CLF-C02 Practice Test 34 — 15 Questions

Question 1

A company uses AWS Organizations. The management account receives the consolidated bill. Which statement about Reserved Instance discount sharing in AWS Organizations is correct?

Accepted Answer

RI discounts are automatically shared across all member accounts in the organization. In AWS Organizations, Reserved Instance (RI) discounts are automatically shared across all accounts in the organization, provided the accounts are under the same consolidated billing family and the RIs are in the same AWS region. This means that if one member account purchases an RI, the hourly cost benefit can apply to qualifying usage from any other account in the organization, reducing the overall bill. The management account receives the consolidated bill and can see the aggregated savings, but no explicit sharing configuration is required.

Answer

Reserved Instance discounts only apply to the account that purchased the RI

Answer

RI discounts are only shared if the management account explicitly enables sharing for each RI

Answer

RI discounts cannot be shared across accounts even in an Organization

Question 2

A company currently runs its infrastructure in a colocation data center. The CIO wants to estimate the total cost of ownership (TCO) of migrating the existing workload to AWS, compared to continuing with the on-premises solution. The company has detailed data on current server specifications, power, cooling, and labor costs. Which AWS tool should the company use to perform this analysis?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of running infrastructure on-premises versus on AWS. It allows you to input detailed data on server specifications, power, cooling, and labor costs to generate a side-by-side TCO comparison, which directly meets the CIO's requirement.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 3

A company is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances and use an Amazon RDS for MySQL database. The security team needs to understand which security controls remain the company's responsibility after the migration. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

Accepted Answer

Patching the guest operating system on the Amazon EC2 instances.. Under the AWS Shared Responsibility Model, the customer is responsible for patching the guest operating system on Amazon EC2 instances because EC2 is an Infrastructure as a Service (IaaS) offering where AWS manages the hypervisor and physical infrastructure, but the customer has full control over the OS, applications, and configurations. In contrast, for Amazon RDS, AWS handles patching of the database engine (e.g., MySQL) and the underlying OS, making option A AWS's responsibility. Physical security at AWS data centers is always AWS's responsibility, not the customer's.

Answer

Patching the MySQL database engine for the Amazon RDS instance.

Answer

Providing physical security at the AWS data center facilities.

Answer

Replacing failed network switches in the AWS global network.

Question 4

A security team needs to demonstrate to auditors that no AWS infrastructure has been modified between two audit periods. Which AWS service provides a continuous record of configuration changes with before-and-after state for all resources?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously records configuration changes to AWS resources and provides a detailed history of each change, including the before-and-after state. This allows the security team to demonstrate to auditors that no infrastructure modifications occurred between two audit periods by reviewing the configuration timeline and compliance snapshots.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 5

A solutions architect is reviewing a system to ensure the right instance types are selected for each workload, that resource selection is based on data rather than assumptions, and that performance is monitored and improved over time. Which pillar of the AWS Well-Architected Framework is being applied?

Accepted Answer

Performance Efficiency. The Performance Efficiency pillar focuses on using computing resources efficiently to meet system requirements and maintaining that efficiency as demand changes and technologies evolve. The scenario describes selecting instance types based on data, monitoring performance, and iteratively improving—all core activities of this pillar. It directly aligns with the AWS Well-Architected Framework's design principle of 'democratizing advanced technologies' and the pillar's focus on right-sizing and continuous improvement.

Answer

Reliability

Answer

Cost Optimisation

Answer

Operational Excellence

Question 6

Which of the following is NOT one of the five characteristics of cloud computing as defined by NIST?

Accepted Answer

Dedicated hardware allocation per customer. The five essential characteristics of cloud computing as defined by NIST SP 800-145 are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Dedicated hardware allocation per customer is not a characteristic; instead, cloud computing relies on resource pooling where physical and virtual resources are dynamically assigned and reassigned according to consumer demand, often with multi-tenant models.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 7

A company's compliance framework requires that all AWS API calls must be logged and that log integrity must be validated. Which AWS service with which feature satisfies this requirement?

Accepted Answer

AWS CloudTrail with Log File Integrity Validation enabled. AWS CloudTrail Log File Integrity Validation uses industry-standard algorithms (SHA-256 hashing and digital signatures with SHA-256 with RSA) to ensure that CloudTrail log files have not been tampered with after delivery. This feature enables you to validate that log files were not modified, deleted, or changed without authorization, directly meeting the compliance requirement for logging all AWS API calls and validating log integrity.

Answer

Amazon CloudWatch Logs with metric filters

Answer

AWS Config with conformance packs

Answer

VPC Flow Logs stored in S3

Question 8

A company stores sensitive financial data in an Amazon S3 bucket. The security policy requires that all data must be encrypted in transit. The security administrator discovers that some automated scripts are using HTTP instead of HTTPS to upload files. The administrator must enforce that any request that does not use HTTPS is denied by the S3 bucket policy. Which condition key should the administrator include in the bucket policy to enforce this requirement?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). Setting it to `false` denies any request that uses HTTP, enforcing encryption in transit as required by the security policy.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 9

A company uses AWS and wants to make their application fault tolerant against the failure of an entire AWS Region. Which approach achieves Region-level fault tolerance?

Accepted Answer

Deploy the application in multiple AWS Regions with Route 53 failover routing. Deploying the application in multiple AWS Regions and using Route 53 failover routing ensures that if an entire Region becomes unavailable, traffic is automatically redirected to a healthy Region. This is the only approach that provides fault tolerance against a complete Region failure, as Availability Zones within a single Region cannot protect against a Region-wide outage.

Answer

Deploy resources across multiple Availability Zones within a single Region

Answer

Use Reserved Instances in a single Region for guaranteed capacity

Answer

Enable S3 versioning in a single Region

Question 10

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with encryption

Answer

AWS KMS

Question 11

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

Accepted Answer

SSE-KMS with a customer-managed CMK. SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Answer

SSE-S3 (Amazon S3-managed keys)

Answer

SSE-KMS with an AWS managed CMK (aws/s3)

Answer

S3 Versioning with MFA Delete

Question 12

A startup founder is evaluating whether to build their own data center or use AWS. Which cloud benefit eliminates the need for guessing future infrastructure requirements and making large upfront investments?

Accepted Answer

Trade capital expense for variable expense and stop guessing capacity. It directly addresses the startup founder's concern about eliminating the need to guess future infrastructure requirements and make large upfront investments. AWS's pay-as-you-go model allows you to trade capital expense (upfront hardware costs) for variable expense (paying only for what you use), and you no longer have to predict capacity needs—you can scale up or down based on actual demand. This is a core pillar of the AWS Well-Architected Framework's Cost Optimization pillar.

Answer

Stop spending money running and maintaining data centers

Answer

Benefit from massive economies of scale

Answer

Increase speed and agility for innovation

Question 13

Which AWS storage service is designed for shared file storage accessible simultaneously by multiple EC2 instances using the NFS protocol?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed, scalable NFS file system that can be mounted concurrently on multiple EC2 instances. It uses the NFSv4.1 protocol, enabling shared access across Availability Zones and instances, which is exactly what the question describes.

Answer

Amazon EBS

Answer

Amazon S3

Answer

Amazon FSx for Windows File Server

Question 14

A company runs a MySQL database and wants to migrate to a cloud-native relational database that is fully managed, provides up to 5x the performance of standard MySQL, offers automated backups with point-in-time recovery, and is compatible with MySQL drivers and tools without application changes. Which AWS service meets these requirements?

Accepted Answer

Amazon Aurora. Amazon Aurora is a fully managed, MySQL-compatible relational database that delivers up to 5x the performance of standard MySQL, provides automated backups with point-in-time recovery, and is designed to work with existing MySQL drivers and tools without requiring application changes. This makes it the ideal choice for migrating a MySQL database to a cloud-native, high-performance relational database service.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 15

A retail company is migrating its e-commerce platform to AWS. The company's financial controller notes that AWS can offer lower pay-as-you-go prices than what it would cost the company to build and operate its own data center at the same scale. Which cloud computing concept best explains this pricing advantage?

Accepted Answer

Economies of scale. Economies of scale. AWS operates at a massive global scale, allowing it to negotiate lower prices for hardware, data center power, and network bandwidth. These savings are passed on to customers as lower pay-as-you-go prices, which a single company building its own data center cannot match due to its smaller procurement volume.

Answer

Agility

Answer

Elasticity

Answer

High availability