CLF-C02 Practice Test 32 — 15 Questions

Question 1

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

Accepted Answer

Apply an SCP that denies all actions unless MFA is authenticated. Option B is correct because Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Answer

Enable MFA on the root account only

Answer

Configure IAM password policies to require MFA

Answer

Enable AWS Config rule to check MFA status

Question 2

Which AWS service provides quantum computing hardware as a cloud service, enabling researchers to run algorithms on actual quantum processors?

Accepted Answer

Amazon Braket. Amazon Braket is the correct answer because it is a fully managed AWS service that provides access to quantum computing hardware from multiple providers, including IonQ, Rigetti, and D-Wave, in a single environment. It allows researchers to design, test, and run quantum algorithms on actual quantum processors without managing the underlying infrastructure, making it the only option that directly offers quantum computing as a cloud service.

Answer

AWS Inferentia

Answer

AWS Wavelength

Answer

Amazon EC2 High Performance Computing

Question 3

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

Accepted Answer

AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements. AWS does not have a blanket HIPAA certification; instead, it provides a Business Associate Agreement (BAA) for specific services listed in its HIPAA Eligible Services Reference. Customers must sign a BAA with AWS and then configure those eligible services (e.g., enabling encryption, access controls, logging) to meet their own HIPAA compliance obligations. This shared responsibility model means AWS is responsible for the security of the cloud, while the customer is responsible for security in the cloud.

Answer

AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA

Answer

PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA

Answer

HIPAA compliance is automatic once a BAA is signed with AWS

Question 4

A company wants to improve the resilience of their Amazon RDS database by ensuring that read traffic is distributed across multiple copies of the database and that a replica can be promoted if the primary fails. Which RDS feature enables this?

Accepted Answer

RDS Read Replicas. Amazon RDS Read Replicas allow you to create one or more copies of your database instance that serve read traffic, offloading read queries from the primary DB instance. In the event of a primary failure, a Read Replica can be manually promoted to a standalone primary instance, providing resilience and continuity for read-heavy workloads. This directly matches the requirement to distribute read traffic and enable replica promotion.

Answer

RDS Multi-AZ deployment

Answer

RDS Automated Backups

Answer

RDS Performance Insights

Question 5

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with encryption

Answer

AWS KMS

Question 6

A company needs to verify the identity of users who call into their contact center by comparing their voice against a stored voiceprint. Which AWS service provides speaker identification from voice data?

Accepted Answer

Amazon Connect Voice ID. Amazon Connect Voice ID is the correct AWS service for real-time speaker identification and verification using voice biometrics. It compares a caller's live voice against a stored voiceprint to authenticate their identity, specifically designed for contact center use cases within Amazon Connect.

Answer

Amazon Transcribe

Answer

Amazon Rekognition

Answer

Amazon Lex

Question 7

A company is considering AWS for their new application. Which tool allows them to compare the cost of running their workloads on AWS versus on-premises, and estimate the potential savings?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator (formerly TCO Calculator) is specifically designed to compare the cost of running workloads on AWS versus on-premises environments. It allows users to input their current on-premises infrastructure details (such as server specifications, storage, and network usage) and generates a detailed cost comparison, including estimated savings from migrating to AWS. This directly matches the question's requirement for comparing costs and estimating potential savings.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 8

A company's data scientists want a managed environment for collaborative Jupyter notebooks connected to their AWS data sources and compute without managing infrastructure. Which AWS service provides this?

Accepted Answer

Amazon SageMaker Studio. Amazon SageMaker Studio is a fully managed, web-based visual interface for data scientists to build, train, debug, deploy, and monitor machine learning models. It provides collaborative Jupyter notebooks that can connect directly to AWS data sources (e.g., S3, Athena, Redshift) and compute resources (e.g., SageMaker training instances, endpoints) without requiring any infrastructure management by the user.

Answer

AWS Cloud9

Answer

Amazon EMR Studio

Answer

AWS Lambda with Jupyter

Question 9

A company wants to provide their data analysts with a way to run SQL queries on their S3 data lake using familiar BI tools like Tableau or Power BI. Which AWS service provides an ODBC/JDBC connection to S3 data?

Accepted Answer

Amazon Athena with JDBC/ODBC drivers. Amazon Athena is a serverless interactive query service that allows you to run standard SQL directly against data stored in Amazon S3. It provides JDBC and ODBC drivers that enable BI tools like Tableau and Power BI to connect to Athena and query the S3 data lake without needing to move or transform the data.

Answer

Amazon QuickSight

Answer

Amazon EMR with Hive

Answer

AWS Glue Data Catalog only

Question 10

Which AWS service enables you to create a private, isolated network within the AWS Cloud where you can define your own IP address range, subnets, and routing?

Accepted Answer

Amazon VPC. Amazon VPC (Virtual Private Cloud) enables you to provision a logically isolated section of the AWS Cloud where you can define your own IP address range using CIDR notation (e.g., 10.0.0.0/16), create subnets across Availability Zones, and configure custom route tables to control traffic flow. This service gives you full control over your virtual networking environment, including the selection of private and public IP addresses, network gateways, and security settings.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

AWS Transit Gateway

Question 11

A company architect is reviewing their architecture for the Operational Excellence pillar of the Well-Architected Framework. Which practice is a core recommendation of this pillar?

Accepted Answer

Perform operations as code using infrastructure-as-code and automated runbooks. The Operational Excellence pillar focuses on running and monitoring systems to deliver business value and continually improve supporting processes and procedures. Performing operations as code—using infrastructure-as-code (e.g., AWS CloudFormation, AWS CDK) and automated runbooks (e.g., AWS Systems Manager Automation)—is a core recommendation because it enables consistent, repeatable, and auditable operations, reducing human error and enabling rapid recovery.

Answer

Encrypt all data at rest using AWS KMS

Answer

Use Reserved Instances to minimize cost

Answer

Deploy across multiple Availability Zones

Question 12

Which AWS service provides a serverless, fully managed Apache Spark processing engine for big data analytics without managing clusters?

Accepted Answer

AWS Glue (serverless Apache Spark ETL). AWS Glue provides a fully managed, serverless Apache Spark environment for ETL (extract, transform, load) workloads. It automatically provisions, configures, and scales the Spark cluster behind the scenes, so you don't need to manage any infrastructure. This makes it the correct choice for a serverless Apache Spark processing engine for big data analytics.

Answer

Amazon EMR on EC2

Answer

Amazon Redshift

Answer

Amazon Kinesis Data Analytics

Question 13

A company wants to use AWS for disaster recovery but wants to minimize costs. They only need backups of their data, with recovery taking several hours if disaster strikes. Which DR strategy requires the least investment?

Accepted Answer

Backup and Restore. The Backup and Restore strategy (Option C) requires the least investment because it involves periodically copying data to low-cost storage like Amazon S3 (including S3 Glacier for archival) and only restoring infrastructure when needed. This approach has the highest Recovery Time Objective (RTO) and Recovery Point Objective (RPO), often measured in hours, which aligns with the requirement of minimizing costs while tolerating several hours for recovery.

Answer

Pilot Light

Answer

Warm Standby

Answer

Multi-Site Active/Active

Question 14

A company wants to protect their web application from common Layer 7 attacks and also implement rate limiting to prevent API abuse. Which AWS service provides both capabilities?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common Layer 7 attacks such as SQL injection and cross-site scripting (XSS). It also supports rate-based rules that automatically block requests from a client IP when the request rate exceeds a defined threshold, enabling API abuse prevention. This makes AWS WAF the correct choice for both capabilities.

Answer

AWS Shield Standard

Answer

Security Groups

Answer

Amazon GuardDuty

Question 15

Which Amazon EC2 instance type provides the best performance for a relational database that requires very high IOPS with consistent sub-millisecond storage latency?

Accepted Answer

Storage-optimized instances (I family). The I family (Storage-optimized instances) is designed for high-frequency, low-latency I/O operations, leveraging NVMe SSD-backed instance storage to deliver very high IOPS and consistent sub-millisecond latency, making it ideal for relational databases with demanding storage performance requirements.

Answer

General purpose instances (M family)

Answer

Compute-optimized instances (C family)

Answer

Memory-optimized instances (R family)