CLF-C02 Practice Exam 54 — 20 Questions

Question 1

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 2

A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is correct because it provides managed rules like 'iam-user-mfa-enabled' that can continuously evaluate whether all IAM users have MFA enabled. When a new user is created without MFA, AWS Config can trigger an Amazon SNS notification via its compliance change event, meeting both the verification and notification requirements automatically.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 3

A company has 50 TB of on-premises file server data that must be transferred to Amazon S3. The company's internet connection is limited to 100 Mbps, and the data transfer must not impact daily business operations. The company needs a physical device to securely copy the data and then ship it to AWS for ingestion. Which AWS service should the company use?

Accepted Answer

AWS Snowball. AWS Snowball is a physical data transport solution designed for large-scale data transfers when network bandwidth is limited or unreliable. With 50 TB of data and a 100 Mbps connection, transferring over the network would take approximately 46 days and saturate the link, impacting business operations. Snowball provides a rugged, secure device that you copy data to locally and ship to AWS, bypassing the network entirely.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 4

A company has a global user base that uploads images to an Amazon S3 bucket in the us-east-1 Region. Users report slow upload speeds and frequent timeouts when uploading large files from distant locations. The company wants to use the AWS global network and edge locations to accelerate uploads to the S3 bucket. The solution must require minimal infrastructure changes on the client side and must be configured at the bucket level. Which AWS feature should the company enable?

Accepted Answer

Amazon S3 Transfer Acceleration. Amazon S3 Transfer Acceleration (A) uses AWS edge locations to route uploads over the AWS global network, reducing latency and timeouts for large files from distant locations. It is enabled at the bucket level and requires only a simple client-side change (using the accelerated endpoint instead of the standard S3 endpoint), meeting the requirement for minimal client-side modifications.

Answer

Amazon CloudFront with an origin access identity

Answer

AWS Global Accelerator using a custom routing accelerator

Answer

Amazon S3 cross-region replication

Question 5

A company collects sensor data from IoT devices and stores the data in Amazon S3. For the first 90 days, the data is accessed frequently for real-time analysis. After 90 days, the data is rarely accessed but must be retrievable within 24 hours for compliance audits. After 365 days, the data must be retained for legal purposes but can be deleted after 7 years. Which S3 storage class should the company use for the data from day 91 to day 365 to minimize storage costs while meeting the retrieval time requirement?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). From day 91 to day 365, the data is rarely accessed but must be retrievable within 24 hours. Amazon S3 Standard-IA (S3 Standard-IA) is designed for infrequently accessed data that needs rapid access when required, with retrieval times in milliseconds, easily meeting the 24-hour requirement. It offers lower storage costs than S3 Standard while still providing high durability and low-latency retrieval, making it the most cost-effective choice for this period.

Answer

Amazon S3 Standard

Answer

Amazon S3 Glacier Flexible Retrieval

Answer

Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

Question 6

A company has 20 AWS accounts managed under AWS Organizations. The finance team wants to centralize billing so that the company receives volume discounts for the aggregated usage across all accounts. Additionally, the team needs to set monthly budgets for each department and automatically receive email notifications when a department's spending reaches 80% of its budget threshold. Which combination of AWS features or services should the company use to meet these requirements?

Accepted Answer

Consolidated Billing with AWS Budgets. Consolidated Billing aggregates usage across all accounts in AWS Organizations, enabling volume discounts. AWS Budgets allows setting monthly budgets per department and configuring alerts (e.g., at 80% threshold) to send email notifications via Amazon SNS. Together, they meet both centralization and notification requirements.

Answer

AWS Cost Explorer with AWS Budgets

Answer

AWS Trusted Advisor with Consolidated Billing

Answer

AWS Cost Explorer with AWS Organizations

Question 7

A cloud provider uses shared physical infrastructure to serve many customers. Each customer's compute and storage resources are logically isolated and secure, but the underlying hardware is pooled across all customers. Which essential characteristic of cloud computing does this scenario BEST describe?

Accepted Answer

Resource pooling. Resource pooling is the correct characteristic because the scenario describes a multi-tenant model where physical and virtual resources are dynamically assigned and reassigned according to consumer demand. The cloud provider's shared infrastructure (compute, storage, network) is pooled to serve multiple customers, with logical isolation ensuring each customer's data remains secure despite the shared underlying hardware. This directly matches the NIST SP 800-145 definition of resource pooling.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 8

A company generates large log files from its application and stores them in an Amazon S3 bucket. During the first 30 days, logs are frequently accessed for troubleshooting. After 30 days, logs are accessed infrequently (a few times per month). After 90 days, logs are rarely accessed but must be retained for compliance for one year, with retrieval possible within minutes if needed. The company wants to minimize storage costs while meeting these access and retention requirements. Which S3 feature should the company configure?

Accepted Answer

S3 Lifecycle policies. B is correct because S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Standard-IA after 30 days, then to S3 Glacier Instant Retrieval after 90 days) and expire them after one year. This directly matches the access patterns: frequent access for 30 days, infrequent access for the next 60 days, rare access with minute-level retrieval for the remainder of the year, and deletion after compliance retention is met.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Replication

Question 9

A company expects a steady baseline usage of AWS compute services (Amazon EC2, AWS Lambda, and AWS Fargate) over the next three years. They want to reduce costs compared to On-Demand pricing while maintaining the flexibility to change instance families, regions, or even switch between compute services (e.g., from EC2 to Lambda) without losing their discount. Which AWS pricing option should the company choose?

Accepted Answer

Compute Savings Plan. The Compute Savings Plan offers the highest flexibility, automatically applying discounts to any compute usage across EC2, Lambda, and Fargate, regardless of instance family, region, or compute service. It provides up to 66% savings over On-Demand while allowing the company to change instance types, regions, or switch between compute services without losing the discount. This matches the requirement for steady baseline usage with maximum flexibility.

Answer

Reserved Instances (Standard)

Answer

Reserved Instances (Convertible)

Answer

EC2 Instance Savings Plan

Question 10

A company has an on-premises file server that stores large datasets. The company wants to reduce its on-premises storage footprint by moving cold data to AWS. However, users need low-latency access to frequently used files, and the applications must be able to access the data using the standard SMB protocol. The company wants to cache frequently accessed data locally on-premises for low latency, while securely storing all data in Amazon S3. Which AWS service should the company use?

Accepted Answer

AWS Storage Gateway File Gateway. AWS Storage Gateway File Gateway is the correct choice because it provides on-premises caching of frequently accessed files for low-latency access via the standard SMB protocol, while all data is stored durably in Amazon S3. This directly meets the requirement to reduce on-premises storage footprint by moving cold data to AWS, while keeping hot data cached locally for performance.

Answer

Amazon FSx for Windows File Server

Answer

AWS DataSync

Answer

Amazon S3 with AWS Direct Connect

Question 11

A company has a serverless architecture on AWS for its order processing system. The system uses AWS Lambda functions to validate payment, check inventory, update the database, and send email notifications. The company needs a managed service to coordinate these functions into a workflow, implement retry logic in case of failures, and manage the execution of each step sequentially. Which AWS service should the company use?

Accepted Answer

AWS Step Functions. AWS Step Functions is a fully managed service designed to coordinate multiple AWS services into a serverless workflow. It allows you to define state machines that execute Lambda functions sequentially, implement built-in retry logic with exponential backoff, and handle error conditions, making it the ideal choice for orchestrating the order processing steps (payment validation, inventory check, database update, and email notification).

Answer

Amazon Simple Workflow Service (Amazon SWF)

Answer

Amazon Simple Queue Service (Amazon SQS)

Answer

AWS AppSync

Question 12

A company has a development environment running on Amazon EC2 instances. To control costs, the team wants to set a monthly budget of $5,000 for this environment. If the forecasted cost for the month exceeds $6,000 (20% over budget), they want AWS to automatically stop all non-critical EC2 instances to prevent further spending. Which AWS feature should the team use to implement this automated cost control?

Accepted Answer

AWS Budgets with budget actions. AWS Budgets with budget actions allows you to set a monthly budget of $5,000 and define an action that triggers when the forecasted cost exceeds a specified threshold (e.g., 20% over budget, or $6,000). The action can automatically stop non-critical EC2 instances using an IAM role and a predefined runbook, directly enforcing cost control without manual intervention. This is the only AWS feature that combines budget monitoring with automated remediation actions.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Cost Anomaly Detection

Question 13

A company has a security policy that requires all SSH connections to Amazon EC2 instances to originate from the company's corporate network IP range (203.0.113.0/24). An administrator is creating an IAM policy to enforce this restriction. Which IAM policy element should the administrator use to specify the allowed IP address range?

Accepted Answer

aws:SourceIp condition key. The aws:SourceIp condition key is used in IAM policies to restrict access based on the requester's IP address. Since the security policy requires SSH connections to EC2 instances to originate only from the corporate network IP range (203.0.113.0/24), the administrator should use aws:SourceIp in a condition block to enforce this restriction. This key evaluates the source IP address of the API caller, not the destination of the traffic.

Answer

aws:RequestedRegion condition key

Answer

aws:PrincipalOrgID condition key

Answer

aws:MultiFactorAuthPresent condition key

Question 14

A company has been using Amazon EC2 instances for a production application for the past 12 months. The finance team wants to understand historical spending patterns and identify opportunities to reduce costs. Specifically, they need to see which EC2 instance families and sizes are being underutilized and get recommendations for purchasing Reserved Instances to save money compared to current On-Demand pricing. The team wants to use a native AWS tool that provides a visual dashboard of costs, usage trends, and actionable recommendations. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a visual dashboard of historical cost and usage data, including the ability to filter by EC2 instance families and sizes to identify underutilized resources. It also offers Reserved Instance (RI) purchase recommendations based on historical On-Demand usage, enabling the finance team to compare costs and identify savings opportunities directly within the native AWS console.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Compute Optimizer

Question 15

A company manages multiple AWS accounts through AWS Organizations. The finance team wants to receive a consolidated view of costs across all accounts and track costs against a monthly budget of $50,000 for the entire organization. They want to be alerted when actual costs reach 90% of the budget and again when they exceed 100%. Which combination of AWS services should the finance team use?

Accepted Answer

AWS Budgets to create a budget and configure alerts, and AWS Cost Explorer to view consolidated cost data.. AWS Budgets is the correct service for setting a monthly budget of $50,000 and configuring alerts at 90% and 100% thresholds. AWS Cost Explorer provides the consolidated view of costs across all accounts in AWS Organizations. Together, they meet both requirements: Budgets handles the alerting, and Cost Explorer provides the consolidated cost visualization.

Answer

AWS Cost Explorer to create a budget alert and AWS Budgets to view consolidated costs.

Answer

AWS Trusted Advisor to set a cost optimization budget and AWS Cost Explorer to send alerts.

Answer

AWS Cost and Usage Report to generate a daily report and Amazon Simple Email Service (Amazon SES) to send email alerts.

Question 16

A company has employees in field offices who need to manage AWS resources (e.g., launch EC2 instances, upload files to S3) using a web browser on their company-issued laptops. The laptops connect to the internet via public Wi-Fi or cellular hotspots. The employees do not have any VPN or direct corporate network connection. They can successfully access the AWS Management Console and perform all actions over standard HTTPS ports. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Broad network access. This scenario demonstrates broad network access because the employees can access and manage AWS resources from anywhere using standard web browsers over HTTPS (port 443) on public Wi-Fi or cellular hotspots, without requiring a VPN or dedicated corporate network. Broad network access means that cloud resources are available over the network through standard mechanisms (e.g., web browsers, REST APIs) from heterogeneous client platforms (laptops, phones, tablets). The ability to perform all actions via the AWS Management Console over HTTPS directly illustrates this characteristic.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 17

A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?

Accepted Answer

IAM Access Analyzer. IAM Access Analyzer is designed to continuously analyze resource-based policies (such as S3 bucket policies and IAM role trust policies) and generate findings when access is granted to principals outside of the trusted AWS Organization. It uses zone of trust logic to identify policies that allow access to external AWS accounts, making it the correct service for this security requirement.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 18

A company has migrated its customer-facing web application to AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer. The company's customers access the application from various devices—desktop computers, laptops, tablets, and smartphones—using standard web browsers without any additional configuration or proprietary software. The ability for customers to reach the application over the internet from any device with a standard browser best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes customers accessing the application from various devices (desktops, laptops, tablets, smartphones) using standard web browsers over the internet without any proprietary software. This directly matches the NIST definition of broad network access: resources are available over the network and accessed through standard mechanisms (e.g., HTTP/HTTPS) that promote use by heterogeneous thin or thick client platforms.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 19

A company has a web application deployed on AWS in the us-west-2 Region. The application is accessed by users across the globe, including Europe, Asia, and South America. The company wants to improve the application's performance for international users by reducing latency and packet loss. The solution must route user traffic over the AWS global network to the closest edge location. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network to route user traffic to the closest edge location via Anycast IP addresses, reducing latency and packet loss. It optimizes the path from users to the application by directing traffic to the nearest edge endpoint, then forwarding it over the AWS backbone to the application in us-west-2. This improves performance for international users without caching content, unlike a CDN.

Answer

Amazon CloudFront

Answer

Amazon Route 53 (with latency-based routing)

Answer

AWS Direct Connect

Question 20

A company has multiple AWS accounts that are consolidated under AWS Organizations. The company uses cost allocation tags to track costs by project. The finance team now wants an interactive tool that can visualize the company's AWS spending over the past 6 months, break down costs by the 'Project' tag, and allow filtering by service, region, and linked account. The team also wants to forecast future spending based on historical trends. Which AWS service or feature should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides an interactive, pre-built dashboard that visualizes cost and usage data over customizable time periods (up to 12 months), supports filtering by service, region, and linked account, and includes a forecasting feature that uses machine learning to predict future spending based on historical trends. It directly meets the finance team's requirement for an interactive tool with filtering and forecasting capabilities.

Answer

AWS Budgets

Answer

AWS Cost and Usage Report (CUR)

Answer

AWS Trusted Advisor