CLF-C02 Practice Test 45 — 15 Questions

Question 1

A company runs several Amazon EC2 instances for development and testing purposes. The finance team wants to identify any instances that have been running with very low CPU utilization (less than 10%) over the past two weeks so they can stop or resize them to reduce costs. Which AWS tool provides this specific recommendation as part of its cost optimization checks?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor provides cost optimization checks that include identifying Amazon EC2 instances with low utilization. Specifically, the 'Low Utilization Amazon EC2 Instances' check flags instances that have had a CPU utilization of 10% or less for the past 14 days, enabling the finance team to stop or resize them to reduce costs.

Answer

AWS Compute Optimizer

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 2

A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS security and compliance reports, including SOC 2 and ISO 27001 certifications. The company can download the latest versions directly from the AWS Artifact console or API, satisfying the auditor's request for evidence without needing to configure any additional resources.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

A company's compliance team needs to enforce a policy that all Amazon S3 buckets must have 'Block all public access' enabled. If a bucket is created without this setting, the company wants the policy to be automatically remediated within minutes without manual intervention. The solution must check for compliance continuously and apply the fix automatically. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with an AWS Config rule and an automatic remediation action. AWS Config can continuously evaluate the configuration of S3 buckets against a managed rule like 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited'. When a noncompliant bucket is detected, AWS Config can automatically trigger a remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-DisableS3BucketPublicReadWrite') to enable 'Block all public access' within minutes, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)

Question 4

A company's internal audit team needs to download the latest AWS SOC 2 Type II report and ISO 27001 certificate to include in their compliance documentation for an upcoming external audit. The team requires a centralized, self-service portal where they can access these reports and any other relevant AWS compliance artifacts. They do not want to contact AWS Support or manage any infrastructure to obtain these documents. Which AWS service should the audit team use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, such as SOC 2 Type II and ISO 27001 certificates, without requiring any infrastructure management or contacting AWS Support. The audit team can simply log in, browse the available artifacts, and download the latest versions directly, meeting their requirement for a no-touch, self-service solution.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor

Question 5

What does the AWS Free Tier offer to new AWS customers?

Accepted Answer

Free usage of certain services up to specified limits for 12 months. The AWS Free Tier is designed to allow new customers to explore and experiment with AWS services at no cost for the first 12 months after sign-up. It includes specific usage limits per service (e.g., 750 hours of Amazon EC2 t2.micro instances per month, 5 GB of Amazon S3 standard storage, etc.), after which standard pay-as-you-go rates apply. This helps customers gain hands-on experience without upfront financial commitment.

Answer

Unlimited free usage of all AWS services forever

Answer

Free usage only for the first month after signup

Answer

Free usage for all services with a credit card on file

Question 6

A company's security policy requires that all IAM user access keys be rotated every 90 days. The security team wants to automatically identify any IAM user in the company's AWS account whose access keys are older than 90 days and trigger a notification to the security team. They need a managed AWS service that continuously evaluates the access key age against this requirement and generates findings. Which AWS service should the security team use?

Accepted Answer

AWS Config. AWS Config is a managed service that continuously evaluates your AWS resource configurations against desired policies (e.g., access keys older than 90 days) using managed rules like 'iam-user-unused-keys-check'. It generates compliance findings and can trigger notifications via Amazon EventBridge or SNS, meeting the requirement for continuous evaluation and alerting.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS IAM Access Analyzer

Question 7

A company's security team needs to investigate a potential security incident. They want to determine which IAM user launched a new, unauthorized Amazon EC2 instance two days ago. The team needs to see the exact timestamp, the source IP address, and the instance type that was launched. Which AWS service should the security team use to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including the exact timestamp, source IP address, and details (such as instance type) for every RunInstances API call. This allows the security team to trace the unauthorized EC2 launch back to the specific IAM user who made the request, as CloudTrail logs include the user identity, request parameters, and response elements.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 8

A company's security team manages AWS accounts for multiple business units using AWS Organizations. The security team needs a single place to view and prioritize all security alerts, including findings from Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. The team also wants to automatically run continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark. The solution must provide a consolidated dashboard with automated findings aggregation and compliance score tracking. Which AWS service should the security team choose?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct choice because it provides a single, consolidated dashboard that aggregates security findings from multiple AWS services, including Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. It also performs automated continuous compliance checks against industry standards like the CIS AWS Foundations Benchmark and tracks compliance scores over time, meeting all the stated requirements.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 9

A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3. It can identify PII such as names, addresses, and credit card numbers, and it provides continuous monitoring with alerts when new sensitive data is uploaded, meeting both the discovery and ongoing monitoring requirements.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 10

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 11

Which AWS service provides a fully managed NoSQL database with single-digit millisecond latency at any scale?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers consistent single-digit millisecond latency at any scale. It achieves this through its distributed architecture, automatic partitioning, and SSD-backed storage, making it ideal for high-traffic applications like gaming, ad tech, and IoT.

Answer

Amazon RDS

Answer

Amazon ElastiCache

Answer

Amazon Redshift

Question 12

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 13

A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

Accepted Answer

Configure the S3 bucket to use SSE-KMS encryption with the customer-managed key, and modify the KMS key policy to grant the kms:Decrypt permission only to the 'Auditors' role.. Option A is correct because SSE-KMS with a customer-managed key separates encryption key management from S3 bucket policies. The KMS key policy is the authoritative access control for decryption operations. By granting kms:Decrypt only to the 'Auditors' role, even if the S3 bucket policy allows s3:GetObject to other users, they cannot decrypt the objects without the key permission. This enforces the security requirement that only the Auditors role can decrypt the sensitive financial reports.

Answer

Configure an S3 bucket policy that denies s3:GetObject requests unless the request is encrypted in transit using HTTPS.

Answer

Enable S3 Block Public Access on the bucket and attach an IAM policy to the 'Auditors' role that allows s3:GetObject.

Answer

Use S3 object-level logging to monitor access and revoke permissions for any role that attempts to decrypt objects without authorization.

Question 14

A development team is building a web application and wants to minimize operational overhead. The team wants to focus solely on writing and deploying code without managing the underlying operating system, runtime, or middleware. The team needs the ability to simply upload their application code and have it run, with the cloud provider automatically handling capacity provisioning, load balancing, and patching of the platform. Which cloud computing service model best describes this approach?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it abstracts the underlying infrastructure, runtime, and middleware, allowing the team to simply upload code and have it executed. The cloud provider automatically handles capacity provisioning, load balancing, and patching, which directly matches the requirement to minimize operational overhead by focusing solely on code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 15

Which of the following best describes an AWS Region?

Accepted Answer

A geographic area containing multiple Availability Zones. An AWS Region is a distinct geographic area that consists of multiple, isolated, and physically separate Availability Zones (AZs). Each AZ contains one or more data centers with redundant power, networking, and connectivity. This design ensures high availability and fault tolerance, as resources can be distributed across AZs within a Region to withstand failures in a single data center.

Answer

A single data center used by AWS

Answer

A group of edge locations used for content delivery

Answer

A virtual private network segment within AWS