CLF-C02 Practice Test 39 — 15 Questions

Question 1

Which AWS Well-Architected Framework pillar focuses on protecting information, systems, and assets while delivering business value through risk assessments and mitigation strategies?

Accepted Answer

Security. The Security pillar of the AWS Well-Architected Framework is specifically designed to protect information, systems, and assets through the implementation of risk assessments and mitigation strategies. It encompasses practices such as identity and access management (IAM), detective controls (e.g., AWS CloudTrail, Amazon GuardDuty), infrastructure protection (e.g., AWS WAF, security groups), data protection (e.g., encryption at rest and in transit), and incident response. This pillar directly aligns with the question's focus on delivering business value while managing security risks.

Answer

Reliability

Answer

Operational Excellence

Answer

Performance Efficiency

Question 2

Which AWS service provides a managed Kubernetes service that removes the overhead of installing, operating, and maintaining a Kubernetes control plane?

Accepted Answer

Amazon EKS. Amazon EKS (Elastic Kubernetes Service) is the correct answer because it is a managed Kubernetes service that handles the provisioning, scaling, and maintenance of the Kubernetes control plane (including the API server, etcd, and controller manager). This removes the operational overhead of installing and operating the control plane yourself, allowing you to focus on deploying and managing containerized applications.

Answer

Amazon ECS

Answer

AWS Fargate

Answer

AWS App Mesh

Question 3

A company stores customer health records in an application database and needs a HIPAA-eligible AWS service for the database tier. Which relational database option on AWS is eligible for HIPAA workloads?

Accepted Answer

Amazon RDS with a signed Business Associate Agreement (BAA) with AWS. Amazon RDS can be used for HIPAA workloads when the customer has signed a Business Associate Agreement (BAA) with AWS and configures the RDS instance with encryption at rest (using AWS KMS) and encryption in transit (using TLS). The BAA is a contractual requirement under HIPAA that makes AWS a business associate, allowing covered entities to store protected health information (PHI) in RDS. Without a signed BAA, no AWS service is automatically HIPAA-eligible, even if technical security controls are in place.

Answer

Amazon RDS requires no special configuration for HIPAA compliance

Answer

Amazon Redshift only, because RDS does not support HIPAA workloads

Answer

Only self-managed databases on EC2 can be used for HIPAA workloads on AWS

Question 4

Which AWS service provides automated security assessments of EC2 instances against a library of security best practices and common vulnerabilities?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct AWS service because it is specifically designed to perform automated security assessments of EC2 instances. It uses a library of rules mapped to common security best practices (e.g., CIS benchmarks) and common vulnerabilities (e.g., CVEs) to scan the instance's OS and network configuration, generating a detailed findings report.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 5

Which AWS service provides a fully managed virtual desktop infrastructure (VDI) that allows users to access Windows or Linux desktops from any device?

Accepted Answer

Amazon WorkSpaces. Amazon WorkSpaces is a fully managed, secure virtual desktop infrastructure (VDI) service that provisions either Windows or Linux desktops. Users can access their persistent desktops from any supported device (e.g., PC, Mac, iPad, Chromebook) using the WorkSpaces client application or a web browser, without needing to manage the underlying EC2 instances or operating system.

Answer

Amazon AppStream 2.0

Answer

AWS Client VPN

Answer

Amazon EC2 with Remote Desktop Protocol

Question 6

A company wants to minimise the environmental impact of their AWS workloads by choosing the right instance sizes, maximising utilisation, using graviton processors for better performance per watt, and designing architectures that reduce total compute needed. Which AWS Well-Architected Framework pillar guides these decisions?

Accepted Answer

Sustainability. The Sustainability pillar of the AWS Well-Architected Framework focuses on minimizing the environmental impact of cloud workloads. Choosing right-sized instances, maximizing utilization, using Graviton processors for better performance per watt, and designing architectures to reduce total compute directly align with sustainability goals by reducing energy consumption and carbon footprint.

Answer

Cost Optimisation

Answer

Performance Efficiency

Answer

Reliability

Question 7

An enterprise is planning their cloud adoption strategy. They want to understand how cloud adoption typically progresses. Which framework provides a structured approach to cloud adoption organized around business, people, governance, platform, security, and operations perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud adoption journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. Unlike the Well-Architected Framework, which focuses on architectural best practices for building workloads, the CAF addresses the broader organizational and process changes needed for successful cloud adoption.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor

Question 8

A company is assessing their on-premises environment before migrating to AWS. Which AWS service helps discover on-premises servers, profile their utilization, and create a business case for cloud migration?

Accepted Answer

AWS Application Discovery Service. AWS Application Discovery Service is designed to gather information about on-premises data centers, including server specifications, utilization metrics, and network dependencies. It provides this data to help build a detailed business case for migration, including cost projections and migration planning. This directly matches the requirement to discover servers, profile utilization, and create a business case.

Answer

AWS Migration Hub

Answer

AWS Database Migration Service

Answer

AWS Server Migration Service

Question 9

A company stores large amounts of data in Amazon S3 and wants to query it using standard SQL without loading it into a database. They need queries to complete in seconds. Which query optimization technique should they apply?

Accepted Answer

Convert data to columnar Parquet format and implement partitioning. B is correct because converting data to columnar Parquet format reduces the amount of data scanned by only reading the columns needed for the query, and partitioning further limits the data scanned by filtering on partition keys. This combination enables queries to complete in seconds on Amazon S3 using services like Amazon Athena or Amazon Redshift Spectrum, without loading data into a database.

Answer

Store data in CSV format for maximum compatibility

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Move all data to Amazon RDS for faster SQL queries

Question 10

A company wants to receive a notification whenever a new AWS root account sign-in occurs. Which combination of services achieves this?

Accepted Answer

CloudTrail + EventBridge + SNS notification. AWS CloudTrail logs all root account sign-in events as `ConsoleLogin` events in the management events trail. Amazon EventBridge can be configured with a rule that matches this specific event pattern (e.g., `detail.userIdentity.type` = `Root` and `detail.eventName` = `ConsoleLogin`). The rule then triggers an Amazon SNS topic to send a notification (email, SMS, etc.) to the designated recipients. This combination provides a real-time, event-driven notification for root account activity.

Answer

AWS Config + AWS Lambda

Answer

AWS Budgets + SES email

Answer

Amazon GuardDuty finding + S3 export

Question 11

A company runs a high-traffic e-commerce application. During peak holiday season, database read performance degrades. They want to offload read traffic from their RDS primary database. What should they implement?

Accepted Answer

RDS Read Replicas. B is correct because RDS Read Replicas are specifically designed to offload read traffic from the primary database instance. By creating one or more read-only replicas, the application can direct SELECT queries to the replicas, reducing the load on the primary RDS instance and improving overall read performance during peak traffic.

Answer

RDS Multi-AZ

Answer

Increase the RDS instance size

Answer

Enable RDS Automated Backups

Question 12

A healthcare company runs a production application on AWS that stores protected health information (PHI). The company needs a support plan that provides a designated Technical Account Manager (TAM) who will perform quarterly business reviews, offer proactive architectural guidance, and help optimize the environment. The company also requires a 15-minute response time for critical system failures. Which AWS Support plan should the company choose?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the only plan that provides a designated Technical Account Manager (TAM) who conducts quarterly business reviews, offers proactive architectural guidance, and helps optimize the environment. It also guarantees a 15-minute response time for critical system failures, meeting the healthcare company's requirements for handling protected health information (PHI) with high availability and compliance.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 13

A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS security and compliance reports, including SOC 2 and ISO 27001 certifications. The company can download the latest versions directly from the AWS Artifact console or API, satisfying the auditor's request for evidence without needing to configure any additional resources.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 14

A company uses AWS Organizations. They want to ensure that member accounts cannot turn off CloudTrail or AWS Config in their accounts. What is the most effective way to enforce this?

Accepted Answer

Apply Service Control Policies (SCPs) at the organization level. Service Control Policies (SCPs) are the most effective way to enforce guardrails across all member accounts in AWS Organizations. SCPs can deny the ability to disable CloudTrail or AWS Config at the organization, organizational unit (OU), or account level, and they cannot be overridden by IAM policies in member accounts. This ensures that even account administrators cannot turn off these services, providing a centralized security control.

Answer

Configure IAM policies in each account to deny these actions

Answer

Use AWS Config rules to detect and alert on violations

Answer

Enable MFA delete on all accounts

Question 15

Which AWS service provides a finding-based security recommendations service that uses AI to identify security threats and anomalies, going beyond simple rule-based Config checks?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a security monitoring service that uses machine learning to analyze AWS logs (CloudTrail, VPC Flow Logs, DNS) and identifies threats, anomalies, and suspicious behavior. It provides findings and security recommendations, going beyond simple rule-based checks like AWS Config by using AI to detect patterns indicative of security issues. Amazon DevOps Guru focuses on operational health, not security, so it does not match the 'security recommendations' description.

Answer

AWS Config

Answer

Amazon DevOps Guru

Answer

Amazon Inspector