CLF-C02 Practice Test 32 — 15 Questions

Question 1

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF rules

Answer

VPC route tables

Question 2

A company runs a mix of production and non-production Amazon EC2 instances. The finance team uses AWS Budgets to monitor monthly spending. For the development accounts, the team wants to automatically stop all running EC2 instances when the account's monthly spending reaches 90% of the budgeted amount. The team wants a solution that does not require custom scripting or additional infrastructure. Which AWS Budgets feature should the team configure to meet this requirement?

Accepted Answer

Configure a budget action that runs an AWS Systems Manager automation document to stop the EC2 instances.. AWS Budgets supports budget actions that can automatically trigger AWS Systems Manager automation documents to stop EC2 instances when a budget threshold is exceeded. This meets the requirement of no custom scripting or additional infrastructure, as the automation document is a built-in capability of Systems Manager.

Answer

Create a budget alert that sends an email notification to the operations team when spending reaches 90% of the budget.

Answer

Configure a budget action that applies an IAM policy to deny the ec2:StopInstances permission for all users.

Answer

Create a budget alert that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic, and subscribe an AWS Lambda function to stop the instances.

Question 3

Which AWS service provides a hybrid cloud storage solution that allows on-premises applications to seamlessly access data stored in AWS cloud storage using standard file protocols?

Accepted Answer

AWS Storage Gateway. AWS Storage Gateway provides a hybrid cloud storage solution by offering on-premises appliances that expose standard file protocols (NFS, SMB) to local applications, while storing data durably in Amazon S3 or Amazon EBS. This allows seamless access to AWS cloud storage without modifying existing workflows, as the gateway caches frequently accessed data locally and asynchronously transfers data to the cloud.

Answer

AWS DataSync

Answer

AWS Direct Connect

Answer

Amazon FSx

Question 4

A development team accidentally deletes important files from an Amazon S3 bucket. The company wants to protect against accidental deletions and overwrites in the future, allowing recovery of previous versions of objects. Which S3 feature should they enable?

Accepted Answer

S3 Versioning. S3 Versioning is the correct feature because it preserves every version of an object, including overwrites and deletions. When versioning is enabled, deleting an object only adds a delete marker, and previous versions remain recoverable. This directly addresses the requirement to protect against accidental deletions and overwrites by allowing restoration of earlier object versions.

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Answer

S3 Intelligent-Tiering

Question 5

A company needs to deploy their application in multiple geographic locations to ensure data sovereignty compliance and reduce latency for users in different continents. What is the AWS infrastructure concept that represents a distinct geographic area with multiple isolated locations?

Accepted Answer

AWS Region. An AWS Region is a distinct geographic area that contains multiple, isolated Availability Zones. This design allows customers to deploy applications across separate locations within a region for high availability, while also choosing specific regions to meet data sovereignty requirements and reduce latency for users on different continents.

Answer

Availability Zone

Answer

Edge Location

Answer

Local Zone

Question 6

A company wants to analyse petabytes of historical sales data using standard SQL queries and connect their existing business intelligence (BI) tools to the data store. The workload is analytical (OLAP), not transactional (OLTP). Which AWS service is designed for this use case?

Accepted Answer

Amazon Redshift. Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed for analytical (OLAP) workloads. It uses standard SQL and integrates directly with popular BI tools via JDBC/ODBC connections, making it ideal for querying large historical datasets and connecting existing business intelligence tools.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Aurora

Question 7

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 8

A company runs a critical e-commerce application on a single Amazon EC2 instance in one Availability Zone. The company wants to ensure that if the entire Availability Zone becomes unavailable, the application continues to run without manual intervention. Which AWS cloud concept best describes this requirement?

Accepted Answer

High availability. High availability (B) is the correct concept because it ensures that an application remains operational even when an entire Availability Zone fails. By deploying the EC2 instance across multiple Availability Zones (e.g., using an Auto Scaling group with a minimum of two instances and an Application Load Balancer), the application can automatically fail over to a healthy instance in another zone without manual intervention. This directly addresses the requirement for continuous operation during a zone outage.

Answer

Scalability

Answer

Elasticity

Answer

Disaster recovery

Question 9

A company migrates their self-managed MySQL database running on a virtual machine to Amazon RDS for MySQL, taking advantage of managed backups and Multi-AZ without changing the database schema or application code. Which migration strategy does this represent?

Accepted Answer

Replatform. This is a Replatform (also called 'lift and reshape' or 'platform modernization') migration because the company moves the MySQL database from a self-managed VM to Amazon RDS without changing the database schema or application code. They gain managed backups and Multi-AZ, which are RDS-specific features, but the core database engine and application interface remain unchanged, so no refactoring of the application is required.

Answer

Rehost

Answer

Refactor

Answer

Repurchase

Question 10

A company manages multiple AWS accounts, each used by a separate business unit. The finance team wants to obtain a single monthly bill that aggregates charges from all accounts and to benefit from volume discount pricing tiers on services like Amazon EC2 and Amazon S3 across the entire organization. Which AWS feature or service should the company use to meet these requirements?

Accepted Answer

AWS Organizations consolidated billing. AWS Organizations consolidated billing allows you to combine usage across multiple accounts to receive a single monthly bill and aggregate usage for volume discount pricing tiers (e.g., for EC2 and S3). This feature enables the finance team to benefit from lower rates as total usage across all accounts increases, without requiring any architectural changes.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 11

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Answer

Amazon Cognito

Question 12

A company wants to deploy AWS services in a specific geographic location within a metropolitan area to reduce latency for end users in that city, while still using standard AWS APIs. Which AWS infrastructure type addresses this?

Accepted Answer

AWS Local Zones. AWS Local Zones are an infrastructure type that places compute, storage, and other select AWS services closer to end users in a specific metropolitan area, enabling single-digit millisecond latency for latency-sensitive applications while using the same AWS APIs and tools as in an AWS Region. This directly meets the requirement of reducing latency within a city without requiring custom APIs or on-premises hardware.

Answer

AWS Outposts

Answer

CloudFront Edge Locations

Answer

AWS Wavelength Zones

Question 13

A startup's development team wants to deploy their Node.js web application to AWS without learning about load balancers, auto scaling, or EC2 configuration. They want to simply upload their application code and have AWS handle everything else. Which AWS service is designed for this use case?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct service because it is a Platform as a Service (PaaS) offering that automatically handles capacity provisioning, load balancing, auto scaling, and application health monitoring. The development team can simply upload their Node.js application code, and Elastic Beanstalk deploys it on pre-configured EC2 instances without requiring any manual configuration of infrastructure components.

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Answer

Amazon ECS

Question 14

Which AWS compute service is best suited for running batch processing jobs that require specific compute resources and can run for hours or days without user interaction?

Accepted Answer

AWS Batch. AWS Batch is purpose-built for running batch computing workloads that can run for extended durations without user interaction. It dynamically provisions the optimal quantity and type of compute resources (e.g., EC2 instances or Spot Instances) based on the volume and specific resource requirements of the submitted jobs, making it ideal for hours- or days-long batch processing.

Answer

AWS Lambda

Answer

Amazon EC2 with manual provisioning

Answer

Amazon ECS with Fargate

Question 15

An operations team documents all operational procedures as runbooks, deploys infrastructure using AWS CloudFormation templates stored in version control, and continuously refines their processes based on lessons learned from incidents. Which pillar of the AWS Well-Architected Framework does this represent?

Accepted Answer

Operational Excellence. Operational Excellence focuses on running and monitoring systems to deliver business value, and continually improving processes and procedures. Documenting runbooks, using infrastructure as code (CloudFormation) with version control, and refining processes from incident lessons are core practices of this pillar, as they enable repeatable, auditable, and continuously improving operations.

Answer

Reliability

Answer

Security

Answer

Cost Optimisation