CLF-C02 Practice Test 36 — 15 Questions

Question 1

Which AWS feature provides personalized recommendations about your account's security and cost optimization, available at no cost for all AWS customers?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct answer because it provides personalized recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits. It is available at no additional cost for all AWS customers, with the basic checks included in the Free Tier and Basic Support plan, while more detailed checks require a Business or Enterprise Support plan.

Answer

AWS Cost Explorer

Answer

AWS Personal Health Dashboard

Answer

Amazon CloudWatch

Question 2

A startup is evaluating cloud vs. on-premises for their new product. Which cloud characteristic means they can experiment with 10 servers for a week, then scale to 1,000 servers for a product launch, and back to 10 afterward — paying only for what they use?

Accepted Answer

Elasticity and pay-as-you-go pricing. Elasticity is the cloud characteristic that allows resources to automatically scale up or down based on demand, while pay-as-you-go pricing ensures you only incur costs for resources actually consumed. In this scenario, the startup can provision 10 servers for a week, scale to 1,000 servers for a launch, and then scale back to 10 — paying only for the compute hours used during each period. This combination of rapid scaling and consumption-based billing is unique to cloud computing and directly supports the described experimental and production workloads.

Answer

Durability

Answer

Multi-tenancy

Answer

Service Level Agreement (SLA)

Question 3

A company stores sensitive customer data in Amazon S3. The security policy requires that all objects be encrypted at rest using an encryption key that is automatically rotated every 12 months. The company must retain full control over the key, including the ability to immediately revoke access to the key if a security incident occurs. The security team also needs to audit every use of the key through AWS CloudTrail. Which key management solution should the company choose to meet these requirements?

Accepted Answer

Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.. AWS KMS customer managed keys (CMKs) allow you to enable automatic annual key rotation (every 12 months) and retain full control over the key, including the ability to immediately revoke access by disabling or deleting the key. CloudTrail integration is inherent with KMS, logging every use of the key via the `Decrypt` and `GenerateDataKey` API calls, meeting the audit requirement. This combination satisfies all stated security policy needs: encryption at rest, automatic rotation, full control, immediate revocation, and auditability.

Answer

Use an AWS KMS AWS managed key with automatic key rotation.

Answer

Use Amazon S3 server-side encryption with SSE-S3.

Answer

Use AWS CloudHSM to generate and manage the key.

Question 4

A company runs a monolithic order processing application on a single Amazon EC2 instance. During peak hours, the instance receives a sudden burst of orders that exceeds its processing capacity. Orders are dropped and customers do not receive confirmations. The company needs a solution that buffers incoming orders, stores them durably, and allows the application to process them at a manageable pace. The solution must be fully managed and ensure that no orders are lost. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples application components. It durably stores incoming orders in a queue, allowing the EC2 instance to poll and process them at its own pace, preventing order loss during traffic bursts. SQS guarantees at-least-once delivery and provides a buffer that absorbs spikes in demand.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Firehose

Answer

Amazon ElastiCache

Question 5

Which AWS service provides a central place to manage security alerts and automate compliance checks across an AWS Organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a single, central location for aggregating, organizing, and prioritizing security alerts (findings) from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It also enables automated compliance checks against standards such as CIS AWS Foundations, PCI DSS, and AWS Foundational Security Best Practices across all accounts in an AWS Organization, using built-in or custom controls.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 6

A company needs to provide business users with self-service business intelligence dashboards and visualizations of data from multiple AWS data sources. Which AWS service enables this?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a fully managed, serverless business intelligence (BI) service designed specifically for creating interactive dashboards and visualizations. It natively integrates with multiple AWS data sources (e.g., Amazon S3, Amazon RDS, Amazon Redshift, Amazon Athena) and provides self-service capabilities for business users via a web-based interface, without requiring any infrastructure management.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon EMR

Question 7

A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?

Accepted Answer

Bucket policies and S3 Block Public Access settings. Bucket policies are resource-based policies that explicitly define who has access to an S3 bucket, including public access grants like `"Principal": "*"`. S3 Block Public Access settings act as an overarching security control that can override bucket policies to prevent public access. Reviewing both mechanisms together identifies exactly how public readability was granted and whether any block was misconfigured or absent.

Answer

IAM identity-based policies attached to the root user

Answer

AWS Organizations Service Control Policies

Answer

Amazon Macie classification rules

Question 8

A data analyst needs to run SQL queries directly against log files stored in Amazon S3 without loading the data into a database and without provisioning any servers. Which AWS service enables this?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL. It requires no infrastructure to manage and charges only for the data scanned per query, making it ideal for ad-hoc analysis of log files without loading data into a database.

Answer

Amazon RDS

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 9

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.

Answer

Security Groups

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF

Question 10

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is the correct choice because it provides managed clusters for Elasticsearch and OpenSearch, enabling log analytics, full-text search, and real-time application monitoring. It integrates with Logstash and Kibana (the ELK stack) and supports the OpenSearch API, making it the direct AWS offering for this use case.

Answer

Amazon CloudSearch

Answer

Amazon Athena

Answer

Amazon Redshift

Question 11

A company's compliance officer needs to provide an external auditor with copies of AWS SOC 2 reports and a PCI DSS attestation of compliance. The officer needs a self-service portal to download these documents directly, without contacting AWS Support. The solution must provide the most current versions of these reports. Which AWS service should the officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS attestations of compliance. It ensures the most current versions are always available without needing to contact AWS Support, directly meeting the compliance officer's requirement for a self-service download solution.

Answer

AWS Audit Manager

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A company needs a managed service to forecast product demand using machine learning, helping them optimize inventory levels without building a custom ML model. Which AWS AI service provides ready-to-use time-series forecasting?

Accepted Answer

Amazon Forecast. Amazon Forecast is a fully managed service that uses machine learning to deliver highly accurate time-series forecasts based on historical data, without requiring any custom model building. It is specifically designed for use cases like product demand forecasting, inventory planning, and resource allocation, making it the correct choice for this scenario.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 13

A company's application receives images from users and needs to detect and blur any credit card numbers visible in the images for compliance. Which AWS AI service provides document text extraction from images?

Accepted Answer

Amazon Textract. Amazon Textract is specifically designed to extract text, including handwritten and printed text, from scanned documents and images. It goes beyond simple optical character recognition (OCR) by using machine learning to identify and extract key-value pairs, tables, and form data, making it the correct choice for extracting credit card numbers from images for compliance processing.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

Amazon Macie

Question 14

A company is evaluating the AWS Sustainability pillar in the Well-Architected Framework. Which action aligns with AWS cloud sustainability best practices?

Accepted Answer

Right-sizing instances and using managed services to maximize resource utilization. Right-sizing instances and using managed services directly aligns with the AWS Sustainability pillar, which focuses on minimizing the environmental impact of cloud workloads. By matching instance capacity to actual demand and leveraging services like AWS Lambda or Amazon RDS, you reduce wasted compute cycles and energy consumption, improving resource utilization and lowering carbon footprint.

Answer

Provisioning maximum instance sizes to ensure peak performance at all times

Answer

Running workloads 24/7 even when not needed to maintain warm state

Answer

Replicating all data to multiple regions for maximum redundancy

Question 15

Which statement about AWS pricing is accurate?

Accepted Answer

AWS offers pay-as-you-go pricing with volume discounts as usage grows. AWS pricing is accurate as pay-as-you-go with volume discounts because customers only pay for the resources they consume, and as usage increases, tiered pricing or volume-based discounts (e.g., AWS Lambda's per-request pricing or S3's storage tiers) automatically reduce the per-unit cost. This model eliminates upfront commitments and aligns cost with actual consumption, which is a core AWS pricing philosophy.

Answer

AWS prices are fixed and never change

Answer

AWS requires annual contracts for all services

Answer

Data transfer into AWS from the internet is the largest AWS cost component