CLF-C02 Practice Test 35 — 15 Questions

Question 1

A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it can provision, manage, and automatically renew public SSL/TLS certificates for use with an Application Load Balancer at no additional cost. ACM integrates directly with ALB to handle certificate deployment and renewal, eliminating the need for manual renewal of third-party certificates. The service is free for public certificates used with supported AWS services like ALB, CloudFront, and API Gateway.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS WAF

Answer

AWS Secrets Manager

Question 2

A company is running their application on EC2 instances behind an Application Load Balancer. They want to ensure the application remains available during an AZ outage. What is the minimum architecture configuration required?

Accepted Answer

EC2 instances distributed across at least two Availability Zones behind an ALB. To remain available during an Availability Zone outage, the application must be resilient to the failure of an entire AZ. An Application Load Balancer distributes traffic across healthy targets, but it cannot route to instances in a failed AZ. Therefore, EC2 instances must be deployed in at least two separate Availability Zones, and the ALB must be configured with subnets in those same AZs to route traffic and perform health checks, ensuring continuous availability if one AZ goes down.

Answer

Multiple EC2 instances in a single Availability Zone

Answer

A single large EC2 instance with enhanced networking

Answer

EC2 instances in a single Region across multiple subnets in the same AZ

Question 3

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

Accepted Answer

Apply an SCP in AWS Organizations that denies resource creation outside approved regions. B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.

Answer

Configure AWS Config rules in each account to detect out-of-region deployments

Answer

Train developers to only deploy in approved regions

Answer

Enable IAM permission boundaries restricting regions in each account

Question 4

A company used to spend $2 million upfront purchasing servers and building a data centre before launching a new product. With AWS, they provision resources as needed and pay monthly based on actual usage. Which cloud benefit does this represent?

Accepted Answer

Trade capital expense for variable expense. This scenario describes shifting from a large upfront capital expenditure (CapEx) on servers and data centers to a variable operational expenditure (OpEx) based on actual usage. AWS's pay-as-you-go model directly enables this trade, allowing the company to align costs with consumption rather than paying for idle capacity. This is the core benefit of trading capital expense for variable expense.

Answer

Stop guessing about capacity

Answer

Benefit from economies of scale

Answer

Increase speed and agility

Question 5

A company uses Amazon CloudFront to serve their website globally. They want to ensure that users in China can also access the website with low latency. What infrastructure consideration is required?

Accepted Answer

Use AWS China Regions (cn-north-1, cn-northwest-1) which require a separate AWS account. Serving content to users in China with low latency via CloudFront requires using AWS China Regions (cn-north-1, cn-northwest-1), which are isolated from global AWS Regions and require a separate AWS account due to Chinese regulatory and legal requirements. CloudFront distributions cannot directly serve content from global edge locations to users in China with optimal performance; instead, you must set up a separate CloudFront distribution in a China Region or use third-party CDN integration.

Answer

Enable CloudFront Geo-targeting for the China region

Answer

Enable CloudFront Accelerated Transfer for China

Answer

Use Route 53 latency routing to direct Chinese users to the nearest CloudFront PoP

Question 6

A company needs to store database passwords and API keys used by their applications, with automatic rotation and audit logging of access. Which AWS service is purpose-built for this?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing, automatically rotating, and auditing access to database passwords, API keys, and other secrets. It natively supports automatic rotation with built-in integrations for Amazon RDS, Redshift, and DocumentDB, and it logs every secret access call in AWS CloudTrail for audit compliance.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon S3 with bucket policies

Question 7

A company wants to set up a cloud-based customer service contact centre with an interactive voice response (IVR) system, agent call routing, and the ability to scale to thousands of agents without purchasing phone hardware or PBX equipment. Which AWS service provides this?

Accepted Answer

Amazon Connect. Amazon Connect is a cloud-based contact center service that provides an interactive voice response (IVR) system, automatic call distribution (ACD) for agent routing, and the ability to scale to thousands of agents without requiring any physical phone hardware or PBX equipment. It is purpose-built for this exact use case, offering pay-as-you-go pricing and integration with AWS services like Lambda and Lex for custom IVR flows.

Answer

Amazon Chime

Answer

Amazon SNS

Answer

Amazon WorkMail

Question 8

A financial services company needs to maintain a tamper-proof audit log of all financial transactions for regulatory compliance. Which AWS service is most appropriate?

Accepted Answer

Amazon QLDB. Amazon QLDB (Quantum Ledger Database) is purpose-built to provide a cryptographically verifiable, immutable, and tamper-proof transaction log. It uses a journal that stores every change as a series of entries, and each entry is chained using a hash, making it impossible to alter or delete past records without detection. This aligns directly with the financial services requirement for an audit log that must be tamper-proof for regulatory compliance.

Answer

Amazon RDS with transaction logging

Answer

Amazon DynamoDB with global tables

Answer

AWS CloudTrail with log file integrity validation

Question 9

A company received an unexpected AWS bill that was much higher than expected. Which AWS service would help them understand which resource or service caused the cost spike?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer (B) is the correct service because it provides a pre-built dashboard and reports that allow you to visualize, analyze, and drill down into your AWS costs and usage over time. You can filter by service, linked account, region, or resource tags to identify exactly which resource or service caused the unexpected cost spike. AWS Budgets (A) can alert you when costs exceed a threshold, but it does not provide the historical analysis and granular breakdown needed to pinpoint the root cause of a past spike.

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Answer

AWS Trusted Advisor

Question 10

Which AWS feature provides personalized recommendations about your account's security and cost optimization, available at no cost for all AWS customers?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct answer because it provides personalized recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits. It is available at no additional cost for all AWS customers, with the basic checks included in the Free Tier and Basic Support plan, while more detailed checks require a Business or Enterprise Support plan.

Answer

AWS Cost Explorer

Answer

AWS Personal Health Dashboard

Answer

Amazon CloudWatch

Question 11

A startup is evaluating cloud vs. on-premises for their new product. Which cloud characteristic means they can experiment with 10 servers for a week, then scale to 1,000 servers for a product launch, and back to 10 afterward — paying only for what they use?

Accepted Answer

Elasticity and pay-as-you-go pricing. Elasticity is the cloud characteristic that allows resources to automatically scale up or down based on demand, while pay-as-you-go pricing ensures you only incur costs for resources actually consumed. In this scenario, the startup can provision 10 servers for a week, scale to 1,000 servers for a launch, and then scale back to 10 — paying only for the compute hours used during each period. This combination of rapid scaling and consumption-based billing is unique to cloud computing and directly supports the described experimental and production workloads.

Answer

Durability

Answer

Multi-tenancy

Answer

Service Level Agreement (SLA)

Question 12

A company stores sensitive customer data in Amazon S3. The security policy requires that all objects be encrypted at rest using an encryption key that is automatically rotated every 12 months. The company must retain full control over the key, including the ability to immediately revoke access to the key if a security incident occurs. The security team also needs to audit every use of the key through AWS CloudTrail. Which key management solution should the company choose to meet these requirements?

Accepted Answer

Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.. AWS KMS customer managed keys (CMKs) allow you to enable automatic annual key rotation (every 12 months) and retain full control over the key, including the ability to immediately revoke access by disabling or deleting the key. CloudTrail integration is inherent with KMS, logging every use of the key via the `Decrypt` and `GenerateDataKey` API calls, meeting the audit requirement. This combination satisfies all stated security policy needs: encryption at rest, automatic rotation, full control, immediate revocation, and auditability.

Answer

Use an AWS KMS AWS managed key with automatic key rotation.

Answer

Use Amazon S3 server-side encryption with SSE-S3.

Answer

Use AWS CloudHSM to generate and manage the key.

Question 13

A company runs a monolithic order processing application on a single Amazon EC2 instance. During peak hours, the instance receives a sudden burst of orders that exceeds its processing capacity. Orders are dropped and customers do not receive confirmations. The company needs a solution that buffers incoming orders, stores them durably, and allows the application to process them at a manageable pace. The solution must be fully managed and ensure that no orders are lost. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples application components. It durably stores incoming orders in a queue, allowing the EC2 instance to poll and process them at its own pace, preventing order loss during traffic bursts. SQS guarantees at-least-once delivery and provides a buffer that absorbs spikes in demand.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Firehose

Answer

Amazon ElastiCache

Question 14

Which AWS service provides a central place to manage security alerts and automate compliance checks across an AWS Organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a single, central location for aggregating, organizing, and prioritizing security alerts (findings) from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It also enables automated compliance checks against standards such as CIS AWS Foundations, PCI DSS, and AWS Foundational Security Best Practices across all accounts in an AWS Organization, using built-in or custom controls.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A company needs to provide business users with self-service business intelligence dashboards and visualizations of data from multiple AWS data sources. Which AWS service enables this?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a fully managed, serverless business intelligence (BI) service designed specifically for creating interactive dashboards and visualizations. It natively integrates with multiple AWS data sources (e.g., Amazon S3, Amazon RDS, Amazon Redshift, Amazon Athena) and provides self-service capabilities for business users via a web-based interface, without requiring any infrastructure management.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon EMR