CLF-C02 Practice Exam 55 — 20 Questions

Question 1

A company has migrated to AWS and uses multiple accounts under AWS Organizations with consolidated billing. The finance team needs a monthly cost breakdown by business unit. Each business unit's AWS resources are tagged with a 'BusinessUnit' tag (e.g., 'Marketing', 'Engineering'). However, some resources are not tagged. The team wants to see both the cost per business unit (based on tagged resources) and the total cost of untagged resources, all in one view. They also need the ability to filter by AWS service (e.g., EC2, S3) for each business unit. Which AWS tool or feature should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a customizable dashboard that allows you to filter and group costs by tags (such as 'BusinessUnit') and by AWS service (e.g., EC2, S3). It can display both tagged and untagged resource costs in the same view, enabling the finance team to see a monthly breakdown per business unit alongside the total cost of untagged resources. This meets all the requirements without additional configuration.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Monthly Report (from Billing console)

Question 2

A company hosts an e-commerce website on Amazon EC2 instances in the us-east-1 Region. The website serves static assets (images, CSS, and JavaScript) to a global user base. Users in Europe and Asia report slow page load times. The company needs to improve the performance of delivering these static assets to all users without modifying the application code or provisioning additional origin servers. Which AWS service should the company use?

Accepted Answer

Use Amazon CloudFront to distribute the static assets from AWS edge locations.. Amazon CloudFront is a content delivery network (CDN) that caches static assets at AWS edge locations worldwide, reducing latency for global users without requiring code changes or additional origin servers. It integrates seamlessly with EC2 origins and automatically serves content from the nearest edge location, directly addressing the slow page load times reported in Europe and Asia.

Answer

Deploy the website on additional Amazon EC2 instances in the eu-west-1 and ap-southeast-1 Regions, and use a Network Load Balancer to distribute traffic across all Regions.

Answer

Use Amazon Route 53 with geolocation routing policies to route users to the nearest AWS Region for the website.

Answer

Enable S3 Transfer Acceleration on the Amazon S3 bucket that stores the static assets.

Question 3

A company has a security policy that requires all Amazon EBS volumes attached to production Amazon EC2 instances to be encrypted at rest using customer-managed encryption keys. The policy also mandates that the encryption keys must be automatically rotated every 365 days. The company wants to minimize operational overhead by using a managed AWS service for key management and automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it provides managed customer master keys (CMKs) that can be used to encrypt EBS volumes at rest, and it supports automatic annual key rotation (every 365 days) with no additional operational overhead. KMS integrates directly with EBS to enforce encryption using customer-managed keys, meeting both the encryption and rotation requirements.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 4

A company has been using AWS for several months. The finance team wants to view a graphical dashboard of their monthly spending trends for the past 6 months and also obtain a forecast of their expected costs for the next month. The team needs an AWS managed service that provides this visualization and forecasting without requiring any additional data export or third-party tools. Which AWS service should the team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, managed graphical dashboard that visualizes historical spending trends and generates cost forecasts for the next month without requiring any data export or third-party tools. It allows filtering by time range (e.g., past 6 months) and automatically computes a forecast based on historical usage patterns using AWS's internal machine learning models.

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Answer

AWS Trusted Advisor

Question 5

A company has been using AWS for six months and wants to predict their expected spending for the next quarter. They have historical cost data and need to use an AWS tool that can analyze past usage patterns and generate a monthly cost forecast. Which AWS tool should they use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built dashboard with historical cost data and the ability to generate forecasts for future spending based on past usage patterns. It uses machine learning models to analyze your historical usage and produce a monthly cost forecast, making it the correct tool for predicting expected spending for the next quarter.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Report

Question 6

A company has a web application that processes user-uploaded images. When a user uploads an image, the application needs to resize the image into multiple formats (thumbnail, medium, large). The company wants to avoid managing servers and wants the image processing to execute only when a new image is uploaded. The solution must automatically scale to handle thousands of concurrent uploads. Which AWS service should the company use to perform the image processing?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an image upload to Amazon S3. It automatically scales from zero to thousands of concurrent executions, perfectly matching the requirement to avoid managing servers and to process images only when a new upload occurs.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate launch type

Answer

AWS Elastic Beanstalk

Question 7

A company has been running workloads on AWS for over a year. The finance team needs to analyze historical spending patterns. They want a graphical dashboard that shows costs by service (e.g., EC2, S3), by AWS Region, and by custom cost allocation tags over the last 12 months. Additionally, they need to generate a 3-month cost forecast based on this historical data. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built graphical dashboard that allows you to visualize, understand, and manage AWS costs and usage over time. It supports filtering by service (e.g., EC2, S3), AWS Region, and custom cost allocation tags, and it includes a built-in forecasting feature that can generate a 3-month cost forecast based on historical data. This directly meets all the requirements for analyzing historical spending patterns and generating a forecast.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 8

A company has an AWS Basic Support plan. The operations team wants to use AWS Trusted Advisor to receive recommendations for cost optimization, such as identifying idle load balancers and underutilized Amazon EC2 instances. They log into the AWS Management Console and navigate to Trusted Advisor, but they only see a limited set of checks, such as S3 bucket permissions and service limits. Which action should the team take to access the complete library of Trusted Advisor checks, including the cost optimization recommendations?

Accepted Answer

Upgrade to a Business or Enterprise Support plan.. AWS Trusted Advisor provides a full set of checks, including cost optimization recommendations (e.g., idle load balancers, underutilized EC2 instances), only to customers with a Business or Enterprise Support plan. The Basic Support plan restricts Trusted Advisor to a limited subset of checks, such as S3 bucket permissions and service limits. Therefore, upgrading to a Business or Enterprise Support plan is required to access the complete library of checks.

Answer

Enable AWS Config to perform the cost optimization and underutilization checks.

Answer

Upgrade to a Developer Support plan.

Answer

No action is needed; the full set of Trusted Advisor checks is already available for all AWS Support plans.

Question 9

A company has multiple AWS accounts consolidated under AWS Organizations. The finance team wants to set a hard monthly cost limit for a development account. If the forecasted costs for the month exceed that limit, the team wants AWS to automatically stop all non-critical Amazon EC2 instances in that account to prevent overspending. The team also needs to receive an email alert when the cost threshold is first crossed. Which AWS service or feature should the team use to define the budget and configure the automated action?

Accepted Answer

AWS Budgets with an Amazon EC2 action. AWS Budgets allows you to set a cost budget with a threshold and, when forecasted costs exceed that threshold, trigger an AWS Budgets action to stop specific Amazon EC2 instances. This meets the requirement for a hard monthly cost limit and automated instance stoppage, while also sending an email alert via Amazon SNS when the threshold is first crossed.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 10

A company hosts a critical e-commerce web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team is concerned about Layer 7 attacks, such as SQL injection and cross-site scripting (XSS). They also want to automatically block traffic from known malicious IP addresses. The company needs a managed web application firewall that integrates directly with the ALB. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common Layer 7 attacks, such as SQL injection and cross-site scripting (XSS), by inspecting HTTP/HTTPS requests. It integrates directly with an Application Load Balancer (ALB) to allow you to create custom rules that block or allow traffic based on request patterns, including automatically blocking traffic from known malicious IP addresses using managed IP reputation lists.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 11

A company has multiple IAM users. The security policy requires that every user must have an MFA device assigned and must use it for console sign-in. The security team wants to automatically detect any IAM user that does not have MFA enabled and receive an email alert. Which combination of AWS services should the team use to meet these requirements?

Accepted Answer

AWS Config and Amazon Simple Notification Service (Amazon SNS). AWS Config can continuously monitor IAM users for compliance with the security policy by using a managed rule such as IAM_USER_MFA_ENABLED. When a non-compliant user is detected, AWS Config can trigger an Amazon SNS topic to send an email alert, meeting the requirement for automatic detection and notification.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

AWS Trusted Advisor and Amazon Simple Email Service (Amazon SES)

Answer

AWS IAM Access Analyzer and Amazon Inspector

Question 12

A company is deploying a three-tier web application on AWS. The security team requires a network-level firewall that operates at the subnet level and can evaluate both inbound and outbound traffic using stateless rules. Which AWS feature should the company use to meet this requirement?

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a stateless, subnet-level firewall that evaluates both inbound and outbound traffic based on numbered rules. Unlike security groups, NACLs do not maintain connection state, so rules must be explicitly defined for both directions, meeting the requirement for stateless inspection at the subnet boundary.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield

Question 13

A company has migrated its IT infrastructure to AWS. The company's finance team receives a monthly bill that itemizes charges based on the number of Amazon EC2 instance hours consumed, the amount of Amazon S3 storage used in gigabyte-months, and the total data transferred out to the internet. The cloud provider automatically tracks and reports this usage data for billing purposes. This scenario best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Measured service. The correct answer is C because the scenario describes a cloud provider automatically tracking and reporting usage data (EC2 instance hours, S3 storage in gigabyte-months, and data transfer) for billing purposes. This is the essence of measured service, where cloud resources are metered and usage is monitored, controlled, and reported transparently. The pay-per-use billing model relies on this characteristic to provide cost visibility and optimization.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 14

A company has deployed a customer relationship management (CRM) application on AWS. Sales representatives use the application from their office laptops, company-issued tablets, and personal smartphones. They access the application securely through a web browser using HTTPS from any location, including client sites and home offices. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes the ability to access the CRM application from various devices (laptops, tablets, smartphones) over the network using standard protocols (HTTPS). This aligns with the NIST definition of broad network access, which states that capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 15

A company is deploying a multi-tier web application that includes a VPC, subnets, security groups, EC2 instances, and an Application Load Balancer. The team needs to define the entire infrastructure in a version-controlled template so that it can be consistently deployed across development, test, and production environments with minimal manual effort. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define your entire multi-tier web application infrastructure—including VPC, subnets, security groups, EC2 instances, and an Application Load Balancer—in a version-controlled template (JSON or YAML). This enables consistent, repeatable deployments across development, test, and production environments with minimal manual effort, as CloudFormation handles the provisioning and updates in an orderly, predictable manner.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS Systems Manager

Question 16

A company has deployed a web application on Amazon EC2 instances. The company's security team wants to ensure that the underlying host operating system is patched against a newly discovered vulnerability. According to the AWS Shared Responsibility Model, who is responsible for applying the patch to the host operating system?

Accepted Answer

AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes the physical infrastructure, hypervisor, and host operating system that runs EC2 instances. When a vulnerability is discovered in the host OS (the OS that runs the hypervisor and manages the physical hardware), AWS must apply the patch because the customer has no access to or control over the host OS. The customer is only responsible for patching the guest OS (the OS running inside the EC2 instance) and any applications deployed on it.

Answer

The company, because patches for underlying infrastructure are always the customer's responsibility in EC2.

Answer

The company, because EC2 is an Infrastructure as a Service (IaaS) offering and the customer manages the OS.

Answer

Both the company and AWS share responsibility equally for host OS patching.

Question 17

A company hosts a web application on an Application Load Balancer in the us-east-1 AWS Region. Users are distributed across North America, Europe, and Asia. The company wants to improve application performance and availability for global users by using the AWS global network. The solution must provide two static anycast IP addresses that do not change over time and automatically route incoming traffic to the nearest healthy endpoint in the region. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator with the Application Load Balancer configured as an endpoint. AWS Global Accelerator provides two static anycast IP addresses that serve as fixed entry points to the application. It uses the AWS global network to route traffic to the nearest healthy Application Load Balancer endpoint in us-east-1, automatically rerouting in case of endpoint failure. This meets the requirement for static IPs and performance improvement via the AWS backbone.

Answer

Amazon CloudFront with the Application Load Balancer configured as a custom origin

Answer

Amazon Route 53 with latency-based routing policy

Answer

Amazon S3 Transfer Acceleration

Question 18

A company hosts a public-facing web application behind an Application Load Balancer (ALB). The development team has recently identified that the application is vulnerable to common web attacks such as SQL injection and cross-site scripting (XSS). The security team wants to deploy a managed solution that can inspect incoming HTTP requests and block malicious traffic before it reaches the application. The solution must integrate directly with the existing ALB and provide pre-configured rule sets that can be customized. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests. It provides pre-configured rule sets, such as those for SQL injection and cross-site scripting (XSS), which can be customized to block malicious traffic before it reaches the application. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 19

A company hosts a static website on Amazon S3. Users in different geographic locations experience high latency when accessing the website. The company wants to reduce latency for all users and also minimize the number of direct requests to the S3 bucket. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, significantly reducing latency for users regardless of their geographic location. By serving content from the edge, CloudFront also offloads direct requests to the S3 bucket, reducing the load on the origin and potentially lowering costs.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 20

A company hosts its primary web application on Amazon EC2 instances in the us-east-1 AWS Region. To meet disaster recovery requirements, the company has launched an identical set of EC2 instances in the eu-west-1 Region. The company wants to direct all user traffic to the us-east-1 endpoints under normal conditions. If us-east-1 becomes unhealthy due to a regional outage, traffic must be automatically redirected to the eu-west-1 endpoints. The company uses Amazon Route 53 as its DNS service. Which Route 53 routing policy should the company use to meet these requirements?

Accepted Answer

Failover routing. Failover routing is the correct choice because it allows you to configure an active-passive setup where Route 53 health checks monitor the primary endpoint (us-east-1). If the health check fails, Route 53 automatically routes traffic to the secondary (eu-west-1) endpoint, meeting the disaster recovery requirement.

Answer

Geolocation routing

Answer

Latency routing

Answer

Weighted routing