CLF-C02 Practice Test 35 — 15 Questions

Question 1

A company operates multiple AWS accounts for separate departments. The finance team wants to simplify monthly billing by receiving a single consolidated invoice that covers all accounts. Additionally, the company wants to aggregate usage across accounts to qualify for lower volume-based pricing tiers. Which AWS feature should the company enable to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Consolidated billing through AWS Organizations. AWS Organizations enables consolidated billing by allowing you to combine multiple AWS accounts under a single paying account, which aggregates usage across all accounts. This aggregation qualifies the company for lower volume-based pricing tiers (e.g., AWS volume discounts for services like S3 or EC2) because usage is summed across all member accounts. The master account receives a single consolidated invoice covering all accounts, simplifying monthly billing.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 2

A small startup wants to launch a new application on AWS without any upfront investment in servers. Which cloud computing deployment model allows them to use AWS infrastructure without owning any physical hardware?

Accepted Answer

Public cloud. The public cloud deployment model, such as AWS, provides on-demand access to shared computing resources over the internet, allowing the startup to provision virtual servers (e.g., EC2 instances) and other services without any upfront capital expenditure or ownership of physical hardware. This model is ideal for startups because it offers a pay-as-you-go pricing structure, eliminating the need for server procurement, maintenance, and data center management.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 3

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

Accepted Answer

AWS Config with the access-keys-rotated rule. AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 4

A company runs a web application where requests to /api/* should be routed to one group of EC2 instances and requests to /images/* should be routed to another group. Which AWS load balancer type supports this URL path-based routing?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports content-based routing, including path-based routing rules that direct requests to different target groups based on URL paths such as /api/* and /images/*. This makes ALB the correct choice for the described use case.

Answer

Network Load Balancer (NLB)

Answer

Classic Load Balancer (CLB)

Answer

Gateway Load Balancer (GWLB)

Question 5

A DevOps team needs to deploy a multi-tier web application on AWS. The application consists of Amazon EC2 instances, an Application Load Balancer, an Amazon RDS database, and security groups. The team wants to define all these resources in a single declarative template, automatically manage the creation order and dependencies, and version control the template for repeatable deployments. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define all AWS resources (EC2, ALB, RDS, security groups) in a single declarative JSON or YAML template. It automatically manages the creation order based on resource dependencies (e.g., EC2 instances depend on security groups), supports version control of templates, and enables repeatable, consistent deployments across environments.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodePipeline

Question 6

A company architect is designing a new system on AWS. They want to implement the Well-Architected Framework principle of 'loosely coupled components.' Which architecture pattern best achieves this?

Accepted Answer

Use Amazon SQS or Amazon SNS between services to decouple them. Amazon SQS (message queue) and Amazon SNS (pub/sub) enable asynchronous communication between services, allowing them to operate independently without direct dependencies. This decoupling aligns with the Well-Architected Framework's principle of loosely coupled components, as services can fail, scale, or be updated without impacting others.

Answer

Have all services call each other directly via synchronous API calls

Answer

Deploy all application components on a single large EC2 instance

Answer

Use a single shared database for all microservices

Question 7

A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it can provision, manage, and automatically renew public SSL/TLS certificates for use with an Application Load Balancer at no additional cost. ACM integrates directly with ALB to handle certificate deployment and renewal, eliminating the need for manual renewal of third-party certificates. The service is free for public certificates used with supported AWS services like ALB, CloudFront, and API Gateway.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS WAF

Answer

AWS Secrets Manager

Question 8

A company is running their application on EC2 instances behind an Application Load Balancer. They want to ensure the application remains available during an AZ outage. What is the minimum architecture configuration required?

Accepted Answer

EC2 instances distributed across at least two Availability Zones behind an ALB. To remain available during an Availability Zone outage, the application must be resilient to the failure of an entire AZ. An Application Load Balancer distributes traffic across healthy targets, but it cannot route to instances in a failed AZ. Therefore, EC2 instances must be deployed in at least two separate Availability Zones, and the ALB must be configured with subnets in those same AZs to route traffic and perform health checks, ensuring continuous availability if one AZ goes down.

Answer

Multiple EC2 instances in a single Availability Zone

Answer

A single large EC2 instance with enhanced networking

Answer

EC2 instances in a single Region across multiple subnets in the same AZ

Question 9

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

Accepted Answer

Apply an SCP in AWS Organizations that denies resource creation outside approved regions. B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.

Answer

Configure AWS Config rules in each account to detect out-of-region deployments

Answer

Train developers to only deploy in approved regions

Answer

Enable IAM permission boundaries restricting regions in each account

Question 10

A company used to spend $2 million upfront purchasing servers and building a data centre before launching a new product. With AWS, they provision resources as needed and pay monthly based on actual usage. Which cloud benefit does this represent?

Accepted Answer

Trade capital expense for variable expense. This scenario describes shifting from a large upfront capital expenditure (CapEx) on servers and data centers to a variable operational expenditure (OpEx) based on actual usage. AWS's pay-as-you-go model directly enables this trade, allowing the company to align costs with consumption rather than paying for idle capacity. This is the core benefit of trading capital expense for variable expense.

Answer

Stop guessing about capacity

Answer

Benefit from economies of scale

Answer

Increase speed and agility

Question 11

A company uses Amazon CloudFront to serve their website globally. They want to ensure that users in China can also access the website with low latency. What infrastructure consideration is required?

Accepted Answer

Use AWS China Regions (cn-north-1, cn-northwest-1) which require a separate AWS account. Serving content to users in China with low latency via CloudFront requires using AWS China Regions (cn-north-1, cn-northwest-1), which are isolated from global AWS Regions and require a separate AWS account due to Chinese regulatory and legal requirements. CloudFront distributions cannot directly serve content from global edge locations to users in China with optimal performance; instead, you must set up a separate CloudFront distribution in a China Region or use third-party CDN integration.

Answer

Enable CloudFront Geo-targeting for the China region

Answer

Enable CloudFront Accelerated Transfer for China

Answer

Use Route 53 latency routing to direct Chinese users to the nearest CloudFront PoP

Question 12

A company needs to store database passwords and API keys used by their applications, with automatic rotation and audit logging of access. Which AWS service is purpose-built for this?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing, automatically rotating, and auditing access to database passwords, API keys, and other secrets. It natively supports automatic rotation with built-in integrations for Amazon RDS, Redshift, and DocumentDB, and it logs every secret access call in AWS CloudTrail for audit compliance.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon S3 with bucket policies

Question 13

A company wants to set up a cloud-based customer service contact centre with an interactive voice response (IVR) system, agent call routing, and the ability to scale to thousands of agents without purchasing phone hardware or PBX equipment. Which AWS service provides this?

Accepted Answer

Amazon Connect. Amazon Connect is a cloud-based contact center service that provides an interactive voice response (IVR) system, automatic call distribution (ACD) for agent routing, and the ability to scale to thousands of agents without requiring any physical phone hardware or PBX equipment. It is purpose-built for this exact use case, offering pay-as-you-go pricing and integration with AWS services like Lambda and Lex for custom IVR flows.

Answer

Amazon Chime

Answer

Amazon SNS

Answer

Amazon WorkMail

Question 14

A financial services company needs to maintain a tamper-proof audit log of all financial transactions for regulatory compliance. Which AWS service is most appropriate?

Accepted Answer

Amazon QLDB. Amazon QLDB (Quantum Ledger Database) is purpose-built to provide a cryptographically verifiable, immutable, and tamper-proof transaction log. It uses a journal that stores every change as a series of entries, and each entry is chained using a hash, making it impossible to alter or delete past records without detection. This aligns directly with the financial services requirement for an audit log that must be tamper-proof for regulatory compliance.

Answer

Amazon RDS with transaction logging

Answer

Amazon DynamoDB with global tables

Answer

AWS CloudTrail with log file integrity validation

Question 15

A company received an unexpected AWS bill that was much higher than expected. Which AWS service would help them understand which resource or service caused the cost spike?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer (B) is the correct service because it provides a pre-built dashboard and reports that allow you to visualize, analyze, and drill down into your AWS costs and usage over time. You can filter by service, linked account, region, or resource tags to identify exactly which resource or service caused the unexpected cost spike. AWS Budgets (A) can alert you when costs exceed a threshold, but it does not provide the historical analysis and granular breakdown needed to pinpoint the root cause of a past spike.

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Answer

AWS Trusted Advisor