CLF-C02 Practice Test 34 — 15 Questions

Question 1

A company wants to run code that automatically resizes images whenever a new image is uploaded to an Amazon S3 bucket. The code runs for less than 60 seconds per image. The company wants to pay only for the compute time used and does not want to provision or manage any servers. Which AWS service best meets these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 object creation event, and automatically scales. It charges only for the compute time consumed (rounded to the nearest 1 ms) and requires no server provisioning or management. The 60-second execution limit per invocation is well within the 15-minute maximum duration of Lambda, making it ideal for short-lived image resizing tasks.

Answer

Amazon EC2

Answer

AWS Elastic Beanstalk

Answer

Amazon ECS

Question 2

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

Accepted Answer

The customer, because OS patching is in the customer's area of responsibility for IaaS services. Under the AWS Shared Responsibility Model, for Infrastructure as a Service (IaaS) like EC2, the customer is responsible for managing the guest operating system, including patching and security updates. AWS is responsible for the physical infrastructure and the hypervisor layer, but not for the OS running inside the EC2 instance. Therefore, option B is correct.

Answer

AWS, because they own and operate all EC2 infrastructure

Answer

Both AWS and the customer equally share this responsibility

Answer

A third-party managed service provider designated by AWS

Question 3

A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?

Accepted Answer

AWS KMS. AWS KMS is a managed service that allows you to create, rotate, and control encryption keys used to protect data in Amazon S3, Amazon RDS, and Amazon EBS. It integrates with AWS CloudTrail to provide full audit trails of key usage, meeting the security team's requirements for a managed key management solution.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 4

A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?

Accepted Answer

Create an IAM group, attach the required policies to the group, and add all 10 users to the group. IAM groups allow administrators to assign permissions to multiple users at once. By creating a 'Developers' group with the required policies and adding all 10 users to it, permissions are managed centrally. Adding a policy to the group affects all members simultaneously.

Answer

Attach an inline policy to each of the 10 IAM users individually

Answer

Create one IAM user account and share the credentials with all 10 developers

Answer

Grant the developers root account access with MFA enabled

Question 5

A security team wants to automatically detect unusual activity in their AWS account, such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicating credential compromise, or cryptocurrency mining activity. Which AWS service uses machine learning to detect these threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious or unauthorized behavior in AWS accounts and workloads. It specifically analyzes VPC Flow Logs, AWS CloudTrail management and data events, and DNS logs to detect patterns such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicative of credential compromise, and cryptocurrency mining activity. This makes it the correct choice for the described use case.

Answer

Amazon Inspector

Answer

AWS Security Hub

Answer

Amazon Macie

Question 6

A finance team wants to view and analyse their AWS spending patterns over the past 12 months, filter costs by service and linked account, and identify which teams are spending the most. Which AWS tool provides this historical cost analysis?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides a pre-built, customizable dashboard for visualizing, analyzing, and filtering historical AWS cost and usage data over the past 12 months. It allows you to group costs by service, linked account, or tag, making it ideal for identifying which teams are spending the most.

Answer

AWS Pricing Calculator

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 7

A development team accidentally deletes important files from an Amazon S3 bucket. The company wants to protect against accidental deletions and overwrites in the future, allowing recovery of previous versions of objects. Which S3 feature should they enable?

Accepted Answer

S3 Versioning. S3 Versioning is the correct feature because it preserves every version of an object, including overwrites and deletions. When versioning is enabled, deleting an object only adds a delete marker, and previous versions remain recoverable. This directly addresses the requirement to protect against accidental deletions and overwrites by allowing restoration of earlier object versions.

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Answer

S3 Intelligent-Tiering

Question 8

A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?

Accepted Answer

Network Access Control Lists (NACLs). Network Access Control Lists (NACLs) are the correct choice because they operate at the subnet level, are stateless (meaning they do not automatically allow return traffic), and require explicit inbound and outbound rules. This matches the requirement for stateless traffic filtering where both directions must be defined separately, including rules for return traffic.

Answer

Security groups

Answer

AWS WAF

Answer

VPC route tables

Question 9

A developer needs to read objects from a specific Amazon S3 bucket. Following AWS security best practices, which approach should be used when creating the IAM policy for this developer?

Accepted Answer

Grant only s3:GetObject permission on the specific bucket. Option C is correct because the principle of least privilege dictates granting only the specific permissions required for the task. By attaching an IAM policy with only the s3:GetObject action on the specific bucket ARN, the developer can read objects without having unnecessary permissions that could lead to accidental or malicious changes. This approach aligns with AWS security best practices for IAM policies.

Answer

Grant AdministratorAccess to ensure all required permissions are included

Answer

Grant AmazonS3FullAccess to cover all S3 operations

Answer

Use the root account credentials since they guarantee access

Question 10

A development team uses AWS developer tools for their entire software delivery process: a Git-based code repository, automated compilation and testing, and automated deployment to EC2 instances. Which combination of AWS services provides these three capabilities?

Accepted Answer

AWS CodeCommit, AWS CodeBuild, and AWS CodeDeploy. AWS CodeCommit provides a Git-based code repository for source control. AWS CodeBuild performs automated compilation and testing. AWS CodeDeploy automates deployment to EC2 instances. Together, these three services directly map to the three capabilities described in the question.

Answer

AWS CloudFormation, AWS Elastic Beanstalk, and Amazon EC2

Answer

Amazon S3, AWS Lambda, and Amazon CloudWatch

Answer

AWS CodePipeline, Amazon ECR, and Amazon ECS

Question 11

A company runs mixed workloads on AWS — some on EC2, some on Lambda, and some on Fargate — and wants to commit to a consistent hourly spend on compute to receive discounts similar to Reserved Instances, but with the flexibility to apply those discounts across different compute services and instance types. Which purchasing option provides this flexibility?

Accepted Answer

Savings Plans. Savings Plans (C) offer the flexibility to commit to a consistent hourly spend (e.g., $10/hour) and automatically apply the discount across EC2 instances, AWS Lambda, and AWS Fargate usage, regardless of instance family, size, OS, or region. This matches the requirement for a Reserved Instance-like discount with cross-service and cross-instance flexibility, which Reserved Instances cannot provide because they are tied to a specific instance family and region.

Answer

Reserved Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 12

A company runs a web application on multiple EC2 instances across multiple Availability Zones. All instances need to access and share the same file system simultaneously to read and write shared configuration files. Which AWS storage service supports simultaneous access from multiple EC2 instances?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, NFS-based file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, providing shared access for reading and writing configuration files. It uses the NFSv4.1 protocol and supports thousands of simultaneous connections, making it ideal for shared storage scenarios.

Answer

Amazon EBS

Answer

Instance Store

Answer

Amazon S3

Question 13

A data analyst needs to run SQL queries directly against log files stored in Amazon S3 without loading the data into a database and without provisioning any servers. Which AWS service enables this?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL. It requires no infrastructure to manage and charges only for the data scanned per query, making it ideal for ad-hoc analysis of log files without loading data into a database.

Answer

Amazon RDS

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 14

A company manages a fleet of hundreds of EC2 instances and needs to automate patching across all instances, run commands remotely without SSH, and store configuration parameters centrally. Which AWS service provides these operational management capabilities?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct choice because it provides a unified interface for operational management tasks, including automated patching via Patch Manager, remote command execution without SSH using Run Command, and centralized parameter storage with Parameter Store. These capabilities directly address the need to manage fleets of EC2 instances at scale without requiring direct network access to each instance.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

AWS CloudFormation

Question 15

A company wants to create RESTful APIs that serve as the front door to their backend Lambda functions and EC2 services. They need features including API key management, throttling to protect backends from overload, and usage plan enforcement. Which AWS service provides this?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly provides built-in API key management, throttling (rate limiting and burst limits), and usage plan enforcement to protect backend services like Lambda functions and EC2 instances from overload. These features are core to API Gateway's functionality, making it the correct choice for acting as the front door to the described backend resources.

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Answer

Amazon Route 53