CLF-C02 Practice Exam 53 — 20 Questions

Question 1

A company uses Amazon EC2 instances to run its workloads. The company's IT team does not know the exact physical server where each instance runs, and instances from multiple customers may be hosted on the same physical hardware. The team only specifies the AWS Region and Availability Zone. Which essential characteristic of cloud computing does this scenario BEST represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes how AWS aggregates compute resources from multiple physical hosts into a shared pool, which is then dynamically assigned and reassigned to customers based on demand. The IT team has no control over or knowledge of the exact physical server, and instances from different customers can run on the same hardware, which is the defining behavior of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 2

A development team needs to deploy a web application on AWS. They want to avoid managing the underlying infrastructure, such as EC2 instances and load balancers, but still need the ability to control scaling, update the application code, and perform rollbacks. The application must scale automatically based on demand and remain highly available. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform as a Service (PaaS) model that abstracts the underlying EC2 instances, load balancers, and Auto Scaling groups. It allows the team to upload their application code, and Elastic Beanstalk automatically handles capacity provisioning, load balancing, scaling, and health monitoring. The team retains control over scaling configuration, application version updates, and rollbacks through the Elastic Beanstalk console or CLI, without managing the infrastructure directly.

Answer

Amazon EC2 with Auto Scaling groups and an Application Load Balancer

Answer

AWS Lambda

Answer

Amazon ECS using the EC2 launch type

Question 3

A company is migrating a critical database to Amazon RDS. The database must run continuously for the next 3 years to support the company's operations. The finance team wants to minimize compute costs for this database. However, they have a limited budget and cannot make large upfront payments. They want to commit to a 3-year term to receive the highest possible discount without paying anything upfront. Which pricing option should the finance team select for the DB instance?

Accepted Answer

3-Year No Upfront Reserved DB instances. The finance team wants to commit to a 3-year term to receive the highest possible discount without paying anything upfront. AWS Reserved Instances offer three payment options: All Upfront, Partial Upfront, and No Upfront. The No Upfront option provides a significant discount over On-Demand pricing (typically around 40-60% for a 3-year term) while requiring no upfront payment, making it the most cost-effective choice given the budget constraint. Option D (3-Year No Upfront Reserved DB instances) satisfies both the requirement for a 3-year commitment and the inability to make large upfront payments.

Answer

On-Demand DB instances

Answer

1-Year All Upfront Reserved DB instances

Answer

3-Year Partial Upfront Reserved DB instances

Question 4

A company operates a healthcare application on AWS that must comply with HIPAA regulations. The application stores sensitive patient data in Amazon S3. The compliance team requires that all data at rest in S3 be encrypted with a key that the company manages. The company also needs the ability to automatically rotate the encryption key every 365 days and to audit all key usage through AWS CloudTrail. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with a customer managed key. AWS KMS with a customer managed key (CMK) allows the company to create and control the encryption key used for S3 server-side encryption, meeting HIPAA's requirement for customer-managed keys. KMS supports automatic key rotation every 365 days (or custom period) and integrates with AWS CloudTrail to log every key usage (e.g., Decrypt, Encrypt API calls) for auditing. This combination satisfies all stated requirements: encryption at rest, customer-managed key, automatic rotation, and auditability.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

Amazon S3 server-side encryption with S3-managed keys (SSE-S3)

Question 5

A global gaming company needs to deploy its application in multiple geographic locations to reduce latency for players worldwide. The application must also remain available even if an entire data center fails. The company plans to run the application on Amazon EC2 instances behind an Application Load Balancer. Which combination of AWS global infrastructure components should the company use to meet these requirements?

Accepted Answer

Deploy the application in multiple AWS Regions, each with at least two Availability Zones, and use Amazon Route 53 for DNS-based routing.. Deploying the application in multiple AWS Regions, each with at least two Availability Zones, ensures global low latency by placing compute resources closer to players worldwide, while the multi-AZ architecture within each Region provides high availability even if an entire data center (Availability Zone) fails. Amazon Route 53 then enables DNS-based routing (e.g., latency-based or geolocation routing) to direct player traffic to the optimal Region, meeting both latency and fault tolerance requirements.

Answer

Deploy the application in a single AWS Region across multiple Availability Zones and use Amazon Route 53 with latency-based routing.

Answer

Deploy the application in a single AWS Region within a single Availability Zone and use Amazon CloudFront for content caching.

Answer

Deploy the application in multiple AWS Regions and use Amazon CloudFront with multiple origins, each pointing to an Application Load Balancer in a single Availability Zone.

Question 6

A company uses Amazon WorkMail for corporate email. Employees access email through a web browser or mobile app. The company does not manage any servers, email software, or storage infrastructure. Which cloud service model does this represent?

Accepted Answer

Software as a Service (SaaS). Amazon WorkMail is a fully managed email service where users access their email via a web browser or mobile app without managing any underlying servers, email software, or storage infrastructure. This aligns with the Software as a Service (SaaS) model, where the provider delivers the entire application and the consumer only uses the software over the internet.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Hybrid cloud

Question 7

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.

Answer

AWS CloudFormation StackSets

Answer

AWS Organizations

Answer

AWS Security Hub

Question 8

What is the primary purpose of an AWS Virtual Private Cloud (VPC)?

Accepted Answer

To create a logically isolated virtual network in the AWS Cloud. The primary purpose of an AWS Virtual Private Cloud (VPC) is to create a logically isolated virtual network within the AWS Cloud, where you can launch AWS resources in a defined virtual network that closely resembles a traditional on-premises network. This isolation is achieved through IP address ranges (CIDR blocks), subnets, route tables, and network gateways, giving you full control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

Answer

To provide a CDN for distributing content globally

Answer

To manage user authentication and access control

Answer

To monitor AWS resource usage and performance metrics

Question 9

A company uses multiple AWS accounts and wants to perform detailed custom cost analysis using a third-party business intelligence (BI) tool. The company needs the most granular cost and usage data available, including resource-level details such as instance type, region, and tags. The BI tool can read CSV files from an Amazon S3 bucket. The company wants a managed AWS service that automatically exports this detailed data to an S3 bucket on a daily basis with no additional coding. Which AWS service should the company use?

Accepted Answer

AWS Cost and Usage Reports. AWS Cost and Usage Reports (CUR) is the correct choice because it is a managed AWS service that automatically publishes the most granular cost and usage data—including resource-level details like instance type, region, and tags—to an Amazon S3 bucket in CSV format on a daily basis, with no additional coding required. This directly meets the company's need for detailed custom cost analysis using a third-party BI tool that reads CSV files from S3.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 10

A company's application experiences traffic spikes every weekday morning when employees arrive at work. During off-hours, very few users are active. Which AWS feature automatically adjusts the number of EC2 instances based on demand, adding instances during peak hours and removing them during quiet periods?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is the correct service because it automatically adjusts the number of EC2 instances in response to demand, using scaling policies (e.g., scheduled scaling or dynamic scaling) to add instances during peak hours and terminate them during quiet periods. This directly matches the described traffic pattern of weekday morning spikes and off-hour lulls, without manual intervention.

Answer

Amazon EC2 Reserved Instances

Answer

AWS Elastic Load Balancing

Answer

AWS CloudFormation

Question 11

A media production company has a physical studio in Atlanta, Georgia. The company runs video editing workloads on Amazon EC2 instances that require single-digit millisecond latency to the studio's on-premises storage and workstations. The company wants to use AWS infrastructure that is physically located in or very near Atlanta to achieve this latency, while still having full access to AWS services like EC2, EBS, and VPC. The company does not want to manage the underlying hardware. Which AWS infrastructure option should the company use?

Accepted Answer

AWS Local Zones. AWS Local Zones are an infrastructure deployment that places compute, storage, and database services closer to large population centers, enabling single-digit millisecond latency for latency-sensitive applications. Since the company needs physical proximity to Atlanta without managing hardware, a Local Zone in or near Atlanta provides the required low latency while offering full access to EC2, EBS, and VPC services, with AWS handling the underlying hardware.

Answer

AWS Outposts

Answer

AWS Wavelength

Answer

AWS Edge Locations

Question 12

A company migrates its on-premises applications to AWS. The finance team wants to allocate costs to different departments based on the exact amount of compute, storage, and network resources each department consumes. They also want to set automatic alerts when a department's usage exceeds a predefined budget. Which essential characteristic of cloud computing enables this level of visibility and control over resource consumption?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and report resource usage (compute hours, storage GB, data transfer) at a granular level. This metering data enables the finance team to allocate exact costs per department and set automated budget alerts via services like AWS Budgets or Cost Explorer, directly supporting the requirement for visibility and control over consumption.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Resource pooling

Question 13

A company has multiple AWS accounts used by different departments (Finance, Marketing, Engineering). The finance team wants to see a single monthly bill that aggregates charges from all accounts. Additionally, they want to track costs by department using custom cost allocation tags that each department applies to its resources. Which AWS feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows the company to aggregate charges from all member accounts into a single monthly bill for the finance team. Additionally, it enables the use of cost allocation tags, including custom tags applied by each department, to track and filter costs by department in AWS Cost Explorer and cost reports.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Cost Explorer

Question 14

A security team needs to continuously assess their AWS resources for security vulnerabilities and deviations from security best practices. Which service provides automated security assessments?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of your security posture across AWS accounts by aggregating, organizing, and prioritizing security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It continuously assesses your environment against security standards and best practices (e.g., CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices) and generates automated security assessments and compliance checks. This directly matches the requirement for continuous, automated security assessments.

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Answer

AWS Config

Question 15

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.

Answer

S3 Block Public Access account-level settings

Answer

AWS Config managed rule s3-bucket-public-read-prohibited

Answer

Amazon Macie with a sensitive data discovery job

Question 16

A company has a web application that processes user-uploaded images. When a user uploads an image, the application needs to resize the image into multiple formats (thumbnail, medium, large). The company wants to avoid managing servers and wants the image processing to execute only when a new image is uploaded. The solution must automatically scale to handle thousands of concurrent uploads. Which AWS service should the company use to perform the image processing?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an image upload to Amazon S3. It automatically scales from zero to thousands of concurrent executions, perfectly matching the requirement to avoid managing servers and to process images only when a new upload occurs.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate launch type

Answer

AWS Elastic Beanstalk

Question 17

A startup is evaluating a migration from its on-premises infrastructure to AWS. The CTO notes that AWS can offer significantly lower per-unit costs for compute and storage compared to the startup's own data center. The CTO explains that AWS achieves this by pooling the demand of millions of customers, which allows AWS to negotiate better hardware prices and spread the fixed costs of data centers, power, cooling, and operational staff across a massive customer base. This specific cost advantage of cloud computing is best described by which fundamental concept?

Accepted Answer

Economies of scale. Economies of scale (Option B) is the correct concept because it directly describes how AWS achieves lower per-unit costs by aggregating demand from millions of customers. This massive scale allows AWS to negotiate bulk discounts on hardware, spread fixed costs (data centers, power, cooling, staff) over a huge customer base, and operate at a cost structure that individual startups cannot match. The CTO's description of pooling demand and spreading fixed costs is the textbook definition of economies of scale in cloud computing.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance

Question 18

A company is migrating a large enterprise workload to AWS. They want to understand all the migration strategies available. Which framework categorizes cloud migration strategies as the '7 Rs'?

Accepted Answer

AWS Migration Strategy 7 Rs. The '7 Rs' (Retire, Retain, Rehost, Replatform, Repurchase, Refactor, Relocate) is a specific set of migration strategies defined by AWS to categorize how workloads can be moved to the cloud. This framework is directly referenced in AWS documentation and training as the 'AWS Migration Strategy 7 Rs' and is the standard taxonomy for discussing migration approaches.

Answer

AWS Well-Architected Framework pillars

Answer

AWS Cloud Adoption Framework perspectives

Answer

AWS Service Control Policy levels

Question 19

A company uses AWS CloudTrail to log all API calls in their AWS account for compliance and security auditing. Their compliance officer needs to prove to an external auditor that the CloudTrail log files have not been altered or deleted after they were created. The company must use the most cost-effective and built-in AWS feature to detect any tampering with the log files. What should the company enable?

Accepted Answer

Enable CloudTrail log file integrity validation. CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that is signed with a private key, allowing you to verify that log files have not been modified, deleted, or tampered with after delivery. This is a built-in, no-cost feature that directly meets the compliance officer's requirement to prove log integrity to an external auditor without additional services or costs.

Answer

Enable server-side encryption for the CloudTrail log file S3 bucket using SSE-KMS

Answer

Configure CloudTrail to send logs to CloudWatch Logs and set a metric filter for changes

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket

Question 20

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Config