CLF-C02 Practice Test 30 — 15 Questions

Question 1

A healthcare company is required to encrypt all protected health information (PHI) stored in Amazon S3. The company must maintain control over the encryption keys, rotate them annually, and log all key usage. Which AWS service or feature should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Key Management Service (AWS KMS) with customer managed keys. AWS KMS with customer managed keys is correct because it allows the healthcare company to maintain full control over the encryption keys, enforce annual rotation (via automatic or manual key rotation), and log all key usage through AWS CloudTrail. This meets the compliance requirements for protecting PHI in S3 while retaining key management authority.

Answer

Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Question 2

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS WAF logs

Question 3

A cloud provider uses shared physical infrastructure to serve many customers. Each customer's compute and storage resources are logically isolated and secure, but the underlying hardware is pooled across all customers. Which essential characteristic of cloud computing does this scenario BEST describe?

Accepted Answer

Resource pooling. Resource pooling is the correct characteristic because the scenario describes a multi-tenant model where physical and virtual resources are dynamically assigned and reassigned according to consumer demand. The cloud provider's shared infrastructure (compute, storage, network) is pooled to serve multiple customers, with logical isolation ensuring each customer's data remains secure despite the shared underlying hardware. This directly matches the NIST SP 800-145 definition of resource pooling.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 4

A startup runs an application on AWS and receives a monthly bill that charges exactly for the number of compute hours used, the gigabytes of data stored, and the gigabytes of data transferred. The company pays nothing for resources they did not use. Which cloud computing characteristic does this represent?

Accepted Answer

Measured service. This scenario describes a pay-per-use model where costs directly correlate with actual consumption of compute hours, storage, and data transfer. Measured service is the cloud characteristic that enables this by automatically monitoring, controlling, and reporting resource usage, providing transparency for both the provider and consumer. AWS implements this through services like AWS CloudTrail and detailed billing reports, ensuring customers are charged only for what they consume.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Resource pooling

Question 5

A startup can now test a new application idea by provisioning cloud resources in minutes, run the experiment for a week, and tear down the resources if the idea fails — spending only a few dollars. Previously, the same experiment would have required months of procurement and significant capital expenditure. Which cloud benefit does this illustrate?

Accepted Answer

Increased agility. The scenario describes the ability to rapidly provision, experiment with, and decommission cloud resources in minutes, which directly illustrates increased agility. Agility in cloud computing refers to the speed at which resources can be deployed, scaled, and released, enabling fast experimentation without long procurement cycles.

Answer

Economies of scale

Answer

Elimination of capital expense

Answer

Global reach

Question 6

A company wants to implement a hub-and-spoke network architecture where multiple VPCs can communicate with a shared services VPC (containing DNS, monitoring, and security tools) but not with each other. Which AWS networking feature enables this?

Accepted Answer

AWS Transit Gateway with route tables. AWS Transit Gateway with route tables is the correct choice because it acts as a central hub that connects multiple VPCs (spokes) to a shared services VPC, while using separate route tables to prevent inter-spoke communication. This allows the shared services VPC to be reachable from all other VPCs, but the route tables can be configured to not propagate routes between the spoke VPCs, enforcing the desired isolation.

Answer

VPC Peering with route table customization

Answer

Internet Gateway with security groups

Answer

VPC Endpoints

Question 7

A retail company's order processing system receives large bursts of orders during flash sales. The order intake API gets overwhelmed because it directly calls a downstream processing service that is slower. The company wants to decouple the API from the processing service so orders are not lost during spikes. Which AWS service should they use?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that decouples the order intake API from the downstream processing service. When the API receives a burst of orders, it can immediately push each order message into an SQS queue, and the processing service can poll and consume messages at its own pace, ensuring no orders are lost even during traffic spikes.

Answer

Amazon SNS

Answer

Amazon EventBridge

Answer

AWS Step Functions

Question 8

A company wants to accelerate their machine learning workflows by using pre-trained foundation models for tasks like text generation and image creation without training models from scratch. Which AWS service provides access to pre-trained foundation models via API?

Accepted Answer

Amazon Bedrock. Amazon Bedrock is a fully managed service that provides access to pre-trained foundation models (FMs) from leading AI providers like AI21 Labs, Anthropic, Cohere, Meta, Stability AI, and Amazon via a single API. It enables you to build generative AI applications for tasks such as text generation and image creation without managing underlying infrastructure or training models from scratch.

Answer

Amazon SageMaker

Answer

Amazon Rekognition

Answer

AWS DeepComposer

Question 9

Which AWS feature allows multiple AWS accounts to be managed under one umbrella, receive a single consolidated bill, and potentially share volume discounts?

Accepted Answer

AWS Organizations. AWS Organizations is the correct service because it provides centralized management of multiple AWS accounts, enabling a single consolidated bill and the ability to aggregate usage across accounts to qualify for volume discounts. It allows you to create a hierarchy of accounts with organizational units (OUs) and apply service control policies (SCPs) for governance, while the consolidated billing feature combines all usage into a single payer account for pricing benefits.

Answer

AWS Control Tower

Answer

AWS IAM Identity Center

Answer

AWS Cost Explorer

Question 10

A company runs a database on an Amazon EC2 instance. They need block storage that persists independently from the EC2 instance — if the instance is stopped or terminated, the data must remain available. Which AWS storage service provides this?

Accepted Answer

Amazon EBS. Amazon EBS (Elastic Block Store) provides persistent block-level storage volumes that can be attached to an EC2 instance. Unlike instance store, EBS volumes persist independently of the instance lifecycle — data remains intact even when the instance is stopped or terminated, as long as the volume is not deleted. This makes EBS the correct choice for the requirement of persistent, independent block storage.

Answer

Amazon S3

Answer

Instance Store

Answer

Amazon EFS

Question 11

A company runs a set of Amazon EC2 instances that handle a consistent, predictable workload 24 hours a day, 7 days a week. The company expects to continue running this workload for the next three years. The finance team wants to minimize the total cost of these EC2 instances while maintaining flexibility to change instance families if needed. Which AWS pricing option should the company choose to meet these requirements?

Accepted Answer

Compute Savings Plans (3-year, all upfront). Compute Savings Plans (3-year, all upfront) provide the highest discount (up to 66%) for consistent, predictable workloads running 24/7 for three years, and they offer flexibility to change instance families, operating systems, or regions within the compute scope. This matches the requirement to minimize cost while maintaining the ability to switch instance families.

Answer

On-Demand instances

Answer

EC2 Instance Savings Plans (1-year, no upfront)

Answer

Spot Instances

Question 12

A company wants to use AWS free tier for testing new services. Which statement about the AWS Free Tier is accurate?

Accepted Answer

The Free Tier includes a mix of 12-month free, always free, and short-term trial offers. The AWS Free Tier is structured into three categories: 12-month free offers (e.g., 750 hours of EC2 t2.micro per month), always free offers (e.g., 1 million Lambda requests per month), and short-term trials (e.g., 30-day free trial of Amazon Inspector). This mix allows customers to test services without incurring costs for the specified limits and durations.

Answer

The Free Tier is available indefinitely for all AWS services

Answer

The Free Tier applies equally to all AWS accounts including Enterprise support customers

Answer

AWS does not charge if you stay within Free Tier limits for any service

Question 13

A company runs a mix of Amazon EC2 instances and AWS Fargate containers. The CFO wants to reduce costs by committing to a consistent amount of compute usage (measured in $ per hour) for a 1-year term. The company expects to change instance families and regions occasionally and needs the flexibility to apply the savings to both EC2 and ECS Fargate usage. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the flexibility to cover EC2 instance and Fargate usage across any region, instance family, or compute type, while providing a discounted hourly rate in exchange for a 1-year commitment. This matches the CFO's requirement to reduce costs with a consistent $/hour commitment and the need to change instance families and regions occasionally, as Compute Savings Plans automatically apply to any eligible compute usage without requiring specific reservations.

Answer

EC2 Instance Savings Plans

Answer

Reserved Instances (Convertible)

Answer

On-Demand Instances

Question 14

A company has bring-your-own-license (BYOL) server software that is licensed per physical CPU socket. They need to run this software on AWS and require visibility into and control over the physical host their instances run on. Which EC2 option meets this requirement?

Accepted Answer

Dedicated Hosts. Dedicated Hosts provide you with a physical server fully dedicated to your use, allowing you to see and control the physical host's CPU sockets and cores. This is essential for bring-your-own-license (BYOL) software that is licensed per physical CPU socket, as you must ensure compliance with the license terms by managing the exact hardware configuration.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 15

A company hosts a static website on Amazon S3. The website serves product images and documents to customers around the world. Users in distant regions report slow load times. The company wants to reduce latency for all users without changing the existing S3 bucket configuration. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., images, documents) at edge locations worldwide. By distributing content from the nearest edge location to the user, CloudFront significantly reduces latency without requiring any changes to the existing S3 bucket configuration. The origin remains the S3 bucket, and CloudFront handles the global distribution automatically.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

AWS Global Accelerator