CLF-C02 Practice Test 34 — 15 Questions

Question 1

A company's compliance framework requires that all AWS API calls must be logged and that log integrity must be validated. Which AWS service with which feature satisfies this requirement?

Accepted Answer

AWS CloudTrail with Log File Integrity Validation enabled. AWS CloudTrail Log File Integrity Validation uses industry-standard algorithms (SHA-256 hashing and digital signatures with SHA-256 with RSA) to ensure that CloudTrail log files have not been tampered with after delivery. This feature enables you to validate that log files were not modified, deleted, or changed without authorization, directly meeting the compliance requirement for logging all AWS API calls and validating log integrity.

Answer

Amazon CloudWatch Logs with metric filters

Answer

AWS Config with conformance packs

Answer

VPC Flow Logs stored in S3

Question 2

A company stores sensitive financial data in an Amazon S3 bucket. The security policy requires that all data must be encrypted in transit. The security administrator discovers that some automated scripts are using HTTP instead of HTTPS to upload files. The administrator must enforce that any request that does not use HTTPS is denied by the S3 bucket policy. Which condition key should the administrator include in the bucket policy to enforce this requirement?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). Setting it to `false` denies any request that uses HTTP, enforcing encryption in transit as required by the security policy.

Answer

aws:SourceIp

Answer

aws:Referer

Answer

s3:x-amz-server-side-encryption

Question 3

A company uses AWS and wants to make their application fault tolerant against the failure of an entire AWS Region. Which approach achieves Region-level fault tolerance?

Accepted Answer

Deploy the application in multiple AWS Regions with Route 53 failover routing. Deploying the application in multiple AWS Regions and using Route 53 failover routing ensures that if an entire Region becomes unavailable, traffic is automatically redirected to a healthy Region. This is the only approach that provides fault tolerance against a complete Region failure, as Availability Zones within a single Region cannot protect against a Region-wide outage.

Answer

Deploy resources across multiple Availability Zones within a single Region

Answer

Use Reserved Instances in a single Region for guaranteed capacity

Answer

Enable S3 versioning in a single Region

Question 4

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with encryption

Answer

AWS KMS

Question 5

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

Accepted Answer

SSE-KMS with a customer-managed CMK. SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Answer

SSE-S3 (Amazon S3-managed keys)

Answer

SSE-KMS with an AWS managed CMK (aws/s3)

Answer

S3 Versioning with MFA Delete

Question 6

A startup founder is evaluating whether to build their own data center or use AWS. Which cloud benefit eliminates the need for guessing future infrastructure requirements and making large upfront investments?

Accepted Answer

Trade capital expense for variable expense and stop guessing capacity. It directly addresses the startup founder's concern about eliminating the need to guess future infrastructure requirements and make large upfront investments. AWS's pay-as-you-go model allows you to trade capital expense (upfront hardware costs) for variable expense (paying only for what you use), and you no longer have to predict capacity needs—you can scale up or down based on actual demand. This is a core pillar of the AWS Well-Architected Framework's Cost Optimization pillar.

Answer

Stop spending money running and maintaining data centers

Answer

Benefit from massive economies of scale

Answer

Increase speed and agility for innovation

Question 7

Which AWS storage service is designed for shared file storage accessible simultaneously by multiple EC2 instances using the NFS protocol?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed, scalable NFS file system that can be mounted concurrently on multiple EC2 instances. It uses the NFSv4.1 protocol, enabling shared access across Availability Zones and instances, which is exactly what the question describes.

Answer

Amazon EBS

Answer

Amazon S3

Answer

Amazon FSx for Windows File Server

Question 8

A company runs a MySQL database and wants to migrate to a cloud-native relational database that is fully managed, provides up to 5x the performance of standard MySQL, offers automated backups with point-in-time recovery, and is compatible with MySQL drivers and tools without application changes. Which AWS service meets these requirements?

Accepted Answer

Amazon Aurora. Amazon Aurora is a fully managed, MySQL-compatible relational database that delivers up to 5x the performance of standard MySQL, provides automated backups with point-in-time recovery, and is designed to work with existing MySQL drivers and tools without requiring application changes. This makes it the ideal choice for migrating a MySQL database to a cloud-native, high-performance relational database service.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 9

A retail company is migrating its e-commerce platform to AWS. The company's financial controller notes that AWS can offer lower pay-as-you-go prices than what it would cost the company to build and operate its own data center at the same scale. Which cloud computing concept best explains this pricing advantage?

Accepted Answer

Economies of scale. Economies of scale. AWS operates at a massive global scale, allowing it to negotiate lower prices for hardware, data center power, and network bandwidth. These savings are passed on to customers as lower pay-as-you-go prices, which a single company building its own data center cannot match due to its smaller procurement volume.

Answer

Agility

Answer

Elasticity

Answer

High availability

Question 10

A company operates multiple AWS accounts for separate departments. The finance team wants to simplify monthly billing by receiving a single consolidated invoice that covers all accounts. Additionally, the company wants to aggregate usage across accounts to qualify for lower volume-based pricing tiers. Which AWS feature should the company enable to meet these requirements?

Accepted Answer

Consolidated billing through AWS Organizations. AWS Organizations enables consolidated billing by allowing you to combine multiple AWS accounts under a single paying account, which aggregates usage across all accounts. This aggregation qualifies the company for lower volume-based pricing tiers (e.g., AWS volume discounts for services like S3 or EC2) because usage is summed across all member accounts. The master account receives a single consolidated invoice covering all accounts, simplifying monthly billing.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 11

A small startup wants to launch a new application on AWS without any upfront investment in servers. Which cloud computing deployment model allows them to use AWS infrastructure without owning any physical hardware?

Accepted Answer

Public cloud. The public cloud deployment model, such as AWS, provides on-demand access to shared computing resources over the internet, allowing the startup to provision virtual servers (e.g., EC2 instances) and other services without any upfront capital expenditure or ownership of physical hardware. This model is ideal for startups because it offers a pay-as-you-go pricing structure, eliminating the need for server procurement, maintenance, and data center management.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 12

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

Accepted Answer

AWS Config with the access-keys-rotated rule. AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 13

A company runs a web application where requests to /api/* should be routed to one group of EC2 instances and requests to /images/* should be routed to another group. Which AWS load balancer type supports this URL path-based routing?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports content-based routing, including path-based routing rules that direct requests to different target groups based on URL paths such as /api/* and /images/*. This makes ALB the correct choice for the described use case.

Answer

Network Load Balancer (NLB)

Answer

Classic Load Balancer (CLB)

Answer

Gateway Load Balancer (GWLB)

Question 14

A DevOps team needs to deploy a multi-tier web application on AWS. The application consists of Amazon EC2 instances, an Application Load Balancer, an Amazon RDS database, and security groups. The team wants to define all these resources in a single declarative template, automatically manage the creation order and dependencies, and version control the template for repeatable deployments. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define all AWS resources (EC2, ALB, RDS, security groups) in a single declarative JSON or YAML template. It automatically manages the creation order based on resource dependencies (e.g., EC2 instances depend on security groups), supports version control of templates, and enables repeatable, consistent deployments across environments.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodePipeline

Question 15

A company architect is designing a new system on AWS. They want to implement the Well-Architected Framework principle of 'loosely coupled components.' Which architecture pattern best achieves this?

Accepted Answer

Use Amazon SQS or Amazon SNS between services to decouple them. Amazon SQS (message queue) and Amazon SNS (pub/sub) enable asynchronous communication between services, allowing them to operate independently without direct dependencies. This decoupling aligns with the Well-Architected Framework's principle of loosely coupled components, as services can fail, scale, or be updated without impacting others.

Answer

Have all services call each other directly via synchronous API calls

Answer

Deploy all application components on a single large EC2 instance

Answer

Use a single shared database for all microservices