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that integrates directly with Amazon CloudFront to inspect HTTP(S) requests. It provides pre-configured rule groups (e.g., the SQL injection and cross-site scripting rule sets) and allows the security team to author custom rules to block common web exploits before they reach the origin. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 14

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The application serves users worldwide, and the company wants to optimize both performance and availability for all users. The solution should use the AWS global network to route traffic from users to the nearest edge location and then over the AWS backbone to the ALB, without caching content at edge locations. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route user traffic to the nearest edge location via Anycast IP addresses, then forwards it over the AWS backbone directly to the Application Load Balancer (ALB) in us-east-1. This optimizes performance by reducing latency and jitter, and improves availability by providing static IP addresses and health-check-based traffic shifting, without caching any content at edge locations.

Answer

Amazon CloudFront

Answer

AWS Shield

Answer

Amazon Route 53 latency-based routing

Question 15

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.

Answer

AWS KMS (Key Management Service)

Answer

AWS Systems Manager Parameter Store

Answer

AWS IAM (Identity and Access Management)