CLF-C02 Practice Exam 54 — 20 Questions

Question 1

A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the application to obtain temporary AWS credentials via the instance metadata service (IMDS). This eliminates the need to store long-term access keys on the instance, satisfying the security requirement while granting the necessary S3 read permissions.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

Answer

Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

Answer

Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

Question 2

A company's development team has written a Python web application using the Flask framework. The team wants to deploy the application to the AWS Cloud without managing the underlying servers, operating system, or web server software. They want AWS to automatically handle the deployment, from provisioning EC2 instances to configuring the web server and load balancer, and to scale the application based on traffic. They also want the ability to upload new code versions directly from their Git repository. Which AWS service should the team use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it is a Platform as a Service (PaaS) offering that automatically handles the deployment, capacity provisioning, load balancing, and auto-scaling of web applications. The team can upload code directly from a Git repository using the EB CLI or integrated CodePipeline, and Elastic Beanstalk manages the underlying EC2 instances, operating system, and web server (e.g., Apache or Nginx) without requiring manual intervention.

Answer

AWS CloudFormation

Answer

Amazon EC2 Auto Scaling

Answer

AWS CodeDeploy

Question 3

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a managed service specifically designed to store, manage, and automatically rotate database credentials (such as those for Amazon RDS MySQL) on a scheduled basis without manual intervention. It natively integrates with Amazon RDS to rotate credentials, eliminating the need to embed secrets in application code or configuration files, which directly addresses the security team's requirements.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (AWS KMS)

Question 4

A mid-size company is planning to migrate its IT infrastructure to the AWS Cloud. The Chief Information Officer (CIO) expresses concern that multiple customers' virtual servers might run on the same physical hardware, potentially increasing the risk of data exposure. Which cloud computing characteristic describes this shared infrastructure model, where computing resources are pooled to serve multiple customers using a multi-tenant model?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it directly describes the multi-tenant model where the provider's computing resources (such as physical servers, storage, and network) are pooled to serve multiple customers. In AWS, this is achieved through hypervisor-level isolation (e.g., Xen or Nitro hypervisors) that allows multiple virtual servers (EC2 instances) to run on the same physical host while maintaining strict memory and I/O separation, preventing data exposure between tenants.

Answer

On-demand self-service

Answer

Measured service

Answer

Broad network access

Question 5

Which statement best describes the AWS global infrastructure concept of an Availability Zone (AZ)?

Accepted Answer

One or more discrete data centers with redundant power, networking, and connectivity within a Region. An Availability Zone (AZ) consists of one or more discrete data centers with independent power, cooling, and physical networking, connected to each other through low-latency links within a single AWS Region. This design ensures that if one AZ fails, applications can continue operating in other AZs, providing high availability and fault tolerance. Option B correctly captures this definition, as it emphasizes the discrete, redundant infrastructure that makes an AZ distinct from a Region or a data center.

Answer

A geographic location where AWS hosts data centers, such as North America or Europe

Answer

A CDN edge location used to cache content close to end users

Answer

A logically isolated section of the AWS Cloud where customers launch resources

Question 6

A company develops a mobile application that allows employees to upload sales reports to an Amazon S3 bucket. The application must work reliably from any location, including from corporate offices, remote home offices, and international travel locations. The solution uses standard HTTPS requests over the internet. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes a mobile application that must work reliably from any location—corporate offices, remote home offices, and international travel locations—using standard HTTPS requests over the internet. This directly aligns with the NIST definition of broad network access, which states that capabilities are available over the network and accessed through standard mechanisms (e.g., HTTPS) by heterogeneous client platforms (such as mobile phones, laptops, and tablets). The ability to access the S3 bucket from diverse geographic locations via the public internet is the core characteristic being illustrated.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 7

A company needs to synchronize data in real time between its on-premises Oracle database and an Amazon RDS MySQL instance during a migration. Which AWS service handles ongoing data replication between heterogeneous databases?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture, CDC) from an on-premises Oracle database to an Amazon RDS MySQL instance, even when the source and target are heterogeneous database engines. DMS uses a replication instance to read the source database's transaction logs and apply changes in near real time to the target, making it ideal for continuous synchronization during a migration.

Answer

AWS DataSync

Answer

AWS Snowball

Answer

Amazon Kinesis Data Streams

Question 8

Which type of Elastic Load Balancer routes HTTP/HTTPS traffic based on content such as URL path, hostname, and HTTP headers, enabling advanced request routing rules?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 of the OSI model and can route HTTP/HTTPS traffic based on request-level attributes such as URL path, hostname, HTTP headers, and query strings. This enables advanced routing rules like path-based routing (e.g., /api to one target group, /images to another) and host-based routing (e.g., app1.example.com vs app2.example.com). ALB also supports features like WebSocket, HTTP/2, and AWS WAF integration, making it the correct choice for content-based routing.

Answer

Network Load Balancer (NLB)

Answer

Gateway Load Balancer (GWLB)

Answer

Classic Load Balancer

Question 9

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Accepted Answer

A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances. Configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Answer

AWS ensuring the physical data center is protected from unauthorized entry

Answer

AWS patching the underlying hypervisor on EC2 hosts

Answer

AWS ensuring S3 storage hardware is replaced when it fails

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team wants a preventive control to ensure that nobody in any account, including account root users, can disable AWS CloudTrail or delete Amazon S3 bucket policies. Which AWS feature should the security team use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they provide centralized preventive controls over the maximum available permissions for all IAM users, roles, and root users in member accounts within AWS Organizations. SCPs can explicitly deny actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:PutBucketPolicy, ensuring that even root users cannot disable CloudTrail or delete S3 bucket policies. This makes SCPs the only AWS feature that can enforce such restrictions across all accounts in an organization.

Answer

IAM roles with multi-factor authentication (MFA)

Answer

AWS Config rules with automatic remediation

Answer

AWS Shield Advanced

Question 11

A company wants to run code that automatically resizes images whenever a new image is uploaded to an Amazon S3 bucket. The code runs for less than 60 seconds per image. The company wants to pay only for the compute time used and does not want to provision or manage any servers. Which AWS service best meets these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 object creation event, and automatically scales. It charges only for the compute time consumed (rounded to the nearest 1 ms) and requires no server provisioning or management. The 60-second execution limit per invocation is well within the 15-minute maximum duration of Lambda, making it ideal for short-lived image resizing tasks.

Answer

Amazon EC2

Answer

AWS Elastic Beanstalk

Answer

Amazon ECS

Question 12

A company hosts a web application on an Amazon EC2 instance. The company installs its own application software and configures the operating system. The company also uses AWS Key Management Service (AWS KMS) to create a customer-managed key to encrypt data on the Amazon Elastic Block Store (Amazon EBS) volume attached to the instance. According to the AWS shared responsibility model, which of the following is the responsibility of AWS?

Accepted Answer

Ensuring the physical security of the data center where the Amazon EC2 instance runs.. Under the AWS shared responsibility model, AWS is responsible for the security of the cloud, which includes the physical security of data centers, hardware, networking, and facilities where EC2 instances run. This is a foundational layer that customers cannot manage or control.

Answer

Encrypting the data on the Amazon EBS volume using the customer-managed key.

Answer

Patching the operating system of the Amazon EC2 instance.

Answer

Configuring the security group rules to restrict traffic to the Amazon EC2 instance.

Question 13

A company has migrated to AWS and uses multiple accounts under AWS Organizations with consolidated billing. The finance team needs a monthly cost breakdown by business unit. Each business unit's AWS resources are tagged with a 'BusinessUnit' tag (e.g., 'Marketing', 'Engineering'). However, some resources are not tagged. The team wants to see both the cost per business unit (based on tagged resources) and the total cost of untagged resources, all in one view. They also need the ability to filter by AWS service (e.g., EC2, S3) for each business unit. Which AWS tool or feature should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a customizable dashboard that allows you to filter and group costs by tags (such as 'BusinessUnit') and by AWS service (e.g., EC2, S3). It can display both tagged and untagged resource costs in the same view, enabling the finance team to see a monthly breakdown per business unit alongside the total cost of untagged resources. This meets all the requirements without additional configuration.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Monthly Report (from Billing console)

Question 14

Which AWS service enables sending promotional and transactional email at scale, such as marketing newsletters and order confirmations?

Accepted Answer

Amazon SES. Amazon SES (Simple Email Service) is specifically designed for sending high-volume transactional and marketing emails, such as order confirmations and newsletters. It provides dedicated SMTP endpoints and APIs for email delivery, with features like bounce handling, suppression lists, and deliverability tracking. This makes it the correct choice for scalable email sending at scale.

Answer

Amazon SNS

Answer

Amazon Pinpoint

Answer

Amazon Cognito

Question 15

A company has multiple IAM users. The security policy requires that every user must have an MFA device assigned and must use it for console sign-in. The security team wants to automatically detect any IAM user that does not have MFA enabled and receive an email alert. Which combination of AWS services should the team use to meet these requirements?

Accepted Answer

AWS Config and Amazon Simple Notification Service (Amazon SNS). AWS Config can continuously monitor IAM users for compliance with the security policy by using a managed rule such as IAM_USER_MFA_ENABLED. When a non-compliant user is detected, AWS Config can trigger an Amazon SNS topic to send an email alert, meeting the requirement for automatic detection and notification.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

AWS Trusted Advisor and Amazon Simple Email Service (Amazon SES)

Answer

AWS IAM Access Analyzer and Amazon Inspector

Question 16

A company is building a microservices application on AWS. The application consists of multiple independent services that need to communicate asynchronously. When an order is placed, the order service must send a notification to the inventory service, the shipping service, and the analytics service simultaneously. The company wants a fully managed, durable, and scalable messaging service that supports a fan-out pattern where a single message can be delivered to multiple subscribers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that supports fan-out, where a single message published to a topic is delivered to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints) simultaneously. It is durable (persists messages across AZs) and scales automatically to handle high throughput, making it ideal for the asynchronous notification requirements of the order, inventory, shipping, and analytics services.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 17

Which cloud deployment model involves running applications on AWS infrastructure managed entirely by AWS, where the customer does not manage any physical hardware?

Accepted Answer

Public cloud. The public cloud deployment model is defined by infrastructure that is owned, managed, and maintained by a third-party cloud provider (in this case, AWS). The customer has no responsibility for the physical hardware, such as servers, storage, or networking equipment, and accesses resources on-demand via the internet. This matches the scenario where AWS manages everything, and the customer only interacts with virtualized services.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 18

A company wants to use machine learning to automatically identify objects, scenes, and activities in images uploaded by users. Which AWS service should they use?

Accepted Answer

Amazon Rekognition. Amazon Rekognition is the correct service because it is specifically designed to analyze images and videos to identify objects, scenes, activities, faces, and text. It provides pre-trained machine learning models that can automatically detect these elements without requiring custom model training, making it ideal for the use case described.

Answer

Amazon Textract

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Question 19

A company's finance team needs the most granular AWS billing data available, including cost and usage data at the hourly level, broken down by resource ID and cost allocation tags, delivered to Amazon S3 for analysis with their BI tools. Which AWS service provides this?

Accepted Answer

AWS Cost and Usage Report. AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular billing data available, including hourly-level cost and usage, broken down by resource ID and cost allocation tags, and can be delivered to Amazon S3 for analysis with BI tools. This service is designed for detailed, customizable reports that meet the finance team's requirements for granularity and integration.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

Amazon CloudWatch Billing Metrics

Question 20

A company is deploying a web application on AWS. The application will run on multiple Amazon EC2 instances distributed across two Availability Zones. An Application Load Balancer will distribute incoming traffic across the instances. The company's primary goal is to ensure the application remains available to users even if one Availability Zone experiences a service disruption. Which cloud computing concept does this architecture primarily demonstrate?

Accepted Answer

High availability. This architecture demonstrates high availability because it uses multiple EC2 instances across two Availability Zones with an Application Load Balancer to distribute traffic. If one AZ fails, the load balancer automatically routes traffic to the healthy instances in the other AZ, ensuring the application remains accessible. High availability focuses on minimizing downtime by eliminating single points of failure through redundancy.

Answer

Elasticity

Answer

Scalability

Answer

Fault tolerance