CLF-C02 Practice Test 35 — 15 Questions

Question 1

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Answer

AWS Directory Service

Answer

Amazon Cognito

Answer

AWS Control Tower

Question 2

A company needs 24/7 phone and chat access to AWS support engineers, full access to all AWS Trusted Advisor checks, and a response time of less than 1 hour for production system outages. Which is the minimum AWS Support plan that meets all these requirements?

Accepted Answer

Business Support. The Business Support plan is the minimum plan that provides 24/7 phone and chat access to AWS support engineers, full access to all AWS Trusted Advisor checks, and a response time of less than 1 hour for production system outages. The Basic and Developer plans lack 24/7 phone/chat and full Trusted Advisor checks, while the Enterprise On-Ramp plan offers these features but is not the minimum because Business Support already meets all requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise On-Ramp Support

Question 3

A company's finance team wants to forecast their AWS spending for the next 12 months to set accurate budget targets. Which AWS service provides cost forecasting based on historical usage patterns?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides cost forecasting based on historical usage patterns, allowing you to project your AWS spending for the next 12 months. It uses machine learning to analyze past consumption and generate future cost estimates, which directly supports the finance team's need for accurate budget targets.

Answer

AWS Pricing Calculator

Answer

AWS Budgets

Answer

Amazon QuickSight

Question 4

A company's application experiences traffic spikes every weekday morning when employees arrive at work. During off-hours, very few users are active. Which AWS feature automatically adjusts the number of EC2 instances based on demand, adding instances during peak hours and removing them during quiet periods?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is the correct service because it automatically adjusts the number of EC2 instances in response to demand, using scaling policies (e.g., scheduled scaling or dynamic scaling) to add instances during peak hours and terminate them during quiet periods. This directly matches the described traffic pattern of weekday morning spikes and off-hour lulls, without manual intervention.

Answer

Amazon EC2 Reserved Instances

Answer

AWS Elastic Load Balancing

Answer

AWS CloudFormation

Question 5

A company wants to provide employees with secure, managed virtual Windows or Linux desktops accessible from any device, without purchasing physical computers or managing on-premises VDI infrastructure. Which AWS service provides cloud-based virtual desktops?

Accepted Answer

Amazon WorkSpaces. Amazon WorkSpaces is a fully managed, cloud-based virtual desktop infrastructure (VDI) service that provides secure, persistent Windows or Linux desktops accessible from any supported device. It eliminates the need to purchase physical hardware or manage on-premises VDI, aligning directly with the scenario described.

Answer

Amazon AppStream 2.0

Answer

Amazon EC2 with Remote Desktop

Answer

AWS Connect

Question 6

A company launches EC2 instances in a public subnet of their VPC. For these instances to communicate directly with the internet — both to receive inbound requests and to make outbound requests — which VPC component must be attached to the VPC and referenced in the subnet's route table?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that enables communication between a VPC and the internet. For EC2 instances in a public subnet to both receive inbound requests and make outbound requests, the IGW must be attached to the VPC and a route in the subnet's route table must point 0.0.0.0/0 (or a specific public IP range) to the IGW. Without the IGW, the instances have no path to the internet, even if they have public IP addresses.

Answer

NAT Gateway

Answer

VPC Peering connection

Answer

Virtual Private Gateway

Question 7

A development team builds Docker container images as part of their CI/CD pipeline and needs a managed, private registry to store and version these images, integrated with Amazon ECS and EKS for deployment. Which AWS service provides this container image registry?

Accepted Answer

Amazon ECR. Amazon ECR (Elastic Container Registry) is the correct choice because it is a fully managed Docker container registry that stores, manages, and deploys container images. It integrates natively with Amazon ECS and Amazon EKS, allowing seamless image pulls during deployment without needing to manage underlying infrastructure.

Answer

Amazon ECS

Answer

Amazon S3

Answer

AWS CodeBuild

Question 8

A company deploys their web application across two Availability Zones using an Application Load Balancer. If one AZ experiences an outage, traffic is automatically routed to the other AZ and the application continues to function. Which cloud benefit does this demonstrate?

Accepted Answer

High availability and fault tolerance. This scenario demonstrates high availability and fault tolerance because the application is deployed across two Availability Zones with an Application Load Balancer (ALB) distributing traffic. If one AZ fails, the ALB automatically reroutes traffic to the healthy AZ, ensuring continuous operation. This design eliminates a single point of failure and maintains service availability, which is the core of fault tolerance in AWS.

Answer

Economies of scale

Answer

On-demand self-service

Answer

Rapid elasticity

Question 9

A company's compliance framework requires that all AWS API calls must be logged and that log integrity must be validated. Which AWS service with which feature satisfies this requirement?

Accepted Answer

AWS CloudTrail with Log File Integrity Validation enabled. AWS CloudTrail Log File Integrity Validation uses industry-standard algorithms (SHA-256 hashing and digital signatures with SHA-256 with RSA) to ensure that CloudTrail log files have not been tampered with after delivery. This feature enables you to validate that log files were not modified, deleted, or changed without authorization, directly meeting the compliance requirement for logging all AWS API calls and validating log integrity.

Answer

Amazon CloudWatch Logs with metric filters

Answer

AWS Config with conformance packs

Answer

VPC Flow Logs stored in S3

Question 10

A company discovers they have 30 EC2 instances running 24/7 that are almost never used — CPU utilisation under 1%. Terminating these idle instances would save thousands of dollars per month. Which AWS Well-Architected Framework pillar encourages this practice?

Accepted Answer

Cost Optimisation. Option D is correct because the Cost Optimization pillar of the AWS Well-Architected Framework focuses on avoiding unnecessary costs by matching capacity with demand. Terminating idle EC2 instances (CPU utilization under 1%) directly reduces wasted spend, aligning with the pillar's principle of 'right-sizing' resources and eliminating unused components.

Answer

Operational Excellence

Answer

Reliability

Answer

Performance Efficiency

Question 11

A company wants to set up a cloud-based customer service contact centre with an interactive voice response (IVR) system, agent call routing, and the ability to scale to thousands of agents without purchasing phone hardware or PBX equipment. Which AWS service provides this?

Accepted Answer

Amazon Connect. Amazon Connect is a cloud-based contact center service that provides an interactive voice response (IVR) system, automatic call distribution (ACD) for agent routing, and the ability to scale to thousands of agents without requiring any physical phone hardware or PBX equipment. It is purpose-built for this exact use case, offering pay-as-you-go pricing and integration with AWS services like Lambda and Lex for custom IVR flows.

Answer

Amazon Chime

Answer

Amazon SNS

Answer

Amazon WorkMail

Question 12

Which Amazon S3 feature allows you to automatically delete objects after a specified number of days to reduce storage costs?

Accepted Answer

S3 Lifecycle policies with expiration rules. S3 Lifecycle policies with expiration rules allow you to define rules that automatically delete objects after a specified number of days. This is a cost-optimization feature that helps reduce storage costs by removing data that is no longer needed, such as logs or temporary files, without manual intervention.

Answer

S3 Versioning

Answer

S3 Object Lock

Answer

S3 Block Public Access

Question 13

A company wants to test a new version of their application by sending 10% of user traffic to the new version and 90% to the existing version, gradually increasing traffic to the new version as confidence grows. Which Amazon Route 53 routing policy supports this?

Accepted Answer

Weighted routing. Weighted routing (C) is correct because it allows you to assign a percentage of traffic to each resource, such as 10% to the new version and 90% to the existing version. As confidence grows, you can adjust the weights to gradually shift more traffic to the new version. This policy is specifically designed for load balancing between multiple endpoints in a controlled, proportional manner.

Answer

Failover routing

Answer

Geolocation routing

Answer

Latency routing

Question 14

A company's microservices application consists of 10 services. When a user request is slow, the development team cannot determine which service in the chain is the bottleneck. Which AWS service provides distributed tracing so they can see the full path of a request and identify the slow component?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end distributed tracing, allowing developers to trace a request as it travels through multiple microservices. It generates a service map that shows the full path of a request, including latency breakdowns for each service, enabling identification of the slow component. This directly addresses the need to pinpoint bottlenecks in a chain of 10 services.

Answer

Amazon CloudWatch Metrics

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 15

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config