CLF-C02 Practice Test 36 — 15 Questions

Question 1

A data engineering team processes petabytes of raw log data using Apache Spark and Hadoop frameworks. They need a managed AWS service that provisions the cluster, installs the big data frameworks, and terminates the cluster after the job completes to minimise cost. Which service should they use?

Accepted Answer

Amazon EMR. Amazon EMR is the correct choice because it is a managed big data platform that can provision Apache Spark and Hadoop clusters, install the required frameworks, and automatically terminate the cluster upon job completion using features like transient clusters and step-based lifecycle management. This minimizes cost by only paying for compute resources during active processing.

Answer

Amazon Redshift

Answer

AWS Glue

Answer

Amazon Athena

Question 2

A company has unused Reserved Instances that don't match their current infrastructure. What option allows them to recoup some cost from unused RIs?

Accepted Answer

Sell them on the Reserved Instance Marketplace. The AWS Reserved Instance Marketplace allows customers to sell unused Reserved Instances (RIs) to other AWS users, enabling them to recoup some of the upfront costs. This is the only option that directly addresses the need to recover costs from RIs that no longer match the current infrastructure, as AWS does not offer refunds or free transfers for unused RIs.

Answer

Convert them to Spot Instances

Answer

Request a refund from AWS for unused RI capacity

Answer

Transfer them to another AWS account for free

Question 3

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 4

A company runs workloads for multiple teams in a single AWS account and wants to track and report costs per team in their monthly AWS bill. Which feature allows them to categorise and report AWS costs by team?

Accepted Answer

AWS Cost Allocation Tags. AWS Cost Allocation Tags allow you to tag AWS resources with team-specific metadata (e.g., 'Team: Engineering') and then activate those tags in the Billing and Cost Management console. Once activated, AWS generates cost reports that group and summarize charges by those tags, enabling per-team cost tracking in the monthly bill. This is the correct feature because it directly categorizes costs at the resource level and reports them in billing data.

Answer

AWS Budgets

Answer

AWS Organisations consolidated billing

Answer

AWS Cost and Usage Report

Question 5

A startup has a development AWS account and wants the minimum paid AWS Support plan that provides email-based technical support from AWS staff. They do not need 24/7 phone access. Which is the minimum support plan that provides access to AWS technical support engineers?

Accepted Answer

Developer Support. The Developer Support plan is the minimum AWS Support plan that provides access to AWS technical support engineers via email during business hours. Basic Support offers no technical support from AWS staff, only account and billing assistance. Business and Enterprise Support include 24/7 phone and chat support, which exceeds the stated requirement for email-only access.

Answer

Basic Support

Answer

Business Support

Answer

Enterprise Support

Question 6

A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized security policy management across multiple AWS accounts and regions. It allows an administrator to define and enforce AWS WAF rules, security group rules, and Shield Advanced protections from a single administrator account, ensuring consistent compliance across all accounts in an AWS Organization.

Answer

AWS WAF

Answer

AWS Security Hub

Answer

AWS Shield Advanced

Question 7

A company needs to ensure their containerized applications pass security scans for known vulnerabilities before being deployed to production. Which AWS service scans container images for CVEs?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is designed to automatically scan container images stored in Amazon Elastic Container Registry (ECR) for software vulnerabilities, including Common Vulnerabilities and Exposures (CVEs). It continuously monitors the images at rest and during deployment, providing a detailed findings report that helps you remediate security issues before the container reaches production.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

Amazon Macie

Question 8

Which statement best describes the AWS global infrastructure concept of an Availability Zone (AZ)?

Accepted Answer

One or more discrete data centers with redundant power, networking, and connectivity within a Region. An Availability Zone (AZ) consists of one or more discrete data centers with independent power, cooling, and physical networking, connected to each other through low-latency links within a single AWS Region. This design ensures that if one AZ fails, applications can continue operating in other AZs, providing high availability and fault tolerance. Option B correctly captures this definition, as it emphasizes the discrete, redundant infrastructure that makes an AZ distinct from a Region or a data center.

Answer

A geographic location where AWS hosts data centers, such as North America or Europe

Answer

A CDN edge location used to cache content close to end users

Answer

A logically isolated section of the AWS Cloud where customers launch resources

Question 9

A startup wants to ensure its web application automatically handles traffic spikes during product launches without over-provisioning resources during quiet periods. Which AWS capability best addresses this requirement?

Accepted Answer

Elasticity through AWS Auto Scaling. AWS Auto Scaling enables the startup to automatically adjust the number of Amazon EC2 instances in response to real-time demand, scaling up during traffic spikes and scaling down during quiet periods. This elasticity eliminates the need to over-provision resources, optimizing both cost and performance for variable workloads.

Answer

High availability through multiple AZs

Answer

Durability through S3 data replication

Answer

Agility through rapid resource provisioning

Question 10

What does the principle of least privilege mean in the context of AWS IAM?

Accepted Answer

Grant only the minimum permissions necessary to perform required tasks. The principle of least privilege in AWS IAM means granting only the permissions that are strictly necessary for a user, role, or service to perform its intended functions. This minimizes the attack surface by ensuring that even if credentials are compromised, the potential damage is limited to only the allowed actions and resources. AWS IAM enforces this through fine-grained policy statements that specify exact actions, resources, and conditions.

Answer

All IAM users should have the same level of access to ensure consistency

Answer

Use AWS managed policies instead of customer-managed policies

Answer

Rotate IAM access keys every 90 days

Question 11

According to the AWS Well-Architected Framework, which design principle is most closely associated with the recommendation to 'stop spending money on undifferentiated heavy lifting'?

Accepted Answer

Use managed services to reduce operational burden. The AWS Well-Architected Framework's principle of 'stop spending money on undifferentiated heavy lifting' directly advocates for using managed services to offload operational tasks like patching, scaling, and hardware maintenance. By leveraging services such as Amazon RDS (instead of self-managed databases) or AWS Lambda (instead of managing servers), you reduce the operational burden and focus on business differentiation. This aligns with the Operational Excellence pillar's goal of minimizing manual overhead.

Answer

Design for failure

Answer

Implement least-privilege access controls

Answer

Automate infrastructure provisioning

Question 12

Which tool allows a company to estimate the monthly cost of running a new AWS architecture before deploying any resources?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly Simple Monthly Calculator) allows users to estimate the monthly cost of AWS services by configuring resources like EC2 instances, storage, and data transfer before deployment. It provides a detailed cost breakdown based on selected regions, instance types, and usage patterns, enabling informed budgeting without incurring actual charges.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 13

Which AWS service is a fully managed data warehousing service optimized for online analytical processing (OLAP) of large datasets?

Accepted Answer

Amazon Redshift. Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed specifically for online analytical processing (OLAP) of large datasets. It uses columnar storage, massively parallel processing (MPP), and data compression to deliver fast query performance on structured and semi-structured data, making it the correct choice for OLAP workloads.

Answer

Amazon RDS

Answer

Amazon DynamoDB

Answer

Amazon Aurora

Question 14

Which AWS support plan provides access to AWS Infrastructure Event Management (IEM) for product launches and migrations at no additional charge?

Accepted Answer

Enterprise Support. The Enterprise Support plan includes AWS Infrastructure Event Management (IEM) at no additional charge, providing architectural and scaling guidance for product launches and migrations. This is a key differentiator from lower-tier plans, which either do not include IEM or require an extra fee. The Business Support plan offers IEM only as a paid add-on, while Developer and Basic plans lack access entirely.

Answer

Developer Support

Answer

Business Support

Answer

Basic Support

Question 15

A company wants to receive alerts when their AWS spend exceeds a specific threshold. Which AWS service should they use to configure these alerts?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when your actual or forecasted spend exceeds a defined threshold. It is the primary service designed for proactive cost monitoring and alerting, supporting both monthly and daily budget tracking with configurable actions such as email notifications or automated responses via AWS Chatbot.

Answer

AWS Cost Explorer

Answer

AWS Cost and Usage Report

Answer

Amazon CloudWatch Billing alarms