CLF-C02 Practice Test 50 — 15 Questions

Question 1

Match each AWS compute service to its typical use case.

Question 2

Match each AWS pricing concept to its definition.

Question 3

A company's sales team uses a cloud-based CRM application hosted on AWS. Sales representatives access the application from various devices—office desktops, company-issued laptops, and personal smartphones—using only standard web browsers and internet connections. No special client software or dedicated network connections are required. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. The scenario describes sales representatives accessing the CRM application from various devices (desktops, laptops, smartphones) using only standard web browsers and internet connections, without requiring special client software or dedicated network connections. This directly illustrates 'broad network access,' which is the ability for resources to be accessed over the network by a wide range of client platforms (e.g., mobile phones, laptops, workstations) using standard protocols (HTTP/HTTPS). The key is that the service is available from anywhere with an internet connection, not limited to a specific location or device type.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 4

A company's development team has written a Python web application using the Flask framework. The team wants to deploy the application to the AWS Cloud without managing the underlying servers, operating system, or web server software. They want AWS to automatically handle the deployment, from provisioning EC2 instances to configuring the web server and load balancer, and to scale the application based on traffic. They also want the ability to upload new code versions directly from their Git repository. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a Platform as a Service (PaaS) offering that automatically handles the deployment, capacity provisioning, load balancing, and auto-scaling of web applications. The team can upload code directly from a Git repository using the EB CLI or integrated CodePipeline, and Elastic Beanstalk manages the underlying EC2 instances, operating system, and web server (e.g., Apache or Nginx) without requiring manual intervention.

Answer

AWS CloudFormation

Answer

Amazon EC2 Auto Scaling

Answer

AWS CodeDeploy

Question 5

A company's data analytics team needs to process log files immediately after they are uploaded to an Amazon S3 bucket. The processing logic is implemented as a custom Python script that runs for about 10 seconds per file. The team wants a fully managed solution that does not require provisioning or managing servers, automatically scales with the number of incoming log files, and executes the script only when new files are uploaded. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Lambda with an S3 bucket notification trigger. AWS Lambda is the correct choice because it is a fully managed, serverless compute service that can be triggered directly by S3 bucket notifications (e.g., s3:ObjectCreated:* events). The custom Python script runs within the Lambda function, which automatically scales to handle concurrent invocations for each new log file, and the 10-second execution time is well within the 15-minute maximum duration for Lambda functions. This meets all requirements without provisioning or managing servers.

Answer

Amazon EC2 with an Auto Scaling group configured to launch instances based on S3 events

Answer

AWS Elastic Beanstalk configured with a worker environment

Answer

Amazon EMR with a scheduled step to process new files

Question 6

A company's finance team wants to receive an email alert when monthly AWS costs exceed 80% of the budgeted amount. Additionally, they want to automatically apply a specific IAM policy to restrict further resource provisioning if costs exceed 100% of the budget. Which AWS feature should the team configure to meet both requirements?

Accepted Answer

AWS Budgets with budget actions. AWS Budgets allows you to set cost budgets and configure budget actions that trigger when actual or forecasted costs exceed a threshold. In this scenario, you can create a budget with an alert action to send an email when costs reach 80% of the budget, and a separate budget action (using an IAM policy) to automatically restrict resource provisioning when costs hit 100%. This meets both requirements natively without additional services.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations Service Control Policies (SCPs)

Question 7

A company wants to allow its developers to provision virtual servers in AWS without needing to submit a ticket to an IT administrator or wait for manual approval. The developers need to be able to spin up instances directly from the AWS Management Console, CLI, or SDKs, and the resources should be available immediately after the request is submitted. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning virtual servers directly from the AWS Management Console, CLI, or SDKs without manual intervention or approval. This aligns with the on-demand self-service characteristic of cloud computing, where users can provision computing resources automatically as needed without requiring human interaction with the service provider. The key is that the resources are available immediately after the request, which is the hallmark of self-service, not elasticity.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Question 8

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action using an AWS Systems Manager Automation document. AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` continuously evaluates S3 buckets against the encryption requirement. When a non-compliant bucket is detected, an automatic remediation action can invoke an AWS Systems Manager Automation document to enable default encryption (SSE-S3 or SSE-KMS). AWS Config also provides a compliance score dashboard and allows the security team to review non-compliant resources, meeting all stated requirements.

Answer

Amazon GuardDuty with a finding type for S3 bucket encryption

Answer

AWS Trusted Advisor with the S3 Bucket Permissions check

Answer

AWS CloudTrail with a trail that logs S3 API calls and an Amazon CloudWatch alarm

Question 9

A company's security team needs to run automated vulnerability scans on all Amazon EC2 instances in their production environment. They require a managed service that checks for common vulnerabilities and exposures (CVEs) and identifies insecure network configurations. The scans must be scheduled to run weekly and the results must be viewable in the AWS Management Console. Which AWS service should the team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is a managed vulnerability management service that automatically scans EC2 instances for software vulnerabilities (CVEs) and unintended network exposure. It supports scheduled recurring scans (e.g., weekly) and integrates with the AWS Management Console to display findings, making it the correct choice for the team's requirements.

Answer

AWS Shield

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 10

A company stores historical sales data in Amazon S3. The data is accessed only once a month for generating quarterly reports. When accessed, the data must be available for retrieval within seconds. The company wants to minimize storage costs while meeting the retrieval latency requirement. Which S3 storage class should the company use?

Accepted Answer

S3 Standard-IA (Infrequent Access). S3 Standard-IA (Infrequent Access) is the correct choice because it offers the same low-latency retrieval (milliseconds) as S3 Standard but at a lower storage cost, making it ideal for data accessed infrequently (e.g., once a month) yet requiring immediate availability. The company's requirement of 'within seconds' is fully met by S3 Standard-IA, which provides the same first-byte latency as S3 Standard, while minimizing storage costs for data that is not accessed frequently.

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Deep Archive

Question 11

A company's security team is concerned about the risk of compromised Amazon EC2 instances being used for crypto-mining activities. They want a managed AWS service that can automatically detect unusual outbound network traffic patterns that are characteristic of crypto-mining, without requiring the installation of any agents on the instances. The team needs continuous monitoring and the ability to receive findings that include details about the suspicious activity. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor for malicious activity, including unusual outbound network traffic patterns like those associated with crypto-mining. It operates at the AWS account and VPC level by analyzing DNS logs, VPC Flow Logs, and CloudTrail events, and it does not require any agents to be installed on EC2 instances. When suspicious activity is detected, GuardDuty generates detailed findings that include information about the affected resource, the type of threat, and recommended remediation steps.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon Detective

Question 12

A company's security team wants to identify all Amazon S3 buckets that are shared with external AWS accounts or publicly accessible. The team needs a continuous evaluation that reports findings in a centralized dashboard and sends alerts when new unintended external shares are created. Which AWS service should the security team use to meet these requirements?

Accepted Answer

IAM Access Analyzer. IAM Access Analyzer is the correct choice because it continuously monitors resource policies, including S3 bucket policies, to identify resources shared with external AWS accounts or publicly. It provides a centralized dashboard in the IAM console to view findings and integrates with Amazon EventBridge to send alerts via Amazon SNS when new unintended external shares are created, meeting all stated requirements.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 13

A company stores product images in an Amazon S3 bucket. New images are accessed frequently for the first 30 days, but access drops sharply after that. The company wants to automatically optimize storage costs by moving data between access tiers without any manual intervention or upfront lifecycle policy setup. Which Amazon S3 storage class should the company use to meet these requirements?

Accepted Answer

Amazon S3 Intelligent-Tiering. Amazon S3 Intelligent-Tiering is the correct choice because it automatically moves objects between three access tiers (frequent, infrequent, and archive instant) based on changing access patterns, with no lifecycle rules required. This meets the requirement of optimizing storage costs for images that are frequently accessed for the first 30 days and then rarely accessed afterward, without any manual intervention or upfront setup.

Answer

Amazon S3 Standard

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Glacier Deep Archive

Question 14

A company uses Amazon EC2 instances to run its workloads. The company's IT team does not know the exact physical server where each instance runs, and instances from multiple customers may be hosted on the same physical hardware. The team only specifies the AWS Region and Availability Zone. Which essential characteristic of cloud computing does this scenario BEST represent?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes how AWS aggregates compute resources from multiple physical hosts into a shared pool, which is then dynamically assigned and reassigned to customers based on demand. The IT team has no control over or knowledge of the exact physical server, and instances from different customers can run on the same hardware, which is the defining behavior of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 15

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.

Answer

S3 Block Public Access account-level settings

Answer

AWS Config managed rule s3-bucket-public-read-prohibited

Answer

Amazon Macie with a sensitive data discovery job