CLF-C02 Practice Test 37 — 15 Questions

Question 1

Which AWS service provides a marketplace where customers can find, buy, and deploy software from third-party vendors that runs on AWS infrastructure?

Accepted Answer

AWS Marketplace. AWS Marketplace is the correct service because it is a curated digital catalog that enables customers to find, buy, and deploy third-party software solutions that run on AWS infrastructure. It offers pre-configured software, including AMIs, SaaS subscriptions, and container images, with integrated billing through AWS. This directly matches the question's requirement for a marketplace for third-party software deployment.

Answer

AWS Service Catalog

Answer

AWS Partner Network

Answer

Amazon AppFlow

Question 2

Which benefit of cloud computing allows a company to experiment with new ideas and quickly spin down failed experiments without financial penalty?

Accepted Answer

Agility. Agility (Option C) is correct because cloud computing enables rapid experimentation by allowing companies to provision and de-provision resources on demand. This means a company can quickly spin up infrastructure to test a new idea and, if it fails, tear it down immediately without incurring ongoing costs. The pay-as-you-go model ensures there is no long-term financial penalty for failed experiments, directly supporting innovation and iterative development.

Answer

Economies of scale

Answer

Elasticity

Answer

Durability

Question 3

Which AWS storage type provides the lowest latency storage for a single EC2 instance, with data stored on NVMe SSDs physically attached to the host computer?

Accepted Answer

EC2 Instance Store. EC2 Instance Store provides temporary block-level storage for an EC2 instance, with data stored on NVMe SSDs that are physically attached to the host computer. This direct attachment eliminates network latency, offering the lowest possible latency for a single EC2 instance compared to any network-attached storage option.

Answer

Amazon EBS (Elastic Block Store)

Answer

Amazon EFS (Elastic File System)

Answer

Amazon S3

Question 4

Which AWS service enables you to create a private, isolated network within the AWS Cloud where you can define your own IP address range, subnets, and routing?

Accepted Answer

Amazon VPC. Amazon VPC (Virtual Private Cloud) enables you to provision a logically isolated section of the AWS Cloud where you can define your own IP address range using CIDR notation (e.g., 10.0.0.0/16), create subnets across Availability Zones, and configure custom route tables to control traffic flow. This service gives you full control over your virtual networking environment, including the selection of private and public IP addresses, network gateways, and security settings.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

AWS Transit Gateway

Question 5

A company wants to take advantage of AWS's global infrastructure to replicate their database to a second geographic region for disaster recovery. Which benefit of cloud computing does this leverage?

Accepted Answer

Go global in minutes. AWS's global infrastructure allows you to deploy resources, such as database replicas, across multiple geographic regions in minutes. By using services like Amazon RDS Cross-Region Read Replicas or Aurora Global Database, you can replicate data to a second region for disaster recovery, leveraging the cloud's ability to rapidly expand globally without provisioning physical data centers.

Answer

Economies of scale

Answer

Trade capital expense for variable expense

Answer

Increase speed and agility for experiments

Question 6

Which AWS service provides a managed blockchain network using open-source frameworks like Hyperledger Fabric and Ethereum?

Accepted Answer

Amazon Managed Blockchain. Amazon Managed Blockchain is the correct AWS service because it is specifically designed to create and manage blockchain networks using popular open-source frameworks like Hyperledger Fabric and Ethereum. It handles the heavy lifting of setting up the blockchain infrastructure, including peer nodes, ordering service, and certificate authorities, allowing developers to focus on building decentralized applications.

Answer

Amazon DynamoDB

Answer

AWS Quantum Ledger Database (QLDB)

Answer

Amazon Neptune

Question 7

According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?

Accepted Answer

Physical security of data center facilities. AWS is responsible for the physical security of data center facilities, including access controls, surveillance, and environmental systems. This is a foundational component of the Shared Responsibility Model, where AWS secures the infrastructure that runs all AWS services, while the customer secures their data and configurations within those services.

Answer

Encrypting customer data stored in Amazon S3

Answer

Configuring security groups for EC2 instances

Answer

Managing IAM user access policies

Question 8

Which statement about AWS data transfer pricing is correct?

Accepted Answer

Data transfer into AWS from the internet is free; outbound data transfer to the internet is charged. AWS does not charge for data transfer into AWS from the internet, but it does charge for outbound data transfer from AWS to the internet. This pricing model is fundamental to AWS's cost structure, encouraging data ingestion while charging for egress. For example, data uploaded to Amazon S3 is free, but downloading that data to the internet incurs per-GB charges.

Answer

All data transfer into and out of AWS is free

Answer

Data transfer between EC2 instances in different Availability Zones is free

Answer

Data transfer between AWS Regions is free because it stays within AWS infrastructure

Question 9

A company wants to use Amazon S3 to store objects that must not be deleted or overwritten for a specified period for regulatory compliance. Which S3 feature enforces this?

Accepted Answer

S3 Object Lock. Amazon S3 Object Lock is designed specifically to prevent objects from being deleted or overwritten for a fixed period or indefinitely. It enforces a write-once-read-many (WORM) model by applying retention modes (Governance or Compliance) or legal holds, which block both DELETE and PUT operations on locked objects until the retention period expires. This directly meets the regulatory compliance requirement described in the question.

Answer

S3 Versioning

Answer

S3 Lifecycle policies

Answer

S3 Block Public Access

Question 10

Which AWS Well-Architected Framework pillar includes recommendations for using a mix of purchase options and rightsizing instances to optimize costs?

Accepted Answer

Cost Optimization. The Cost Optimization pillar of the AWS Well-Architected Framework specifically includes guidance on using a mix of purchase options (e.g., Reserved Instances, Savings Plans, Spot Instances) and rightsizing instances (e.g., selecting the correct instance family and size based on utilization metrics) to reduce overall spending while maintaining performance. This pillar focuses on avoiding unnecessary costs and aligning expenditure with business needs.

Answer

Operational Excellence

Answer

Performance Efficiency

Answer

Reliability

Question 11

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 12

Which AWS service provides a fully managed extract, transform, and load (ETL) service that automatically discovers data schemas and generates ETL code?

Accepted Answer

AWS Glue. AWS Glue is a fully managed ETL service that automatically discovers data schemas using its crawler component and generates ETL code via its code generation engine. It integrates with the AWS Glue Data Catalog to store metadata and provides a serverless Spark environment to run ETL jobs without manual infrastructure management.

Answer

Amazon EMR

Answer

Amazon Kinesis Data Firehose

Answer

AWS Data Pipeline

Question 13

What does the principle of least privilege mean in the context of AWS IAM?

Accepted Answer

Grant only the minimum permissions necessary to perform required tasks. The principle of least privilege in AWS IAM means granting only the permissions that are strictly necessary for a user, role, or service to perform its intended functions. This minimizes the attack surface by ensuring that even if credentials are compromised, the potential damage is limited to only the allowed actions and resources. AWS IAM enforces this through fine-grained policy statements that specify exact actions, resources, and conditions.

Answer

All IAM users should have the same level of access to ensure consistency

Answer

Use AWS managed policies instead of customer-managed policies

Answer

Rotate IAM access keys every 90 days

Question 14

A company needs to generate a pre-signed URL to allow a business partner to download a specific S3 object for 24 hours without requiring AWS credentials. Which S3 feature enables this?

Accepted Answer

S3 Pre-signed URLs. Pre-signed URLs grant temporary access to a specific S3 object by embedding credentials in a URL signed with the bucket owner's AWS signature. The URL is valid for a specified duration (up to 7 days, here 24 hours) and allows the partner to download the object without having AWS credentials. This is the only S3 feature that provides time-limited, object-specific access without requiring the partner to authenticate with AWS.

Answer

S3 Bucket Policy with IP-based restrictions

Answer

S3 Access Points

Answer

S3 Bucket public-read ACL

Question 15

Which statement accurately describes the relationship between AWS Regions and Availability Zones?

Accepted Answer

Each Region contains multiple Availability Zones connected with low-latency networking. An AWS Region is a geographical area that consists of multiple, isolated Availability Zones (AZs), each containing one or more data centers. These AZs within a Region are connected via redundant, low-latency networking (typically less than 2 milliseconds round-trip time) to enable high availability and fault tolerance for applications.

Answer

Each Availability Zone contains multiple Regions

Answer

Each Region is a single large data center

Answer

Availability Zones in the same Region share the same power infrastructure