CLF-C02 Practice Test 32 — 15 Questions

Question 1

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 2

A company runs a critical e-commerce application on a single Amazon EC2 instance in one Availability Zone. The company wants to ensure that if the entire Availability Zone becomes unavailable, the application continues to run without manual intervention. Which AWS cloud concept best describes this requirement?

Accepted Answer

High availability. High availability (B) is the correct concept because it ensures that an application remains operational even when an entire Availability Zone fails. By deploying the EC2 instance across multiple Availability Zones (e.g., using an Auto Scaling group with a minimum of two instances and an Application Load Balancer), the application can automatically fail over to a healthy instance in another zone without manual intervention. This directly addresses the requirement for continuous operation during a zone outage.

Answer

Scalability

Answer

Elasticity

Answer

Disaster recovery

Question 3

A company migrates their self-managed MySQL database running on a virtual machine to Amazon RDS for MySQL, taking advantage of managed backups and Multi-AZ without changing the database schema or application code. Which migration strategy does this represent?

Accepted Answer

Replatform. This is a Replatform (also called 'lift and reshape' or 'platform modernization') migration because the company moves the MySQL database from a self-managed VM to Amazon RDS without changing the database schema or application code. They gain managed backups and Multi-AZ, which are RDS-specific features, but the core database engine and application interface remain unchanged, so no refactoring of the application is required.

Answer

Rehost

Answer

Refactor

Answer

Repurchase

Question 4

A company manages multiple AWS accounts, each used by a separate business unit. The finance team wants to obtain a single monthly bill that aggregates charges from all accounts and to benefit from volume discount pricing tiers on services like Amazon EC2 and Amazon S3 across the entire organization. Which AWS feature or service should the company use to meet these requirements?

Accepted Answer

AWS Organizations consolidated billing. AWS Organizations consolidated billing allows you to combine usage across multiple accounts to receive a single monthly bill and aggregate usage for volume discount pricing tiers (e.g., for EC2 and S3). This feature enables the finance team to benefit from lower rates as total usage across all accounts increases, without requiring any architectural changes.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 5

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Answer

Amazon Cognito

Question 6

A company wants to deploy AWS services in a specific geographic location within a metropolitan area to reduce latency for end users in that city, while still using standard AWS APIs. Which AWS infrastructure type addresses this?

Accepted Answer

AWS Local Zones. AWS Local Zones are an infrastructure type that places compute, storage, and other select AWS services closer to end users in a specific metropolitan area, enabling single-digit millisecond latency for latency-sensitive applications while using the same AWS APIs and tools as in an AWS Region. This directly meets the requirement of reducing latency within a city without requiring custom APIs or on-premises hardware.

Answer

AWS Outposts

Answer

CloudFront Edge Locations

Answer

AWS Wavelength Zones

Question 7

A startup's development team wants to deploy their Node.js web application to AWS without learning about load balancers, auto scaling, or EC2 configuration. They want to simply upload their application code and have AWS handle everything else. Which AWS service is designed for this use case?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct service because it is a Platform as a Service (PaaS) offering that automatically handles capacity provisioning, load balancing, auto scaling, and application health monitoring. The development team can simply upload their Node.js application code, and Elastic Beanstalk deploys it on pre-configured EC2 instances without requiring any manual configuration of infrastructure components.

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Answer

Amazon ECS

Question 8

Which AWS compute service is best suited for running batch processing jobs that require specific compute resources and can run for hours or days without user interaction?

Accepted Answer

AWS Batch. AWS Batch is purpose-built for running batch computing workloads that can run for extended durations without user interaction. It dynamically provisions the optimal quantity and type of compute resources (e.g., EC2 instances or Spot Instances) based on the volume and specific resource requirements of the submitted jobs, making it ideal for hours- or days-long batch processing.

Answer

AWS Lambda

Answer

Amazon EC2 with manual provisioning

Answer

Amazon ECS with Fargate

Question 9

An operations team documents all operational procedures as runbooks, deploys infrastructure using AWS CloudFormation templates stored in version control, and continuously refines their processes based on lessons learned from incidents. Which pillar of the AWS Well-Architected Framework does this represent?

Accepted Answer

Operational Excellence. Operational Excellence focuses on running and monitoring systems to deliver business value, and continually improving processes and procedures. Documenting runbooks, using infrastructure as code (CloudFormation) with version control, and refining processes from incident lessons are core practices of this pillar, as they enable repeatable, auditable, and continuously improving operations.

Answer

Reliability

Answer

Security

Answer

Cost Optimisation

Question 10

Which AWS service enables event-driven architectures by acting as a central event bus that routes events from AWS services, SaaS applications, and custom applications to configured targets?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is a serverless event bus that ingests events from AWS services, SaaS partners, and custom applications, then routes them to targets like Lambda, Step Functions, or SQS based on configurable rules. It decouples event producers from consumers, enabling event-driven architectures without polling or custom middleware. This matches the question's description of a central event bus for cross-domain event routing.

Answer

Amazon SNS

Answer

Amazon SQS

Answer

AWS Step Functions

Question 11

A company stores genomics data (several petabytes) on Amazon S3. They need to run complex analytics on this data using standard bioinformatics tools that require a POSIX file system interface. Which AWS solution provides this?

Accepted Answer

Amazon FSx for Lustre linked to S3. Amazon FSx for Lustre is a high-performance file system that provides a POSIX-compliant interface and can be linked directly to an S3 bucket, allowing you to run standard bioinformatics tools on genomics data stored in S3 without needing to copy it. This solution delivers the low-latency, high-throughput file access required for complex analytics on petabyte-scale datasets, while seamlessly integrating with S3 for durable storage.

Answer

Amazon EFS mounted on EC2

Answer

Amazon EBS io2 volumes on EC2

Answer

Amazon S3 with S3 Select

Question 12

A company is developing a microservices application on AWS. The application includes a front-end web tier and a backend order processing service. The front-end sends order requests to the backend, which may take several seconds to process. The company wants to ensure that the front-end does not wait for the backend to complete, and that no orders are lost if the backend service is temporarily unavailable. Which AWS service should the company use to decouple the front-end and backend?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the front-end and backend services. The front-end can send order requests to an SQS queue and immediately return a response, while the backend processes messages asynchronously. SQS also stores messages durably across multiple Availability Zones, ensuring no orders are lost even if the backend is temporarily unavailable.

Answer

Amazon ElastiCache

Answer

Amazon Route 53

Answer

Amazon CloudWatch

Question 13

A startup is migrating a web application to AWS. The application runs on Amazon EC2 instances that use a custom Amazon Machine Image (AMI) with the company's proprietary software. The security team needs to understand which security tasks the company must perform. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

Accepted Answer

Configuring security groups to control inbound traffic to the instances. Configuring security groups is a customer responsibility because security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Under the AWS Shared Responsibility Model, the customer is responsible for configuring network access controls, while AWS manages the underlying infrastructure. This includes defining rules based on IP protocols, ports, and source/destination CIDR ranges.

Answer

Patching the hypervisor that hosts the EC2 instances

Answer

Physical security of the data center where the instances run

Answer

Maintaining the underlying network infrastructure

Question 14

A security team needs to analyze VPC network traffic to detect anomalies and investigate security incidents. Which AWS service captures and stores network flow data for VPCs?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This data is stored in Amazon CloudWatch Logs or Amazon S3, enabling security teams to analyze traffic patterns, detect anomalies, and investigate incidents. AWS CloudTrail, Amazon Inspector, and Amazon GuardDuty serve different purposes—auditing API calls, assessing vulnerabilities, and threat detection, respectively—but do not directly capture raw network flow data.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 15

A company archives compliance records that must be retained for 7 years but will almost never be accessed. They need the absolute lowest storage cost with retrieval times of several hours being acceptable. Which S3 storage class should they use?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is designed for long-term retention of data that is accessed rarely, with retrieval times of 12 hours or more, making it the lowest-cost S3 storage class. For compliance records that must be retained for 7 years and almost never accessed, with acceptable retrieval times of several hours, this class provides the absolute minimum storage cost while meeting the retrieval time requirement.

Answer

S3 Glacier Instant Retrieval

Answer

S3 Standard-IA

Answer

S3 Glacier Flexible Retrieval