CLF-C02 Practice Test 3 — 10 Questions

Question 1

A company's security team wants to automatically remediate non-compliant AWS Config rules, such as automatically enabling S3 server-side encryption on any bucket found without it. Which AWS Config feature enables this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config Rules with Automatic Remediation using SSM Automation. AWS Config Rules with Automatic Remediation using SSM Automation (Option B) is the correct feature because it allows you to associate an SSM Automation document with a non-compliant AWS Config rule. When a resource is evaluated as non-compliant, Config can automatically invoke the SSM Automation runbook to remediate the issue—for example, enabling S3 server-side encryption on a bucket that lacks it. This directly satisfies the security team's requirement for automated, policy-driven remediation without manual intervention.

Answer

AWS Config rule compliance reporting only

Answer

AWS Security Hub findings export to S3

Answer

Amazon GuardDuty threat response

Question 2

A company is moving its workloads to AWS. The compliance team requires that all data must reside within the European Union (EU) and must not be stored on any physical server located outside the EU. The team also understands that AWS does not provide information about the specific physical server or data center where their data is stored. Which essential characteristic of cloud computing does this situation best describe?

Accepted Answer

Resource pooling. Resource pooling allows AWS to serve multiple customers from shared physical resources, with the provider abstracting the exact physical server location. The compliance requirement that data must reside only in the EU is satisfied by selecting an EU Region (e.g., eu-west-1), but AWS does not disclose the specific physical server or data center within that Region, which is a direct consequence of resource pooling—the provider's multi-tenant model hides the underlying hardware details from the customer.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 3

A company wants to provision and manage SSL/TLS certificates for their AWS resources without paying for certificates or manually handling renewals. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancing, CloudFront, API Gateway) at no additional cost. ACM automatically handles certificate renewals, eliminating the need for manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS IAM

Question 4

A company is migrating its on-premises infrastructure to AWS. The operations team needs a managed service that allows them to define their entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—as a reusable template stored in version control. The service must automatically handle resource dependencies, such as creating the database before launching the application servers, and ensure that the infrastructure is provisioned consistently across multiple environments (e.g., development, staging, production). Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it provides Infrastructure as Code (IaC) capabilities, allowing you to define your entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—in a reusable JSON or YAML template stored in version control. It automatically manages resource dependencies using the DependsOn attribute and intrinsic functions like Ref and Fn::GetAtt, ensuring resources are created in the correct order (e.g., database before application servers). CloudFormation also supports consistent provisioning across multiple environments by using parameters, mappings, and stacksets, making it ideal for the operations team's requirements.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 5

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The security team needs to understand their responsibilities under the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility?

Accepted Answer

Configuring security group rules to control network access to the database. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security group rules to control network access to the database. Security groups act as a virtual firewall that controls inbound and outbound traffic at the instance level, and the customer must define the rules (e.g., source IP, port 3306 for MySQL) to restrict access appropriately.

Answer

Applying minor version patches to the MySQL database engine

Answer

Managing the physical security of the data center where the RDS instance is hosted

Answer

Replacing failed hardware components in the RDS host server

Question 6

A startup uses AWS Lambda for its backend processing. The company is billed only for the number of function invocations and the compute time consumed, rounded up to the nearest millisecond. There are no minimum fees or upfront commitments. This billing model is a direct example of which essential characteristic of cloud computing?

Accepted Answer

Measured service. The AWS Lambda billing model—charging only for function invocations and compute time rounded to the nearest millisecond, with no minimum fees or upfront commitments—directly exemplifies measured service. This essential characteristic of cloud computing means that resource usage is metered, monitored, and reported transparently, allowing customers to pay only for what they consume. In Lambda, the metering is granular: each invocation is counted, and duration is measured in 1-millisecond increments, enabling precise cost allocation.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Broad network access

Question 7

A financial services company runs a high-frequency stock trading platform on AWS. The platform must continue processing trades without any interruption, even if an entire AWS Availability Zone experiences a complete outage. The architecture is designed with duplicate infrastructure in multiple Availability Zones, and all components are active simultaneously. The system is engineered so that if one AZ fails, the remaining AZs continue processing trades instantly, with zero downtime for end users. Which cloud computing concept does this requirement BEST represent?

Accepted Answer

Fault tolerance. This requirement describes a system that continues to operate without any interruption even when an entire AWS Availability Zone fails. That is the definition of fault tolerance: the system is designed to survive component failures with zero impact on service. The architecture uses duplicate active infrastructure in multiple AZs so that if one AZ fails, the remaining AZs instantly take over with no downtime, which is fault tolerance, not just high availability.

Answer

Elasticity

Answer

High availability

Answer

Durability

Question 8

A company runs a production workload on AWS and needs technical support that includes phone and email access with a response time of less than 1 hour for critical system failures. The company also wants architectural guidance for cost optimization and performance improvement. The company currently has an AWS account with the Basic Support plan. Which AWS Support plan should the company choose to meet these requirements at the most cost-effective price?

Accepted Answer

Business Support. The Business Support plan is the most cost-effective option that provides phone and email support with a response time of under 1 hour for critical system failures, along with architectural guidance for cost optimization and performance improvement. The Basic and Developer plans lack phone support and the required response time SLA, while the Enterprise plan offers additional features (e.g., a Technical Account Manager) that are not needed here, making it more expensive than necessary.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise Support

Question 9

A company runs a data-intensive workload in a colocation facility and wants to establish a dedicated, private network connection to its Amazon VPC. The connection must bypass the public internet to provide consistent high throughput and low latency. The company also wants to avoid data transfer costs associated with internet-based connections. Which AWS service should the company use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private network connection from an on-premises or colocation facility directly to an Amazon VPC, bypassing the public internet entirely. This ensures consistent high throughput, low latency, and eliminates data transfer costs associated with internet-based connections, as traffic flows over a private physical link.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

AWS Transit Gateway

Question 10

A company is migrating a legacy monolithic e-commerce application to AWS. The application has three tightly integrated modules: user authentication, payment processing, and inventory management. In the current design, a failure in the payment processing module often causes the entire application to crash. The company wants to redesign the application so that each module runs independently, and a failure in one module does not cascade to other modules. Which cloud computing concept should the company apply to achieve this goal?

Accepted Answer

Loose coupling. Loose coupling. Loose coupling is a cloud computing concept where components are designed to have minimal dependencies on each other, communicating through well-defined interfaces or APIs. By decoupling the user authentication, payment processing, and inventory management modules, a failure in one module (e.g., payment processing) will not cascade and crash the entire application, as each module can operate independently and handle its own failures gracefully.

Answer

Elasticity

Answer

High availability

Answer

Disaster recovery