CLF-C02 Practice Exam 51 — 20 Questions

Question 1

A SaaS company wants to expose their service to AWS customers through the AWS Marketplace and allow customers to access it privately without traversing the public internet. Which technology enables this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS PrivateLink. AWS PrivateLink enables private connectivity between VPCs and AWS services without traversing the public internet. By creating a VPC Endpoint powered by PrivateLink, the SaaS company can expose their service via an internal Network Load Balancer (NLB) in their own VPC, and customers can access it privately using Elastic Network Interfaces (ENIs) in their VPCs. This ensures traffic stays within the AWS network, meeting the requirement for private, non-internet-based access through the AWS Marketplace.

Answer

Amazon VPC Peering

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 2

A company generates large log files from its application and stores them in an Amazon S3 bucket. During the first 30 days, logs are frequently accessed for troubleshooting. After 30 days, logs are accessed infrequently (a few times per month). After 90 days, logs are rarely accessed but must be retained for compliance for one year, with retrieval possible within minutes if needed. The company wants to minimize storage costs while meeting these access and retention requirements. Which S3 feature should the company configure?

Accepted Answer

S3 Lifecycle policies. B is correct because S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Standard-IA after 30 days, then to S3 Glacier Instant Retrieval after 90 days) and expire them after one year. This directly matches the access patterns: frequent access for 30 days, infrequent access for the next 60 days, rare access with minute-level retrieval for the remainder of the year, and deletion after compliance retention is met.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Replication

Question 3

A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3. It can identify PII such as names, addresses, and credit card numbers, and it provides continuous monitoring with alerts when new sensitive data is uploaded, meeting both the discovery and ongoing monitoring requirements.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 4

A retail company expects 10x normal traffic during Black Friday. They want to ensure their application can handle this peak load automatically. Which AWS services should they configure to handle this requirement?

Accepted Answer

EC2 Auto Scaling + Application Load Balancer with CloudWatch scaling policies. EC2 Auto Scaling automatically adjusts the number of EC2 instances based on demand, and an Application Load Balancer distributes incoming traffic across those instances. CloudWatch scaling policies monitor metrics like CPU utilization or request count to trigger scaling actions, ensuring the application can handle the 10x traffic spike without manual intervention.

Answer

Launch the maximum number of instances before Black Friday and keep them running year-round

Answer

Increase the EC2 instance size to the largest available type

Answer

Use AWS Snowball to temporarily add compute capacity

Question 5

A company wants to build a serverless application that processes images uploaded to an Amazon S3 bucket. When a user uploads a new image, the application must automatically resize the image to multiple dimensions and store the resized versions in the same bucket under a different prefix. The company wants to minimize operational overhead and pay only for the compute time used. Which AWS service should be used to run the image processing code?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to S3 events, such as object creation. It automatically scales with the number of uploads, charges only for the compute time consumed (per 100ms increments), and requires no infrastructure management, making it ideal for event-driven image processing tasks.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate

Answer

AWS Batch

Question 6

A data science team wants to build, train, and deploy machine learning models without managing the underlying server infrastructure for training and inference. Which AWS service provides a fully managed environment for the machine learning workflow?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is a fully managed service that provides every component needed for the machine learning workflow, including data labeling, model building, training, tuning, and deployment. It eliminates the need to manage underlying server infrastructure for both training and inference by automatically provisioning, scaling, and managing compute resources.

Answer

AWS Lambda

Answer

Amazon EC2 with NVIDIA GPUs

Answer

Amazon Rekognition

Question 7

A startup company is evaluating the benefits of migrating to AWS. The CEO wants to experiment with a new application idea by quickly launching a small server, testing the application for a few days, and then decommissioning it. The company does not want to go through a lengthy procurement process to purchase hardware. Which cloud computing concept does this scenario best demonstrate?

Accepted Answer

Agility. The scenario describes the ability to rapidly provision a small server, test an application for a few days, and then decommission it without the delay of hardware procurement. This directly demonstrates agility, which in cloud computing refers to the speed and ease with which resources can be deployed, modified, and removed to respond to changing business needs. AWS services like EC2 allow instances to be launched in minutes via the AWS Management Console, CLI, or SDK, and terminated just as quickly, bypassing traditional hardware acquisition cycles.

Answer

Elasticity

Answer

High availability

Answer

Pay-as-you-go

Question 8

Which AWS service enables real-time translation of text between languages for applications serving a global audience?

Accepted Answer

Amazon Translate. Amazon Translate is a neural machine translation service that delivers fast, high-quality, and customizable language translation in real time. It is specifically designed to translate text between languages for applications serving a global audience, making it the correct choice for this use case.

Answer

Amazon Comprehend

Answer

Amazon Polly

Answer

Amazon Transcribe

Question 9

A company has two separate VPCs — one for development workloads and one for a shared services environment — and wants EC2 instances in both VPCs to communicate with each other using private IP addresses without traffic traversing the public internet. Which AWS feature enables this?

Accepted Answer

VPC Peering. VPC Peering enables direct network connectivity between two VPCs using private IP addresses, with traffic routed entirely within the AWS network backbone. This allows EC2 instances in the development VPC and the shared services VPC to communicate without traversing the public internet, as traffic stays within the AWS global infrastructure.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Direct Connect

Question 10

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct choice because it integrates directly with Application Load Balancers to provision, deploy, and automatically renew SSL/TLS certificates. ACM manages the entire certificate lifecycle, including private key generation and storage, without requiring manual intervention. This meets the security team's requirement for automatic renewal and AWS-managed certificate lifecycle.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Question 12

A company runs a production web application on a fleet of Amazon EC2 instances. The operations team has observed that most instances have an average CPU utilization below 10% over the past month. They want to receive automated, ML-based recommendations for downsizing these instances to smaller instance types to reduce costs without compromising performance. The team also wants to see the estimated monthly savings for each recommendation. Which AWS service should the operations team use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (such as CPU, memory, and network) of EC2 instances and provides actionable recommendations to downsize or rightsize instances. It specifically generates estimated monthly savings for each recommendation, directly addressing the need for automated, ML-based downsizing suggestions without compromising performance.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 13

A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS) using pre-configured rule sets (e.g., AWS Managed Rules). It integrates natively with both CloudFront and Application Load Balancers (ALBs) without requiring additional infrastructure, and it supports geo-blocking to restrict requests from specific countries, meeting all stated requirements.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Question 14

A company runs a variety of workloads on AWS and wants to be notified when their monthly spending behaves unusually compared to past patterns. They want a managed service that uses machine learning to detect cost anomalies and provides root cause analysis. Which AWS service or feature should they use?

Accepted Answer

AWS Cost Anomaly Detection. AWS Cost Anomaly Detection is a managed service that leverages machine learning to continuously monitor your cost and usage patterns, detect anomalies, and provide root cause analysis. It automatically establishes a baseline from historical spending data and alerts you when actual spending deviates from expected patterns, making it the correct choice for this use case.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 15

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 16

A company runs multiple applications across hundreds of Amazon EC2 instances in several AWS accounts. The finance team needs to perform daily cost analysis by combining detailed usage data (including instance type, operating system, and custom cost allocation tags) with their own business data stored in an on-premises data warehouse. They want to export cost and usage data from AWS at the most granular level possible (down to each individual resource and hour) into their on-premises system for custom reporting. Which AWS tool should they use to achieve this?

Accepted Answer

AWS Cost and Usage Report. AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular cost and usage data available, down to individual resource IDs and hourly intervals, and supports custom cost allocation tags. It can be delivered to an Amazon S3 bucket and then integrated with on-premises systems for custom reporting, meeting the finance team's requirement for detailed daily cost analysis combined with their own business data.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 17

A company runs multiple containerized applications on a single Amazon ECS cluster using AWS Fargate. The company's compliance team asks whether sharing the same underlying physical hardware with other AWS customers introduces security risks. The company explains that AWS isolates each customer's compute environment, even though resources are drawn from a shared pool. Which essential characteristic of cloud computing does this arrangement best illustrate?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic where a provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. AWS Fargate abstracts the underlying infrastructure, so even though containers run on shared physical hardware, each customer's compute environment is isolated at the hypervisor and kernel level. This arrangement directly illustrates resource pooling because the provider manages the shared pool while ensuring logical separation between tenants.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 18

A company's IT team manually provisions S3 buckets, EC2 instances, security groups, and IAM roles for each new project using the AWS Management Console. This process often results in configuration errors, such as overly permissive security rules or incorrect tagging, which the security team then has to fix manually. The company wants to define its entire infrastructure in a declarative template file, store it in version control, and have AWS automatically create or update the resources based on that template. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire infrastructure—including S3 buckets, EC2 instances, security groups, and IAM roles—in a declarative JSON or YAML template. You can store this template in version control, and CloudFormation automatically provisions or updates the resources to match the template, eliminating manual configuration errors like overly permissive security rules or incorrect tagging.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 19

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The security team needs to understand their responsibilities under the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility?

Accepted Answer

Configuring security group rules to control network access to the database. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security group rules to control network access to the database. Security groups act as a virtual firewall that controls inbound and outbound traffic at the instance level, and the customer must define the rules (e.g., source IP, port 3306 for MySQL) to restrict access appropriately.

Answer

Applying minor version patches to the MySQL database engine

Answer

Managing the physical security of the data center where the RDS instance is hosted

Answer

Replacing failed hardware components in the RDS host server

Question 20

Which AWS support plan provides access to AWS Infrastructure Event Management (IEM) for product launches and migrations at no additional charge?

Accepted Answer

Enterprise Support. The Enterprise Support plan includes AWS Infrastructure Event Management (IEM) at no additional charge, providing architectural and scaling guidance for product launches and migrations. This is a key differentiator from lower-tier plans, which either do not include IEM or require an extra fee. The Business Support plan offers IEM only as a paid add-on, while Developer and Basic plans lack access entirely.

Answer

Developer Support

Answer

Business Support

Answer

Basic Support