CLF-C02 Practice Exam 51 — 20 Questions

Question 1

A company needs to synchronize files between their on-premises file server and Amazon S3 on a recurring schedule, detecting and copying only the changed files. Which AWS service is designed for this use case?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS DataSync. AWS DataSync is purpose-built for automating and accelerating the transfer of data between on-premises storage systems and AWS storage services, including Amazon S3. It supports incremental, scheduled transfers that detect and copy only changed files, making it the ideal choice for recurring file synchronization with S3.

Answer

AWS Snowball

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Storage Gateway

Question 2

A company needs a managed workflow service to coordinate long-running business processes that may require human approval steps and can run for up to one year. Which AWS service handles this?

Accepted Answer

AWS Step Functions (Standard Workflows). AWS Step Functions Standard Workflows are designed for long-running, durable, and auditable workflows that can run for up to one year, making them ideal for coordinating business processes that require human approval steps. They provide built-in error handling, retries, and state management, which are essential for orchestrating multi-step processes with human intervention.

Answer

AWS Lambda

Answer

Amazon SQS

Answer

Amazon EventBridge

Question 3

Which Amazon RDS feature enables automatic scaling of database storage capacity without any downtime when storage is running low?

Accepted Answer

RDS Storage Auto Scaling. RDS Storage Auto Scaling is the correct answer because it automatically increases the allocated storage for an RDS database instance when free space drops below a configured threshold, without requiring any downtime or manual intervention. This feature uses a scaling policy that triggers a storage increase in predefined increments, ensuring the database remains available and performant during storage growth.

Answer

RDS Multi-AZ

Answer

RDS Read Replicas

Answer

RDS Automated Backups

Question 4

Which AWS service provides a Web Application Firewall that protects web applications from common exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules that block, allow, or monitor web requests based on conditions such as IP addresses, HTTP headers, URI strings, and request body content. This makes it the correct service for the described use case.

Answer

AWS Shield

Answer

Amazon GuardDuty

Answer

Security Groups

Question 5

Which AWS service provides detailed billing reports that can be delivered hourly to Amazon S3 for custom analysis with tools like Amazon Athena or Redshift?

Accepted Answer

AWS Cost and Usage Report (CUR). AWS Cost and Usage Report (CUR) is the correct service because it provides the most granular billing data, including hourly usage and cost details, which can be delivered to an Amazon S3 bucket. This allows you to use analytics tools like Amazon Athena or Amazon Redshift to run custom queries and perform in-depth analysis on the raw billing data.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

Amazon CloudWatch Billing Metrics

Question 6

Which AWS service provides private connectivity between VPCs and supported AWS services without requiring internet gateway, NAT device, VPN, or Direct Connect?

Accepted Answer

VPC Endpoints. VPC Endpoints (specifically Gateway Endpoints for S3/DynamoDB and Interface Endpoints for other services) enable private connectivity between a VPC and supported AWS services using the AWS network, without requiring an internet gateway, NAT device, VPN, or Direct Connect. Traffic stays within the AWS backbone and never traverses the public internet, leveraging AWS PrivateLink for interface endpoints or route table entries for gateway endpoints.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

VPC Peering

Question 7

A company is using several AWS services and has noticed their bill has been increasing. They want to identify which team or project is responsible for each cost. Which AWS feature enables tracking costs by team, project, or environment?

Accepted Answer

AWS Cost Allocation Tags. AWS Cost Allocation Tags allow you to tag AWS resources with metadata (e.g., team, project, environment) and then activate those tags in the Billing and Cost Management console. Once activated, AWS generates cost reports that break down charges by those tag values, enabling you to attribute costs to specific teams or projects. This is the native AWS feature designed specifically for cost allocation and tracking.

Answer

AWS Organizations consolidated billing

Answer

AWS Budgets

Answer

AWS Config tags

Question 8

Which AWS IAM object should be used to grant permissions to an AWS service (like EC2 or Lambda) to access other AWS services on behalf of the application?

Accepted Answer

IAM Role. An IAM Role is the correct AWS identity to grant permissions to an AWS service (e.g., EC2, Lambda) because it provides temporary security credentials via AWS Security Token Service (STS). Unlike IAM Users, roles are designed to be assumed by trusted entities, including AWS services, enabling them to access other AWS resources on behalf of the application without long-lived access keys.

Answer

IAM User with access keys

Answer

IAM Group

Answer

IAM Policy

Question 9

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce a policy that prevents any user, including the root user, in any member account from disabling the 'Block Public Access' setting on Amazon S3 buckets. The policy must be centrally managed and automatically applied to all existing and future member accounts. Which AWS feature should the security team use?

Accepted Answer

AWS Service Control Policy (SCP). AWS Service Control Policies (SCPs) are the correct choice because they allow central management of permissions across all accounts in an AWS Organization. SCPs can explicitly deny actions like s3:PutBucketPublicAccessBlock at the root, OU, or account level, and they apply to all principals, including the root user, in member accounts. SCPs are automatically inherited by new accounts added to the organization, ensuring consistent enforcement without per-account configuration.

Answer

AWS Identity and Access Management (IAM) policy

Answer

AWS Config rule with automatic remediation

Answer

AWS Trusted Advisor

Question 10

Which benefit of cloud computing allows organizations to avoid the capital expense of buying hardware and instead pay only for what they use?

Accepted Answer

Trade capital expense for variable expense. Trading capital expense (CapEx) for variable/operational expense (OpEx) is a core cloud benefit. Instead of investing in data centers and servers upfront, organizations pay only for the computing resources they consume, converting large fixed costs into smaller, flexible operating expenses.

Answer

Economies of scale

Answer

Stop spending money running and maintaining data centers

Answer

Increase speed and agility

Question 11

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for downloading AWS compliance reports, including SOC 2 Type II reports, without needing to contact AWS Support. It offers on-demand access to AWS’s security and compliance documents, directly meeting the requirement for auditor evidence.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 12

A SaaS company wants to expose their service to AWS customers through the AWS Marketplace and allow customers to access it privately without traversing the public internet. Which technology enables this?

Accepted Answer

AWS PrivateLink. AWS PrivateLink enables private connectivity between VPCs and AWS services without traversing the public internet. By creating a VPC Endpoint powered by PrivateLink, the SaaS company can expose their service via an internal Network Load Balancer (NLB) in their own VPC, and customers can access it privately using Elastic Network Interfaces (ENIs) in their VPCs. This ensures traffic stays within the AWS network, meeting the requirement for private, non-internet-based access through the AWS Marketplace.

Answer

Amazon VPC Peering

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 13

A company generates large log files from its application and stores them in an Amazon S3 bucket. During the first 30 days, logs are frequently accessed for troubleshooting. After 30 days, logs are accessed infrequently (a few times per month). After 90 days, logs are rarely accessed but must be retained for compliance for one year, with retrieval possible within minutes if needed. The company wants to minimize storage costs while meeting these access and retention requirements. Which S3 feature should the company configure?

Accepted Answer

S3 Lifecycle policies. B is correct because S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Standard-IA after 30 days, then to S3 Glacier Instant Retrieval after 90 days) and expire them after one year. This directly matches the access patterns: frequent access for 30 days, infrequent access for the next 60 days, rare access with minute-level retrieval for the remainder of the year, and deletion after compliance retention is met.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Replication

Question 14

A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3. It can identify PII such as names, addresses, and credit card numbers, and it provides continuous monitoring with alerts when new sensitive data is uploaded, meeting both the discovery and ongoing monitoring requirements.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 15

A company uses multiple AWS accounts for different departments. Which AWS feature enables them to receive a single monthly bill and potentially lower rates through combined usage?

Accepted Answer

AWS Consolidated Billing. AWS Consolidated Billing allows organizations to combine usage across multiple AWS accounts into a single monthly bill. This aggregated usage can qualify for volume pricing discounts and lower rates due to combined resource consumption, such as reaching higher tiers of AWS Support or Reserved Instance benefits.

Answer

AWS Cost Allocation Tags

Answer

AWS Cost Explorer

Answer

AWS Marketplace

Question 16

A retail company expects 10x normal traffic during Black Friday. They want to ensure their application can handle this peak load automatically. Which AWS services should they configure to handle this requirement?

Accepted Answer

EC2 Auto Scaling + Application Load Balancer with CloudWatch scaling policies. EC2 Auto Scaling automatically adjusts the number of EC2 instances based on demand, and an Application Load Balancer distributes incoming traffic across those instances. CloudWatch scaling policies monitor metrics like CPU utilization or request count to trigger scaling actions, ensuring the application can handle the 10x traffic spike without manual intervention.

Answer

Launch the maximum number of instances before Black Friday and keep them running year-round

Answer

Increase the EC2 instance size to the largest available type

Answer

Use AWS Snowball to temporarily add compute capacity

Question 17

A company wants to build a serverless application that processes images uploaded to an Amazon S3 bucket. When a user uploads a new image, the application must automatically resize the image to multiple dimensions and store the resized versions in the same bucket under a different prefix. The company wants to minimize operational overhead and pay only for the compute time used. Which AWS service should be used to run the image processing code?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to S3 events, such as object creation. It automatically scales with the number of uploads, charges only for the compute time consumed (per 100ms increments), and requires no infrastructure management, making it ideal for event-driven image processing tasks.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate

Answer

AWS Batch

Question 18

A data science team wants to build, train, and deploy machine learning models without managing the underlying server infrastructure for training and inference. Which AWS service provides a fully managed environment for the machine learning workflow?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is a fully managed service that provides every component needed for the machine learning workflow, including data labeling, model building, training, tuning, and deployment. It eliminates the need to manage underlying server infrastructure for both training and inference by automatically provisioning, scaling, and managing compute resources.

Answer

AWS Lambda

Answer

Amazon EC2 with NVIDIA GPUs

Answer

Amazon Rekognition

Question 19

A startup company is evaluating the benefits of migrating to AWS. The CEO wants to experiment with a new application idea by quickly launching a small server, testing the application for a few days, and then decommissioning it. The company does not want to go through a lengthy procurement process to purchase hardware. Which cloud computing concept does this scenario best demonstrate?

Accepted Answer

Agility. The scenario describes the ability to rapidly provision a small server, test an application for a few days, and then decommission it without the delay of hardware procurement. This directly demonstrates agility, which in cloud computing refers to the speed and ease with which resources can be deployed, modified, and removed to respond to changing business needs. AWS services like EC2 allow instances to be launched in minutes via the AWS Management Console, CLI, or SDK, and terminated just as quickly, bypassing traditional hardware acquisition cycles.

Answer

Elasticity

Answer

High availability

Answer

Pay-as-you-go

Question 20

Which AWS service enables real-time translation of text between languages for applications serving a global audience?

Accepted Answer

Amazon Translate. Amazon Translate is a neural machine translation service that delivers fast, high-quality, and customizable language translation in real time. It is specifically designed to translate text between languages for applications serving a global audience, making it the correct choice for this use case.

Answer

Amazon Comprehend

Answer

Amazon Polly

Answer

Amazon Transcribe