CLF-C02 Practice Test 48 — 15 Questions

Question 1

Which AWS service provides hardware-based key management and cryptographic operations using FIPS 140-2 Level 3 validated hardware security modules (HSMs)?

Accepted Answer

AWS CloudHSM. AWS CloudHSM is the correct answer because it provides dedicated, single-tenant hardware security modules (HSMs) that are FIPS 140-2 Level 3 validated. This allows customers to perform cryptographic operations (e.g., key generation, signing, encryption) using hardware that meets the highest security level required for regulated workloads like PKI and financial services.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

Amazon Macie

Question 2

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

Accepted Answer

Customer data and its classification. Under the AWS Shared Responsibility Model, the customer is always responsible for customer data and its classification, regardless of the service used. This includes deciding what data to store, how it is encrypted, and how access controls are configured. AWS never assumes responsibility for the content or classification of customer data, as this is entirely under the customer's control.

Answer

Physical security of the data center

Answer

Patching the underlying hypervisor

Answer

Network infrastructure management

Question 3

A financial institution needs a private, dedicated, high-bandwidth network connection from their on-premises data centre to AWS that does not traverse the public internet, provides consistent low latency, and supports up to 100 Gbps bandwidth. Which AWS service provides this?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a private, dedicated network connection from an on-premises data center to AWS that bypasses the public internet, ensuring consistent low latency and supporting bandwidths up to 100 Gbps (via 100 Gbps dedicated connections or link aggregation). This meets all the specified requirements for a high-bandwidth, private, and low-latency link.

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 4

Which AWS feature protects S3 buckets from having their versioned objects permanently deleted without multi-factor authentication approval?

Accepted Answer

S3 MFA Delete. S3 MFA Delete is the correct answer because it is the specific S3 versioning feature that requires multi-factor authentication (MFA) to permanently delete versioned objects or suspend versioning on a bucket. When enabled, any DeleteObject request that includes a version ID (permanent delete) or a PUT request to suspend versioning must include the x-amz-mfa header with a valid MFA code from a hardware or virtual MFA device. This prevents unauthorized or accidental permanent deletion of object versions, even by users with full S3 permissions.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Access Points

Question 5

A company is deploying a multi-tier web application that includes a VPC, subnets, security groups, EC2 instances, and an Application Load Balancer. The team needs to define the entire infrastructure in a version-controlled template so that it can be consistently deployed across development, test, and production environments with minimal manual effort. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define your entire multi-tier web application infrastructure—including VPC, subnets, security groups, EC2 instances, and an Application Load Balancer—in a version-controlled template (JSON or YAML). This enables consistent, repeatable deployments across development, test, and production environments with minimal manual effort, as CloudFormation handles the provisioning and updates in an orderly, predictable manner.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS Systems Manager

Question 6

A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The company can use AWS Artifact to download the SOC 2 Type II report directly, fulfilling the auditor's request without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 7

A company runs a globally distributed web application on Amazon EC2 instances behind Network Load Balancers in two AWS Regions: us-east-1 and eu-west-1. Users around the world access the application over the internet. The company wants to improve latency for all users by directing each user to the nearest healthy application endpoint. Additionally, the company requires two static IP addresses that clients can use for firewall whitelisting and that do not change even if the underlying infrastructure changes. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it provides two static anycast IP addresses that serve as fixed entry points, and it directs user traffic to the nearest healthy application endpoint via the AWS global network, reducing latency. Unlike CloudFront, it does not cache content but optimizes TCP/UDP traffic, making it ideal for non-HTTP or dynamic applications behind Network Load Balancers.

Answer

Amazon CloudFront

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 8

A company has committed to a 1-year Compute Savings Plan at $100/hour. During a given hour, their actual compute usage is only worth $80 at On-Demand rates. How does the Savings Plan apply?

Accepted Answer

You pay the committed $100 for the hour, with $20 of the commitment being unused. With a Compute Savings Plan, you commit to a consistent hourly spend ($100/hour) in exchange for lower compute rates. If your actual usage in an hour is only $80 at On-Demand rates, you still pay the full $100 commitment for that hour; the unused $20 is not refunded or carried over. This is because Savings Plans require you to pay the committed amount regardless of actual usage, ensuring AWS receives the predictable revenue that funds the discount.

Answer

You pay $80 (actual usage) and the unused $20 commitment carries over to the next hour

Answer

You are refunded the $20 unused portion at end of month

Answer

You pay $80 discounted at the Savings Plan rate, saving even more than committed

Question 9

Which AWS service provides a fully managed, scalable search service that allows you to set up, manage, and scale a search solution for your website or application?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service is a fully managed service that makes it easy to deploy, operate, and scale OpenSearch clusters in the AWS Cloud. It provides built-in integrations with tools like Kibana for visualization and Logstash for data ingestion, and it supports full-text search, structured search, and analytics, making it the correct choice for a scalable search solution.

Answer

Amazon Athena

Answer

Amazon RDS with full-text search

Answer

AWS Glue

Question 10

A company is migrating to AWS and wants to understand the different types of cloud service models. Which model describes a service where the provider manages everything including the application, and the customer only manages their data and user access?

Accepted Answer

Software as a Service (SaaS). In the Software as a Service (SaaS) model, the cloud provider manages the entire application stack, including infrastructure, platform, and application software. The customer is responsible only for their data and user access, typically through a web browser or API. This aligns with the description where the provider manages everything including the application.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 11

A development team needs to create a temporary Amazon RDS database for testing a new feature. The team uses the AWS Management Console to launch a db.t3.micro MySQL instance, configures the security group, and connects the application within minutes. When the testing is complete, they terminate the instance without any interaction with AWS support or IT administrators. This ability to provision and manage resources entirely through self-service interfaces best describes which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes the development team provisioning and terminating an RDS instance entirely through the AWS Management Console without requiring any human interaction with AWS support or IT administrators. This aligns with the NIST definition of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Rapid elasticity

Answer

Measured service

Question 12

Which AWS service enables automatic speech recognition (ASR) to convert audio from customer service calls into text for further analysis?

Accepted Answer

Amazon Transcribe. Amazon Transcribe is the correct AWS service for automatic speech recognition (ASR) because it is specifically designed to convert audio speech into text. It uses deep learning-based ASR models to process audio files or real-time streams, making it ideal for transcribing customer service call recordings for downstream analysis.

Answer

Amazon Polly

Answer

Amazon Lex

Answer

Amazon Comprehend

Question 13

A company is designing a resilient multi-tier web application on AWS. The architect wants to implement the Well-Architected Framework Reliability pillar design principle of 'automatically recover from failure.' Which combination of services implements this most completely?

Accepted Answer

EC2 Auto Scaling + ELB health checks + RDS Multi-AZ. It combines EC2 Auto Scaling to automatically replace unhealthy instances, ELB health checks to detect failures and route traffic away from them, and RDS Multi-AZ to automatically failover to a standby database in a different Availability Zone. This trio directly implements the 'automatically recover from failure' principle by enabling self-healing at both the compute and database tiers without manual intervention.

Answer

Manual restart procedures documented in a runbook

Answer

AWS CloudTrail + Amazon CloudWatch

Answer

AWS Config rules with manual remediation

Question 14

A company running large-scale scientific simulations needs EC2 instances with exclusive access to a physical host for software licensing reasons (per-socket licensing). Which EC2 option provides this?

Accepted Answer

Dedicated Hosts. Dedicated Hosts (Option B) provide EC2 instances with exclusive access to a physical host, allowing you to control instance placement on a specific server. This is required for per-socket software licensing because you can see and manage the physical sockets and cores of the host, ensuring compliance with licensing terms that are tied to physical hardware.

Answer

Dedicated Instances

Answer

Reserved Instances

Answer

EC2 Bare Metal instances

Question 15

A company uses AWS Organizations to manage multiple accounts. The finance team needs to perform a detailed cost analysis by joining AWS usage data with their internal accounting system. They require hourly-level billing data that includes resource IDs, operation types, and cost allocation tags. The data must be available in a CSV file that can be imported into their financial software. Which AWS tool or service should the finance team use to meet this requirement?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular billing data available, including hourly-level usage, resource IDs, operation types, and cost allocation tags. The report can be delivered to an Amazon S3 bucket in CSV format, making it directly importable into the finance team's financial software for detailed cost analysis.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor