CLF-C02 Practice Exam 51 — 20 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The finance team needs to generate custom cost and usage reports that include every line item, all user-defined cost allocation tags, and resource-level details. The team also needs the ability to query the data using standard SQL tools for in-depth analysis. Which AWS feature should the team use to meet these requirements?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the only AWS feature that provides comprehensive, granular cost and usage data including every line item, all user-defined cost allocation tags, and resource-level details. It delivers this data to an Amazon S3 bucket in a CSV or Parquet format, which can then be queried using standard SQL tools via Amazon Athena or other SQL engines. This directly matches the requirement for custom reports and SQL-based analysis.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 2

A company uses AWS to host its web application. The company's IT manager learns that multiple AWS customers may have virtual machines running on the same physical server within an AWS data center. However, the manager is confident that each customer's data is securely isolated from others and that customers have no visibility into or control over the underlying physical infrastructure. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes the cloud characteristic where the provider's computing resources (such as physical servers) are pooled to serve multiple customers using a multi-tenant model. AWS uses hypervisor-based isolation (e.g., Xen or Nitro) to ensure that each customer's virtual machine has no visibility into or control over the underlying physical hardware or other tenants' workloads, while still sharing the same physical server. This directly matches the scenario's description of multiple customers running VMs on the same physical host with secure isolation.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Measured service

Question 3

A company uses multiple AWS accounts and wants to enforce cost governance. The company needs to set a monthly cost budget of $10,000 for each account. When an account's actual or forecasted costs exceed this budget, the company wants to automatically apply a restrictive IAM policy that prevents the creation of new resources in that account. Additionally, the company wants to receive an email notification when the budget is exceeded. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and when actual or forecasted costs exceed the budget threshold, it can trigger actions such as applying an IAM policy to restrict resource creation and sending SNS-based email notifications. This directly meets the requirement for automated enforcement and alerting per account.

Answer

AWS Cost Explorer

Answer

AWS Cost Anomaly Detection

Answer

AWS Trusted Advisor

Question 4

A company uses separate AWS accounts for development, testing, and production. The finance team wants to receive a single monthly invoice that covers all accounts and to benefit from volume pricing discounts across the entire organization. Which AWS feature should the company use to achieve this?

Accepted Answer

Enable Consolidated Billing in AWS Organizations. AWS Organizations with Consolidated Billing allows a company to combine usage across multiple accounts into a single monthly invoice, enabling the organization to aggregate usage and benefit from volume pricing discounts (e.g., tiered pricing for EC2, S3, or data transfer). The management account pays for all member accounts, and the consolidated view simplifies cost tracking while maximizing savings from AWS's graduated pricing model.

Answer

Set up an AWS Budget to track all account costs

Answer

Use Cost Explorer to generate a combined cost report

Answer

Activate AWS Trusted Advisor on the management account

Question 5

A company wants to proactively monitor its AWS spending and receive email notifications when actual or forecasted costs exceed a defined threshold. The company has a monthly budget of $10,000 and wants to be alerted when costs reach 80% of the budget. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and configure alerts that trigger when actual or forecasted costs exceed a defined threshold (e.g., 80% of a $10,000 monthly budget). It can send email notifications via Amazon SNS when the threshold is breached, meeting the proactive monitoring requirement.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 6

A development team needs to create a new Amazon RDS MySQL database for a temporary testing environment. A developer logs into the AWS Management Console, selects the desired instance type, storage, and network settings, and clicks 'Create database'. The database is available within 10 minutes, and the developer did not need to submit a request or wait for IT approval. Which essential characteristic of cloud computing does this process best demonstrate?

Accepted Answer

On-demand self-service. The developer was able to create and provision the RDS MySQL database entirely through the AWS Management Console without any human interaction or approval from IT. This is the core definition of on-demand self-service: a user can provision computing resources as needed automatically, without requiring service provider interaction. The process took only 10 minutes and required no ticket submission, which directly aligns with the NIST definition of on-demand self-service.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 7

A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it allows the company to create and manage a customer managed key (CMK) with annual rotation, and it integrates with AWS CloudTrail to deliver tamper-proof logs of every KMS API call (e.g., Decrypt, Encrypt, GenerateDataKey). These logs record the key ID, the IAM user or role that made the request, and the S3 object ARN (via encryption context), satisfying both key management and audit logging requirements.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 8

A development team needs to deploy a web application on AWS. They want to avoid managing the underlying infrastructure, such as EC2 instances and load balancers, but still need the ability to control scaling, update the application code, and perform rollbacks. The application must scale automatically based on demand and remain highly available. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform as a Service (PaaS) model that abstracts the underlying EC2 instances, load balancers, and Auto Scaling groups. It allows the team to upload their application code, and Elastic Beanstalk automatically handles capacity provisioning, load balancing, scaling, and health monitoring. The team retains control over scaling configuration, application version updates, and rollbacks through the Elastic Beanstalk console or CLI, without managing the infrastructure directly.

Answer

Amazon EC2 with Auto Scaling groups and an Application Load Balancer

Answer

AWS Lambda

Answer

Amazon ECS using the EC2 launch type

Question 9

A development team needs to provision a new Amazon EC2 instance for a proof-of-concept project. The team has an AWS account with appropriate IAM permissions. One developer logs into the AWS Management Console, selects an Amazon Machine Image (AMI), chooses an instance type, configures security groups, and launches the instance. The entire process takes less than 10 minutes and does not require any interaction with AWS support or IT administrators. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. This scenario best illustrates on-demand self-service because the developer was able to provision an EC2 instance entirely through the AWS Management Console without any human interaction with AWS support or IT administrators. The ability to independently configure and launch compute resources—selecting an AMI, instance type, and security groups—within minutes, without requiring manual approval or provisioning, is the defining characteristic of on-demand self-service as defined by NIST SP 800-145.

Answer

Resource pooling

Answer

Measured service

Answer

Broad network access

Question 10

A financial services company is preparing for an annual third-party audit. The auditor has requested a copy of the AWS SOC 2 Type II report to evaluate the security controls of the AWS infrastructure. The company needs to retrieve the report as quickly as possible without raising a support ticket. Which AWS service should they use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications, without needing to open a support ticket. The auditor's request for a SOC 2 Type II report is exactly the use case AWS Artifact is designed for, allowing the company to download the report immediately from the AWS Management Console or via the AWS CLI.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 11

A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?

Accepted Answer

Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.. Option D is correct because AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.

Answer

Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.

Answer

Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.

Answer

Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.

Question 12

A gaming company is preparing to launch a new online multiplayer game. The company expects the player traffic to be extremely high on the first few days after launch, but then stabilize at a much lower level. The IT team wants to provision sufficient server capacity to handle the launch spike without over-provisioning and wasting money during the quieter periods. Which benefit of cloud computing most directly addresses this requirement?

Accepted Answer

Stop guessing capacity. The requirement is to provision enough capacity for a launch spike without over-provisioning for lower steady-state traffic. AWS Auto Scaling with Elastic Load Balancing directly addresses this by automatically adjusting the number of EC2 instances based on real-time demand, eliminating the need to guess peak capacity. This is the core benefit of 'Stop guessing capacity' — cloud elasticity allows you to match resources to actual usage, not predictions.

Answer

Trade capital expense for variable expense

Answer

Increase speed and agility

Answer

Benefit from massive economies of scale

Question 13

A global gaming company needs to deploy its application in multiple geographic locations to reduce latency for players worldwide. The application must also remain available even if an entire data center fails. The company plans to run the application on Amazon EC2 instances behind an Application Load Balancer. Which combination of AWS global infrastructure components should the company use to meet these requirements?

Accepted Answer

Deploy the application in multiple AWS Regions, each with at least two Availability Zones, and use Amazon Route 53 for DNS-based routing.. Option C is correct because deploying the application in multiple AWS Regions, each with at least two Availability Zones, ensures global low latency by placing compute resources closer to players worldwide, while the multi-AZ architecture within each Region provides high availability even if an entire data center (Availability Zone) fails. Amazon Route 53 then enables DNS-based routing (e.g., latency-based or geolocation routing) to direct player traffic to the optimal Region, meeting both latency and fault tolerance requirements.

Answer

Deploy the application in a single AWS Region across multiple Availability Zones and use Amazon Route 53 with latency-based routing.

Answer

Deploy the application in a single AWS Region within a single Availability Zone and use Amazon CloudFront for content caching.

Answer

Deploy the application in multiple AWS Regions and use Amazon CloudFront with multiple origins, each pointing to an Application Load Balancer in a single Availability Zone.

Question 14

A healthcare company is migrating patient records to Amazon S3. The company must comply with HIPAA and needs to automatically identify any S3 buckets that contain protected health information (PHI) and generate alerts. The solution must be fully managed and require no manual effort to scan the data. Which AWS service should the company use?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in Amazon S3. It automatically identifies protected health information (PHI) such as medical record numbers, diagnosis codes, and patient names, and can generate alerts when such data is found in S3 buckets, meeting HIPAA compliance requirements without any manual scanning effort.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Security Hub

Question 15

Drag and drop the steps to set up a VPC with a public subnet and an internet gateway in the correct order.

Question 16

Drag and drop the steps to launch an EC2 instance in the correct order.

Question 17

Drag and drop the steps to migrate an on-premises database to Amazon RDS using AWS DMS in the correct order.

Question 18

Drag and drop the steps to create an IAM user with programmatic access and attach a policy in the correct order.

Question 19

Drag and drop the steps to configure an Application Load Balancer (ALB) in the correct order.

Question 20

Drag and drop the steps to recover an EC2 instance from a snapshot in the correct order.