CLF-C02 Practice Test 40 — 15 Questions

Question 1

A company wants to automate the creation and management of machine learning models without writing code. Which AWS service provides a no-code ML model building interface?

Accepted Answer

Amazon SageMaker Canvas. Amazon SageMaker Canvas is a no-code ML service that provides a visual, drag-and-drop interface for building and managing machine learning models without writing any code. It is designed for business analysts and domain experts who need to generate predictions from their data without programming expertise.

Answer

Amazon SageMaker Studio

Answer

Amazon SageMaker Autopilot

Answer

Amazon Rekognition Custom Labels

Question 2

Which AWS service allows you to create a private network connection between your on-premises data center and AWS without using the public internet?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a dedicated, private network connection from your on-premises data center directly to AWS, bypassing the public internet entirely. This is achieved through a physical cross-connect at an AWS Direct Connect location, using industry-standard 802.1Q VLANs to maintain traffic isolation. Unlike VPN-based solutions, Direct Connect offers consistent network performance, lower latency, and higher bandwidth, making it ideal for hybrid workloads and large-scale data transfers.

Answer

AWS VPN

Answer

Amazon VPC Peering

Answer

AWS Transit Gateway

Question 3

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

Accepted Answer

Apply an SCP that denies all actions unless MFA is authenticated. Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Answer

Enable MFA on the root account only

Answer

Configure IAM password policies to require MFA

Answer

Enable AWS Config rule to check MFA status

Question 4

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

Accepted Answer

Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.. A Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

Answer

Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

Answer

Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

Answer

Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

Question 5

A company's application has components that tightly depend on each other, making it difficult to scale individual components or update one without affecting others. The architects want to refactor to a more resilient architecture. What AWS design principle addresses this?

Accepted Answer

Implement loose coupling through asynchronous messaging between components. Loose coupling through asynchronous messaging (e.g., using Amazon SQS or Amazon SNS) decouples components so that they can scale independently and updates can be made to one component without affecting others. This directly addresses the tight dependency described in the question, where scaling or updating one component impacts the entire application. By introducing message queues or pub/sub patterns, components communicate indirectly, improving resilience and fault isolation.

Answer

Design for failure by adding redundant instances

Answer

Use larger instance types to handle all components on fewer servers

Answer

Enable AWS Auto Scaling to handle traffic variability

Question 6

A company wants to migrate their on-premises VMware virtual machines to Amazon EC2. Which AWS service simplifies this lift-and-shift migration?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service (AWS MGN) is the correct choice because it is specifically designed to simplify and automate the lift-and-shift migration of on-premises VMware virtual machines to Amazon EC2. It continuously replicates source servers (including VMware VMs) to a staging area in AWS, then automatically converts and launches the instances on EC2, minimizing downtime and manual effort.

Answer

AWS Snowball

Answer

AWS Database Migration Service

Answer

Amazon EC2 Import/Export

Question 7

Which AWS service automatically moves S3 objects between storage classes based on access patterns without requiring upfront knowledge of how frequently data will be accessed?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct answer because it is the only AWS service that automatically moves objects between storage classes based on changing access patterns, without requiring any upfront knowledge or lifecycle rules. It monitors access at the object level and moves data between two access tiers (frequent and infrequent) and an optional archive tier, charging a small monitoring fee but no retrieval costs.

Answer

S3 Lifecycle policies

Answer

S3 Standard-IA

Answer

S3 Replication

Question 8

A company is deploying a multi-tier application on AWS. Which AWS service provides layer 4 (TCP/UDP) load balancing with ultra-high performance and static IP addresses?

Accepted Answer

Network Load Balancer (NLB). Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with ultra-low latency. It provides static IP addresses per Availability Zone, which is essential for applications requiring fixed endpoints for whitelisting or DNS stability.

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Answer

Classic Load Balancer

Question 9

A company wants to run containerized applications without managing the underlying EC2 instances or clusters. Which AWS service enables this?

Accepted Answer

AWS Fargate. AWS Fargate is a serverless compute engine for containers that allows you to run containerized applications without managing the underlying EC2 instances or clusters. You define your task definitions and Fargate automatically provisions and scales the compute infrastructure, abstracting away the need to handle instance patching, capacity planning, or cluster management.

Answer

Amazon EC2 with Docker installed

Answer

Amazon ECS on EC2

Answer

AWS Lambda

Question 10

Which AWS service provides a desktop development environment in the cloud with a browser-based code editor and computing resources, requiring no local installation?

Accepted Answer

AWS Cloud9. AWS Cloud9 is a cloud-based integrated development environment (IDE) that provides a browser-based code editor, terminal, and pre-configured computing resources (e.g., EC2 instances or SSH servers). It requires no local installation, making it ideal for developing applications directly from a web browser.

Answer

AWS CloudShell

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Question 11

A developer wants to send real-time notifications to mobile app users when new content is available. Which AWS service enables push notifications to iOS and Android devices?

Accepted Answer

Amazon SNS. Amazon SNS (Simple Notification Service) is the correct choice because it provides a fully managed pub/sub messaging service that supports push notifications to mobile endpoints via platform application endpoints for iOS (APNs) and Android (FCM). It enables real-time delivery of messages directly to mobile apps without requiring polling or additional infrastructure.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

AWS AppSync

Question 12

Which AWS service is used to send emails, SMS messages, and push notifications to subscribers in a publish/subscribe pattern?

Accepted Answer

Amazon SNS. Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers via multiple protocols, including email (JSON/plain text), SMS (text messages), and push notifications to mobile devices. It decouples message producers from consumers by using topics, where each topic can have multiple subscriber endpoints that receive messages asynchronously.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

Amazon SQS

Question 13

What is the principle of least privilege in AWS IAM?

Accepted Answer

Granting users only the minimum permissions required to perform their tasks. The principle of least privilege in AWS IAM dictates that users, roles, and services should be granted only the minimum permissions necessary to perform their intended functions. This is implemented by creating fine-grained IAM policies that specify exactly which actions are allowed on which resources, reducing the attack surface and limiting the blast radius of a potential compromise. Option B correctly captures this core security concept.

Answer

Giving all users administrator access to simplify management

Answer

Allowing users to request additional permissions as needed

Answer

Restricting all access by default and never granting permissions

Question 14

Which AWS service allows you to build, train, and deploy machine learning models at scale?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is the correct answer because it is a fully managed service that provides every component needed for the machine learning lifecycle, including building, training, and deploying models at scale. It offers integrated Jupyter notebooks for development, built-in algorithms, automatic model tuning, and one-click deployment to a production endpoint with auto-scaling. This makes it the single AWS service designed specifically for end-to-end ML workflows, unlike the other options which serve narrower AI/ML functions.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

AWS DeepLens

Question 15

Which AWS service provides a private, dedicated network connection between an organization's on-premises environment and AWS through a colocation facility or telecommunications partner?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a private, dedicated network connection from an on-premises data center to AWS, bypassing the public internet. This connection is established through a colocation facility or a telecommunications partner using industry-standard 802.1Q VLANs, offering consistent latency and higher bandwidth than internet-based VPNs.

Answer

AWS VPN CloudHub

Answer

Amazon CloudFront Private Content

Answer

AWS PrivateLink