CLF-C02 Practice Questions 2 — 50 Questions

Question 1

A company is launching a critical production application on AWS. The operations team requires technical support with a response time of less than 1 hour for urgent system issues. They also need access to AWS Trusted Advisor best practice checks for cost optimization and security. Which AWS Support plan meets these requirements at the lowest cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Business Support. AWS Business Support provides a response time of less than 1 hour for urgent system issues (production system impaired) and includes full access to AWS Trusted Advisor best practice checks for cost optimization and security. This meets all stated requirements at the lowest cost among the plans that offer these features.

Answer

AWS Developer Support

Answer

AWS Enterprise On-Ramp Support

Answer

AWS Enterprise Support

Question 2

A company runs a web application on Amazon EC2 instances. The application experiences unpredictable traffic spikes during marketing campaigns. The company configures an Amazon EC2 Auto Scaling group to automatically add instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This allows the company to handle peak loads without manual intervention and avoid paying for idle capacity during low traffic periods. Which essential characteristic of cloud computing does this configuration BEST demonstrate?

Accepted Answer

Rapid elasticity. The Auto Scaling group dynamically adjusts the number of EC2 instances in response to CPU utilization thresholds, scaling out during traffic spikes and scaling in during low traffic. This ability to rapidly provision and release compute resources to match demand is the defining characteristic of rapid elasticity, which allows the company to handle peak loads without manual intervention and avoid paying for idle capacity.

Answer

On-demand self-service

Answer

Broad network access

Answer

Measured service

Question 3

A company runs a customer-facing web application on a single Amazon EC2 instance. To improve resilience, the solutions architect decides to deploy a second EC2 instance in a different Availability Zone and configure an Application Load Balancer to distribute traffic. The goal is to ensure that the application remains accessible even if one instance or one Availability Zone becomes unavailable. Which cloud computing benefit does this architecture primarily aim to achieve?

Accepted Answer

High availability. By deploying a second EC2 instance in a different Availability Zone and using an Application Load Balancer (ALB) to distribute traffic, the architecture ensures that if one instance or one Availability Zone fails, the ALB automatically routes traffic to the healthy instance in the other AZ. This design directly achieves high availability by eliminating a single point of failure and maintaining application uptime during infrastructure failures.

Answer

Elasticity

Answer

Scalability

Answer

Cost optimization

Question 4

A company is migrating its workloads to AWS. The IT team is concerned that they will lose visibility into which specific physical server is running their application. A solutions architect explains that AWS abstracts the underlying hardware, allowing customers to focus on their applications without managing physical infrastructure. The architect also notes that AWS pools resources from a large number of data centers to serve multiple customers, and changes the physical location of resources dynamically. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. The scenario describes AWS pooling compute resources from multiple data centers to serve multiple customers, with the physical location of resources changing dynamically. This directly aligns with the 'resource pooling' characteristic of cloud computing, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. The customer has no knowledge or control over the exact physical location of the provided resources (e.g., which specific server runs their application), which matches the concern in the question.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 5

A company has a serverless application built with AWS Lambda. The application requires a series of functions to run in a specific order: after a user uploads a file, a validation function must run, then a processing function, and finally a metadata storage function. The company needs a service to coordinate these steps, manage state, handle errors, and automatically retry failed functions based on defined conditions. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into a flexible, visual workflow. It directly meets the requirement to run Lambda functions in a specific order, manage state between steps, handle errors with built-in retry logic, and define conditions for automatic retries using Amazon States Language (ASL). This makes it the ideal choice for orchestrating a multi-step serverless application with error handling and state management.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Batch

Answer

Amazon EventBridge

Question 6

A company has been running multiple workloads on AWS for the past six months. The finance team needs to analyze historical spending to identify month-over-month trends by AWS service and by individual linked accounts. The team requires a graphical, interactive tool that allows them to apply custom date ranges and filters, and view the results as customizable charts and graphs. Which AWS service should the finance team use to meet this requirement?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a graphical interface with pre-built charts and graphs that allow users to visualize historical spending trends. It supports filtering by AWS service and linked accounts, and enables custom date ranges for month-over-month analysis, making it the correct choice for the finance team's requirements.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 7

A company has a security policy that requires all Amazon EBS volumes attached to production Amazon EC2 instances to be encrypted at rest using customer-managed encryption keys. The policy also mandates that the encryption keys must be automatically rotated every 365 days. The company wants to minimize operational overhead by using a managed AWS service for key management and automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it provides managed customer master keys (CMKs) that can be used to encrypt EBS volumes at rest, and it supports automatic annual key rotation (every 365 days) with no additional operational overhead. KMS integrates directly with EBS to enforce encryption using customer-managed keys, meeting both the encryption and rotation requirements.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 8

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in an organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrator permissions via IAM policies. By applying an SCP that denies the `cloudtrail:DeleteTrail` and `cloudtrail:StopLogging` actions, the security team can enforce that CloudTrail cannot be disabled or deleted across all development accounts, regardless of individual IAM configurations.

Answer

IAM policies

Answer

AWS Config rules

Answer

Amazon CloudWatch Events

Question 9

A company runs a latency-sensitive application on AWS that must communicate with an on-premises data center. The company requires a dedicated, private network connection that provides consistent, low-latency performance and bypasses the public internet. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent, low-latency performance for latency-sensitive applications by using a physical cross-connect or hosted virtual interface, which avoids the variability and potential congestion of internet-based connections.

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Question 10

A company manages multiple AWS accounts through AWS Organizations. The finance team wants to receive a consolidated view of costs across all accounts and track costs against a monthly budget of $50,000 for the entire organization. They want to be alerted when actual costs reach 90% of the budget and again when they exceed 100%. Which combination of AWS services should the finance team use?

Accepted Answer

AWS Budgets to create a budget and configure alerts, and AWS Cost Explorer to view consolidated cost data.. AWS Budgets is the correct service for setting a monthly budget of $50,000 and configuring alerts at 90% and 100% thresholds. AWS Cost Explorer provides the consolidated view of costs across all accounts in AWS Organizations. Together, they meet both requirements: Budgets handles the alerting, and Cost Explorer provides the consolidated cost visualization.

Answer

AWS Cost Explorer to create a budget alert and AWS Budgets to view consolidated costs.

Answer

AWS Trusted Advisor to set a cost optimization budget and AWS Cost Explorer to send alerts.

Answer

AWS Cost and Usage Report to generate a daily report and Amazon Simple Email Service (Amazon SES) to send email alerts.

Question 11

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A company is expanding its AWS environment from a single account to multiple accounts using AWS Organizations. The security team wants to enforce a baseline set of permissions across all accounts, ensuring that users in any account cannot disable AWS CloudTrail or modify Amazon S3 bucket policies that prevent public access. Which feature of AWS Organizations should the security team use to achieve this control?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce baseline permissions across all accounts in an AWS Organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrative privileges within their own account. By creating an SCP that explicitly denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:PutBucketPolicy` actions (or similar), the security team can prevent disabling CloudTrail and modifying S3 bucket policies that block public access across the entire organization.

Answer

Consolidated Billing

Answer

AWS Config rules

Answer

IAM roles

Question 13

A company runs a web application that accepts customer orders. During peak hours, the order processing component often becomes overloaded, causing orders to be dropped. The company wants to ensure that every order is reliably stored and processed, and that the web tier and the processing tier can scale independently without losing data. Which AWS service should the company use to decouple the application components and provide a durable buffer for incoming orders?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed, durable, and scalable message queue that decouples the web tier from the processing tier. Orders are reliably stored in an SQS queue until the processing component retrieves them, ensuring no orders are dropped even during peak loads. SQS guarantees at-least-once delivery and supports independent scaling of producers and consumers without data loss.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 14

A healthcare organization stores sensitive patient records in Amazon S3. The organization's compliance team learns that AWS stores data from multiple customers on the same physical hardware. They are concerned that data from different customers could be mixed or accessed by another customer. Which fundamental characteristic of cloud computing explains how AWS allows customers to share physical infrastructure while keeping each customer's data logically isolated?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes how AWS aggregates computing resources (including storage) from multiple customers into a shared pool, then logically isolates each customer's data through software-defined boundaries. In Amazon S3, this isolation is achieved via bucket policies, IAM roles, and object ACLs that enforce strict access controls, ensuring that even though physical hardware is shared, no customer can access another's data. This characteristic directly addresses the compliance team's concern about data mixing or unauthorized cross-tenant access.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Measured service

Question 15

A company has a web application deployed on AWS in the us-west-2 Region. The application is accessed by users across the globe, including Europe, Asia, and South America. The company wants to improve the application's performance for international users by reducing latency and packet loss. The solution must route user traffic over the AWS global network to the closest edge location. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network to route user traffic to the closest edge location via Anycast IP addresses, reducing latency and packet loss. It optimizes the path from users to the application by directing traffic to the nearest edge endpoint, then forwarding it over the AWS backbone to the application in us-west-2. This improves performance for international users without caching content, unlike a CDN.

Answer

Amazon CloudFront

Answer

Amazon Route 53 (with latency-based routing)

Answer

AWS Direct Connect

Question 16

A company hosts a public-facing web application behind an Application Load Balancer (ALB). The development team has recently identified that the application is vulnerable to common web attacks such as SQL injection and cross-site scripting (XSS). The security team wants to deploy a managed solution that can inspect incoming HTTP requests and block malicious traffic before it reaches the application. The solution must integrate directly with the existing ALB and provide pre-configured rule sets that can be customized. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests. It provides pre-configured rule sets, such as those for SQL injection and cross-site scripting (XSS), which can be customized to block malicious traffic before it reaches the application. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 17

A company runs a multiplayer gaming application on Amazon EC2 instances in the us-east-1 Region. The application uses the UDP protocol for real-time communication between players and game servers. Players in Asia and Europe report high latency and packet loss. The company wants to improve performance by directing player traffic from the nearest edge location to the application over the AWS global network, without modifying the application code. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route UDP traffic from the nearest edge location to the application, reducing latency and packet loss without requiring code changes. It leverages Anycast IP addresses to direct player traffic to the closest edge location, then transports it over the optimized AWS backbone to the EC2 instances in us-east-1.

Answer

Amazon CloudFront

Answer

Amazon Route 53 latency routing

Answer

AWS Site-to-Site VPN

Question 18

A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it allows the company to create and manage a customer managed key (CMK) with annual rotation, and it integrates with AWS CloudTrail to deliver tamper-proof logs of every KMS API call (e.g., Decrypt, Encrypt, GenerateDataKey). These logs record the key ID, the IAM user or role that made the request, and the S3 object ARN (via encryption context), satisfying both key management and audit logging requirements.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 19

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 20

A company has a global user base that uploads images to an Amazon S3 bucket in the us-east-1 Region. Users report slow upload speeds and frequent timeouts when uploading large files from distant locations. The company wants to use the AWS global network and edge locations to accelerate uploads to the S3 bucket. The solution must require minimal infrastructure changes on the client side and must be configured at the bucket level. Which AWS feature should the company enable?

Accepted Answer

Amazon S3 Transfer Acceleration. Amazon S3 Transfer Acceleration (A) uses AWS edge locations to route uploads over the AWS global network, reducing latency and timeouts for large files from distant locations. It is enabled at the bucket level and requires only a simple client-side change (using the accelerated endpoint instead of the standard S3 endpoint), meeting the requirement for minimal client-side modifications.

Answer

Amazon CloudFront with an origin access identity

Answer

AWS Global Accelerator using a custom routing accelerator

Answer

Amazon S3 cross-region replication