CLF-C02 Practice Test 38 — 15 Questions

Question 1

A company wants to use Amazon S3 to store objects that must not be deleted or overwritten for a specified period for regulatory compliance. Which S3 feature enforces this?

Accepted Answer

S3 Object Lock. Amazon S3 Object Lock is designed specifically to prevent objects from being deleted or overwritten for a fixed period or indefinitely. It enforces a write-once-read-many (WORM) model by applying retention modes (Governance or Compliance) or legal holds, which block both DELETE and PUT operations on locked objects until the retention period expires. This directly meets the regulatory compliance requirement described in the question.

Answer

S3 Versioning

Answer

S3 Lifecycle policies

Answer

S3 Block Public Access

Question 2

Which AWS Well-Architected Framework pillar includes recommendations for using a mix of purchase options and rightsizing instances to optimize costs?

Accepted Answer

Cost Optimization. The Cost Optimization pillar of the AWS Well-Architected Framework specifically includes guidance on using a mix of purchase options (e.g., Reserved Instances, Savings Plans, Spot Instances) and rightsizing instances (e.g., selecting the correct instance family and size based on utilization metrics) to reduce overall spending while maintaining performance. This pillar focuses on avoiding unnecessary costs and aligning expenditure with business needs.

Answer

Operational Excellence

Answer

Performance Efficiency

Answer

Reliability

Question 3

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 4

Which AWS service provides a fully managed extract, transform, and load (ETL) service that automatically discovers data schemas and generates ETL code?

Accepted Answer

AWS Glue. AWS Glue is a fully managed ETL service that automatically discovers data schemas using its crawler component and generates ETL code via its code generation engine. It integrates with the AWS Glue Data Catalog to store metadata and provides a serverless Spark environment to run ETL jobs without manual infrastructure management.

Answer

Amazon EMR

Answer

Amazon Kinesis Data Firehose

Answer

AWS Data Pipeline

Question 5

What does the principle of least privilege mean in the context of AWS IAM?

Accepted Answer

Grant only the minimum permissions necessary to perform required tasks. The principle of least privilege in AWS IAM means granting only the permissions that are strictly necessary for a user, role, or service to perform its intended functions. This minimizes the attack surface by ensuring that even if credentials are compromised, the potential damage is limited to only the allowed actions and resources. AWS IAM enforces this through fine-grained policy statements that specify exact actions, resources, and conditions.

Answer

All IAM users should have the same level of access to ensure consistency

Answer

Use AWS managed policies instead of customer-managed policies

Answer

Rotate IAM access keys every 90 days

Question 6

A company needs to generate a pre-signed URL to allow a business partner to download a specific S3 object for 24 hours without requiring AWS credentials. Which S3 feature enables this?

Accepted Answer

S3 Pre-signed URLs. Pre-signed URLs grant temporary access to a specific S3 object by embedding credentials in a URL signed with the bucket owner's AWS signature. The URL is valid for a specified duration (up to 7 days, here 24 hours) and allows the partner to download the object without having AWS credentials. This is the only S3 feature that provides time-limited, object-specific access without requiring the partner to authenticate with AWS.

Answer

S3 Bucket Policy with IP-based restrictions

Answer

S3 Access Points

Answer

S3 Bucket public-read ACL

Question 7

Which statement accurately describes the relationship between AWS Regions and Availability Zones?

Accepted Answer

Each Region contains multiple Availability Zones connected with low-latency networking. An AWS Region is a geographical area that consists of multiple, isolated Availability Zones (AZs), each containing one or more data centers. These AZs within a Region are connected via redundant, low-latency networking (typically less than 2 milliseconds round-trip time) to enable high availability and fault tolerance for applications.

Answer

Each Availability Zone contains multiple Regions

Answer

Each Region is a single large data center

Answer

Availability Zones in the same Region share the same power infrastructure

Question 8

Which statement best describes the concept of 'infrastructure as code' (IaC) in the context of AWS?

Accepted Answer

Defining and provisioning cloud resources using version-controlled configuration files. Infrastructure as Code (IaC) is the practice of defining and managing cloud resources through machine-readable definition files (e.g., AWS CloudFormation templates or Terraform HCL) that are stored in version control. This allows for automated, repeatable, and consistent provisioning of AWS infrastructure, enabling change management, peer review, and rollback capabilities.

Answer

Using the AWS Management Console to provision resources manually

Answer

Writing scripts to install software on EC2 instances

Answer

Backing up AWS resource configurations to Amazon S3

Question 9

A solutions architect is designing a new architecture on AWS that includes EC2, RDS, S3, and data transfer. Before deploying anything, they want to estimate the monthly cost of running this architecture. Which AWS tool should they use?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator is the correct tool because it allows you to estimate the monthly cost of AWS services before deployment by specifying resource configurations (e.g., EC2 instance type, RDS storage, S3 data transfer). Unlike Cost Explorer, which analyzes historical costs, the Pricing Calculator provides upfront cost projections for new architectures.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 10

A company wants to understand the AWS Well-Architected Framework's sixth pillar added in 2021. Which pillar focuses on minimizing the environmental impact of cloud workloads?

Accepted Answer

Sustainability. The AWS Well-Architected Framework added a sixth pillar, Sustainability, in 2021. This pillar provides design principles and best practices to minimize the environmental impact of cloud workloads, such as optimizing utilization, reducing energy consumption, and selecting efficient hardware and regions.

Answer

Cost Optimization

Answer

Governance

Answer

Resilience

Question 11

According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?

Accepted Answer

Writing secure function code and managing IAM permissions for the function. Under the AWS Shared Responsibility Model, AWS manages the security of the cloud, including the Lambda execution environment, runtime, and underlying servers. The customer is responsible for security in the cloud, which includes writing secure function code and managing IAM permissions to control access to the function and its resources. Option C correctly identifies this customer responsibility.

Answer

Patching the Lambda execution environment and runtime

Answer

Managing the underlying servers that run Lambda functions

Answer

Ensuring Lambda scales automatically during traffic spikes

Question 12

A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS allows you to create customer managed keys (CMKs) with automatic annual rotation enabled. You retain control over key policies and access permissions, while AWS handles the rotation of the key material. This satisfies the compliance requirement for encrypted data at rest in S3 with automatic yearly key rotation.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 13

Which AWS service enables you to run relational database workloads with up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL at a lower price point than commercial databases?

Accepted Answer

Amazon Aurora. Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud, offering up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL. It achieves this performance through a distributed, auto-healing storage subsystem that separates compute from storage, and it is priced lower than commercial databases like Oracle or SQL Server while providing high availability and durability.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 14

A company's CTO asks about the AWS Cloud Adoption Framework (AWS CAF). Which statement about AWS CAF is accurate?

Accepted Answer

AWS CAF organizes guidance into six perspectives covering Business, People, Governance, Platform, Security, and Operations. The AWS Cloud Adoption Framework (AWS CAF) organizes its guidance into six distinct perspectives: Business, People, Governance, Platform, Security, and Operations. These perspectives help organizations identify and address gaps in their cloud readiness across both business and technical domains, providing actionable best practices for cloud adoption.

Answer

AWS CAF is a compliance framework similar to SOC 2 or PCI DSS

Answer

AWS CAF is only relevant for large enterprises migrating more than 1,000 servers

Answer

AWS CAF replaces the AWS Well-Architected Framework for architecture guidance

Question 15

Which statement correctly describes how Amazon S3 pricing works?

Accepted Answer

S3 charges per GB stored, per request, and for outbound data transfer. Amazon S3 pricing is based on a pay-as-you-go model where you are charged for the amount of storage you use (per GB per month), the number and type of requests (e.g., PUT, GET, LIST), and data transfer out to the internet. This granular billing reflects actual usage, making option B correct.

Answer

S3 charges a flat monthly fee regardless of storage used

Answer

S3 storage is free; only data transfer is charged

Answer

S3 charges by the number of files stored, not the size