CLF-C02 Practice Exam 53 — 20 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants a preventive control to ensure that nobody in any account, including account root users, can disable AWS CloudTrail or delete Amazon S3 bucket policies. Which AWS feature should the security team use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they provide centralized preventive controls over the maximum available permissions for all IAM users, roles, and root users in member accounts within AWS Organizations. SCPs can explicitly deny actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:PutBucketPolicy, ensuring that even root users cannot disable CloudTrail or delete S3 bucket policies. This makes SCPs the only AWS feature that can enforce such restrictions across all accounts in an organization.

Answer

IAM roles with multi-factor authentication (MFA)

Answer

AWS Config rules with automatic remediation

Answer

AWS Shield Advanced

Question 2

A developer needs to launch a test server for a new application prototype. The developer logs into the AWS Management Console, selects an Amazon EC2 instance type, configures the security group, and starts the instance. The instance is running within two minutes, and the developer did not need to submit a formal request to the company's IT procurement team or wait for approval from a cloud administrator. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

On-demand self-service. The scenario demonstrates on-demand self-service because the developer was able to provision and launch an EC2 instance directly through the AWS Management Console without any human interaction with IT procurement or a cloud administrator. This characteristic, defined by NIST as a core pillar of cloud computing, allows users to unilaterally provision computing capabilities as needed automatically, which is exactly what happened when the instance was running within two minutes of the console action.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 3

A company operates a social media analytics platform that runs on AWS. The platform experiences unpredictable traffic spikes during major events. The company wants to ensure that compute capacity automatically increases during these spikes without any manual intervention, and decreases when traffic subsides to avoid paying for idle resources. Which characteristic of cloud computing does this business requirement directly rely on?

Accepted Answer

Rapid elasticity. The requirement to automatically scale compute capacity up during traffic spikes and down when traffic subsides directly relies on rapid elasticity, a key characteristic of cloud computing defined by the NIST SP 800-145 standard. Rapid elasticity enables resources to be provisioned and released elastically, often automatically, to match demand at any scale, which is essential for handling unpredictable traffic on a social media analytics platform without manual intervention.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 4

A company runs a production web application on Amazon EC2 and Amazon RDS. The internal IT team needs a support plan that provides a guaranteed response time of less than one hour for a production system outage. Additionally, the company wants access to AWS Infrastructure Event Management, which includes guidance from AWS experts during planned events such as product launches or migrations. The company does not require a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

Accepted Answer

Business Support. The Business Support plan is the correct choice because it provides a guaranteed response time of less than one hour for production system outages (production system impaired) and includes access to AWS Infrastructure Event Management for guidance during planned events. The company does not need a dedicated Technical Account Manager (TAM), which is only available with the Enterprise Support plan, making Business Support the most cost-effective option that meets all stated requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise Support

Question 5

A company runs a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that allows them to create custom rules to filter malicious HTTP traffic and integrates directly with the ALB and Amazon CloudFront. Which AWS service should the security team configure?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects against common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers (ALB) and Amazon CloudFront, and allows you to create custom rules to filter malicious HTTP traffic based on conditions such as IP addresses, HTTP headers, and request body patterns.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

AWS Network Firewall

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any user or role in any member account from disabling AWS CloudTrail or deleting CloudTrail log files from Amazon S3. The team needs a solution that is centrally managed from the management account and applies to all current and future member accounts automatically. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts within an organization. By attaching an SCP that explicitly denies the actions to disable CloudTrail or delete CloudTrail log files from S3, the security team can enforce this policy across all current and future member accounts from the management account, as SCPs automatically apply to new accounts added to the organization.

Answer

AWS Config conformance packs

Answer

IAM permissions boundaries

Answer

AWS CloudTrail data events

Question 7

A company runs a web application on Amazon EC2 instances that connect to a relational database. The application requires high database availability so that if the primary database instance fails, a standby instance automatically takes over without manual intervention. The company wants to minimize administrative overhead for database patching, backups, and replication. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon RDS Multi-AZ. Amazon RDS Multi-AZ provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. If the primary database instance fails, Amazon RDS automatically fails over to the standby, ensuring minimal downtime without manual intervention. Additionally, RDS handles patching, backups, and replication automatically, reducing administrative overhead.

Answer

Amazon RDS Single-AZ

Answer

Amazon DynamoDB Global Tables

Answer

Amazon S3

Question 8

A company runs a web application on AWS that experiences unpredictable traffic spikes. The operations team wants the infrastructure to automatically add compute capacity when demand increases and remove it when demand decreases, without manual intervention. The team also wants to pay only for the compute resources they actually use. Which cloud computing concept does this scenario best describe?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, AWS services like Auto Scaling groups and Amazon EC2 can add instances during traffic spikes and terminate them when demand drops, ensuring the infrastructure matches workload requirements without manual intervention.

Answer

High availability

Answer

Fault tolerance

Answer

Pay-as-you-go

Question 9

A company runs a web application on Amazon EC2 instances. The finance team wants to set a monthly spending limit for the application and receive email alerts when the actual cost exceeds 80% of that limit. Additionally, they want the system to automatically stop non-critical EC2 instances if the cost exceeds the limit. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set a monthly spending limit (budget) and configure cost alerts that trigger when actual or forecasted costs exceed a specified threshold (e.g., 80% of the limit). It also integrates with AWS Actions to automatically stop non-critical EC2 instances when the budget limit is exceeded, meeting both the alert and automated remediation requirements.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a consistent set of security group rules across all accounts. For example, they want to ensure that no security group in any account allows inbound SSH (port 22) from the internet (0.0.0.0/0). If a non-compliant security group is created, the service should automatically remediate by removing the offending rule or by applying a corrective policy. The company wants a managed AWS service that centrally applies these rules and requires no custom scripting. Which AWS service should the security team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized, managed way to apply security group rules across all accounts in an AWS Organization. It can automatically detect non-compliant security groups (e.g., those allowing SSH from 0.0.0.0/0) and remediate them by removing the offending rule or applying a corrective policy, all without custom scripting.

Answer

AWS Config

Answer

AWS Organizations

Answer

AWS Shield Advanced

Question 11

A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS allows you to create customer managed keys (CMKs) with automatic annual rotation enabled. You retain control over key policies and access permissions, while AWS handles the rotation of the key material. This satisfies the compliance requirement for encrypted data at rest in S3 with automatic yearly key rotation.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 12

A company uses multiple AWS accounts managed through AWS Organizations. The finance team wants to receive a notification when the overall monthly spending in any account reaches 80% of the budgeted amount. Additionally, the team wants to be alerted if there is an unexpected daily spike in costs, such as a 50% increase compared to the previous day, so they can investigate anomalies early. Which AWS feature should the finance team configure to meet both requirements with a single managed service?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed (or are expected to exceed) your budgeted thresholds. You can configure a cost budget with an alert at 80% of the monthly budgeted amount, and also create a separate budget or use a cost anomaly detection integration to trigger an alert when daily costs spike by 50% compared to the previous day. This meets both requirements using a single managed service.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application normally handles 1,000 requests per second, but occasionally experiences unpredictable spikes of up to 10,000 requests per second for a few minutes. The Auto Scaling group is configured with a maximum capacity of 2,000 instances, which is insufficient to handle the spikes. The company must ensure that no requests are lost during these spikes without requiring manual scaling. Which solution should the company implement?

Accepted Answer

Use an Amazon SQS queue between the ALB and the EC2 instances to decouple the request flow and buffer excess requests.. Option B is correct because an Amazon SQS queue decouples the ALB from the EC2 instances, allowing the ALB to offload excess requests into the queue during traffic spikes. The EC2 instances then process messages from the queue at their own pace, ensuring no requests are lost even if the spike exceeds the Auto Scaling group's maximum capacity. This buffering mechanism handles unpredictable bursts without requiring manual intervention or pre-provisioning.

Answer

Configure an Amazon CloudFront distribution in front of the ALB to cache responses and absorb the spike.

Answer

Enable Amazon EC2 Auto Scaling with predictive scaling to forecast and pre-provision capacity for the spikes.

Answer

Register additional EC2 instances in an on-premises data center as targets for the ALB and use manual failover.

Question 14

A company's finance team needs to analyze AWS spending in detail. They require a report that includes hourly cost data for each AWS service, each individual resource (e.g., a specific EC2 instance), and any cost allocation tags applied. The team plans to export this data to an Amazon S3 bucket and then import it into a custom business intelligence (BI) analytics dashboard. Which AWS tool should the finance team use to generate this level of detailed cost data?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the correct tool because it provides the granular, hourly cost data broken down by AWS service, individual resource (e.g., specific EC2 instance IDs), and cost allocation tags. It can be delivered to an S3 bucket for integration with custom BI tools like Amazon QuickSight or third-party dashboards, meeting the finance team's exact requirements.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 15

A company currently uses the AWS Basic Support plan. The CTO wants to access the complete set of AWS Trusted Advisor checks, including those related to cost optimization and performance. Additionally, the CTO requires a guaranteed response time of less than 15 minutes for critical business-impairing issues. Which AWS Support plan should the company choose to meet all of these requirements?

Accepted Answer

AWS Enterprise Support. The AWS Enterprise Support plan is the only plan that provides access to the complete set of AWS Trusted Advisor checks, including cost optimization and performance checks, along with a guaranteed response time of less than 15 minutes for critical business-impairing issues. The Business Support plan offers a 15-minute response time for critical issues but only includes core Trusted Advisor checks, not the full set. The Developer Support plan lacks both the full Trusted Advisor checks and the critical response time guarantee.

Answer

AWS Business Support

Answer

AWS Developer Support

Answer

AWS Basic Support

Question 16

A company archives historical transaction records in Amazon S3. The records are accessed frequently for the first 30 days after creation. After 30 days, access drops sharply to only a few times per year, but the company must be able to retrieve any record within 5 minutes if needed. The company wants to minimize storage costs while meeting the retrieval time requirement. Which combination of S3 storage classes should the company use?

Accepted Answer

Use S3 Standard for the first 30 days, then transition to S3 Glacier Flexible Retrieval.. Option B is correct because S3 Standard provides low-latency access for the first 30 days when records are frequently accessed, and then lifecycle rules transition the data to S3 Glacier Flexible Retrieval, which offers retrieval times of minutes (typically 1–5 minutes for expedited retrievals) at a much lower storage cost. This combination meets the 5-minute retrieval requirement while minimizing costs for data that is rarely accessed after 30 days.

Answer

Use S3 Standard for all data.

Answer

Use S3 Standard-IA for the first 30 days, then transition to S3 Glacier Deep Archive.

Answer

Use S3 One Zone-IA for the first 30 days, then transition to S3 Glacier Deep Archive.

Question 17

A company's development team frequently needs temporary test environments. A developer can log into the AWS Management Console, select an Amazon EC2 instance type, configure storage, and launch the instance within minutes without any interaction with the IT infrastructure team. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes a developer independently provisioning EC2 instances without requiring IT intervention. This directly matches the 'on-demand self-service' characteristic of cloud computing, where users can provision computing resources as needed automatically, without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 18

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports (including PCI DSS reports) and agreements such as the Business Associate Addendum (BAA) for HIPAA. It allows the compliance officer to review, download, and sign these documents directly from the AWS Management Console, meeting the requirement for a single managed service.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon Inspector

Question 19

A company has 50 TB of historical data stored on on-premises network-attached storage (NAS). The company wants to transfer this data to Amazon S3. The internet connection provides only 10 Mbps upload speed, and the company wants to complete the transfer within 2 weeks. The data is not sensitive and does not require encryption during transfer. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Snowball Edge. AWS Snowball Edge is the correct choice because it is a physical data transport solution designed for large-scale data transfers over slow or unreliable networks. With 50 TB of data and only 10 Mbps upload speed, transferring over the internet would take approximately 50 TB * 8 bits/byte / (10 Mbps) ≈ 11,574 hours (482 days), far exceeding the 2-week window. Snowball Edge allows the company to physically ship the data to AWS, bypassing network constraints entirely.

Answer

AWS DataSync

Answer

AWS Storage Gateway (File Gateway)

Answer

AWS Direct Connect

Question 20

A company has a mobile application that allows users to upload profile photos. When a new photo is uploaded to an Amazon S3 bucket, the application must automatically create a thumbnail version and store it in another S3 bucket. The company wants a solution that runs only when needed, scales automatically, and requires no management of underlying servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 PUT object event. It automatically scales from zero to thousands of concurrent executions based on the number of incoming uploads, and requires no server management, perfectly meeting the requirement for an on-demand, auto-scaling thumbnail generation solution.

Answer

AWS Batch

Answer

Amazon EC2

Answer

Amazon ECS with EC2 launch type