CLF-C02 Practice Exam 52 — 20 Questions

Question 1

A company has two separate VPCs — one for development workloads and one for a shared services environment — and wants EC2 instances in both VPCs to communicate with each other using private IP addresses without traffic traversing the public internet. Which AWS feature enables this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Peering. VPC Peering enables direct network connectivity between two VPCs using private IP addresses, with traffic routed entirely within the AWS network backbone. This allows EC2 instances in the development VPC and the shared services VPC to communicate without traversing the public internet, as traffic stays within the AWS global infrastructure.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Direct Connect

Question 2

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 3

A company runs a development environment composed of multiple Amazon EC2 instances. The finance team has set a monthly budget of $5,000 for this environment and wants to automatically stop all EC2 instances if the accumulated cost reaches $4,500 before the end of the month. The team needs a managed AWS-native solution that does not require custom scripts or third-party tools. Which AWS feature or service should the company use to meet this requirement?

Accepted Answer

AWS Budgets with a budget action that stops EC2 instances when the threshold is exceeded. AWS Budgets allows you to set a cost budget with an associated budget action that can automatically stop EC2 instances when the actual or forecasted cost exceeds a specified threshold (e.g., $4,500). This is a fully managed, native AWS solution that requires no custom scripts or third-party tools, directly meeting the requirement to stop instances automatically based on cost.

Answer

AWS Cost Explorer with a saved filter and manual instance termination

Answer

AWS Trusted Advisor cost optimization checks

Answer

AWS Organizations Service Control Policies (SCPs)

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct choice because it integrates directly with Application Load Balancers to provision, deploy, and automatically renew SSL/TLS certificates. ACM manages the entire certificate lifecycle, including private key generation and storage, without requiring manual intervention. This meets the security team's requirement for automatic renewal and AWS-managed certificate lifecycle.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Question 5

A company runs a production web application on a fleet of Amazon EC2 instances. The operations team has observed that most instances have an average CPU utilization below 10% over the past month. They want to receive automated, ML-based recommendations for downsizing these instances to smaller instance types to reduce costs without compromising performance. The team also wants to see the estimated monthly savings for each recommendation. Which AWS service should the operations team use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (such as CPU, memory, and network) of EC2 instances and provides actionable recommendations to downsize or rightsize instances. It specifically generates estimated monthly savings for each recommendation, directly addressing the need for automated, ML-based downsizing suggestions without compromising performance.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 6

A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS) using pre-configured rule sets (e.g., AWS Managed Rules). It integrates natively with both CloudFront and Application Load Balancers (ALBs) without requiring additional infrastructure, and it supports geo-blocking to restrict requests from specific countries, meeting all stated requirements.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Question 7

A company runs a variety of workloads on AWS and wants to be notified when their monthly spending behaves unusually compared to past patterns. They want a managed service that uses machine learning to detect cost anomalies and provides root cause analysis. Which AWS service or feature should they use?

Accepted Answer

AWS Cost Anomaly Detection. AWS Cost Anomaly Detection is a managed service that leverages machine learning to continuously monitor your cost and usage patterns, detect anomalies, and provide root cause analysis. It automatically establishes a baseline from historical spending data and alerts you when actual spending deviates from expected patterns, making it the correct choice for this use case.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 8

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 9

A company runs multiple applications across hundreds of Amazon EC2 instances in several AWS accounts. The finance team needs to perform daily cost analysis by combining detailed usage data (including instance type, operating system, and custom cost allocation tags) with their own business data stored in an on-premises data warehouse. They want to export cost and usage data from AWS at the most granular level possible (down to each individual resource and hour) into their on-premises system for custom reporting. Which AWS tool should they use to achieve this?

Accepted Answer

AWS Cost and Usage Report. AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular cost and usage data available, down to individual resource IDs and hourly intervals, and supports custom cost allocation tags. It can be delivered to an Amazon S3 bucket and then integrated with on-premises systems for custom reporting, meeting the finance team's requirement for detailed daily cost analysis combined with their own business data.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 10

A company runs multiple containerized applications on a single Amazon ECS cluster using AWS Fargate. The company's compliance team asks whether sharing the same underlying physical hardware with other AWS customers introduces security risks. The company explains that AWS isolates each customer's compute environment, even though resources are drawn from a shared pool. Which essential characteristic of cloud computing does this arrangement best illustrate?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic where a provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. AWS Fargate abstracts the underlying infrastructure, so even though containers run on shared physical hardware, each customer's compute environment is isolated at the hypervisor and kernel level. This arrangement directly illustrates resource pooling because the provider manages the shared pool while ensuring logical separation between tenants.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 11

A company's IT team manually provisions S3 buckets, EC2 instances, security groups, and IAM roles for each new project using the AWS Management Console. This process often results in configuration errors, such as overly permissive security rules or incorrect tagging, which the security team then has to fix manually. The company wants to define its entire infrastructure in a declarative template file, store it in version control, and have AWS automatically create or update the resources based on that template. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire infrastructure—including S3 buckets, EC2 instances, security groups, and IAM roles—in a declarative JSON or YAML template. You can store this template in version control, and CloudFormation automatically provisions or updates the resources to match the template, eliminating manual configuration errors like overly permissive security rules or incorrect tagging.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 12

Which AWS support plan provides access to AWS Infrastructure Event Management (IEM) for product launches and migrations at no additional charge?

Accepted Answer

Enterprise Support. The Enterprise Support plan includes AWS Infrastructure Event Management (IEM) at no additional charge, providing architectural and scaling guidance for product launches and migrations. This is a key differentiator from lower-tier plans, which either do not include IEM or require an extra fee. The Business Support plan offers IEM only as a paid add-on, while Developer and Basic plans lack access entirely.

Answer

Developer Support

Answer

Business Support

Answer

Basic Support

Question 13

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 14

A development team uses AWS developer tools for their entire software delivery process: a Git-based code repository, automated compilation and testing, and automated deployment to EC2 instances. Which combination of AWS services provides these three capabilities?

Accepted Answer

AWS CodeCommit, AWS CodeBuild, and AWS CodeDeploy. AWS CodeCommit provides a Git-based code repository for source control. AWS CodeBuild performs automated compilation and testing. AWS CodeDeploy automates deployment to EC2 instances. Together, these three services directly map to the three capabilities described in the question.

Answer

AWS CloudFormation, AWS Elastic Beanstalk, and Amazon EC2

Answer

Amazon S3, AWS Lambda, and Amazon CloudWatch

Answer

AWS CodePipeline, Amazon ECR, and Amazon ECS

Question 15

AWS builds and operates large physical data centres and uses virtualisation to serve thousands of customers simultaneously on shared hardware while keeping each customer's data logically isolated. Which cloud computing characteristic does this describe?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because AWS uses virtualization to aggregate physical hardware from its data centers into a shared pool of compute, storage, and network resources that can be dynamically assigned and reassigned to multiple customers. Each customer's data remains logically isolated through hypervisor-level isolation (e.g., using Xen or Nitro hypervisors), but the underlying hardware is shared, which is the essence of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Measured service

Answer

Rapid elasticity

Question 16

A company has migrated its IT infrastructure to AWS. The company's finance team receives a monthly bill that itemizes charges based on the number of Amazon EC2 instance hours consumed, the amount of Amazon S3 storage used in gigabyte-months, and the total data transferred out to the internet. The cloud provider automatically tracks and reports this usage data for billing purposes. This scenario best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Measured service. The scenario describes a cloud provider automatically tracking and reporting usage data (EC2 instance hours, S3 storage in gigabyte-months, and data transfer) for billing purposes. This is the essence of measured service, where cloud resources are metered and usage is monitored, controlled, and reported transparently. The pay-per-use billing model relies on this characteristic to provide cost visibility and optimization.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 17

An e-commerce company runs a MySQL database on-premises to support its transactional workload. The company plans to migrate this database to AWS to reduce operational overhead. The company requires a fully managed database solution that automatically replicates data across multiple Availability Zones to provide failover in the event of an Availability Zone failure. The company does not want to manage database patching, backup scheduling, or replication. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon RDS with Multi-AZ deployment. Amazon RDS with Multi-AZ deployment is the correct choice because it provides a fully managed MySQL database that automatically replicates data synchronously across multiple Availability Zones, enabling automatic failover in the event of an AZ failure. AWS handles patching, backup scheduling, and replication management, meeting the company's requirement to reduce operational overhead.

Answer

Amazon DynamoDB

Answer

Amazon EC2 with a self-managed MySQL installation

Answer

Amazon Redshift

Question 18

A company wants to use Amazon S3 as their data lake but needs a way to track, search, and govern all datasets across multiple S3 buckets. Which AWS service provides centralized data catalog management?

Accepted Answer

AWS Glue Data Catalog. AWS Glue Data Catalog is a fully managed, centralized metadata repository that stores table definitions, schema information, and partition details for datasets across multiple S3 buckets. It integrates with AWS Glue ETL, Amazon Athena, and Amazon Redshift Spectrum to provide a unified view for tracking, searching, and governing data lake assets, making it the correct choice for centralized data catalog management.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Lake Formation

Question 19

A company is developing a real-time multiplayer game that requires extremely low latency (under 10ms) for player interactions. The game will be accessed by mobile users on 5G networks in select metropolitan areas. The company wants to run the game server logic as close to the users as possible, leveraging the low latency of 5G and avoiding the round trip to an AWS Region. Which AWS service should the company use to deploy the game server compute at the edge of the 5G network?

Accepted Answer

AWS Wavelength. AWS Wavelength is designed specifically to bring AWS compute and storage services to the edge of 5G networks, embedding AWS infrastructure within telecommunications providers' data centers. This enables sub-10ms latency for mobile users by eliminating the round trip to a regional AWS Region, making it ideal for real-time multiplayer game server logic on 5G.

Answer

AWS Outposts

Answer

AWS Local Zones

Answer

AWS Global Accelerator

Question 20

A company runs a production MySQL database on Amazon RDS. The workload has a steady baseline usage that requires a db.r5.large instance most of the time, but during end-of-month processing, the database needs to scale up to a db.r5.xlarge for a few days. The company wants to maximize cost savings while retaining the ability to temporarily scale up the instance during those peaks and still receive a discounted rate. Which purchasing option should the company choose?

Accepted Answer

Convertible Reserved Instance. Convertible Reserved Instances (RIs) allow you to change instance attributes (such as size) during the term, which fits the need to temporarily scale from db.r5.large to db.r5.xlarge for a few days each month. They offer a significant discount over On-Demand pricing (typically 30-50%) while retaining flexibility to modify the instance type. Standard RIs lock you into a specific instance family and size, making them unsuitable for this variable workload.

Answer

Standard Reserved Instance

Answer

Compute Savings Plan

Answer

On-Demand