CLF-C02 Practice Test 46 — 15 Questions

Question 1

A healthcare company needs to extract structured medical data from clinical notes and medical documents. Which AWS service provides ML-powered extraction of medical information from unstructured text?

Accepted Answer

Amazon Comprehend Medical. Amazon Comprehend Medical is specifically designed to extract structured medical information such as diagnoses, medications, and test results from unstructured clinical text using natural language processing (NLP) and machine learning. It is the only AWS service purpose-built for healthcare use cases like parsing clinical notes and medical documents.

Answer

Amazon Textract

Answer

Amazon Comprehend

Answer

Amazon Rekognition

Question 2

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. Using a managed rule like 's3-bucket-server-side-encryption-enabled', AWS Config can automatically detect S3 buckets that lack server-side encryption and, through AWS Config rules with auto-remediation (via Systems Manager Automation or Lambda), automatically apply the encryption setting to bring non-compliant buckets into compliance.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 3

A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS environments for suspicious activity, such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior. It integrates natively with AWS Organizations to enable multi-account monitoring and with Amazon CloudWatch Events to trigger automated remediation workflows, directly matching all requirements in the question.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company wants its employees to access cloud applications and manage cloud resources from anywhere using a variety of devices, including laptops, smartphones, and tablets. Which essential characteristic of cloud computing does this requirement directly represent?

Accepted Answer

Broad network access. The requirement for employees to access cloud applications and manage resources from anywhere using laptops, smartphones, and tablets directly represents broad network access. This essential characteristic means that cloud services are available over standard network protocols (e.g., HTTP/HTTPS, SSH) and can be accessed by heterogeneous client platforms, including mobile devices, workstations, and tablets, without requiring location-specific infrastructure.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 5

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application serves dynamic content that changes frequently, but also serves static assets (CSS, JavaScript, images) that change rarely. The company wants to improve the overall performance and reduce the load on the EC2 instances by caching the static assets at edge locations while still routing dynamic requests to the ALB. Which combination of AWS services should the company use?

Accepted Answer

Use Amazon CloudFront with the ALB as the origin, and configure CloudFront to cache the static assets while forwarding dynamic requests to the ALB.. Amazon CloudFront can be configured with the ALB as the origin, allowing it to cache static assets (CSS, JavaScript, images) at edge locations while forwarding dynamic requests to the ALB. This reduces latency for users by serving cached content from the nearest edge location and offloads the EC2 instances from handling repeated requests for static files. CloudFront supports path-based caching behaviors, so you can define specific URL patterns (e.g., /static/*) to cache and others to forward directly to the ALB.

Answer

Use Amazon Route 53 with latency-based routing to direct users to the closest ALB endpoint.

Answer

Use Amazon S3 to host the entire application, and use the ALB to route traffic to the S3 bucket.

Answer

Use AWS Global Accelerator to distribute traffic across multiple ALBs in different AWS Regions.

Question 6

A startup company is developing a new mobile application. The development team needs to quickly provision and tear down test environments to experiment with different backend configurations. They want to try new features, run performance tests for a few hours, and then delete all resources without any upfront commitment. They only pay for the compute and storage resources consumed during each test. Which benefit of cloud computing does this scenario BEST represent?

Accepted Answer

Agility. The scenario describes provisioning test environments on demand, running experiments for a few hours, and then tearing everything down with no upfront commitment. This directly maps to agility—the cloud's ability to rapidly create, modify, and delete resources to adapt to changing business or technical needs. The pay-as-you-go model further reinforces agility by removing the need for long-term contracts or hardware procurement.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 7

A social media company hosts a web application on AWS that serves millions of users worldwide. The application delivers static content such as images, videos, and CSS files. To improve load times for users in different geographic regions, the company wants to cache this content at AWS locations that are as close to end users as possible. Which component of the AWS global infrastructure should the company use?

Accepted Answer

Edge Locations. Edge Locations are part of the AWS CloudFront content delivery network (CDN) and are specifically designed to cache static content (e.g., images, videos, CSS) at geographically dispersed points of presence (PoPs) close to end users. This reduces latency by serving content from the nearest edge location rather than the origin server, directly addressing the requirement to improve load times for a global user base.

Answer

Availability Zones

Answer

Regional Edge Caches

Answer

AWS Direct Connect Locations

Question 8

A media company streams live video to a global audience. The application runs on Application Load Balancers in two AWS Regions (us-east-1 and eu-west-1). The company's clients require the use of a fixed set of static IP addresses for firewall allowlisting. The company needs to route user traffic to the nearest healthy endpoint to minimize latency. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides two static Anycast IP addresses that serve as fixed entry points for traffic, which are then routed over the AWS global network to the nearest healthy endpoint (e.g., Application Load Balancer in us-east-1 or eu-west-1). This minimizes latency by directing users to the closest Region while preserving the static IPs required for firewall allowlisting. Unlike CloudFront, Global Accelerator does not cache content and is optimized for TCP/UDP traffic, making it ideal for live video streaming where low latency and static IPs are critical.

Answer

Amazon CloudFront

Answer

Network Load Balancer

Answer

Amazon Route 53 latency-based routing

Question 9

A company runs a microservices-based e-commerce application on AWS. During peak hours, the order processing service often gets overwhelmed because the web frontend sends requests directly to it. This causes delays and occasional failures. The architecture team needs to decouple the frontend from the order processing service by introducing a fully managed, highly available, and durable message queue. The queue must automatically replicate messages across multiple Availability Zones and allow the order processing service to pull messages at its own pace. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it is a fully managed, highly available, and durable message queue service that automatically replicates messages across multiple Availability Zones (AZs) to ensure fault tolerance. It decouples the web frontend from the order processing service, allowing the latter to poll and process messages at its own pace, which prevents overload during peak hours. SQS provides at-least-once delivery and supports standard queues with high throughput, making it ideal for this use case.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 10

A development team needs to deploy a web application on AWS quickly. The team wants a fully managed service that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring. The team does not want to manage the underlying Amazon EC2 instances or the application stack manually. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a fully managed Platform as a Service (PaaS) that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring without requiring the team to manage the underlying EC2 instances or application stack. It abstracts away infrastructure management, allowing developers to simply upload their code and have the service handle deployment, scaling, and monitoring out of the box.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

Amazon EC2 Auto Scaling

Question 11

A company runs a microservices application on AWS. It needs to send real-time alerts to mobile devices via push notifications and to administrators via email whenever a critical event occurs. The solution must be a fully managed service that supports both delivery channels without requiring separate infrastructure for each. Which AWS service should the company use?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS is a fully managed pub/sub messaging service that supports multiple delivery protocols, including push notifications to mobile devices (via Apple Push Notification Service, Firebase Cloud Messaging, etc.) and email (via SMTP or HTTP endpoints). This allows the company to send real-time alerts through both channels from a single service without provisioning separate infrastructure for each.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Simple Email Service (SES)

Answer

Amazon Pinpoint

Question 12

A company has been using Amazon EC2 instances for a production application for the past 12 months. The finance team wants to understand historical spending patterns and identify opportunities to reduce costs. Specifically, they need to see which EC2 instance families and sizes are being underutilized and get recommendations for purchasing Reserved Instances to save money compared to current On-Demand pricing. The team wants to use a native AWS tool that provides a visual dashboard of costs, usage trends, and actionable recommendations. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a visual dashboard of historical cost and usage data, including the ability to filter by EC2 instance families and sizes to identify underutilized resources. It also offers Reserved Instance (RI) purchase recommendations based on historical On-Demand usage, enabling the finance team to compare costs and identify savings opportunities directly within the native AWS console.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Compute Optimizer

Question 13

A company has a development environment running on Amazon EC2 instances. To control costs, the team wants to set a monthly budget of $5,000 for this environment. If the forecasted cost for the month exceeds $6,000 (20% over budget), they want AWS to automatically stop all non-critical EC2 instances to prevent further spending. Which AWS feature should the team use to implement this automated cost control?

Accepted Answer

AWS Budgets with budget actions. AWS Budgets with budget actions allows you to set a monthly budget of $5,000 and define an action that triggers when the forecasted cost exceeds a specified threshold (e.g., 20% over budget, or $6,000). The action can automatically stop non-critical EC2 instances using an IAM role and a predefined runbook, directly enforcing cost control without manual intervention. This is the only AWS feature that combines budget monitoring with automated remediation actions.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Cost Anomaly Detection

Question 14

A company wants all IAM users to verify their identity with both a password and a one-time code from an authenticator app before accessing the AWS Management Console. Which security control should the company enable?

Accepted Answer

Multi-Factor Authentication (MFA). Multi-Factor Authentication (MFA) is the correct security control because it requires users to present two independent factors: something they know (password) and something they have (a one-time code from an authenticator app). This satisfies the company's requirement for both a password and a one-time code before accessing the AWS Management Console, significantly reducing the risk of unauthorized access even if a password is compromised.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Cognito

Question 15

A company is developing a microservices application using Docker containers. The development team wants to deploy and run these containers on AWS without having to provision or manage any underlying EC2 instances. Additionally, the team does not want to manage the container orchestration control plane. They need a fully serverless compute engine for containers that automatically scales based on demand. Which AWS compute option should the team use?

Accepted Answer

Amazon ECS with the AWS Fargate launch type. Amazon ECS with the AWS Fargate launch type is the correct choice because it provides a fully serverless compute engine for containers. Fargate eliminates the need to provision or manage EC2 instances and removes the burden of managing the container orchestration control plane, as AWS handles both the underlying infrastructure and the orchestration layer. It automatically scales container instances based on demand, meeting the team's requirement for a serverless, auto-scaling container solution.

Answer

Amazon EC2 instances with Docker installed

Answer

AWS Lambda

Answer

Amazon EKS with managed node groups