CLF-C02 Practice Test 31 — 15 Questions

Question 1

A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 2

A developer needs to launch a test EC2 instance for a new prototype. The developer logs into the AWS Management Console, selects an instance type, and launches the instance without contacting AWS support or waiting for approval. Which cloud computing characteristic does this demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a developer independently provisioning an EC2 instance through the AWS Management Console without requiring human interaction with AWS support. This directly aligns with the NIST definition of on-demand self-service, a core characteristic of cloud computing where users can unilaterally provision computing capabilities as needed automatically.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 3

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

Accepted Answer

The customer, because OS patching is in the customer's area of responsibility for IaaS services. Under the AWS Shared Responsibility Model, for Infrastructure as a Service (IaaS) like EC2, the customer is responsible for managing the guest operating system, including patching and security updates. AWS is responsible for the physical infrastructure and the hypervisor layer, but not for the OS running inside the EC2 instance. Therefore, option B is correct.

Answer

AWS, because they own and operate all EC2 infrastructure

Answer

Both AWS and the customer equally share this responsibility

Answer

A third-party managed service provider designated by AWS

Question 4

A company has 50 IAM users in a single AWS account. The security policy requires that every IAM user must have a virtual MFA device enabled for AWS Management Console access. The company wants to automatically detect any user who disables or has an inactive MFA device and immediately revoke that user's ability to access AWS resources by disabling their access keys. The solution must be fully managed, require no custom scripts, and use native AWS services. Which AWS service should the company use to define the compliance rule and automatically trigger the remediation action?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (such as the `iam-user-mfa-enabled` managed rule) that continuously evaluate IAM user configurations against compliance policies. When a user disables or has an inactive virtual MFA device, AWS Config can detect the non-compliant resource and automatically trigger a remediation action via AWS Systems Manager Automation, which can disable the user's access keys without any custom scripts.

Answer

AWS Shield

Answer

AWS CloudTrail

Answer

AWS WAF

Question 5

A company operates 8 separate AWS accounts for different departments. They want to receive one consolidated monthly bill and benefit from combined usage discounts across all accounts for services like S3 and data transfer. Which AWS feature provides this?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows you to combine usage across all accounts in the organization to receive a single monthly bill and aggregate usage for volume discounts on services like S3 and data transfer. This feature enables you to centrally manage billing and take advantage of tiered pricing based on combined usage, which is exactly what the company needs.

Answer

AWS Cost Explorer across all accounts

Answer

AWS Budgets across all accounts

Answer

AWS Support Plan upgrade to Enterprise tier

Question 6

A large enterprise runs business-critical workloads on AWS and needs 24/7 phone and chat access to Cloud Support Engineers, a designated Technical Account Manager (TAM), and access to proactive guidance and architectural reviews. Which AWS Support plan includes all of these features?

Accepted Answer

Enterprise Support. The Enterprise Support plan is the only AWS Support plan that includes 24/7 phone and chat access to Cloud Support Engineers, a designated Technical Account Manager (TAM), and proactive guidance and architectural reviews. These features are specifically designed for large enterprises running business-critical workloads that require personalized support and strategic advice.

Answer

Basic Support

Answer

Developer Support

Answer

Business Support

Question 7

A financial analytics company runs a mission-critical application in its on-premises data center. The application must replicate large volumes of market data to Amazon S3 in real time. The company requires a dedicated, private network connection with consistent low latency and high throughput. The connection must not traverse the public internet. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent low latency and high throughput, which is essential for replicating large volumes of market data in real time. The connection uses industry-standard 802.1Q VLANs and can be provisioned at speeds up to 100 Gbps, meeting the requirement for a private, high-performance link.

Answer

AWS Site-to-Site VPN

Answer

Amazon VPC peering

Answer

AWS Transit Gateway

Question 8

A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it is designed to centralize log storage from multiple sources, including EC2 instances, via the CloudWatch agent. It provides built-in querying with Logs Insights, supports real-time monitoring, and offers configurable retention policies for long-term storage, meeting all requirements for searching, analysis, and retention.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 9

A company is migrating a steady-state web server to AWS. The server is expected to run continuously (24 hours a day, 7 days a week) for the next three years. The workload has predictable CPU and memory usage and does not experience significant spikes. The company wants to minimize the total cost of running this server over the three-year period. Which AWS EC2 pricing model should the company choose?

Accepted Answer

Standard Reserved Instances with a 3-year term and all upfront payment. Standard Reserved Instances with a 3-year term and all upfront payment provide the highest discount (up to 72% compared to On-Demand) for workloads that run continuously and predictably. Since this server will run 24/7 for three years with no significant spikes, a 3-year all upfront Reserved Instance minimizes total cost by locking in the lowest effective hourly rate.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 10

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF rules

Answer

VPC route tables

Question 11

A company runs a mix of production and non-production Amazon EC2 instances. The finance team uses AWS Budgets to monitor monthly spending. For the development accounts, the team wants to automatically stop all running EC2 instances when the account's monthly spending reaches 90% of the budgeted amount. The team wants a solution that does not require custom scripting or additional infrastructure. Which AWS Budgets feature should the team configure to meet this requirement?

Accepted Answer

Configure a budget action that runs an AWS Systems Manager automation document to stop the EC2 instances.. AWS Budgets supports budget actions that can automatically trigger AWS Systems Manager automation documents to stop EC2 instances when a budget threshold is exceeded. This meets the requirement of no custom scripting or additional infrastructure, as the automation document is a built-in capability of Systems Manager.

Answer

Create a budget alert that sends an email notification to the operations team when spending reaches 90% of the budget.

Answer

Configure a budget action that applies an IAM policy to deny the ec2:StopInstances permission for all users.

Answer

Create a budget alert that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic, and subscribe an AWS Lambda function to stop the instances.

Question 12

Which AWS service provides a hybrid cloud storage solution that allows on-premises applications to seamlessly access data stored in AWS cloud storage using standard file protocols?

Accepted Answer

AWS Storage Gateway. AWS Storage Gateway provides a hybrid cloud storage solution by offering on-premises appliances that expose standard file protocols (NFS, SMB) to local applications, while storing data durably in Amazon S3 or Amazon EBS. This allows seamless access to AWS cloud storage without modifying existing workflows, as the gateway caches frequently accessed data locally and asynchronously transfers data to the cloud.

Answer

AWS DataSync

Answer

AWS Direct Connect

Answer

Amazon FSx

Question 13

A development team accidentally deletes important files from an Amazon S3 bucket. The company wants to protect against accidental deletions and overwrites in the future, allowing recovery of previous versions of objects. Which S3 feature should they enable?

Accepted Answer

S3 Versioning. S3 Versioning is the correct feature because it preserves every version of an object, including overwrites and deletions. When versioning is enabled, deleting an object only adds a delete marker, and previous versions remain recoverable. This directly addresses the requirement to protect against accidental deletions and overwrites by allowing restoration of earlier object versions.

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Answer

S3 Intelligent-Tiering

Question 14

A company needs to deploy their application in multiple geographic locations to ensure data sovereignty compliance and reduce latency for users in different continents. What is the AWS infrastructure concept that represents a distinct geographic area with multiple isolated locations?

Accepted Answer

AWS Region. An AWS Region is a distinct geographic area that contains multiple, isolated Availability Zones. This design allows customers to deploy applications across separate locations within a region for high availability, while also choosing specific regions to meet data sovereignty requirements and reduce latency for users on different continents.

Answer

Availability Zone

Answer

Edge Location

Answer

Local Zone

Question 15

A company wants to analyse petabytes of historical sales data using standard SQL queries and connect their existing business intelligence (BI) tools to the data store. The workload is analytical (OLAP), not transactional (OLTP). Which AWS service is designed for this use case?

Accepted Answer

Amazon Redshift. Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed for analytical (OLAP) workloads. It uses standard SQL and integrates directly with popular BI tools via JDBC/ODBC connections, making it ideal for querying large historical datasets and connecting existing business intelligence tools.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Aurora