CLF-C02 Practice Test 30 — 15 Questions

Question 1

A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?

Accepted Answer

AWS App Mesh. AWS App Mesh is a service mesh that provides application-level networking, enabling microservices to communicate securely with mutual TLS (mTLS) and offering observability through metrics, logs, and traces. It integrates with AWS services like AWS X-Ray and Amazon CloudWatch to track network traffic between services, making it the correct choice for this requirement.

Answer

Amazon VPC with security groups

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Question 2

A company's AWS bill has increased significantly. The finance team wants to implement cost governance best practices. Which action represents a foundational cost governance control?

Accepted Answer

Implement a tagging strategy and enforce tags with AWS Config rules. Implementing a tagging strategy and enforcing tags with AWS Config rules is a foundational cost governance control because it enables cost allocation, tracking, and accountability. Tags allow the finance team to categorize resources by project, environment, or cost center, and AWS Config rules can automatically enforce tag compliance, preventing untagged resources from being launched. This directly supports cost governance by providing visibility and control over spending, which is the first step in optimizing costs.

Answer

Delete all non-production resources immediately

Answer

Switch all resources to Spot Instances

Answer

Enable all AWS services to trigger CloudWatch alarms

Question 3

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Accepted Answer

A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances. Option B is correct because configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Answer

AWS ensuring the physical data center is protected from unauthorized entry

Answer

AWS patching the underlying hypervisor on EC2 hosts

Answer

AWS ensuring S3 storage hardware is replaced when it fails

Question 4

A startup wants to deploy their web application to AWS with minimal configuration. They want AWS to handle provisioning, load balancing, scaling, and health monitoring automatically. Which service is most appropriate?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a Platform-as-a-Service (PaaS) offering that automatically handles provisioning, load balancing, auto scaling, and health monitoring with minimal configuration. The startup simply uploads their web application code, and Elastic Beanstalk manages the underlying infrastructure, including the EC2 instances, Elastic Load Balancer, and CloudWatch health checks, without requiring manual setup.

Answer

Amazon EC2 with Auto Scaling

Answer

Amazon EKS

Answer

AWS CloudFormation

Question 5

A company wants to protect their S3 buckets from accidental or malicious data exfiltration by ensuring that data can only leave the VPC through S3 endpoint conditions. Which IAM policy condition controls this?

Accepted Answer

VPC endpoint policy with aws:SourceVpc condition. Option B is correct because the `aws:SourceVpc` condition key in a VPC endpoint policy restricts access to S3 buckets so that requests must originate from the specified VPC. This ensures that data can only leave the VPC through the S3 VPC endpoint, preventing accidental or malicious data exfiltration via the public internet. By combining this condition with a VPC endpoint policy, the company enforces network-level control over S3 access.

Answer

S3 Block Public Access

Answer

S3 CORS configuration

Answer

Amazon Macie sensitive data classification

Question 6

A company is migrating to AWS and wants to understand the different types of cloud service models. Which model describes a service where the provider manages everything including the application, and the customer only manages their data and user access?

Accepted Answer

Software as a Service (SaaS). In the Software as a Service (SaaS) model, the cloud provider manages the entire application stack, including infrastructure, platform, and application software. The customer is responsible only for their data and user access, typically through a web browser or API. This aligns with the description where the provider manages everything including the application.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 7

A company has a hybrid cloud environment with both on-premises servers and AWS. They want a consistent management experience across both environments. Which AWS service extends the same AWS Systems Manager capabilities to non-AWS servers?

Accepted Answer

AWS Systems Manager with hybrid activations. AWS Systems Manager with hybrid activations allows you to manage on-premises servers and other non-AWS compute resources using the same Systems Manager capabilities (e.g., Run Command, Patch Manager, Inventory) as you use for EC2 instances. By installing the SSM Agent on the non-AWS server and registering it via a hybrid activation, the server appears as a managed instance in Systems Manager, providing a consistent management plane across hybrid environments.

Answer

AWS Outposts

Answer

AWS Direct Connect

Answer

Amazon EC2 Systems Manager

Question 8

Which AWS service provides a managed blockchain network using open-source frameworks like Hyperledger Fabric and Ethereum?

Accepted Answer

Amazon Managed Blockchain. Amazon Managed Blockchain is the correct AWS service because it is specifically designed to create and manage blockchain networks using popular open-source frameworks like Hyperledger Fabric and Ethereum. It handles the heavy lifting of setting up the blockchain infrastructure, including peer nodes, ordering service, and certificate authorities, allowing developers to focus on building decentralized applications.

Answer

Amazon DynamoDB

Answer

AWS Quantum Ledger Database (QLDB)

Answer

Amazon Neptune

Question 9

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

Accepted Answer

Enable MFA on the root account and create an IAM admin user for daily operations. Option B is correct because the root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Answer

Create IAM users for all employees immediately

Answer

Create root access keys for programmatic access

Answer

Enable AWS Config in all regions

Question 10

A company needs a managed service to forecast product demand using machine learning, helping them optimize inventory levels without building a custom ML model. Which AWS AI service provides ready-to-use time-series forecasting?

Accepted Answer

Amazon Forecast. Amazon Forecast is a fully managed service that uses machine learning to deliver highly accurate time-series forecasts based on historical data, without requiring any custom model building. It is specifically designed for use cases like product demand forecasting, inventory planning, and resource allocation, making it the correct choice for this scenario.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 11

Which AWS service provides an immutable, cryptographically verifiable transaction log for tracking the complete history of changes to application data?

Accepted Answer

Amazon QLDB (Quantum Ledger Database). Amazon QLDB (Quantum Ledger Database) provides an immutable, append-only journal that records every change to application data. It uses cryptographic hashing to chain entries together, creating a verifiable history that cannot be altered or deleted, which is exactly what the question describes.

Answer

Amazon Managed Blockchain

Answer

Amazon RDS with point-in-time recovery

Answer

AWS CloudTrail

Question 12

Which AWS service provides a finding-based security recommendations service that uses AI to identify operational issues and anomalies, going beyond simple rule-based Config checks?

Accepted Answer

Amazon DevOps Guru. Amazon DevOps Guru is the correct answer because it is an ML-powered service that automatically detects operational issues and anomalies, such as anomalous application behavior or resource contention, and provides finding-based security recommendations. Unlike rule-based services, DevOps Guru analyzes historical and real-time metrics, logs, and events to identify patterns that deviate from normal behavior, going beyond simple compliance checks.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 13

A financial services company needs to maintain a tamper-proof audit log of all financial transactions for regulatory compliance. Which AWS service is most appropriate?

Accepted Answer

Amazon QLDB. Amazon QLDB (Quantum Ledger Database) is purpose-built to provide a cryptographically verifiable, immutable, and tamper-proof transaction log. It uses a journal that stores every change as a series of entries, and each entry is chained using a hash, making it impossible to alter or delete past records without detection. This aligns directly with the financial services requirement for an audit log that must be tamper-proof for regulatory compliance.

Answer

Amazon RDS with transaction logging

Answer

Amazon DynamoDB with global tables

Answer

AWS CloudTrail with log file integrity validation

Question 14

Which AWS service is used to register domain names and route DNS queries for domain names like 'example.com'?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a scalable Domain Name System (DNS) web service that provides both domain name registration and DNS resolution. It translates human-readable domain names like 'example.com' into IP addresses and can also register new domains or transfer existing ones. This dual functionality makes it the correct choice for the question.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

AWS Certificate Manager

Question 15

An enterprise is planning their cloud adoption strategy. They want to understand how cloud adoption typically progresses. Which framework provides a structured approach to cloud adoption organized around business, people, governance, platform, security, and operations perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud adoption journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. Unlike the Well-Architected Framework, which focuses on architectural best practices for building workloads, the CAF addresses the broader organizational and process changes needed for successful cloud adoption.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor