CLF-C02 Practice Exam 55 — 20 Questions

Question 1

A company's data scientists want a managed environment for collaborative Jupyter notebooks connected to their AWS data sources and compute without managing infrastructure. Which AWS service provides this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon SageMaker Studio. Amazon SageMaker Studio is a fully managed, web-based visual interface for data scientists to build, train, debug, deploy, and monitor machine learning models. It provides collaborative Jupyter notebooks that can connect directly to AWS data sources (e.g., S3, Athena, Redshift) and compute resources (e.g., SageMaker training instances, endpoints) without requiring any infrastructure management by the user.

Answer

AWS Cloud9

Answer

Amazon EMR Studio

Answer

AWS Lambda with Jupyter

Question 2

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple Amazon EC2 instances concurrently. The EC2 instances run Amazon Linux and are deployed across multiple Availability Zones for high availability. The file system must grow and shrink automatically as files are added or removed, and the company wants to avoid provisioning storage capacity in advance. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up and down as files are added or removed, eliminating the need to provision storage in advance. EFS supports the NFSv4.1 and NFSv4.0 protocols, making it ideal for shared file workloads on Amazon Linux.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon FSx for Windows File Server

Question 3

A startup recently signed up for AWS and is using the AWS Free Tier to run a small web application. The startup's finance lead wants to monitor the team's usage of AWS services to ensure they do not exceed the Free Tier limits and incur unexpected charges. The finance lead needs a tool that can proactively send an alert when the team approaches 80% of the Free Tier limit for a specific service, such as Amazon EC2. Which AWS service or feature should the finance lead use to set up this alert?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, including alerts for Free Tier usage. You can configure a budget to track your actual Free Tier consumption for a specific service like Amazon EC2 and trigger an alert when usage reaches 80% of the Free Tier limit. This meets the finance lead's requirement for proactive notification before exceeding limits and incurring charges.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Personal Health Dashboard

Question 4

A company is designing a highly available web application on AWS. The application must remain available and continue serving traffic even if an entire physical data center experiences a complete outage. Which AWS global infrastructure component should the solutions architect use to meet this requirement?

Accepted Answer

Deploy the application across multiple Availability Zones within a single AWS Region.. Deploying across multiple Availability Zones (AZs) within a single AWS Region protects against the failure of an entire physical data center. Each AZ is a distinct, isolated location with independent power, cooling, and networking, so if one AZ goes down, the application continues serving traffic from the other AZs. This design meets the requirement for high availability without the complexity and cost of multi-Region deployment.

Answer

Deploy the application across multiple AWS Regions.

Answer

Deploy the application to an AWS Local Zone.

Answer

Use an AWS Edge Location to cache the application's content.

Question 5

Which Amazon EC2 instance family is optimized for memory-intensive workloads such as in-memory databases, real-time big data analytics, and high-performance computing?

Accepted Answer

Memory-optimized instances (R and X family). Memory-optimized instances (R and X families) are designed for workloads that require large amounts of RAM and high memory bandwidth, such as in-memory databases (e.g., Redis, Memcached), real-time big data analytics (e.g., Apache Spark), and high-performance computing (HPC) tasks. These instances offer a high memory-to-vCPU ratio and support for large instance sizes, enabling efficient processing of data sets that reside primarily in memory.

Answer

Compute-optimized instances (C family)

Answer

Storage-optimized instances (I and D family)

Answer

Accelerated computing instances (P and G family)

Question 6

A company runs several applications in a single AWS account. Each application belongs to a different project (Project Alpha, Project Beta, Project Gamma). The company has already applied tags with the key "Project" and the corresponding project name to all AWS resources used by each project. The finance team wants to use AWS Cost Explorer to view and filter monthly costs by project. However, after tagging all resources, the "Project" tag does not appear as a filter option in Cost Explorer. What must the finance team do to make the "Project" tag available for cost filtering in Cost Explorer?

Accepted Answer

Activate the "Project" cost allocation tag in the Billing and Cost Management console.. The 'Project' tag does not appear in Cost Explorer because AWS does not automatically activate user-defined tags for cost tracking. The finance team must manually activate the 'Project' cost allocation tag in the Billing and Cost Management console under 'Cost Allocation Tags'. Once activated, AWS will process the tag data and make it available as a filter in Cost Explorer within 24 hours.

Answer

Create a new AWS Budget with a cost filter for the "Project" tag.

Answer

Enable the AWS Cost and Usage Reports for the account.

Answer

Create a custom cost category with a rule that uses the "Project" tag.

Question 7

A company runs a production e-commerce application on AWS. The CIO requires that the company have access to AWS technical support with a response time of under 1 hour for critical production system failures. Additionally, the operations team wants to use AWS Trusted Advisor to get recommendations on cost optimization, performance, and security for all AWS resources. The company already pays for AWS Business Support for its development account but wants the minimum-cost support plan that meets these requirements for its production account. Which AWS Support plan should the company choose for the production account?

Accepted Answer

AWS Business Support. AWS Business Support is the minimum plan that provides a 1-hour response time for critical production system failures and full access to AWS Trusted Advisor, including cost optimization, performance, and security checks. AWS Basic and Developer Support do not offer a 1-hour response time for critical failures, and Developer Support only provides limited Trusted Advisor checks. Therefore, Business Support meets both requirements at the lowest cost for the production account.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise Support

Question 8

A company wants to run a MySQL database on AWS. They require full control over the operating system, MySQL version selection, storage layout, and network configuration. Which cloud service model provides this level of control?

Accepted Answer

Infrastructure as a Service (IaaS). C is correct because Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the customer full control over the operating system, database software (including MySQL version selection), storage layout (e.g., instance store vs. EBS volumes), and network configuration (e.g., VPC, subnets, security groups). This is the only service model that allows you to manage the underlying OS and database stack directly, similar to running a physical server.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 9

Which AWS service provides a managed message broker for Apache ActiveMQ and RabbitMQ to help migrate existing messaging systems to the cloud?

Accepted Answer

Amazon MQ. Amazon MQ is a managed message broker service that natively supports Apache ActiveMQ and RabbitMQ, making it the ideal choice for migrating existing messaging systems that rely on these protocols to the cloud without rewriting application code. It handles the provisioning, patching, and high availability of the broker infrastructure, allowing you to use standard JMS, AMQP, MQTT, and STOMP protocols.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon Kinesis

Question 10

Which AWS concept describes the practice of tracking and managing costs using software engineering principles — such as tagging, automation, and real-time visibility — to enable engineers and teams to make cost-aware decisions?

Accepted Answer

Cloud Financial Management (FinOps). Cloud Financial Management (FinOps) is the correct answer because it specifically refers to the practice of applying software engineering principles—such as tagging resources, automating cost controls, and providing real-time cost visibility—to manage cloud spending. This enables engineers and teams to make cost-aware decisions during development and operations, aligning with the question's description.

Answer

Total Cost of Ownership (TCO)

Answer

Reserved Instance optimization

Answer

Cost Avoidance

Question 11

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP(S) requests. It provides managed rules to block common web exploits such as SQL injection and cross-site scripting (XSS), and allows you to define custom rules using conditions like IP addresses, HTTP headers, and URI strings. This makes it the correct choice for protecting the ALB-hosted application against these specific threats.

Answer

AWS Shield Advanced

Answer

Security Groups

Answer

AWS Firewall Manager

Question 12

A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?

Accepted Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key. SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Client-side encryption using the AWS Encryption SDK

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Question 13

A financial services company stores sensitive transaction data in Amazon S3. The company must encrypt the data at rest using keys that are stored in a hardware security module (HSM) validated under FIPS 140-2 Level 3. Additionally, the company requires full control over the key lifecycle, including rotation and deletion, and AWS must not have any access to the keys. Which AWS service should the company use to generate and store the encryption keys?

Accepted Answer

AWS CloudHSM. AWS CloudHSM is the correct choice because it provides dedicated hardware security modules (HSMs) that are validated under FIPS 140-2 Level 3, allowing you to generate and store encryption keys entirely within the HSM. With CloudHSM, AWS has no access to your keys, and you retain full control over key lifecycle operations such as rotation and deletion, meeting the strict compliance and security requirements of the financial services company.

Answer

AWS Key Management Service (KMS) with a customer managed key

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 14

A company is building a serverless order-processing application. The workflow consists of several steps that must run in a defined order: validate the order, check inventory, process payment, and then update the database. Some steps, such as shipping notification and invoice generation, can run in parallel after payment is confirmed. The company needs a managed service to orchestrate these steps, automatically handle retries if a step fails, and provide a visual representation of the workflow's execution state. Which AWS service should the company use?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is a fully managed serverless orchestration service that allows you to define workflows as state machines, specifying sequential steps (validate, check inventory, process payment, update database) and parallel branches (shipping notification, invoice generation). It automatically handles retries on failures with configurable backoff rates and provides a visual execution console to track the state of each workflow instance in real time, meeting all the company's requirements.

Answer

Amazon Simple Workflow Service (SWF)

Answer

Amazon MQ

Answer

AWS Glue

Question 15

A company currently owns and operates its own data center. They are considering moving to AWS. Which economic benefit describes the elimination of the costs associated with purchasing, maintaining, and cooling physical servers?

Accepted Answer

Stop spending money running and maintaining data centers. Moving to AWS eliminates the capital and operational expenses associated with owning and operating physical servers, including procurement, maintenance, cooling, and facility management. This aligns with the AWS value proposition of shifting from a capital expenditure (CapEx) model to an operational expenditure (OpEx) model, where customers pay only for the resources they consume.

Answer

Economies of scale

Answer

Go global in minutes

Answer

Increase speed and agility

Question 16

A financial services company has a core banking application that runs on-premises and stores sensitive customer data. Due to strict regulatory requirements, this application cannot be migrated to the cloud. However, the company wants to use AWS for its development and test environments to benefit from rapid provisioning and pay-per-use pricing. The company also wants to establish a dedicated private network connection between its on-premises data center and AWS to securely transfer data between the environments. Which cloud deployment model does this scenario describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud deployment model because it combines on-premises infrastructure (the core banking application) with AWS public cloud resources (development and test environments) connected via a dedicated private network, such as AWS Direct Connect. The hybrid cloud model allows the company to keep sensitive data on-premises for regulatory compliance while leveraging AWS's scalability and pay-per-use pricing for non-production workloads. The key enabler is the private, low-latency connection that securely transfers data between the two environments, which is a hallmark of hybrid cloud architecture.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 17

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

Accepted Answer

Enable MFA on the root account and create an IAM admin user for daily operations. The root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Answer

Create IAM users for all employees immediately

Answer

Create root access keys for programmatic access

Answer

Enable AWS Config in all regions

Question 18

A company runs a fleet of production Amazon EC2 instances that operate 24/7 throughout the year. The CFO wants to reduce compute costs by committing to a consistent usage level. The finance team needs a tool that analyzes the company's historical EC2 usage and provides recommendations for the most cost-effective purchase options, including recommendations for both Reserved Instances and Savings Plans, with support for instance size flexibility. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a comprehensive analysis of historical EC2 usage and generates tailored recommendations for both Reserved Instances (RI) and Savings Plans, including support for instance size flexibility. This directly meets the CFO's requirement to commit to a consistent usage level while optimizing costs based on actual usage patterns.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 19

A global e-commerce company stores product images and videos in an Amazon S3 bucket located in the us-west-2 Region. Customers worldwide report slow page load times. The company also wants to protect its website against common distributed denial-of-service (DDoS) attacks without incurring additional costs for a dedicated DDoS protection service. Which AWS service should the company use to meet both requirements?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It also includes AWS Shield Standard at no additional cost, which provides always-on protection against common DDoS attacks (e.g., SYN floods, UDP reflection). This combination directly addresses both the slow page load times and the need for cost-effective DDoS protection.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Global Accelerator

Answer

AWS Shield Advanced

Question 20

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty