CLF-C02 Practice Test 41 — 15 Questions

Question 1

A company wants to run containerized applications without managing the underlying EC2 instances or clusters. Which AWS service enables this?

Accepted Answer

AWS Fargate. AWS Fargate is a serverless compute engine for containers that allows you to run containerized applications without managing the underlying EC2 instances or clusters. You define your task definitions and Fargate automatically provisions and scales the compute infrastructure, abstracting away the need to handle instance patching, capacity planning, or cluster management.

Answer

Amazon EC2 with Docker installed

Answer

Amazon ECS on EC2

Answer

AWS Lambda

Question 2

Which AWS service provides a desktop development environment in the cloud with a browser-based code editor and computing resources, requiring no local installation?

Accepted Answer

AWS Cloud9. AWS Cloud9 is a cloud-based integrated development environment (IDE) that provides a browser-based code editor, terminal, and pre-configured computing resources (e.g., EC2 instances or SSH servers). It requires no local installation, making it ideal for developing applications directly from a web browser.

Answer

AWS CloudShell

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Question 3

A developer wants to send real-time notifications to mobile app users when new content is available. Which AWS service enables push notifications to iOS and Android devices?

Accepted Answer

Amazon SNS. Amazon SNS (Simple Notification Service) is the correct choice because it provides a fully managed pub/sub messaging service that supports push notifications to mobile endpoints via platform application endpoints for iOS (APNs) and Android (FCM). It enables real-time delivery of messages directly to mobile apps without requiring polling or additional infrastructure.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

AWS AppSync

Question 4

Which AWS service is used to send emails, SMS messages, and push notifications to subscribers in a publish/subscribe pattern?

Accepted Answer

Amazon SNS. Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers via multiple protocols, including email (JSON/plain text), SMS (text messages), and push notifications to mobile devices. It decouples message producers from consumers by using topics, where each topic can have multiple subscriber endpoints that receive messages asynchronously.

Answer

Amazon SES

Answer

Amazon Pinpoint

Answer

Amazon SQS

Question 5

What is the principle of least privilege in AWS IAM?

Accepted Answer

Granting users only the minimum permissions required to perform their tasks. The principle of least privilege in AWS IAM dictates that users, roles, and services should be granted only the minimum permissions necessary to perform their intended functions. This is implemented by creating fine-grained IAM policies that specify exactly which actions are allowed on which resources, reducing the attack surface and limiting the blast radius of a potential compromise. Option B correctly captures this core security concept.

Answer

Giving all users administrator access to simplify management

Answer

Allowing users to request additional permissions as needed

Answer

Restricting all access by default and never granting permissions

Question 6

Which AWS service allows you to build, train, and deploy machine learning models at scale?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is the correct answer because it is a fully managed service that provides every component needed for the machine learning lifecycle, including building, training, and deploying models at scale. It offers integrated Jupyter notebooks for development, built-in algorithms, automatic model tuning, and one-click deployment to a production endpoint with auto-scaling. This makes it the single AWS service designed specifically for end-to-end ML workflows, unlike the other options which serve narrower AI/ML functions.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

AWS DeepLens

Question 7

Which AWS service provides a private, dedicated network connection between an organization's on-premises environment and AWS through a colocation facility or telecommunications partner?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a private, dedicated network connection from an on-premises data center to AWS, bypassing the public internet. This connection is established through a colocation facility or a telecommunications partner using industry-standard 802.1Q VLANs, offering consistent latency and higher bandwidth than internet-based VPNs.

Answer

AWS VPN CloudHub

Answer

Amazon CloudFront Private Content

Answer

AWS PrivateLink

Question 8

Which AWS service continuously assesses your AWS resources for security vulnerabilities, unintended network exposure, and deviations from security best practices?

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It uses a combination of network reachability analysis and agent-based or agentless assessments to detect deviations from security best practices, such as missing patches or open ports to the internet.

Answer

AWS Security Hub

Answer

AWS Config

Answer

Amazon Macie

Question 9

Which AWS service provides a fully managed message broker supporting ActiveMQ and RabbitMQ protocols for migrating on-premises messaging systems to the cloud?

Accepted Answer

Amazon MQ. Amazon MQ is a fully managed message broker service that supports industry-standard protocols like AMQP (ActiveMQ) and MQTT/STOMP (RabbitMQ), making it ideal for migrating on-premises messaging systems without rewriting code. Unlike Amazon SQS or SNS, which are proprietary AWS services, Amazon MQ provides compatibility with existing ActiveMQ and RabbitMQ-based applications, enabling a seamless lift-and-shift migration to the cloud.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Question 10

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

Accepted Answer

AWS Organizations with Service Control Policies. AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.

Answer

AWS IAM policies

Answer

AWS Config rules

Answer

Amazon GuardDuty

Question 11

A solutions architect implements IAM least-privilege policies, enables encryption for all data at rest and in transit, configures VPC security groups and NACLs to limit network access, and sets up automated security incident detection. Which Well-Architected Framework pillar covers these activities?

Accepted Answer

Security. The Security pillar of the AWS Well-Architected Framework focuses on protecting data, systems, and assets through identity and access management (IAM least-privilege policies), data protection (encryption at rest and in transit), infrastructure protection (VPC security groups and NACLs), and detective controls (automated security incident detection). These activities directly map to the Security pillar's design principles and best practices.

Answer

Operational Excellence

Answer

Reliability

Answer

Cost Optimisation

Question 12

A retail company wants to provide personalized product recommendations on their homepage using machine learning. Which AWS service delivers this without requiring any ML expertise or model training?

Accepted Answer

Amazon Personalize. Amazon Personalize is a fully managed ML service that enables developers to build applications with real-time personalized recommendations without requiring any ML expertise or model training. It uses the same technology used by Amazon.com for its recommendation engine, and it automatically handles the entire ML pipeline, including data processing, model training, and inference.

Answer

Amazon SageMaker

Answer

Amazon Forecast

Answer

Amazon Comprehend

Question 13

A company has unused Reserved Instances that don't match their current infrastructure. What option allows them to recoup some cost from unused RIs?

Accepted Answer

Sell them on the Reserved Instance Marketplace. The AWS Reserved Instance Marketplace allows customers to sell unused Reserved Instances (RIs) to other AWS users, enabling them to recoup some of the upfront costs. This is the only option that directly addresses the need to recover costs from RIs that no longer match the current infrastructure, as AWS does not offer refunds or free transfers for unused RIs.

Answer

Convert them to Spot Instances

Answer

Request a refund from AWS for unused RI capacity

Answer

Transfer them to another AWS account for free

Question 14

A startup wants to ensure its web application automatically handles traffic spikes during product launches without over-provisioning resources during quiet periods. Which AWS capability best addresses this requirement?

Accepted Answer

Elasticity through AWS Auto Scaling. AWS Auto Scaling enables the startup to automatically adjust the number of Amazon EC2 instances in response to real-time demand, scaling up during traffic spikes and scaling down during quiet periods. This elasticity eliminates the need to over-provision resources, optimizing both cost and performance for variable workloads.

Answer

High availability through multiple AZs

Answer

Durability through S3 data replication

Answer

Agility through rapid resource provisioning

Question 15

The AWS Well-Architected Framework's Reliability pillar recommends automatically recovering from failure. Which AWS feature directly enables automated recovery when an EC2 instance status check fails?

Accepted Answer

Amazon EC2 Auto Recovery. Amazon EC2 Auto Recovery is a feature that automatically recovers an impaired EC2 instance by restarting it on a new healthy host when a system status check fails. This directly aligns with the Reliability pillar's recommendation to automatically recover from failure without manual intervention.

Answer

EC2 Auto Scaling

Answer

Elastic Load Balancing health checks

Answer

AWS Systems Manager Patch Manager