CLF-C02 Practice Test 47 — 15 Questions

Question 1

A company requires all IAM users to have multi-factor authentication (MFA) enabled for AWS Management Console access. The security team needs an automated way to continuously detect any IAM user without an MFA device and generate a compliance report. The solution must not require custom code. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed, rules-based evaluation of AWS resource configurations. By enabling the 'iam-user-mfa-enabled' managed rule, AWS Config continuously checks all IAM users for the presence of an MFA device and can automatically trigger remediation actions or generate compliance reports via AWS Config aggregators, all without any custom code.

Answer

IAM Access Analyzer

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 2

A company runs a critical web application on AWS behind an Application Load Balancer. The security team is concerned about the risk of Distributed Denial of Service (DDoS) attacks that could deplete application resources and incur high costs due to auto scaling. The company wants a managed service that provides enhanced DDoS detection, access to the AWS DDoS Response Team (DRT), and financial protection against scaling costs associated with DDoS attacks. Which AWS service should the company use?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS detection and mitigation beyond what Shield Standard offers, includes 24/7 access to the AWS DDoS Response Team (DRT) for custom mitigations, and offers financial protection (cost protection) against scaling costs incurred due to DDoS attacks on resources like Application Load Balancers. This directly addresses the company's need for a managed service that covers detection, expert support, and cost coverage.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Firewall Manager

Question 3

A company runs a customer-facing web application with an Amazon RDS database. Initially, the database is deployed as a single instance in one Availability Zone (AZ). A power outage occurs in that AZ, causing the database to become unavailable for several hours. After the incident, the company modifies the database to use a Multi-AZ configuration. Shortly after the change, another power outage affects the same primary AZ. This time, the database automatically fails over to the standby instance in the other AZ without any manual intervention, and the application remains available. Which cloud computing concept does this scenario best demonstrate?

Accepted Answer

Fault tolerance. Fault tolerance is the ability of a system to continue operating without interruption when one or more of its components fail. In this scenario, the Multi-AZ RDS deployment automatically failed over to a standby instance in a different Availability Zone when the primary AZ experienced a power outage, ensuring the application remained available without manual intervention. This demonstrates fault tolerance because the system was designed to withstand the failure of an entire AZ and continue functioning.

Answer

Elasticity

Answer

Scalability

Answer

Resource pooling

Question 4

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 5

A company runs a diverse workload on AWS that includes Amazon EC2 instances of various families and sizes across multiple regions, Amazon RDS databases, and a serverless application using AWS Lambda and AWS Fargate. The finance team wants to reduce compute costs by making a 1-year hourly spend commitment, but they need the flexibility to change instance families, sizes, regions, or switch between EC2, Fargate, and Lambda without losing the discount. Which AWS pricing model should the finance team choose to meet these requirements?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan is the correct choice because it offers a 1-year hourly spend commitment with the flexibility to change instance families, sizes, regions, and even switch between EC2, Fargate, and Lambda while still receiving the discount. This plan applies to any compute usage across these services, automatically adjusting the discount to the most cost-effective instance type or compute option, meeting the finance team's need for both cost reduction and operational flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

On-Demand

Question 6

A company runs a globally distributed multiplayer game on AWS. The game uses UDP for real-time communication and requires static IP addresses that do not change for whitelisting by internet service providers. The company needs to route traffic to the nearest healthy application endpoint to minimize latency and improve performance. The solution must work with both TCP and UDP traffic and provide static IP addresses. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides static IP addresses that serve as fixed entry points to your application, and it uses the AWS global network to route traffic to the nearest healthy endpoint via Anycast. It supports both TCP and UDP traffic, making it ideal for real-time UDP-based gaming workloads that require low latency and static IPs for ISP whitelisting.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 7

A company runs a data-intensive workload in a colocation facility and wants to establish a dedicated, private network connection to its Amazon VPC. The connection must bypass the public internet to provide consistent high throughput and low latency. The company also wants to avoid data transfer costs associated with internet-based connections. Which AWS service should the company use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private network connection from an on-premises or colocation facility directly to an Amazon VPC, bypassing the public internet entirely. This ensures consistent high throughput, low latency, and eliminates data transfer costs associated with internet-based connections, as traffic flows over a private physical link.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

AWS Transit Gateway

Question 8

A company runs a globally distributed web application on Amazon EC2 instances behind Network Load Balancers in two AWS Regions: us-east-1 and eu-west-1. Users around the world access the application over the internet. The company wants to improve latency for all users by directing each user to the nearest healthy application endpoint. Additionally, the company requires two static IP addresses that clients can use for firewall whitelisting and that do not change even if the underlying infrastructure changes. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it provides two static anycast IP addresses that serve as fixed entry points, and it directs user traffic to the nearest healthy application endpoint via the AWS global network, reducing latency. Unlike CloudFront, it does not cache content but optimizes TCP/UDP traffic, making it ideal for non-HTTP or dynamic applications behind Network Load Balancers.

Answer

Amazon CloudFront

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 9

A company runs a microservices application on AWS. It needs to send real-time alerts to mobile devices via push notifications and to administrators via email whenever a critical event occurs. The solution must be a fully managed service that supports both delivery channels without requiring separate infrastructure for each. Which AWS service should the company use?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS is a fully managed pub/sub messaging service that supports multiple delivery protocols, including push notifications to mobile devices (via Apple Push Notification Service, Firebase Cloud Messaging, etc.) and email (via SMTP or HTTP endpoints). This allows the company to send real-time alerts through both channels from a single service without provisioning separate infrastructure for each.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Simple Email Service (SES)

Answer

Amazon Pinpoint

Question 10

A company runs a latency-sensitive application on AWS that must communicate with an on-premises data center. The company requires a dedicated, private network connection that provides consistent, low-latency performance and bypasses the public internet. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent, low-latency performance for latency-sensitive applications by using a physical cross-connect or hosted virtual interface, which avoids the variability and potential congestion of internet-based connections.

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Question 11

A company runs a mix of Amazon EC2 instances and AWS Fargate containers. The CFO wants to reduce costs by committing to a consistent amount of compute usage (measured in $ per hour) for a 1-year term. The company expects to change instance families and regions occasionally and needs the flexibility to apply the savings to both EC2 and ECS Fargate usage. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the flexibility to cover EC2 instance and Fargate usage across any region, instance family, or compute type, while providing a discounted hourly rate in exchange for a 1-year commitment. This matches the CFO's requirement to reduce costs with a consistent $/hour commitment and the need to change instance families and regions occasionally, as Compute Savings Plans automatically apply to any eligible compute usage without requiring specific reservations.

Answer

EC2 Instance Savings Plans

Answer

Reserved Instances (Convertible)

Answer

On-Demand Instances

Question 12

A company runs a mix of production and non-production Amazon EC2 instances. The finance team uses AWS Budgets to monitor monthly spending. For the development accounts, the team wants to automatically stop all running EC2 instances when the account's monthly spending reaches 90% of the budgeted amount. The team wants a solution that does not require custom scripting or additional infrastructure. Which AWS Budgets feature should the team configure to meet this requirement?

Accepted Answer

Configure a budget action that runs an AWS Systems Manager automation document to stop the EC2 instances.. AWS Budgets supports budget actions that can automatically trigger AWS Systems Manager automation documents to stop EC2 instances when a budget threshold is exceeded. This meets the requirement of no custom scripting or additional infrastructure, as the automation document is a built-in capability of Systems Manager.

Answer

Create a budget alert that sends an email notification to the operations team when spending reaches 90% of the budget.

Answer

Configure a budget action that applies an IAM policy to deny the ec2:StopInstances permission for all users.

Answer

Create a budget alert that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic, and subscribe an AWS Lambda function to stop the instances.

Question 13

A company runs a payment processing application on AWS that must comply with the Payment Card Industry Data Security Standard (PCI DSS). An external auditor requests a copy of the AWS SOC 2 report and the PCI DSS Attestation of Compliance (AOC) to verify the security controls of the underlying AWS infrastructure. The company needs to obtain these documents directly from AWS. Which AWS service should the company use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS Attestations of Compliance (AOC). These documents are published directly by AWS and can be downloaded from the AWS Artifact console without needing to contact AWS support, meeting the auditor's requirement for direct retrieval.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor

Question 14

A company runs a read-heavy web application that retrieves the same product catalog data from an Amazon RDS database hundreds of times per second. The database is experiencing high CPU utilization due to repeated reads of the same information. The company wants to reduce the load on the database and improve application response time without modifying the application code or adding more database capacity. The solution must be fully managed and provide a low-latency, in-memory cache for frequently accessed data. Which AWS service should the company use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a fully managed, in-memory caching service (Memcached or Redis) that can store frequently accessed product catalog data. By caching the results of repeated read queries, ElastiCache offloads the RDS database, reducing CPU utilization and improving response times without requiring application code changes or additional database capacity.

Answer

Amazon CloudFront

Answer

Amazon DynamoDB Accelerator (DAX)

Answer

Amazon Simple Queue Service (SQS)

Question 15

A company runs a monolithic web application on Amazon EC2 that processes user-uploaded files synchronously. During peak hours, the application experiences slow response times because the file processing blocks the web server. The company wants to decouple the upload process from the file processing to improve responsiveness and allow each component to scale independently. The file processing backend must poll for new work and handle failures gracefully by retrying failed messages. Which AWS service should the company use to implement this decoupling?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the upload process from the file processing backend. The web server can immediately return a response after placing a message in the SQS queue, while the backend workers poll the queue for new work. SQS also supports dead-letter queues and configurable redrive policies to handle failures gracefully by retrying failed messages.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ