CLF-C02 Practice Test 4 — 10 Questions

Question 1

A developer needs to launch a test server for a new application prototype. The developer logs into the AWS Management Console, selects an Amazon EC2 instance type, configures the security group, and starts the instance. The instance is running within two minutes, and the developer did not need to submit a formal request to the company's IT procurement team or wait for approval from a cloud administrator. Which essential characteristic of cloud computing does this scenario best demonstrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On-demand self-service. The scenario demonstrates on-demand self-service because the developer was able to provision and launch an EC2 instance directly through the AWS Management Console without any human interaction with IT procurement or a cloud administrator. This characteristic, defined by NIST as a core pillar of cloud computing, allows users to unilaterally provision computing capabilities as needed automatically, which is exactly what happened when the instance was running within two minutes of the console action.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 2

A company uses a variety of AWS services and wants to automatically detect unexpected cost spikes that might indicate resource misuse, billing errors, or unauthorized activity. The company needs a managed service that uses machine learning to analyze spending patterns and provide alerts when costs deviate from expected trends. The finance team does not want to manually define thresholds for every service. Which AWS service should the finance team use?

Accepted Answer

AWS Cost Anomaly Detection. AWS Cost Anomaly Detection is a managed service that uses machine learning to continuously monitor your cost and usage patterns, automatically detecting anomalous spending without requiring manual threshold definitions. It analyzes historical data to establish a baseline and alerts you when costs deviate from expected trends, making it ideal for identifying unexpected spikes from resource misuse, billing errors, or unauthorized activity.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 3

A company runs a batch processing workload on an on-premises data center. The servers are powerful machines that are used at maximum capacity only for a few days each month during financial reporting periods. For the rest of the month, the servers run at very low utilization. The CFO wants to migrate this workload to AWS to reduce costs. Which characteristic of AWS cloud computing is most directly aligned with the CFO's goal of paying only for the compute capacity actually used?

Accepted Answer

Pay-as-you-go pricing model. The pay-as-you-go pricing model (Option C) directly aligns with the CFO's goal because it allows the company to pay only for the compute capacity they actually consume, with no upfront costs or long-term commitments. In this scenario, the batch processing workload runs at maximum capacity only a few days per month, so the company can provision resources during those peaks and stop them during low-utilization periods, avoiding the cost of idle on-premises servers. This model eliminates the need to pay for unused capacity, directly reducing costs as the CFO desires.

Answer

High availability across multiple Availability Zones

Answer

Elasticity to automatically scale resources up and down

Answer

The ability to choose from a wide variety of instance types

Question 4

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.

Answer

IAM policies with a Deny effect for CloudTrail actions

Answer

AWS Config rules with an auto-remediation action

Answer

AWS CloudTrail trails with multi-region and organization trail enabled

Question 5

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that allows you to create rules to inspect HTTP/HTTPS requests and block common attack patterns, such as SQL injection and cross-site scripting. By associating a WAF web ACL with the Application Load Balancer, the company can filter incoming traffic and block malicious payloads before they reach the EC2 instances.

Answer

AWS Shield Standard

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 6

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-kms-encryption-specific-key) that can evaluate whether S3 buckets are encrypted with the required KMS customer-managed key. When a noncompliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule to automatically apply the correct encryption configuration, enabling automated remediation without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 7

A company runs a web application across multiple Amazon EC2 instances that are distributed across several Availability Zones. The application needs to share a common set of configuration files and static assets that must be accessible concurrently and consistently from all instances. The company wants a fully managed, scalable file storage solution that does not require provisioning or managing underlying storage hardware. Which AWS service should the company use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It uses the NFSv4.1 protocol, ensuring consistent access to configuration files and static assets without any provisioning or management of underlying storage hardware.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon Relational Database Service (RDS)

Question 8

A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

Accepted Answer

Configure the S3 bucket to use SSE-KMS encryption with the customer-managed key, and modify the KMS key policy to grant the kms:Decrypt permission only to the 'Auditors' role.. SSE-KMS with a customer-managed key separates encryption key management from S3 bucket policies. The KMS key policy is the authoritative access control for decryption operations. By granting kms:Decrypt only to the 'Auditors' role, even if the S3 bucket policy allows s3:GetObject to other users, they cannot decrypt the objects without the key permission. This enforces the security requirement that only the Auditors role can decrypt the sensitive financial reports.

Answer

Configure an S3 bucket policy that denies s3:GetObject requests unless the request is encrypted in transit using HTTPS.

Answer

Enable S3 Block Public Access on the bucket and attach an IAM policy to the 'Auditors' role that allows s3:GetObject.

Answer

Use S3 object-level logging to monitor access and revoke permissions for any role that attempts to decrypt objects without authorization.

Question 9

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Amazon CloudFront and Application Load Balancers (ALB) to inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. This makes it the correct choice for the security team's requirement to filter and block specific attack patterns at the application layer.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

Amazon Inspector

Question 10

A company runs a diverse workload on AWS that includes Amazon EC2 instances of various families and sizes across multiple regions, Amazon RDS databases, and a serverless application using AWS Lambda and AWS Fargate. The finance team wants to reduce compute costs by making a 1-year hourly spend commitment, but they need the flexibility to change instance families, sizes, regions, or switch between EC2, Fargate, and Lambda without losing the discount. Which AWS pricing model should the finance team choose to meet these requirements?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan is the correct choice because it offers a 1-year hourly spend commitment with the flexibility to change instance families, sizes, regions, and even switch between EC2, Fargate, and Lambda while still receiving the discount. This plan applies to any compute usage across these services, automatically adjusting the discount to the most cost-effective instance type or compute option, meeting the finance team's need for both cost reduction and operational flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

On-Demand