CLF-C02 Practice Test 46 — 15 Questions

Question 1

A company manages multiple AWS accounts using AWS Organizations. The company wants employees to sign in using their existing corporate credentials from an on-premises Microsoft Active Directory. The company also needs a single sign-on (SSO) experience so that each employee can access the AWS Management Console for any authorized account without needing separate passwords. Additionally, the company wants to centrally manage permissions across all accounts. Which AWS service should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage single sign-on (SSO) access to multiple AWS accounts and applications. It integrates with an on-premises Microsoft Active Directory via the AWS Directory Service or an external identity provider, allowing employees to use their existing corporate credentials. IAM Identity Center also enables you to centrally define and manage permissions across all accounts in AWS Organizations, meeting all stated requirements.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 2

A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?

Accepted Answer

AWS KMS. AWS KMS is a managed service that allows you to create, rotate, and control encryption keys used to protect data in Amazon S3, Amazon RDS, and Amazon EBS. It integrates with AWS CloudTrail to provide full audit trails of key usage, meeting the security team's requirements for a managed key management solution.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 3

A company has been running multiple workloads on AWS for several months. The finance team notices that monthly costs have increased significantly but cannot identify which services or linked accounts are driving the increase. The team needs a tool that provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies the top cost contributors. They also need to create custom reports that can be emailed on a weekly schedule. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct tool because it provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies top cost contributors. It also supports creating custom reports that can be scheduled and emailed weekly, directly meeting all the stated requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 4

A company manages a web application that consists of Amazon EC2 instances, an Amazon RDS database, and an Amazon S3 bucket. The team deploys the application to separate development, test, and production environments. Currently, the team manually configures each environment, which has led to configuration drift and deployment errors. The company wants to define the entire infrastructure as code, store the definition in a version control system, and deploy it consistently across all environments with a single template. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it enables you to define your entire infrastructure—including EC2 instances, RDS databases, and S3 buckets—as code in a JSON or YAML template. This template can be stored in a version control system and deployed consistently across development, test, and production environments using a single template, eliminating configuration drift and manual errors.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 5

A company has multiple AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost budget of $5,000 for the 'Project Alpha' account. They want to receive an email notification when the actual costs reach 80% of the budget and again when the forecasted costs are expected to exceed the budget. The team also needs to centrally manage these budgets from the management account. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and configure threshold-based alerts via Amazon SNS (email or other notifications). In this scenario, the finance team can create a monthly cost budget of $5,000 for the 'Project Alpha' account, then set an alert at 80% of actual costs and another alert when forecasted costs are expected to exceed the budget. Because the company uses AWS Organizations, budgets can be centrally managed from the management account, enabling the finance team to view and control budgets across member accounts without logging into each one individually.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 6

A company plans to deploy a multi-tier web application on AWS. The architecture includes Amazon EC2 instances for the web and application tiers, an Application Load Balancer for traffic distribution, and an Amazon RDS database for the data tier. The company wants to automate the provisioning and configuration of all these AWS resources in a repeatable and predictable manner. The solution should allow the infrastructure definition to be stored in a version control system and be used to create identical environments for development, testing, and production with minimal manual effort. Which AWS service should the company use to define and manage the infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it enables you to define your entire multi-tier infrastructure—EC2 instances, Application Load Balancer, and RDS database—as a declarative JSON or YAML template. This template can be stored in a version control system and used to provision identical environments across development, testing, and production with a single API call, ensuring repeatability and predictability.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 7

A company based in Germany needs to store and process customer data that, by law, must remain within the European Union (EU). The company plans to use AWS services. Which AWS Global Infrastructure element is the MOST important for the company to evaluate when choosing where to deploy its resources?

Accepted Answer

AWS Regions. AWS Regions are geographically isolated areas that contain multiple Availability Zones. Since the company must ensure customer data remains within the EU by law, choosing the correct AWS Region (e.g., eu-central-1 in Frankfurt) is the primary mechanism to guarantee data residency. Only by deploying resources in an EU-based Region can the company meet legal data sovereignty requirements.

Answer

Availability Zones

Answer

Edge Locations

Answer

Local Zones

Question 8

A company runs a web application on AWS that experiences unpredictable traffic spikes. The company wants to configure its infrastructure to automatically increase compute capacity during peak times and decrease it during low traffic, minimizing costs. Which cloud computing concept does this scenario BEST represent?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically provision and de-provision compute resources in response to real-time demand. In this scenario, AWS Auto Scaling groups can dynamically launch EC2 instances during traffic spikes and terminate them when demand drops, directly matching capacity to load while minimizing cost. This contrasts with static provisioning, which would either over-provision (wasting money) or under-provision (causing outages).

Answer

High availability

Answer

Fault tolerance

Answer

Vertical scaling

Question 9

A healthcare company needs to extract structured medical data from clinical notes and medical documents. Which AWS service provides ML-powered extraction of medical information from unstructured text?

Accepted Answer

Amazon Comprehend Medical. Amazon Comprehend Medical is specifically designed to extract structured medical information such as diagnoses, medications, and test results from unstructured clinical text using natural language processing (NLP) and machine learning. It is the only AWS service purpose-built for healthcare use cases like parsing clinical notes and medical documents.

Answer

Amazon Textract

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 10

A company uses AWS CloudFormation to define and manage its production infrastructure as code. The operations team wants to ensure that any proposed changes to the stack are reviewed and explicitly approved before being applied. Which AWS CloudFormation feature should the company use?

Accepted Answer

AWS CloudFormation Change Sets. AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the operations team to review and explicitly approve changes, ensuring that modifications are not applied automatically without oversight.

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation Stack Policies

Question 11

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. Using a managed rule like 's3-bucket-server-side-encryption-enabled', AWS Config can automatically detect S3 buckets that lack server-side encryption and, through AWS Config rules with auto-remediation (via Systems Manager Automation or Lambda), automatically apply the encryption setting to bring non-compliant buckets into compliance.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 12

A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS environments for suspicious activity, such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior. It integrates natively with AWS Organizations to enable multi-account monitoring and with Amazon CloudWatch Events to trigger automated remediation workflows, directly matching all requirements in the question.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

A company wants its employees to access cloud applications and manage cloud resources from anywhere using a variety of devices, including laptops, smartphones, and tablets. Which essential characteristic of cloud computing does this requirement directly represent?

Accepted Answer

Broad network access. The requirement for employees to access cloud applications and manage resources from anywhere using laptops, smartphones, and tablets directly represents broad network access. This essential characteristic means that cloud services are available over standard network protocols (e.g., HTTP/HTTPS, SSH) and can be accessed by heterogeneous client platforms, including mobile devices, workstations, and tablets, without requiring location-specific infrastructure.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 14

A startup company is developing a new mobile application. The development team needs to quickly provision and tear down test environments to experiment with different backend configurations. They want to try new features, run performance tests for a few hours, and then delete all resources without any upfront commitment. They only pay for the compute and storage resources consumed during each test. Which benefit of cloud computing does this scenario BEST represent?

Accepted Answer

Agility. The scenario describes provisioning test environments on demand, running experiments for a few hours, and then tearing everything down with no upfront commitment. This directly maps to agility—the cloud's ability to rapidly create, modify, and delete resources to adapt to changing business or technical needs. The pay-as-you-go model further reinforces agility by removing the need for long-term contracts or hardware procurement.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 15

A social media company hosts a web application on AWS that serves millions of users worldwide. The application delivers static content such as images, videos, and CSS files. To improve load times for users in different geographic regions, the company wants to cache this content at AWS locations that are as close to end users as possible. Which component of the AWS global infrastructure should the company use?

Accepted Answer

Edge Locations. Edge Locations are part of the AWS CloudFront content delivery network (CDN) and are specifically designed to cache static content (e.g., images, videos, CSS) at geographically dispersed points of presence (PoPs) close to end users. This reduces latency by serving content from the nearest edge location rather than the origin server, directly addressing the requirement to improve load times for a global user base.

Answer

Availability Zones

Answer

Regional Edge Caches

Answer

AWS Direct Connect Locations