CLF-C02 Practice Exam 54 — 20 Questions

Question 1

A company is planning to migrate its on-premises database and web application to AWS. The solutions architect needs to provide a detailed monthly cost estimate for the AWS resources that will be used, including Amazon EC2 instances, Amazon RDS database instances, and Amazon S3 storage. The architect wants to specify instance types, storage sizes, data transfer amounts, and other parameters to get a precise estimate before building the environment. Which AWS tool should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly Simple Monthly Calculator) allows users to specify exact instance types, storage sizes, data transfer amounts, and other parameters for services like EC2, RDS, and S3 to generate a detailed monthly cost estimate before provisioning resources. This makes it the correct tool for the architect's requirement of a precise, pre-build cost estimate.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Total Cost of Ownership (TCO) Calculator

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

Accepted Answer

Service Control Policies (SCPs) in AWS Organizations. Service Control Policies (SCPs) in AWS Organizations are the correct choice because they allow the security team to centrally define a policy that denies the creation of publicly accessible S3 buckets across all accounts in the organization. SCPs apply to all users, including account administrators, and cannot be overridden by any IAM policy or local account permissions, ensuring organization-wide enforcement.

Answer

AWS Config rules with auto-remediation

Answer

AWS Identity and Access Management (IAM) policies with a Deny effect

Answer

Amazon Macie with automated response

Question 3

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP(S) requests. It provides managed rules to block common web exploits such as SQL injection and cross-site scripting (XSS), and allows you to define custom rules using conditions like IP addresses, HTTP headers, and URI strings. This makes it the correct choice for protecting the ALB-hosted application against these specific threats.

Answer

AWS Shield Advanced

Answer

Security Groups

Answer

AWS Firewall Manager

Question 4

A company is evaluating cloud adoption. Which of the following is a benefit of moving to the cloud over traditional on-premises infrastructure? (Select all that apply in context: which single answer best captures the operational model shift?)

Accepted Answer

Shift from capital expenditure (CapEx) to operational expenditure (OpEx). Moving to the cloud shifts infrastructure costs from upfront capital expenditure (CapEx) for hardware to operational expenditure (OpEx) for pay-as-you-go services. This operational model change allows companies to avoid large initial investments and instead pay for compute and storage resources based on actual usage, aligning costs with business growth.

Answer

Shift from operational expenditure (OpEx) to capital expenditure (CapEx)

Answer

Increased requirement for physical infrastructure management

Answer

Reduced ability to scale resources based on demand

Question 5

A company has multiple AWS accounts consolidated under AWS Organizations. The finance team wants to set a hard monthly cost limit for a development account. If the forecasted costs for the month exceed that limit, the team wants AWS to automatically stop all non-critical Amazon EC2 instances in that account to prevent overspending. The team also needs to receive an email alert when the cost threshold is first crossed. Which AWS service or feature should the team use to define the budget and configure the automated action?

Accepted Answer

AWS Budgets with an Amazon EC2 action. AWS Budgets allows you to set a cost budget with a threshold and, when forecasted costs exceed that threshold, trigger an AWS Budgets action to stop specific Amazon EC2 instances. This meets the requirement for a hard monthly cost limit and automated instance stoppage, while also sending an email alert via Amazon SNS when the threshold is first crossed.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 6

A company manages 15 AWS accounts through AWS Organizations. The finance team needs to perform custom analysis of monthly costs across all accounts. They want to download a detailed, hourly-level CSV file that breaks down usage and costs by service, by member account, and by user-defined cost allocation tags. The file must be delivered to an Amazon S3 bucket daily, and the team will then query the data using Amazon Athena and create dashboards in Amazon QuickSight. Which AWS feature should they configure to meet these requirements?

Accepted Answer

AWS Cost and Usage Report (CUR). The AWS Cost and Usage Report (CUR) is the only feature that delivers a detailed, hourly-level CSV file with granular breakdowns by service, member account, and user-defined cost allocation tags. It can be automatically published to an S3 bucket daily, enabling downstream analysis with Athena and QuickSight.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 7

A company deploys their web application across multiple isolated locations within the same AWS Region, each with independent power, cooling, and networking. This design ensures that a failure in one location does not affect the others. What are these isolated locations called?

Accepted Answer

Availability Zones. Availability Zones (AZs) are isolated locations within an AWS Region that consist of one or more data centers with independent power, cooling, and networking. This design ensures that a failure in one AZ does not affect the others, providing high availability and fault tolerance for applications. The scenario directly describes the defining characteristics of an Availability Zone.

Answer

AWS Regions

Answer

Edge Locations

Answer

VPC Subnets

Question 8

A company runs multiple workloads in separate Amazon VPCs within the same AWS Region. The networking team needs to enable connectivity between all VPCs using private IP addresses. Additionally, the team must connect all VPCs to the company's on-premises data center through a single AWS Site-to-Site VPN connection to minimize costs and simplify management. The solution must support transitive routing so that any VPC can communicate with any other VPC and with the on-premises network. Which AWS service should the networking team use to meet these requirements?

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks through a single VPN attachment, supporting transitive routing between all connected networks. This meets the requirements for private IP connectivity, cost minimization, and simplified management by avoiding the need for full-mesh VPC peering or multiple VPN connections.

Answer

VPC Peering with a VPN attachment to a Virtual Private Gateway

Answer

AWS Direct Connect gateway with VPC associations

Answer

A Network Load Balancer with VPN endpoints

Question 9

A company runs a read-heavy web application on Amazon EC2 instances that queries an Amazon RDS database. As traffic grows, the database CPU utilization is consistently high, causing slow response times for users. The company wants to reduce the load on the database by caching frequently accessed query results. They need a fully managed, in-memory caching service that can be set up quickly and integrates with common programming languages. Which AWS service should they use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is a fully managed, in-memory caching service that supports Redis and Memcached, both of which integrate with common programming languages via standard client libraries. It can be deployed quickly to cache frequently accessed database query results, offloading read traffic from the Amazon RDS instance and reducing CPU utilization.

Answer

Amazon DynamoDB Accelerator (DAX)

Answer

Amazon CloudFront

Answer

Amazon S3 Transfer Acceleration

Question 10

A company archives historical transaction records in Amazon S3. The records are accessed frequently for the first 30 days after creation. After 30 days, access drops sharply to only a few times per year, but the company must be able to retrieve any record within 5 minutes if needed. The company wants to minimize storage costs while meeting the retrieval time requirement. Which combination of S3 storage classes should the company use?

Accepted Answer

Use S3 Standard for the first 30 days, then transition to S3 Glacier Flexible Retrieval.. S3 Standard provides low-latency access for the first 30 days when records are frequently accessed, and then lifecycle rules transition the data to S3 Glacier Flexible Retrieval, which offers retrieval times of minutes (typically 1–5 minutes for expedited retrievals) at a much lower storage cost. This combination meets the 5-minute retrieval requirement while minimizing costs for data that is rarely accessed after 30 days.

Answer

Use S3 Standard for all data.

Answer

Use S3 Standard-IA for the first 30 days, then transition to S3 Glacier Deep Archive.

Answer

Use S3 One Zone-IA for the first 30 days, then transition to S3 Glacier Deep Archive.

Question 11

A company is migrating a business-critical workload to AWS. The company wants to ensure it has access to a dedicated Technical Account Manager (TAM) who will provide proactive guidance, architectural reviews, and operational support. Additionally, the company requires the Infrastructure Event Management (IEM) service to assist with the migration launch, and it wants the full set of AWS Trusted Advisor best practice checks across all categories (cost optimization, performance, security, fault tolerance, service limits). Which AWS Support plan should the company select?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the only plan that provides a dedicated Technical Account Manager (TAM) for proactive guidance, architectural reviews, and operational support. It also includes Infrastructure Event Management (IEM) for migration launches and full access to all AWS Trusted Advisor best practice checks across all categories, including cost optimization, performance, security, fault tolerance, and service limits. Lower-tier plans lack one or more of these critical features.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 12

A company runs 200 Amazon EC2 instances for its web application. The finance team wants to identify instances that are over-provisioned or underutilized to reduce costs. The team needs automated recommendations that consider the instance's CPU, memory, and network utilization patterns over the past 14 days. Which AWS service should the team use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, network) over a specified lookback period (up to 93 days, but 14 days is supported) and generates actionable recommendations to right-size EC2 instances. It specifically identifies over-provisioned and underutilized instances, directly addressing the finance team's cost-reduction goal with automated, metric-driven insights.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 13

A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

Accepted Answer

Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the application to obtain temporary AWS credentials via the instance metadata service (IMDS). This eliminates the need to store long-term access keys on the instance, satisfying the security requirement while granting the necessary S3 read permissions.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

Answer

Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

Answer

Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

Question 14

A company's development team has written a Python web application using the Flask framework. The team wants to deploy the application to the AWS Cloud without managing the underlying servers, operating system, or web server software. They want AWS to automatically handle the deployment, from provisioning EC2 instances to configuring the web server and load balancer, and to scale the application based on traffic. They also want the ability to upload new code versions directly from their Git repository. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a Platform as a Service (PaaS) offering that automatically handles the deployment, capacity provisioning, load balancing, and auto-scaling of web applications. The team can upload code directly from a Git repository using the EB CLI or integrated CodePipeline, and Elastic Beanstalk manages the underlying EC2 instances, operating system, and web server (e.g., Apache or Nginx) without requiring manual intervention.

Answer

AWS CloudFormation

Answer

Amazon EC2 Auto Scaling

Answer

AWS CodeDeploy

Question 15

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a managed service specifically designed to store, manage, and automatically rotate database credentials (such as those for Amazon RDS MySQL) on a scheduled basis without manual intervention. It natively integrates with Amazon RDS to rotate credentials, eliminating the need to embed secrets in application code or configuration files, which directly addresses the security team's requirements.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (AWS KMS)

Question 16

A mid-size company is planning to migrate its IT infrastructure to the AWS Cloud. The Chief Information Officer (CIO) expresses concern that multiple customers' virtual servers might run on the same physical hardware, potentially increasing the risk of data exposure. Which cloud computing characteristic describes this shared infrastructure model, where computing resources are pooled to serve multiple customers using a multi-tenant model?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it directly describes the multi-tenant model where the provider's computing resources (such as physical servers, storage, and network) are pooled to serve multiple customers. In AWS, this is achieved through hypervisor-level isolation (e.g., Xen or Nitro hypervisors) that allows multiple virtual servers (EC2 instances) to run on the same physical host while maintaining strict memory and I/O separation, preventing data exposure between tenants.

Answer

On-demand self-service

Answer

Measured service

Answer

Broad network access

Question 17

Which statement best describes the AWS global infrastructure concept of an Availability Zone (AZ)?

Accepted Answer

One or more discrete data centers with redundant power, networking, and connectivity within a Region. An Availability Zone (AZ) consists of one or more discrete data centers with independent power, cooling, and physical networking, connected to each other through low-latency links within a single AWS Region. This design ensures that if one AZ fails, applications can continue operating in other AZs, providing high availability and fault tolerance. Option B correctly captures this definition, as it emphasizes the discrete, redundant infrastructure that makes an AZ distinct from a Region or a data center.

Answer

A geographic location where AWS hosts data centers, such as North America or Europe

Answer

A CDN edge location used to cache content close to end users

Answer

A logically isolated section of the AWS Cloud where customers launch resources

Question 18

A company develops a mobile application that allows employees to upload sales reports to an Amazon S3 bucket. The application must work reliably from any location, including from corporate offices, remote home offices, and international travel locations. The solution uses standard HTTPS requests over the internet. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes a mobile application that must work reliably from any location—corporate offices, remote home offices, and international travel locations—using standard HTTPS requests over the internet. This directly aligns with the NIST definition of broad network access, which states that capabilities are available over the network and accessed through standard mechanisms (e.g., HTTPS) by heterogeneous client platforms (such as mobile phones, laptops, and tablets). The ability to access the S3 bucket from diverse geographic locations via the public internet is the core characteristic being illustrated.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 19

A company needs to synchronize data in real time between its on-premises Oracle database and an Amazon RDS MySQL instance during a migration. Which AWS service handles ongoing data replication between heterogeneous databases?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture, CDC) from an on-premises Oracle database to an Amazon RDS MySQL instance, even when the source and target are heterogeneous database engines. DMS uses a replication instance to read the source database's transaction logs and apply changes in near real time to the target, making it ideal for continuous synchronization during a migration.

Answer

AWS DataSync

Answer

AWS Snowball

Answer

Amazon Kinesis Data Streams

Question 20

Which type of Elastic Load Balancer routes HTTP/HTTPS traffic based on content such as URL path, hostname, and HTTP headers, enabling advanced request routing rules?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 of the OSI model and can route HTTP/HTTPS traffic based on request-level attributes such as URL path, hostname, HTTP headers, and query strings. This enables advanced routing rules like path-based routing (e.g., /api to one target group, /images to another) and host-based routing (e.g., app1.example.com vs app2.example.com). ALB also supports features like WebSocket, HTTP/2, and AWS WAF integration, making it the correct choice for content-based routing.

Answer

Network Load Balancer (NLB)

Answer

Gateway Load Balancer (GWLB)

Answer

Classic Load Balancer