CLF-C02 Practice Test 40 — 15 Questions

Question 1

A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?

Accepted Answer

Immediately deactivate or delete the exposed IAM access keys. The immediate priority when IAM access keys are exposed is to revoke their validity to prevent unauthorized use. Deactivating or deleting the keys ensures that any malicious actor who obtained them from the public repository can no longer authenticate as the IAM user, stopping potential data breaches or resource abuse. This aligns with the AWS security best practice of rotating credentials upon suspected compromise.

Answer

Delete the GitHub repository

Answer

Enable MFA for the IAM user

Answer

Move the credentials to a private repository

Question 2

Which AWS service provides a managed graph database for use cases like social networks, recommendation engines, and fraud detection?

Accepted Answer

Amazon Neptune. Amazon Neptune is a fully managed graph database service optimized for storing and querying highly connected datasets. It supports both property graph (using Apache TinkerPop Gremlin) and RDF (using SPARQL) models, making it ideal for use cases like social networks, recommendation engines, and fraud detection that require traversing complex relationships.

Answer

Amazon DynamoDB

Answer

Amazon RDS

Answer

Amazon Redshift

Question 3

Which AWS pricing model provides the largest discount compared to On-Demand pricing in exchange for a 1 or 3-year commitment with full upfront payment?

Accepted Answer

Reserved Instances (All Upfront, 3-year). Reserved Instances (All Upfront, 3-year) provide the largest discount compared to On-Demand pricing because the customer commits to a 1- or 3-year term and pays the entire amount upfront, which gives AWS predictable capacity planning and reduces billing overhead. This model can offer discounts of up to 72% off On-Demand rates, significantly more than partial upfront or no upfront options, and is the most cost-effective for steady-state workloads.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Compute Savings Plans (1-year, No Upfront)

Question 4

Which AWS service provides a fully managed API for building conversational interfaces (chatbots) using natural language understanding powered by the same technology as Amazon Alexa?

Accepted Answer

Amazon Lex. Amazon Lex is the correct answer because it is a fully managed AWS service that provides APIs for building conversational interfaces (chatbots) using automatic speech recognition (ASR) and natural language understanding (NLU), leveraging the same deep learning technology that powers Amazon Alexa. This enables developers to create applications that can understand and respond to natural language input.

Answer

Amazon Polly

Answer

Amazon Transcribe

Answer

Amazon Comprehend

Question 5

Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 6

A company is deploying an application that processes payment card data. Which AWS compliance program provides assurance that AWS infrastructure meets Payment Card Industry Data Security Standard requirements?

Accepted Answer

PCI DSS Level 1 compliance. PCI DSS Level 1 compliance is the highest level of validation for organizations that process payment card data, and AWS has been validated as a Level 1 service provider. This means AWS infrastructure has undergone the required on-site assessments and annual audits to meet the Payment Card Industry Data Security Standard (PCI DSS) requirements, providing assurance for the company's deployment.

Answer

SOC 2 Type II

Answer

HIPAA compliance

Answer

ISO 27001 certification

Question 7

A company is designing a cloud architecture and wants to follow the Well-Architected Framework principle of 'stop guessing capacity.' Which AWS feature directly supports this principle?

Accepted Answer

Amazon EC2 Auto Scaling based on CloudWatch metrics. Amazon EC2 Auto Scaling directly supports the 'stop guessing capacity' principle by automatically adjusting the number of EC2 instances in response to real-time demand using CloudWatch metrics (e.g., CPU utilization, memory). This eliminates the need to manually provision for peak loads, ensuring you only pay for what you need while maintaining performance.

Answer

AWS CloudFormation for repeatable deployments

Answer

AWS Trusted Advisor cost optimization checks

Answer

AWS Cost Explorer right-sizing recommendations

Question 8

A company wants to automate the creation and management of machine learning models without writing code. Which AWS service provides a no-code ML model building interface?

Accepted Answer

Amazon SageMaker Canvas. Amazon SageMaker Canvas is a no-code ML service that provides a visual, drag-and-drop interface for building and managing machine learning models without writing any code. It is designed for business analysts and domain experts who need to generate predictions from their data without programming expertise.

Answer

Amazon SageMaker Studio

Answer

Amazon SageMaker Autopilot

Answer

Amazon Rekognition Custom Labels

Question 9

Which AWS service allows you to create a private network connection between your on-premises data center and AWS without using the public internet?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a dedicated, private network connection from your on-premises data center directly to AWS, bypassing the public internet entirely. This is achieved through a physical cross-connect at an AWS Direct Connect location, using industry-standard 802.1Q VLANs to maintain traffic isolation. Unlike VPN-based solutions, Direct Connect offers consistent network performance, lower latency, and higher bandwidth, making it ideal for hybrid workloads and large-scale data transfers.

Answer

AWS VPN

Answer

Amazon VPC Peering

Answer

AWS Transit Gateway

Question 10

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

Accepted Answer

Apply an SCP that denies all actions unless MFA is authenticated. Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Answer

Enable MFA on the root account only

Answer

Configure IAM password policies to require MFA

Answer

Enable AWS Config rule to check MFA status

Question 11

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

Accepted Answer

Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.. A Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

Answer

Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

Answer

Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

Answer

Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

Question 12

A company's application has components that tightly depend on each other, making it difficult to scale individual components or update one without affecting others. The architects want to refactor to a more resilient architecture. What AWS design principle addresses this?

Accepted Answer

Implement loose coupling through asynchronous messaging between components. Loose coupling through asynchronous messaging (e.g., using Amazon SQS or Amazon SNS) decouples components so that they can scale independently and updates can be made to one component without affecting others. This directly addresses the tight dependency described in the question, where scaling or updating one component impacts the entire application. By introducing message queues or pub/sub patterns, components communicate indirectly, improving resilience and fault isolation.

Answer

Design for failure by adding redundant instances

Answer

Use larger instance types to handle all components on fewer servers

Answer

Enable AWS Auto Scaling to handle traffic variability

Question 13

A company wants to migrate their on-premises VMware virtual machines to Amazon EC2. Which AWS service simplifies this lift-and-shift migration?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service (AWS MGN) is the correct choice because it is specifically designed to simplify and automate the lift-and-shift migration of on-premises VMware virtual machines to Amazon EC2. It continuously replicates source servers (including VMware VMs) to a staging area in AWS, then automatically converts and launches the instances on EC2, minimizing downtime and manual effort.

Answer

AWS Snowball

Answer

AWS Database Migration Service

Answer

Amazon EC2 Import/Export

Question 14

Which AWS service automatically moves S3 objects between storage classes based on access patterns without requiring upfront knowledge of how frequently data will be accessed?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct answer because it is the only AWS service that automatically moves objects between storage classes based on changing access patterns, without requiring any upfront knowledge or lifecycle rules. It monitors access at the object level and moves data between two access tiers (frequent and infrequent) and an optional archive tier, charging a small monitoring fee but no retrieval costs.

Answer

S3 Lifecycle policies

Answer

S3 Standard-IA

Answer

S3 Replication

Question 15

A company is deploying a multi-tier application on AWS. Which AWS service provides layer 4 (TCP/UDP) load balancing with ultra-high performance and static IP addresses?

Accepted Answer

Network Load Balancer (NLB). Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with ultra-low latency. It provides static IP addresses per Availability Zone, which is essential for applications requiring fixed endpoints for whitelisting or DNS stability.

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Answer

Classic Load Balancer