CLF-C02 Practice Exam 52 — 20 Questions

Question 1

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 2

A development team uses AWS developer tools for their entire software delivery process: a Git-based code repository, automated compilation and testing, and automated deployment to EC2 instances. Which combination of AWS services provides these three capabilities?

Accepted Answer

AWS CodeCommit, AWS CodeBuild, and AWS CodeDeploy. AWS CodeCommit provides a Git-based code repository for source control. AWS CodeBuild performs automated compilation and testing. AWS CodeDeploy automates deployment to EC2 instances. Together, these three services directly map to the three capabilities described in the question.

Answer

AWS CloudFormation, AWS Elastic Beanstalk, and Amazon EC2

Answer

Amazon S3, AWS Lambda, and Amazon CloudWatch

Answer

AWS CodePipeline, Amazon ECR, and Amazon ECS

Question 3

AWS builds and operates large physical data centres and uses virtualisation to serve thousands of customers simultaneously on shared hardware while keeping each customer's data logically isolated. Which cloud computing characteristic does this describe?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because AWS uses virtualization to aggregate physical hardware from its data centers into a shared pool of compute, storage, and network resources that can be dynamically assigned and reassigned to multiple customers. Each customer's data remains logically isolated through hypervisor-level isolation (e.g., using Xen or Nitro hypervisors), but the underlying hardware is shared, which is the essence of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Measured service

Answer

Rapid elasticity

Question 4

A company stores sensitive financial data in Amazon S3. The company's security policy requires that all data be encrypted at rest using a key that the company creates and manages, with the ability to rotate the key annually. The company also needs an audit trail of when the key was used and by which AWS service. Which solution should the company use to meet these requirements?

Accepted Answer

Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with a customer managed key (CMK) allows the company to create and manage its own encryption key, enable automatic annual key rotation via AWS KMS, and provides detailed CloudTrail audit logs of every KMS API call (e.g., Decrypt, GenerateDataKey) showing which AWS service or user used the key. This satisfies all stated requirements: customer-managed key, annual rotation, and audit trail.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use client-side encryption with an AWS KMS managed key.

Question 5

A company has migrated its IT infrastructure to AWS. The company's finance team receives a monthly bill that itemizes charges based on the number of Amazon EC2 instance hours consumed, the amount of Amazon S3 storage used in gigabyte-months, and the total data transferred out to the internet. The cloud provider automatically tracks and reports this usage data for billing purposes. This scenario best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Measured service. The scenario describes a cloud provider automatically tracking and reporting usage data (EC2 instance hours, S3 storage in gigabyte-months, and data transfer) for billing purposes. This is the essence of measured service, where cloud resources are metered and usage is monitored, controlled, and reported transparently. The pay-per-use billing model relies on this characteristic to provide cost visibility and optimization.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 6

An e-commerce company runs a MySQL database on-premises to support its transactional workload. The company plans to migrate this database to AWS to reduce operational overhead. The company requires a fully managed database solution that automatically replicates data across multiple Availability Zones to provide failover in the event of an Availability Zone failure. The company does not want to manage database patching, backup scheduling, or replication. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon RDS with Multi-AZ deployment. Amazon RDS with Multi-AZ deployment is the correct choice because it provides a fully managed MySQL database that automatically replicates data synchronously across multiple Availability Zones, enabling automatic failover in the event of an AZ failure. AWS handles patching, backup scheduling, and replication management, meeting the company's requirement to reduce operational overhead.

Answer

Amazon DynamoDB

Answer

Amazon EC2 with a self-managed MySQL installation

Answer

Amazon Redshift

Question 7

A company wants to use Amazon S3 as their data lake but needs a way to track, search, and govern all datasets across multiple S3 buckets. Which AWS service provides centralized data catalog management?

Accepted Answer

AWS Glue Data Catalog. AWS Glue Data Catalog is a fully managed, centralized metadata repository that stores table definitions, schema information, and partition details for datasets across multiple S3 buckets. It integrates with AWS Glue ETL, Amazon Athena, and Amazon Redshift Spectrum to provide a unified view for tracking, searching, and governing data lake assets, making it the correct choice for centralized data catalog management.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Lake Formation

Question 8

A company is developing a real-time multiplayer game that requires extremely low latency (under 10ms) for player interactions. The game will be accessed by mobile users on 5G networks in select metropolitan areas. The company wants to run the game server logic as close to the users as possible, leveraging the low latency of 5G and avoiding the round trip to an AWS Region. Which AWS service should the company use to deploy the game server compute at the edge of the 5G network?

Accepted Answer

AWS Wavelength. AWS Wavelength is designed specifically to bring AWS compute and storage services to the edge of 5G networks, embedding AWS infrastructure within telecommunications providers' data centers. This enables sub-10ms latency for mobile users by eliminating the round trip to a regional AWS Region, making it ideal for real-time multiplayer game server logic on 5G.

Answer

AWS Outposts

Answer

AWS Local Zones

Answer

AWS Global Accelerator

Question 9

A company runs a production MySQL database on Amazon RDS. The workload has a steady baseline usage that requires a db.r5.large instance most of the time, but during end-of-month processing, the database needs to scale up to a db.r5.xlarge for a few days. The company wants to maximize cost savings while retaining the ability to temporarily scale up the instance during those peaks and still receive a discounted rate. Which purchasing option should the company choose?

Accepted Answer

Convertible Reserved Instance. Convertible Reserved Instances (RIs) allow you to change instance attributes (such as size) during the term, which fits the need to temporarily scale from db.r5.large to db.r5.xlarge for a few days each month. They offer a significant discount over On-Demand pricing (typically 30-50%) while retaining flexibility to modify the instance type. Standard RIs lock you into a specific instance family and size, making them unsuitable for this variable workload.

Answer

Standard Reserved Instance

Answer

Compute Savings Plan

Answer

On-Demand

Question 10

A company uses Amazon EC2 instances to run its workloads. The company's IT team does not know the exact physical server where each instance runs, and instances from multiple customers may be hosted on the same physical hardware. The team only specifies the AWS Region and Availability Zone. Which essential characteristic of cloud computing does this scenario BEST represent?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes how AWS aggregates compute resources from multiple physical hosts into a shared pool, which is then dynamically assigned and reassigned to customers based on demand. The IT team has no control over or knowledge of the exact physical server, and instances from different customers can run on the same hardware, which is the defining behavior of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 11

A development team needs to deploy a web application on AWS. They want to avoid managing the underlying infrastructure, such as EC2 instances and load balancers, but still need the ability to control scaling, update the application code, and perform rollbacks. The application must scale automatically based on demand and remain highly available. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform as a Service (PaaS) model that abstracts the underlying EC2 instances, load balancers, and Auto Scaling groups. It allows the team to upload their application code, and Elastic Beanstalk automatically handles capacity provisioning, load balancing, scaling, and health monitoring. The team retains control over scaling configuration, application version updates, and rollbacks through the Elastic Beanstalk console or CLI, without managing the infrastructure directly.

Answer

Amazon EC2 with Auto Scaling groups and an Application Load Balancer

Answer

AWS Lambda

Answer

Amazon ECS using the EC2 launch type

Question 12

A company is migrating a critical database to Amazon RDS. The database must run continuously for the next 3 years to support the company's operations. The finance team wants to minimize compute costs for this database. However, they have a limited budget and cannot make large upfront payments. They want to commit to a 3-year term to receive the highest possible discount without paying anything upfront. Which pricing option should the finance team select for the DB instance?

Accepted Answer

3-Year No Upfront Reserved DB instances. The finance team wants to commit to a 3-year term to receive the highest possible discount without paying anything upfront. AWS Reserved Instances offer three payment options: All Upfront, Partial Upfront, and No Upfront. The No Upfront option provides a significant discount over On-Demand pricing (typically around 40-60% for a 3-year term) while requiring no upfront payment, making it the most cost-effective choice given the budget constraint. Option D (3-Year No Upfront Reserved DB instances) satisfies both the requirement for a 3-year commitment and the inability to make large upfront payments.

Answer

On-Demand DB instances

Answer

1-Year All Upfront Reserved DB instances

Answer

3-Year Partial Upfront Reserved DB instances

Question 13

A company operates a healthcare application on AWS that must comply with HIPAA regulations. The application stores sensitive patient data in Amazon S3. The compliance team requires that all data at rest in S3 be encrypted with a key that the company manages. The company also needs the ability to automatically rotate the encryption key every 365 days and to audit all key usage through AWS CloudTrail. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with a customer managed key. AWS KMS with a customer managed key (CMK) allows the company to create and control the encryption key used for S3 server-side encryption, meeting HIPAA's requirement for customer-managed keys. KMS supports automatic key rotation every 365 days (or custom period) and integrates with AWS CloudTrail to log every key usage (e.g., Decrypt, Encrypt API calls) for auditing. This combination satisfies all stated requirements: encryption at rest, customer-managed key, automatic rotation, and auditability.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

Amazon S3 server-side encryption with S3-managed keys (SSE-S3)

Question 14

A global gaming company needs to deploy its application in multiple geographic locations to reduce latency for players worldwide. The application must also remain available even if an entire data center fails. The company plans to run the application on Amazon EC2 instances behind an Application Load Balancer. Which combination of AWS global infrastructure components should the company use to meet these requirements?

Accepted Answer

Deploy the application in multiple AWS Regions, each with at least two Availability Zones, and use Amazon Route 53 for DNS-based routing.. Deploying the application in multiple AWS Regions, each with at least two Availability Zones, ensures global low latency by placing compute resources closer to players worldwide, while the multi-AZ architecture within each Region provides high availability even if an entire data center (Availability Zone) fails. Amazon Route 53 then enables DNS-based routing (e.g., latency-based or geolocation routing) to direct player traffic to the optimal Region, meeting both latency and fault tolerance requirements.

Answer

Deploy the application in a single AWS Region across multiple Availability Zones and use Amazon Route 53 with latency-based routing.

Answer

Deploy the application in a single AWS Region within a single Availability Zone and use Amazon CloudFront for content caching.

Answer

Deploy the application in multiple AWS Regions and use Amazon CloudFront with multiple origins, each pointing to an Application Load Balancer in a single Availability Zone.

Question 15

A company uses Amazon WorkMail for corporate email. Employees access email through a web browser or mobile app. The company does not manage any servers, email software, or storage infrastructure. Which cloud service model does this represent?

Accepted Answer

Software as a Service (SaaS). Amazon WorkMail is a fully managed email service where users access their email via a web browser or mobile app without managing any underlying servers, email software, or storage infrastructure. This aligns with the Software as a Service (SaaS) model, where the provider delivers the entire application and the consumer only uses the software over the internet.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Hybrid cloud

Question 16

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.

Answer

AWS CloudFormation StackSets

Answer

AWS Organizations

Answer

AWS Security Hub

Question 17

What is the primary purpose of an AWS Virtual Private Cloud (VPC)?

Accepted Answer

To create a logically isolated virtual network in the AWS Cloud. The primary purpose of an AWS Virtual Private Cloud (VPC) is to create a logically isolated virtual network within the AWS Cloud, where you can launch AWS resources in a defined virtual network that closely resembles a traditional on-premises network. This isolation is achieved through IP address ranges (CIDR blocks), subnets, route tables, and network gateways, giving you full control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

Answer

To provide a CDN for distributing content globally

Answer

To manage user authentication and access control

Answer

To monitor AWS resource usage and performance metrics

Question 18

A company uses multiple AWS accounts and wants to perform detailed custom cost analysis using a third-party business intelligence (BI) tool. The company needs the most granular cost and usage data available, including resource-level details such as instance type, region, and tags. The BI tool can read CSV files from an Amazon S3 bucket. The company wants a managed AWS service that automatically exports this detailed data to an S3 bucket on a daily basis with no additional coding. Which AWS service should the company use?

Accepted Answer

AWS Cost and Usage Reports. AWS Cost and Usage Reports (CUR) is the correct choice because it is a managed AWS service that automatically publishes the most granular cost and usage data—including resource-level details like instance type, region, and tags—to an Amazon S3 bucket in CSV format on a daily basis, with no additional coding required. This directly meets the company's need for detailed custom cost analysis using a third-party BI tool that reads CSV files from S3.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 19

A company's application experiences traffic spikes every weekday morning when employees arrive at work. During off-hours, very few users are active. Which AWS feature automatically adjusts the number of EC2 instances based on demand, adding instances during peak hours and removing them during quiet periods?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is the correct service because it automatically adjusts the number of EC2 instances in response to demand, using scaling policies (e.g., scheduled scaling or dynamic scaling) to add instances during peak hours and terminate them during quiet periods. This directly matches the described traffic pattern of weekday morning spikes and off-hour lulls, without manual intervention.

Answer

Amazon EC2 Reserved Instances

Answer

AWS Elastic Load Balancing

Answer

AWS CloudFormation

Question 20

A media production company has a physical studio in Atlanta, Georgia. The company runs video editing workloads on Amazon EC2 instances that require single-digit millisecond latency to the studio's on-premises storage and workstations. The company wants to use AWS infrastructure that is physically located in or very near Atlanta to achieve this latency, while still having full access to AWS services like EC2, EBS, and VPC. The company does not want to manage the underlying hardware. Which AWS infrastructure option should the company use?

Accepted Answer

AWS Local Zones. AWS Local Zones are an infrastructure deployment that places compute, storage, and database services closer to large population centers, enabling single-digit millisecond latency for latency-sensitive applications. Since the company needs physical proximity to Atlanta without managing hardware, a Local Zone in or near Atlanta provides the required low latency while offering full access to EC2, EBS, and VPC services, with AWS handling the underlying hardware.

Answer

AWS Outposts

Answer

AWS Wavelength

Answer

AWS Edge Locations