CLF-C02 Practice Test 41 — 15 Questions

Question 1

Which AWS service continuously assesses your AWS resources for security vulnerabilities, unintended network exposure, and deviations from security best practices?

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It uses a combination of network reachability analysis and agent-based or agentless assessments to detect deviations from security best practices, such as missing patches or open ports to the internet.

Answer

AWS Security Hub

Answer

AWS Config

Answer

Amazon Macie

Question 2

Which AWS service provides a fully managed message broker supporting ActiveMQ and RabbitMQ protocols for migrating on-premises messaging systems to the cloud?

Accepted Answer

Amazon MQ. Amazon MQ is a fully managed message broker service that supports industry-standard protocols like AMQP (ActiveMQ) and MQTT/STOMP (RabbitMQ), making it ideal for migrating on-premises messaging systems without rewriting code. Unlike Amazon SQS or SNS, which are proprietary AWS services, Amazon MQ provides compatibility with existing ActiveMQ and RabbitMQ-based applications, enabling a seamless lift-and-shift migration to the cloud.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Question 3

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

Accepted Answer

AWS Organizations with Service Control Policies. AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.

Answer

AWS IAM policies

Answer

AWS Config rules

Answer

Amazon GuardDuty

Question 4

A solutions architect implements IAM least-privilege policies, enables encryption for all data at rest and in transit, configures VPC security groups and NACLs to limit network access, and sets up automated security incident detection. Which Well-Architected Framework pillar covers these activities?

Accepted Answer

Security. The Security pillar of the AWS Well-Architected Framework focuses on protecting data, systems, and assets through identity and access management (IAM least-privilege policies), data protection (encryption at rest and in transit), infrastructure protection (VPC security groups and NACLs), and detective controls (automated security incident detection). These activities directly map to the Security pillar's design principles and best practices.

Answer

Operational Excellence

Answer

Reliability

Answer

Cost Optimisation

Question 5

A retail company wants to provide personalized product recommendations on their homepage using machine learning. Which AWS service delivers this without requiring any ML expertise or model training?

Accepted Answer

Amazon Personalize. Amazon Personalize is a fully managed ML service that enables developers to build applications with real-time personalized recommendations without requiring any ML expertise or model training. It uses the same technology used by Amazon.com for its recommendation engine, and it automatically handles the entire ML pipeline, including data processing, model training, and inference.

Answer

Amazon SageMaker

Answer

Amazon Forecast

Answer

Amazon Comprehend

Question 6

A company has unused Reserved Instances that don't match their current infrastructure. What option allows them to recoup some cost from unused RIs?

Accepted Answer

Sell them on the Reserved Instance Marketplace. The AWS Reserved Instance Marketplace allows customers to sell unused Reserved Instances (RIs) to other AWS users, enabling them to recoup some of the upfront costs. This is the only option that directly addresses the need to recover costs from RIs that no longer match the current infrastructure, as AWS does not offer refunds or free transfers for unused RIs.

Answer

Convert them to Spot Instances

Answer

Request a refund from AWS for unused RI capacity

Answer

Transfer them to another AWS account for free

Question 7

A startup wants to ensure its web application automatically handles traffic spikes during product launches without over-provisioning resources during quiet periods. Which AWS capability best addresses this requirement?

Accepted Answer

Elasticity through AWS Auto Scaling. AWS Auto Scaling enables the startup to automatically adjust the number of Amazon EC2 instances in response to real-time demand, scaling up during traffic spikes and scaling down during quiet periods. This elasticity eliminates the need to over-provision resources, optimizing both cost and performance for variable workloads.

Answer

High availability through multiple AZs

Answer

Durability through S3 data replication

Answer

Agility through rapid resource provisioning

Question 8

The AWS Well-Architected Framework's Reliability pillar recommends automatically recovering from failure. Which AWS feature directly enables automated recovery when an EC2 instance status check fails?

Accepted Answer

Amazon EC2 Auto Recovery. Amazon EC2 Auto Recovery is a feature that automatically recovers an impaired EC2 instance by restarting it on a new healthy host when a system status check fails. This directly aligns with the Reliability pillar's recommendation to automatically recover from failure without manual intervention.

Answer

EC2 Auto Scaling

Answer

Elastic Load Balancing health checks

Answer

AWS Systems Manager Patch Manager

Question 9

A company needs to verify the identity of users who call into their contact center by comparing their voice against a stored voiceprint. Which AWS service provides speaker identification from voice data?

Accepted Answer

Amazon Connect Voice ID. Amazon Connect Voice ID is the correct AWS service for real-time speaker identification and verification using voice biometrics. It compares a caller's live voice against a stored voiceprint to authenticate their identity, specifically designed for contact center use cases within Amazon Connect.

Answer

Amazon Transcribe

Answer

Amazon Rekognition

Answer

Amazon Lex

Question 10

Which AWS service provides a serverless, fully managed Apache Kafka-compatible data streaming service?

Accepted Answer

Amazon MSK (Managed Streaming for Apache Kafka). Amazon MSK (Managed Streaming for Apache Kafka) is the correct answer because it is a fully managed, serverless service that provides Apache Kafka-compatible data streaming. It handles cluster provisioning, scaling, and maintenance, allowing you to run Kafka workloads without managing infrastructure. This directly matches the question's requirement for a serverless, fully managed Apache Kafka-compatible service.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 11

What is the purpose of AWS Shield Standard?

Accepted Answer

To protect AWS resources against common DDoS attacks. AWS Shield Standard is a free, always-on service that protects all AWS customers from common, infrastructure-layer Distributed Denial of Service (DDoS) attacks, such as SYN floods, UDP floods, and reflection attacks. It uses network flow monitoring and inline mitigation techniques at the AWS edge to automatically detect and block malicious traffic targeting AWS resources like EC2, ELB, CloudFront, and Route 53. This makes option B correct because its sole purpose is to provide baseline DDoS protection without any additional configuration or cost.

Answer

To encrypt data at rest in S3 buckets

Answer

To monitor API calls made to AWS services

Answer

To filter malicious web traffic using rules

Question 12

A media company stores video files in Amazon S3 and needs to transcode them into multiple formats for different devices. Which AWS service is purpose-built for this workflow?

Accepted Answer

Amazon Elastic Transcoder. Amazon Elastic Transcoder is a purpose-built media transcoding service that converts video files stored in Amazon S3 into the formats required by various devices. It handles the complexities of transcoding, including format conversion, resolution scaling, and bitrate adjustment, without requiring you to manage underlying infrastructure.

Answer

Amazon Kinesis Video Streams

Answer

AWS Lambda

Answer

Amazon Rekognition

Question 13

Which AWS tool provides recommendations to help reduce costs, improve performance, enhance security, and increase fault tolerance?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct answer because it provides real-time guidance and recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits. It evaluates your AWS environment against AWS best practices and generates actionable recommendations to reduce costs, improve performance, enhance security, and increase fault tolerance. This makes it the only tool among the options that covers all four areas mentioned in the question.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Compute Optimizer

Question 14

A developer wants to run code in response to an S3 object upload without managing any servers. The code runs for less than 5 minutes. Which AWS service is most appropriate?

Accepted Answer

AWS Lambda. AWS Lambda is the most appropriate service because it is a serverless compute service that automatically runs code in response to events, such as an S3 object upload, without requiring any server management. Lambda supports code execution up to 15 minutes per invocation, which easily accommodates the less-than-5-minute requirement, and it integrates natively with S3 event notifications via the S3 bucket notification configuration.

Answer

Amazon EC2

Answer

AWS Fargate

Answer

Amazon ECS

Question 15

A company needs to convert text documents into natural-sounding speech in multiple languages for an audiobook application. Which AWS service provides this capability?

Accepted Answer

Amazon Polly. Amazon Polly is a managed service that turns text into lifelike speech using deep learning technologies, supporting multiple languages and voices. It is specifically designed for text-to-speech (TTS) conversion, making it the correct choice for generating natural-sounding audio for an audiobook application.

Answer

Amazon Transcribe

Answer

Amazon Translate

Answer

Amazon Lex