CLF-C02 Practice Test 28 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple AWS accounts. The security team must ensure that all API activity across all accounts, including any new accounts added in the future, is recorded and delivered to a centralized S3 bucket for auditing. The solution should require minimal ongoing manual effort. Which AWS feature should the security team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an AWS CloudTrail organization trail that logs events for all accounts in the organization.. AWS CloudTrail organization trails automatically log events for all accounts in an AWS Organization, including any new accounts added in the future, and deliver them to a single S3 bucket without requiring per-account configuration. This satisfies the requirement for minimal ongoing manual effort and centralized auditing.

Answer

Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

Answer

Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

Answer

Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.

Question 2

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 3

A company has workloads that must remain on-premises due to data residency regulations but want to use the same AWS APIs, tools, and services they use in the cloud — including EC2, RDS, and S3 — on their on-premises hardware. Which AWS service enables this?

Accepted Answer

AWS Outposts. AWS Outposts is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises data center or co-location space. It allows customers to run EC2, RDS, and S3 locally on Outposts hardware while maintaining the same AWS control plane and APIs, satisfying data residency requirements without sacrificing cloud-native tooling.

Answer

AWS Direct Connect

Answer

AWS Snow Family

Answer

AWS Local Zones

Question 4

A company has 50 TB of historical data stored on on-premises network-attached storage (NAS). The company wants to transfer this data to Amazon S3. The internet connection provides only 10 Mbps upload speed, and the company wants to complete the transfer within 2 weeks. The data is not sensitive and does not require encryption during transfer. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Snowball Edge. AWS Snowball Edge is the correct choice because it is a physical data transport solution designed for large-scale data transfers over slow or unreliable networks. With 50 TB of data and only 10 Mbps upload speed, transferring over the internet would take approximately 50 TB * 8 bits/byte / (10 Mbps) ≈ 11,574 hours (482 days), far exceeding the 2-week window. Snowball Edge allows the company to physically ship the data to AWS, bypassing network constraints entirely.

Answer

AWS DataSync

Answer

AWS Storage Gateway (File Gateway)

Answer

AWS Direct Connect

Question 5

A company is moving its on-premises workloads to AWS. The company's chief financial officer notes that AWS can provide computing resources at a lower cost per unit because AWS spreads the cost of building and maintaining vast data centers across millions of customers. This cost advantage is best described as an example of which concept?

Accepted Answer

Economies of scale. Economies of scale occur when a provider like AWS spreads the fixed costs of building and operating massive data centers across a huge number of customers, reducing the per-unit cost of compute, storage, and networking. This allows AWS to offer lower prices than a single company could achieve by running its own on-premises infrastructure. The CFO's observation directly describes this principle: AWS's aggregated demand drives down the average cost per resource.

Answer

Resource pooling

Answer

Measured service

Answer

Broad network access

Question 6

A company uses AWS for its development environment. The finance team wants to set a monthly budget of $10,000. They want to receive an email notification when the actual costs reach 80% of the budget ($8,000) and again when costs exceed the budget. The team needs a managed AWS service that can automatically send these alerts without requiring custom code or third-party tools. Which AWS service should the team use?

Accepted Answer

AWS Budgets. AWS Budgets is a managed service that allows you to set custom cost and usage budgets and receive alerts when your actual or forecasted costs exceed (or are forecasted to exceed) your budgeted amount. It can automatically send email notifications at specified thresholds (e.g., 80% and 100%) without requiring any custom code or third-party tools, making it the ideal solution for the finance team's requirements.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 7

A company runs a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that allows them to create custom rules to filter malicious HTTP traffic and integrates directly with the ALB and Amazon CloudFront. Which AWS service should the security team configure?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects against common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers (ALB) and Amazon CloudFront, and allows you to create custom rules to filter malicious HTTP traffic based on conditions such as IP addresses, HTTP headers, and request body patterns.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

AWS Network Firewall

Question 8

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports (including PCI DSS reports) and agreements such as the Business Associate Addendum (BAA) for HIPAA. It allows the compliance officer to review, download, and sign these documents directly from the AWS Management Console, meeting the requirement for a single managed service.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon Inspector

Question 9

A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to obtain an official document from AWS that details the security controls AWS has implemented to support PCI DSS compliance for services such as Amazon RDS and Amazon EC2. The document must be downloadable as a PDF for review and audit purposes. Which AWS service should the compliance officer use to retrieve this document?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports and security documents, including the PCI DSS compliance attestation and responsibility summary. The compliance officer can download the AWS PCI DSS compliance package as a PDF directly from the AWS Artifact console, which is specifically designed for audit and review purposes.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 10

A company runs a globally distributed multiplayer game on AWS. The game uses UDP for real-time communication and requires static IP addresses that do not change for whitelisting by internet service providers. The company needs to route traffic to the nearest healthy application endpoint to minimize latency and improve performance. The solution must work with both TCP and UDP traffic and provide static IP addresses. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides static IP addresses that serve as fixed entry points to your application, and it uses the AWS global network to route traffic to the nearest healthy endpoint via Anycast. It supports both TCP and UDP traffic, making it ideal for real-time UDP-based gaming workloads that require low latency and static IPs for ISP whitelisting.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 11

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 12

A company's leadership team wants a structured framework for planning their AWS cloud migration that addresses organisational change management, skills development, governance, platform, security, and operations. Which AWS framework provides guidance across these perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud migration journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. This framework directly addresses the leadership team's requirements for organizational change management, skills development, governance, platform, security, and operations, making it the correct choice.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor

Question 13

A company runs a web application on multiple EC2 instances across multiple Availability Zones. All instances need to access and share the same file system simultaneously to read and write shared configuration files. Which AWS storage service supports simultaneous access from multiple EC2 instances?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, NFS-based file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, providing shared access for reading and writing configuration files. It uses the NFSv4.1 protocol and supports thousands of simultaneous connections, making it ideal for shared storage scenarios.

Answer

Amazon EBS

Answer

Instance Store

Answer

Amazon S3

Question 14

A company wants to automatically detect potential security threats such as compromised credentials, unauthorized access attempts, and communication with known malicious IP addresses across its AWS environment. The company has enabled AWS CloudTrail, VPC Flow Logs, and DNS logs. Which AWS service should the company use to continuously analyze these logs and generate actionable security findings without requiring manual setup of data sources?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs using machine learning and anomaly detection to identify compromised credentials, unauthorized access, and communication with known malicious IP addresses. It operates without requiring manual setup of data sources because it automatically ingests these logs once enabled, generating actionable security findings.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 15

A company hosts a web application on Amazon EC2 instances in two AWS Regions: us-east-1 and eu-west-1. The application serves a global user base. The company wants to improve performance by directing users to the nearest healthy regional endpoint with minimal latency. Additionally, the company requires two static Anycast IP addresses that remain constant, representing the application entry point. The solution should automatically reroute traffic if a regional endpoint becomes unhealthy. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is correct because it uses the AWS global network and Anycast static IP addresses to route user traffic to the nearest healthy regional endpoint (EC2 instances in us-east-1 or eu-west-1). It automatically reroutes traffic if an endpoint becomes unhealthy, providing low latency and high availability for global users.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Shield