CLF-C02 Practice Exam 55 — 20 Questions

Question 1

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Accepted Answer

A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances. Configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Answer

AWS ensuring the physical data center is protected from unauthorized entry

Answer

AWS patching the underlying hypervisor on EC2 hosts

Answer

AWS ensuring S3 storage hardware is replaced when it fails

Question 2

A company operates 10 AWS accounts, each managed by a different department. The finance team wants to combine the usage of all accounts to qualify for lower volume-based pricing tiers for services such as Amazon S3 and Amazon EC2. Additionally, they want a single monthly bill that aggregates charges from all accounts. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing is the correct feature because it allows the company to combine usage across all 10 AWS accounts into a single aggregated bill. This enables the finance team to qualify for lower volume-based pricing tiers for services like Amazon S3 and Amazon EC2, as AWS aggregates usage across all accounts in the organization. Consolidated billing also provides a single monthly bill that itemizes charges from each account, meeting both requirements.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants a preventive control to ensure that nobody in any account, including account root users, can disable AWS CloudTrail or delete Amazon S3 bucket policies. Which AWS feature should the security team use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they provide centralized preventive controls over the maximum available permissions for all IAM users, roles, and root users in member accounts within AWS Organizations. SCPs can explicitly deny actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:PutBucketPolicy, ensuring that even root users cannot disable CloudTrail or delete S3 bucket policies. This makes SCPs the only AWS feature that can enforce such restrictions across all accounts in an organization.

Answer

IAM roles with multi-factor authentication (MFA)

Answer

AWS Config rules with automatic remediation

Answer

AWS Shield Advanced

Question 4

A company wants to run code that automatically resizes images whenever a new image is uploaded to an Amazon S3 bucket. The code runs for less than 60 seconds per image. The company wants to pay only for the compute time used and does not want to provision or manage any servers. Which AWS service best meets these requirements?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 object creation event, and automatically scales. It charges only for the compute time consumed (rounded to the nearest 1 ms) and requires no server provisioning or management. The 60-second execution limit per invocation is well within the 15-minute maximum duration of Lambda, making it ideal for short-lived image resizing tasks.

Answer

Amazon EC2

Answer

AWS Elastic Beanstalk

Answer

Amazon ECS

Question 5

A company has migrated to AWS and uses multiple accounts under AWS Organizations with consolidated billing. The finance team needs a monthly cost breakdown by business unit. Each business unit's AWS resources are tagged with a 'BusinessUnit' tag (e.g., 'Marketing', 'Engineering'). However, some resources are not tagged. The team wants to see both the cost per business unit (based on tagged resources) and the total cost of untagged resources, all in one view. They also need the ability to filter by AWS service (e.g., EC2, S3) for each business unit. Which AWS tool or feature should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a customizable dashboard that allows you to filter and group costs by tags (such as 'BusinessUnit') and by AWS service (e.g., EC2, S3). It can display both tagged and untagged resource costs in the same view, enabling the finance team to see a monthly breakdown per business unit alongside the total cost of untagged resources. This meets all the requirements without additional configuration.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Monthly Report (from Billing console)

Question 6

Which AWS service enables sending promotional and transactional email at scale, such as marketing newsletters and order confirmations?

Accepted Answer

Amazon SES. Amazon SES (Simple Email Service) is specifically designed for sending high-volume transactional and marketing emails, such as order confirmations and newsletters. It provides dedicated SMTP endpoints and APIs for email delivery, with features like bounce handling, suppression lists, and deliverability tracking. This makes it the correct choice for scalable email sending at scale.

Answer

Amazon SNS

Answer

Amazon Pinpoint

Answer

Amazon Cognito

Question 7

A company has multiple IAM users. The security policy requires that every user must have an MFA device assigned and must use it for console sign-in. The security team wants to automatically detect any IAM user that does not have MFA enabled and receive an email alert. Which combination of AWS services should the team use to meet these requirements?

Accepted Answer

AWS Config and Amazon Simple Notification Service (Amazon SNS). AWS Config can continuously monitor IAM users for compliance with the security policy by using a managed rule such as IAM_USER_MFA_ENABLED. When a non-compliant user is detected, AWS Config can trigger an Amazon SNS topic to send an email alert, meeting the requirement for automatic detection and notification.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

AWS Trusted Advisor and Amazon Simple Email Service (Amazon SES)

Answer

AWS IAM Access Analyzer and Amazon Inspector

Question 8

A company is building a microservices application on AWS. The application consists of multiple independent services that need to communicate asynchronously. When an order is placed, the order service must send a notification to the inventory service, the shipping service, and the analytics service simultaneously. The company wants a fully managed, durable, and scalable messaging service that supports a fan-out pattern where a single message can be delivered to multiple subscribers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that supports fan-out, where a single message published to a topic is delivered to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints) simultaneously. It is durable (persists messages across AZs) and scales automatically to handle high throughput, making it ideal for the asynchronous notification requirements of the order, inventory, shipping, and analytics services.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 9

A financial services company keeps sensitive customer data in an on-premises data center. Regulatory requirements prohibit this data from being stored in the cloud. However, the company needs to run compute-intensive analytics jobs that periodically require more processing power than its on-premises servers can provide. The company wants to use AWS for these burst capacity needs while keeping the sensitive data on premises. Which cloud deployment model best describes this approach?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it combines on-premises infrastructure (private cloud) with public cloud resources (AWS) while keeping sensitive data on-premises. The company uses AWS for burst compute capacity via services like AWS Batch or EC2 Auto Scaling, but the data never leaves the on-premises data center, satisfying regulatory requirements.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 10

Which cloud deployment model involves running applications on AWS infrastructure managed entirely by AWS, where the customer does not manage any physical hardware?

Accepted Answer

Public cloud. The public cloud deployment model is defined by infrastructure that is owned, managed, and maintained by a third-party cloud provider (in this case, AWS). The customer has no responsibility for the physical hardware, such as servers, storage, or networking equipment, and accesses resources on-demand via the internet. This matches the scenario where AWS manages everything, and the customer only interacts with virtualized services.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 11

A company wants to use machine learning to automatically identify objects, scenes, and activities in images uploaded by users. Which AWS service should they use?

Accepted Answer

Amazon Rekognition. Amazon Rekognition is the correct service because it is specifically designed to analyze images and videos to identify objects, scenes, activities, faces, and text. It provides pre-trained machine learning models that can automatically detect these elements without requiring custom model training, making it ideal for the use case described.

Answer

Amazon Textract

Answer

Amazon SageMaker

Answer

Amazon Comprehend

Question 12

A company's finance team needs the most granular AWS billing data available, including cost and usage data at the hourly level, broken down by resource ID and cost allocation tags, delivered to Amazon S3 for analysis with their BI tools. Which AWS service provides this?

Accepted Answer

AWS Cost and Usage Report. AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular billing data available, including hourly-level cost and usage, broken down by resource ID and cost allocation tags, and can be delivered to Amazon S3 for analysis with BI tools. This service is designed for detailed, customizable reports that meet the finance team's requirements for granularity and integration.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

Amazon CloudWatch Billing Metrics

Question 13

A company is deploying a web application on AWS. The application will run on multiple Amazon EC2 instances distributed across two Availability Zones. An Application Load Balancer will distribute incoming traffic across the instances. The company's primary goal is to ensure the application remains available to users even if one Availability Zone experiences a service disruption. Which cloud computing concept does this architecture primarily demonstrate?

Accepted Answer

High availability. This architecture demonstrates high availability because it uses multiple EC2 instances across two Availability Zones with an Application Load Balancer to distribute traffic. If one AZ fails, the load balancer automatically routes traffic to the healthy instances in the other AZ, ensuring the application remains accessible. High availability focuses on minimizing downtime by eliminating single points of failure through redundancy.

Answer

Elasticity

Answer

Scalability

Answer

Fault tolerance

Question 14

A company's data scientists want a managed environment for collaborative Jupyter notebooks connected to their AWS data sources and compute without managing infrastructure. Which AWS service provides this?

Accepted Answer

Amazon SageMaker Studio. Amazon SageMaker Studio is a fully managed, web-based visual interface for data scientists to build, train, debug, deploy, and monitor machine learning models. It provides collaborative Jupyter notebooks that can connect directly to AWS data sources (e.g., S3, Athena, Redshift) and compute resources (e.g., SageMaker training instances, endpoints) without requiring any infrastructure management by the user.

Answer

AWS Cloud9

Answer

Amazon EMR Studio

Answer

AWS Lambda with Jupyter

Question 15

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple Amazon EC2 instances concurrently. The EC2 instances run Amazon Linux and are deployed across multiple Availability Zones for high availability. The file system must grow and shrink automatically as files are added or removed, and the company wants to avoid provisioning storage capacity in advance. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up and down as files are added or removed, eliminating the need to provision storage in advance. EFS supports the NFSv4.1 and NFSv4.0 protocols, making it ideal for shared file workloads on Amazon Linux.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon FSx for Windows File Server

Question 16

A startup recently signed up for AWS and is using the AWS Free Tier to run a small web application. The startup's finance lead wants to monitor the team's usage of AWS services to ensure they do not exceed the Free Tier limits and incur unexpected charges. The finance lead needs a tool that can proactively send an alert when the team approaches 80% of the Free Tier limit for a specific service, such as Amazon EC2. Which AWS service or feature should the finance lead use to set up this alert?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, including alerts for Free Tier usage. You can configure a budget to track your actual Free Tier consumption for a specific service like Amazon EC2 and trigger an alert when usage reaches 80% of the Free Tier limit. This meets the finance lead's requirement for proactive notification before exceeding limits and incurring charges.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Personal Health Dashboard

Question 17

A company is migrating its on-premises data center to AWS. The Chief Financial Officer (CFO) wants to understand how this migration will change the company's financial structure. Historically, the company purchased servers, networking equipment, and software licenses upfront, with costs depreciating over several years. The CFO notes that the move to AWS will replace these large upfront capital expenditures with smaller, recurring operational expenses based on actual usage. Which essential characteristic of cloud computing enables this shift from capital expenditure (CAPEX) to operational expenditure (OPEX)?

Accepted Answer

Measured service. Measured service is the cloud characteristic that allows providers to track and bill customers for actual resource usage (e.g., compute hours, storage GB-months, data transfer). This pay-as-you-go model directly replaces the need for large upfront capital purchases (CAPEX) with variable, usage-based operational expenses (OPEX), as the CFO requires. Without measured service, AWS would have no mechanism to meter consumption and charge proportionally, making the financial shift impossible.

Answer

Elasticity

Answer

High availability

Answer

Resource pooling

Question 18

A company is designing a highly available web application on AWS. The application must remain available and continue serving traffic even if an entire physical data center experiences a complete outage. Which AWS global infrastructure component should the solutions architect use to meet this requirement?

Accepted Answer

Deploy the application across multiple Availability Zones within a single AWS Region.. Deploying across multiple Availability Zones (AZs) within a single AWS Region protects against the failure of an entire physical data center. Each AZ is a distinct, isolated location with independent power, cooling, and networking, so if one AZ goes down, the application continues serving traffic from the other AZs. This design meets the requirement for high availability without the complexity and cost of multi-Region deployment.

Answer

Deploy the application across multiple AWS Regions.

Answer

Deploy the application to an AWS Local Zone.

Answer

Use an AWS Edge Location to cache the application's content.

Question 19

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application serves dynamic content that changes frequently, but also serves static assets (CSS, JavaScript, images) that change rarely. The company wants to improve the overall performance and reduce the load on the EC2 instances by caching the static assets at edge locations while still routing dynamic requests to the ALB. Which combination of AWS services should the company use?

Accepted Answer

Use Amazon CloudFront with the ALB as the origin, and configure CloudFront to cache the static assets while forwarding dynamic requests to the ALB.. Amazon CloudFront can be configured with the ALB as the origin, allowing it to cache static assets (CSS, JavaScript, images) at edge locations while forwarding dynamic requests to the ALB. This reduces latency for users by serving cached content from the nearest edge location and offloads the EC2 instances from handling repeated requests for static files. CloudFront supports path-based caching behaviors, so you can define specific URL patterns (e.g., /static/*) to cache and others to forward directly to the ALB.

Answer

Use Amazon Route 53 with latency-based routing to direct users to the closest ALB endpoint.

Answer

Use Amazon S3 to host the entire application, and use the ALB to route traffic to the S3 bucket.

Answer

Use AWS Global Accelerator to distribute traffic across multiple ALBs in different AWS Regions.

Question 20

Which Amazon EC2 instance family is optimized for memory-intensive workloads such as in-memory databases, real-time big data analytics, and high-performance computing?

Accepted Answer

Memory-optimized instances (R and X family). Memory-optimized instances (R and X families) are designed for workloads that require large amounts of RAM and high memory bandwidth, such as in-memory databases (e.g., Redis, Memcached), real-time big data analytics (e.g., Apache Spark), and high-performance computing (HPC) tasks. These instances offer a high memory-to-vCPU ratio and support for large instance sizes, enabling efficient processing of data sets that reside primarily in memory.

Answer

Compute-optimized instances (C family)

Answer

Storage-optimized instances (I and D family)

Answer

Accelerated computing instances (P and G family)