CLF-C02 Practice Exam 56 — 20 Questions

Question 1

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 2

A company is designing a critical web application that must remain available even if an entire data center goes offline due to a power outage. The application will run on Amazon EC2 instances in the us-east-1 Region. Which AWS infrastructure strategy should the company use to meet this high-availability requirement?

Accepted Answer

Deploy the EC2 instances across two or more Availability Zones within the us-east-1 Region.. Option B is correct because deploying EC2 instances across two or more Availability Zones (AZs) within a single AWS Region protects against an entire data center failure. Each AZ is physically separated, with independent power, cooling, and networking, so if one AZ goes offline, the application continues running in the other AZs. This design meets the high-availability requirement without the complexity and latency of multi-Region deployment.

Answer

Launch all EC2 instances in a single Availability Zone to ensure low latency between instances.

Answer

Deploy the EC2 instances in multiple AWS Regions, such as us-east-1 and eu-west-1.

Answer

Use separate AWS accounts for each EC2 instance to isolate the workload from a data center failure.

Question 3

A company is building a serverless web application using AWS Lambda for compute. The application needs to expose RESTful API endpoints that allow users to perform CRUD operations on a database. The API must support authentication using API keys, throttle requests to prevent abuse, and validate incoming request payloads before they reach the Lambda functions. The company wants a fully managed service that handles these API management tasks and integrates directly with AWS Lambda. Which AWS service should the company use?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is a fully managed service that handles RESTful API creation, authentication via API keys, request throttling to prevent abuse, and request payload validation before invoking AWS Lambda functions. It integrates natively with Lambda, making it the ideal choice for serverless web applications requiring CRUD operations with built-in API management.

Answer

Amazon CloudFront

Answer

Application Load Balancer

Answer

AWS Step Functions

Question 4

A company is developing a microservices application using Docker containers. The development team wants to deploy and run these containers on AWS without having to provision or manage any underlying EC2 instances. Additionally, the team does not want to manage the container orchestration control plane. They need a fully serverless compute engine for containers that automatically scales based on demand. Which AWS compute option should the team use?

Accepted Answer

Amazon ECS with the AWS Fargate launch type. Amazon ECS with the AWS Fargate launch type is the correct choice because it provides a fully serverless compute engine for containers. Fargate eliminates the need to provision or manage EC2 instances and removes the burden of managing the container orchestration control plane, as AWS handles both the underlying infrastructure and the orchestration layer. It automatically scales container instances based on demand, meeting the team's requirement for a serverless, auto-scaling container solution.

Answer

Amazon EC2 instances with Docker installed

Answer

AWS Lambda

Answer

Amazon EKS with managed node groups

Question 5

A company hosts a web application on Amazon EC2 instances in two AWS Regions: us-east-1 and eu-west-1. The application serves a global user base. The company wants to improve performance by directing users to the nearest healthy regional endpoint with minimal latency. Additionally, the company requires two static Anycast IP addresses that remain constant, representing the application entry point. The solution should automatically reroute traffic if a regional endpoint becomes unhealthy. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is correct because it uses the AWS global network and Anycast static IP addresses to route user traffic to the nearest healthy regional endpoint (EC2 instances in us-east-1 or eu-west-1). It automatically reroutes traffic if an endpoint becomes unhealthy, providing low latency and high availability for global users.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Shield

Question 6

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Amazon CloudFront and Application Load Balancers (ALB) to inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. This makes it the correct choice for the security team's requirement to filter and block specific attack patterns at the application layer.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

Amazon Inspector

Question 7

A company is developing a microservices-based application using Docker containers. The development team wants to run these containers on AWS without having to provision or manage any servers. The solution must automatically scale the containers based on demand and integrate with an Application Load Balancer for traffic distribution. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Fargate. AWS Fargate is the correct choice because it is a serverless compute engine for containers that allows you to run Docker containers without provisioning or managing servers. It automatically scales containers based on demand and integrates natively with an Application Load Balancer (ALB) for traffic distribution, meeting all the stated requirements.

Answer

AWS Lambda

Answer

Amazon ECS on Amazon EC2

Answer

Amazon Lightsail

Question 8

A company moves its infrastructure to AWS. The company's IT team notices that they have no control over which specific physical server their virtual machines run on, and they are unaware of the exact hardware location except at the regional level. The underlying physical resources are shared across multiple AWS customers. Which essential characteristic of cloud computing does this scenario BEST describe?

Accepted Answer

Resource pooling. Option C is correct because resource pooling is the cloud characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to customer demand. The scenario describes the customer having no control over the exact physical server or hardware location beyond the regional level, which is the essence of resource pooling. This allows AWS to achieve economies of scale while abstracting the underlying hardware from the customer.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 9

A company is deploying a new web application on AWS. The operations team needs to provision and manage AWS resources such as Amazon EC2 instances, Amazon RDS databases, and Amazon S3 buckets in a repeatable, consistent manner across development, test, and production environments. The team wants to define the entire infrastructure as code using declarative templates that can be version-controlled and reviewed. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire infrastructure as code using declarative templates (JSON or YAML). These templates can be version-controlled and reviewed, enabling repeatable and consistent provisioning of resources like EC2 instances, RDS databases, and S3 buckets across multiple environments. CloudFormation manages the lifecycle of these resources as stacks, ensuring idempotent deployments.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 10

A company hosts a web application on an Amazon EC2 instance. The company installs its own application software and configures the operating system. The company also uses AWS Key Management Service (AWS KMS) to create a customer-managed key to encrypt data on the Amazon Elastic Block Store (Amazon EBS) volume attached to the instance. According to the AWS shared responsibility model, which of the following is the responsibility of AWS?

Accepted Answer

Ensuring the physical security of the data center where the Amazon EC2 instance runs.. Option C is correct because under the AWS shared responsibility model, AWS is responsible for the security of the cloud, which includes the physical security of data centers, hardware, networking, and facilities where EC2 instances run. This is a foundational layer that customers cannot manage or control.

Answer

Encrypting the data on the Amazon EBS volume using the customer-managed key.

Answer

Patching the operating system of the Amazon EC2 instance.

Answer

Configuring the security group rules to restrict traffic to the Amazon EC2 instance.

Question 11

A company is developing a mobile application that requires a database to store user session data and preferences. The data is accessed very frequently with low-latency requirements, and the access patterns are unpredictable – the application experiences sudden spikes in read and write traffic. The company wants a fully managed database service that automatically scales to handle the workload, requires no patching or server administration, and charges based on the throughput consumed rather than on provisioned capacity. Which AWS service meets these requirements?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports on-demand capacity mode, which automatically scales to handle unpredictable traffic spikes and charges based on the actual reads and writes consumed, not on pre-provisioned throughput. This eliminates the need for patching, server administration, or capacity planning, matching all the stated requirements exactly.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon EBS

Question 12

A company is developing a microservices application on AWS. The application has multiple independent services that must communicate asynchronously. The company needs a fully managed service to reliably store and deliver messages between these services, ensuring that each message is processed at least once and allowing the services to scale independently. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables asynchronous communication between microservices. It reliably stores messages in queues and ensures each message is delivered at least once, allowing services to poll and process messages independently, which supports decoupling and independent scaling.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon MQ

Answer

Amazon Kinesis Data Streams

Question 13

A company is deploying a web application on AWS. The application will run on multiple Amazon EC2 instances distributed across two Availability Zones. An Application Load Balancer will distribute incoming traffic across the instances. The company's primary goal is to ensure the application remains available to users even if one Availability Zone experiences a service disruption. Which cloud computing concept does this architecture primarily demonstrate?

Accepted Answer

High availability. This architecture demonstrates high availability because it uses multiple EC2 instances across two Availability Zones with an Application Load Balancer to distribute traffic. If one AZ fails, the load balancer automatically routes traffic to the healthy instances in the other AZ, ensuring the application remains accessible. High availability focuses on minimizing downtime by eliminating single points of failure through redundancy.

Answer

Elasticity

Answer

Scalability

Answer

Fault tolerance

Question 14

A company is evaluating a migration of its on-premises data center to AWS. The CIO wants a detailed report that compares the total cost of ownership (TCO) of the current on-premises infrastructure versus running the equivalent workloads on AWS. The report should include costs for hardware, software, labor, power, cooling, and facilities. Which AWS tool should the company use to generate this comparison?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of on-premises infrastructure with AWS, including hardware, software, labor, power, cooling, and facilities. It generates a detailed report that breaks down these cost categories, making it the correct tool for the CIO's requirement.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 15

A company migrates its on-premises applications to AWS. The finance team wants to allocate costs to different departments based on the exact amount of compute, storage, and network resources each department consumes. They also want to set automatic alerts when a department's usage exceeds a predefined budget. Which essential characteristic of cloud computing enables this level of visibility and control over resource consumption?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and report resource usage (compute hours, storage GB, data transfer) at a granular level. This metering data enables the finance team to allocate exact costs per department and set automated budget alerts via services like AWS Budgets or Cost Explorer, directly supporting the requirement for visibility and control over consumption.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Resource pooling

Question 16

A company is building a microservices application on AWS. The application consists of multiple independent services that need to communicate asynchronously. When an order is placed, the order service must send a notification to the inventory service, the shipping service, and the analytics service simultaneously. The company wants a fully managed, durable, and scalable messaging service that supports a fan-out pattern where a single message can be delivered to multiple subscribers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that supports fan-out, where a single message published to a topic is delivered to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints) simultaneously. It is durable (persists messages across AZs) and scales automatically to handle high throughput, making it ideal for the asynchronous notification requirements of the order, inventory, shipping, and analytics services.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 17

A company is launching a critical production application on AWS. The operations team requires technical support with a response time of less than 1 hour for urgent system issues. They also need access to AWS Trusted Advisor best practice checks for cost optimization and security. Which AWS Support plan meets these requirements at the lowest cost?

Accepted Answer

AWS Business Support. AWS Business Support provides a response time of less than 1 hour for urgent system issues (production system impaired) and includes full access to AWS Trusted Advisor best practice checks for cost optimization and security. This meets all stated requirements at the lowest cost among the plans that offer these features.

Answer

AWS Developer Support

Answer

AWS Enterprise On-Ramp Support

Answer

AWS Enterprise Support

Question 18

A company is building a serverless order-processing application. The workflow consists of several steps that must run in a defined order: validate the order, check inventory, process payment, and then update the database. Some steps, such as shipping notification and invoice generation, can run in parallel after payment is confirmed. The company needs a managed service to orchestrate these steps, automatically handle retries if a step fails, and provide a visual representation of the workflow's execution state. Which AWS service should the company use?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is a fully managed serverless orchestration service that allows you to define workflows as state machines, specifying sequential steps (validate, check inventory, process payment, update database) and parallel branches (shipping notification, invoice generation). It automatically handles retries on failures with configurable backoff rates and provides a visual execution console to track the state of each workflow instance in real time, meeting all the company's requirements.

Answer

Amazon Simple Workflow Service (SWF)

Answer

Amazon MQ

Answer

AWS Glue

Question 19

A company is migrating a legacy application from an on-premises server to AWS Lambda. The Lambda function needs to connect to an Amazon RDS for MySQL database that stores sensitive customer data. The security team requires that database credentials are never stored in the function's code, environment variables, or configuration files. The solution must follow AWS best practices for securing database access. Which approach should the company use?

Accepted Answer

Configure the Lambda function to use an IAM role with permissions to connect to the RDS database using IAM database authentication.. Option C is correct because IAM database authentication eliminates the need to store any credentials in code, environment variables, or configuration files. The Lambda function assumes an IAM role that generates an authentication token using the AWS Signature Version 4 process, which is then used as a password to connect to the RDS MySQL database. This approach meets the security team's requirement and follows AWS best practices by leveraging short-term, rotated credentials without embedding secrets.

Answer

Store the database password in AWS Secrets Manager and retrieve it from within the Lambda function code.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString and retrieve it from within the Lambda function.

Answer

Encrypt the database password using AWS KMS and hardcode the encrypted password in the Lambda function code.

Question 20

A company is launching a new application and expects user demand to grow gradually over the next 12 months. To control upfront costs, the company plans to start with a small number of Amazon EC2 instances and manually add more instances each month as the user base increases. The operations team will monitor usage and adjust capacity based on observed trends. Which cloud computing concept does this approach BEST illustrate?

Accepted Answer

Scalability. The scenario describes manually adding EC2 instances over time to match growing demand, which is a classic example of scalability—the ability to increase or decrease resources to handle changing workloads. Scalability focuses on planned capacity adjustments, whereas elasticity involves automatic, real-time scaling in response to demand fluctuations. Here, the manual, monthly additions based on observed trends align with scalability, not the automated provisioning that defines elasticity.

Answer

Elasticity

Answer

High availability

Answer

Fault tolerance