CLF-C02 Practice Test 28 — 15 Questions

Question 1

A company runs a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that allows them to create custom rules to filter malicious HTTP traffic and integrates directly with the ALB and Amazon CloudFront. Which AWS service should the security team configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects against common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers (ALB) and Amazon CloudFront, and allows you to create custom rules to filter malicious HTTP traffic based on conditions such as IP addresses, HTTP headers, and request body patterns.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

AWS Network Firewall

Question 2

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports (including PCI DSS reports) and agreements such as the Business Associate Addendum (BAA) for HIPAA. It allows the compliance officer to review, download, and sign these documents directly from the AWS Management Console, meeting the requirement for a single managed service.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon Inspector

Question 3

A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to obtain an official document from AWS that details the security controls AWS has implemented to support PCI DSS compliance for services such as Amazon RDS and Amazon EC2. The document must be downloadable as a PDF for review and audit purposes. Which AWS service should the compliance officer use to retrieve this document?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports and security documents, including the PCI DSS compliance attestation and responsibility summary. The compliance officer can download the AWS PCI DSS compliance package as a PDF directly from the AWS Artifact console, which is specifically designed for audit and review purposes.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 4

A company runs a globally distributed multiplayer game on AWS. The game uses UDP for real-time communication and requires static IP addresses that do not change for whitelisting by internet service providers. The company needs to route traffic to the nearest healthy application endpoint to minimize latency and improve performance. The solution must work with both TCP and UDP traffic and provide static IP addresses. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides static IP addresses that serve as fixed entry points to your application, and it uses the AWS global network to route traffic to the nearest healthy endpoint via Anycast. It supports both TCP and UDP traffic, making it ideal for real-time UDP-based gaming workloads that require low latency and static IPs for ISP whitelisting.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 5

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 6

A company's leadership team wants a structured framework for planning their AWS cloud migration that addresses organisational change management, skills development, governance, platform, security, and operations. Which AWS framework provides guidance across these perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud migration journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. This framework directly addresses the leadership team's requirements for organizational change management, skills development, governance, platform, security, and operations, making it the correct choice.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor

Question 7

A company runs a web application on multiple EC2 instances across multiple Availability Zones. All instances need to access and share the same file system simultaneously to read and write shared configuration files. Which AWS storage service supports simultaneous access from multiple EC2 instances?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, NFS-based file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, providing shared access for reading and writing configuration files. It uses the NFSv4.1 protocol and supports thousands of simultaneous connections, making it ideal for shared storage scenarios.

Answer

Amazon EBS

Answer

Instance Store

Answer

Amazon S3

Question 8

A company wants to automatically detect potential security threats such as compromised credentials, unauthorized access attempts, and communication with known malicious IP addresses across its AWS environment. The company has enabled AWS CloudTrail, VPC Flow Logs, and DNS logs. Which AWS service should the company use to continuously analyze these logs and generate actionable security findings without requiring manual setup of data sources?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs using machine learning and anomaly detection to identify compromised credentials, unauthorized access, and communication with known malicious IP addresses. It operates without requiring manual setup of data sources because it automatically ingests these logs once enabled, generating actionable security findings.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 9

A company hosts a web application on Amazon EC2 instances in two AWS Regions: us-east-1 and eu-west-1. The application serves a global user base. The company wants to improve performance by directing users to the nearest healthy regional endpoint with minimal latency. Additionally, the company requires two static Anycast IP addresses that remain constant, representing the application entry point. The solution should automatically reroute traffic if a regional endpoint becomes unhealthy. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is correct because it uses the AWS global network and Anycast static IP addresses to route user traffic to the nearest healthy regional endpoint (EC2 instances in us-east-1 or eu-west-1). It automatically reroutes traffic if an endpoint becomes unhealthy, providing low latency and high availability for global users.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Shield

Question 10

A company runs a combination of Amazon EC2 instances and AWS Lambda functions for its applications. The finance team wants to reduce costs by making a commitment to a consistent amount of compute usage (measured in dollars per hour) for a 1-year term. The team wants the flexibility to change instance families, sizes, and AWS regions, and also wants the commitment to cover both EC2 and Lambda usage. Which AWS pricing option should the team purchase?

Accepted Answer

Compute Savings Plans. Compute Savings Plans provide the required flexibility to change instance families, sizes, and AWS regions, and they automatically apply to both EC2 and Lambda usage. This plan offers a discounted hourly rate in exchange for a 1-year commitment to a consistent amount of compute spend (measured in dollars per hour), making it the only option that meets all the stated requirements.

Answer

EC2 Instance Savings Plans

Answer

Reserved Instances

Answer

Spot Instances

Question 11

A company plans to run a fleet of Amazon EC2 instances continuously for 3 years to support a steady-state application. The company wants the lowest possible cost for this predictable workload while maintaining the flexibility to change instance families if needed. Which AWS purchasing option should the company choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the lowest cost for a predictable, steady-state workload over 3 years while allowing flexibility to change instance families. Unlike Reserved Instances, which lock you to a specific instance family, Compute Savings Plans apply to any EC2 instance (including those in different families) within a chosen region, automatically providing the highest discount (up to 66% vs On-Demand) for consistent compute usage.

Answer

On-Demand Instances

Answer

Standard Reserved Instances

Answer

Spot Instances

Question 12

A company has migrated all of its workloads to AWS and has decommissioned all of its on-premises data centres. All compute, storage, databases, and networking are now managed in AWS. Which cloud deployment model describes this architecture?

Accepted Answer

Public cloud. The company has migrated all workloads to AWS and decommissioned all on-premises data centers, meaning all infrastructure is hosted entirely on AWS's shared infrastructure. This is the definition of a public cloud deployment model, where resources are owned and operated by a third-party cloud provider (AWS) and delivered over the internet to multiple tenants. No private or on-premises components remain, so the architecture is purely public cloud.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Multi-cloud

Question 13

A financial services company maintains a legacy on-premises database for sensitive customer data that must remain in a physically controlled environment due to regulatory requirements. The company runs its customer-facing web application on AWS to benefit from scalability and global reach. A dedicated encrypted VPN connection securely links the on-premises environment with the AWS cloud. Which cloud deployment model does this scenario BEST represent?

Accepted Answer

Hybrid cloud. This scenario best represents a hybrid cloud because it combines on-premises infrastructure (the legacy database) with public cloud resources (AWS) connected via a dedicated encrypted VPN. The hybrid cloud model allows the company to keep sensitive data in a physically controlled environment while leveraging AWS's scalability for the customer-facing web application.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 14

A company operates a global e-commerce website with static assets (product images, CSS, JavaScript) stored in an Amazon S3 bucket. Users in different geographic regions report slow page load times. The company wants to reduce latency without rearchitecting the application or moving the S3 bucket. Which AWS service should the company use to distribute the static assets closer to users?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static assets at edge locations worldwide, significantly reducing latency for users by serving content from the nearest edge location rather than from the origin S3 bucket. It integrates directly with S3 without requiring any application rearchitecture or bucket relocation, making it the ideal solution for this use case.

Answer

S3 Transfer Acceleration

Answer

Add more Amazon EC2 instances in different regions

Answer

Application Load Balancer with cross-zone load balancing

Question 15

A company runs a web application on Amazon EC2 instances that connect to a relational database. The application requires high database availability so that if the primary database instance fails, a standby instance automatically takes over without manual intervention. The company wants to minimize administrative overhead for database patching, backups, and replication. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon RDS Multi-AZ. Amazon RDS Multi-AZ provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. If the primary database instance fails, Amazon RDS automatically fails over to the standby, ensuring minimal downtime without manual intervention. Additionally, RDS handles patching, backups, and replication automatically, reducing administrative overhead.

Answer

Amazon RDS Single-AZ

Answer

Amazon DynamoDB Global Tables

Answer

Amazon S3