CLF-C02 Practice Test 36 — 15 Questions

Question 1

A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?

Accepted Answer

Bucket policies and S3 Block Public Access settings. Bucket policies are resource-based policies that explicitly define who has access to an S3 bucket, including public access grants like `"Principal": "*"`. S3 Block Public Access settings act as an overarching security control that can override bucket policies to prevent public access. Reviewing both mechanisms together identifies exactly how public readability was granted and whether any block was misconfigured or absent.

Answer

IAM identity-based policies attached to the root user

Answer

AWS Organizations Service Control Policies

Answer

Amazon Macie classification rules

Question 2

A data analyst needs to run SQL queries directly against log files stored in Amazon S3 without loading the data into a database and without provisioning any servers. Which AWS service enables this?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL. It requires no infrastructure to manage and charges only for the data scanned per query, making it ideal for ad-hoc analysis of log files without loading data into a database.

Answer

Amazon RDS

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 3

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.

Answer

Security Groups

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF

Question 4

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is the correct choice because it provides managed clusters for Elasticsearch and OpenSearch, enabling log analytics, full-text search, and real-time application monitoring. It integrates with Logstash and Kibana (the ELK stack) and supports the OpenSearch API, making it the direct AWS offering for this use case.

Answer

Amazon CloudSearch

Answer

Amazon Athena

Answer

Amazon Redshift

Question 5

A company's compliance officer needs to provide an external auditor with copies of AWS SOC 2 reports and a PCI DSS attestation of compliance. The officer needs a self-service portal to download these documents directly, without contacting AWS Support. The solution must provide the most current versions of these reports. Which AWS service should the officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS attestations of compliance. It ensures the most current versions are always available without needing to contact AWS Support, directly meeting the compliance officer's requirement for a self-service download solution.

Answer

AWS Audit Manager

Answer

Amazon Inspector

Answer

AWS Config

Question 6

A company needs a managed service to forecast product demand using machine learning, helping them optimize inventory levels without building a custom ML model. Which AWS AI service provides ready-to-use time-series forecasting?

Accepted Answer

Amazon Forecast. Amazon Forecast is a fully managed service that uses machine learning to deliver highly accurate time-series forecasts based on historical data, without requiring any custom model building. It is specifically designed for use cases like product demand forecasting, inventory planning, and resource allocation, making it the correct choice for this scenario.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 7

A company's application receives images from users and needs to detect and blur any credit card numbers visible in the images for compliance. Which AWS AI service provides document text extraction from images?

Accepted Answer

Amazon Textract. Amazon Textract is specifically designed to extract text, including handwritten and printed text, from scanned documents and images. It goes beyond simple optical character recognition (OCR) by using machine learning to identify and extract key-value pairs, tables, and form data, making it the correct choice for extracting credit card numbers from images for compliance processing.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

Amazon Macie

Question 8

A company is evaluating the AWS Sustainability pillar in the Well-Architected Framework. Which action aligns with AWS cloud sustainability best practices?

Accepted Answer

Right-sizing instances and using managed services to maximize resource utilization. Right-sizing instances and using managed services directly aligns with the AWS Sustainability pillar, which focuses on minimizing the environmental impact of cloud workloads. By matching instance capacity to actual demand and leveraging services like AWS Lambda or Amazon RDS, you reduce wasted compute cycles and energy consumption, improving resource utilization and lowering carbon footprint.

Answer

Provisioning maximum instance sizes to ensure peak performance at all times

Answer

Running workloads 24/7 even when not needed to maintain warm state

Answer

Replicating all data to multiple regions for maximum redundancy

Question 9

Which statement about AWS pricing is accurate?

Accepted Answer

AWS offers pay-as-you-go pricing with volume discounts as usage grows. AWS pricing is accurate as pay-as-you-go with volume discounts because customers only pay for the resources they consume, and as usage increases, tiered pricing or volume-based discounts (e.g., AWS Lambda's per-request pricing or S3's storage tiers) automatically reduce the per-unit cost. This model eliminates upfront commitments and aligns cost with actual consumption, which is a core AWS pricing philosophy.

Answer

AWS prices are fixed and never change

Answer

AWS requires annual contracts for all services

Answer

Data transfer into AWS from the internet is the largest AWS cost component

Question 10

A company processes millions of customer records and needs to query data in Amazon S3 without loading it into a database. The data is stored in Parquet format. Which AWS service enables this with no infrastructure to manage?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL, with no infrastructure to manage. It natively supports Parquet format, which is columnar and optimized for efficient querying, making it ideal for querying millions of customer records without loading them into a database.

Answer

Amazon Redshift Spectrum

Answer

Amazon EMR

Answer

AWS Glue ETL

Question 11

A company wants to automatically detect and label objects in photos uploaded by users — such as identifying if a photo contains a person, a car, or an outdoor scene — without building their own machine learning model. Which AWS service provides this pre-built computer vision capability?

Accepted Answer

Amazon Rekognition. Amazon Rekognition is the correct choice because it is a fully managed, pre-trained computer vision service that can automatically detect and label objects, scenes, and faces in images without requiring any custom machine learning model development. It provides APIs for image analysis, including object and scene detection, which directly matches the requirement to identify if a photo contains a person, car, or outdoor scene.

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Answer

Amazon Polly

Question 12

Which AWS concept describes the strategy of designing applications so that any individual component can fail without causing the entire system to fail?

Accepted Answer

Design for failure. B is correct because the 'design for failure' principle is a core AWS Well-Architected Framework concept that mandates building applications with no single point of failure. By distributing workloads across multiple Availability Zones and using services like Elastic Load Balancing (ELB) and Auto Scaling, a failure in one component (e.g., an EC2 instance) is isolated and automatically replaced, ensuring the system remains available. This contrasts with traditional monolithic designs where a single component failure can cascade into a full outage.

Answer

Economies of scale

Answer

Managed services adoption

Answer

Infrastructure as code

Question 13

Which AWS service provides a managed workflow for human review tasks, allowing machine learning models to request human oversight for low-confidence predictions?

Accepted Answer

Amazon Augmented AI (A2I). Amazon Augmented AI (A2I) is the correct service because it provides a managed workflow for human review of machine learning predictions, specifically when models have low confidence. It integrates with services like Amazon Rekognition and Amazon Textract to automatically route low-confidence predictions to human reviewers, enabling a human-in-the-loop (HITL) process without custom infrastructure.

Answer

Amazon SageMaker Ground Truth

Answer

Amazon Mechanical Turk

Answer

Amazon Rekognition Custom Labels

Question 14

Which IAM feature allows you to grant temporary, limited access to AWS resources for users who don't have AWS accounts, such as third-party contractors?

Accepted Answer

IAM Roles with cross-account access. IAM Roles with cross-account access allow you to grant temporary, limited permissions to users from another AWS account or external identity providers (e.g., third-party contractors) without creating IAM users for them. The role is assumed via AWS Security Token Service (STS), which issues temporary credentials that expire after a defined duration, ensuring least-privilege access.

Answer

IAM Groups

Answer

IAM password policies

Answer

Service Control Policies (SCPs)

Question 15

A company wants to purchase and deploy a third-party security software solution (a firewall appliance) directly to their AWS environment, with licensing costs added to their AWS monthly bill. Where can they find and subscribe to this software?

Accepted Answer

AWS Marketplace. AWS Marketplace is the correct place to find, subscribe to, and purchase third-party software solutions like a firewall appliance. It allows you to launch the software directly into your AWS environment and have the licensing costs added to your monthly AWS bill through consolidated billing.

Answer

AWS Service Catalog

Answer

AWS Partner Network

Answer

AWS Trusted Advisor