CLF-C02 Practice Exam 56 — 20 Questions

Question 1

A social media startup plans to launch its application to users across North America, Europe, and Asia. The CTO wants a single deployment approach that minimizes latency for end users in all geographic regions, provides high availability, and allows the company to add new regions within minutes as the user base expands. The startup has no existing data centers outside its home country. Which fundamental benefit of cloud computing does this requirement best illustrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Global reach. The requirement to deploy a single application across North America, Europe, and Asia with low latency, high availability, and the ability to add new regions within minutes directly illustrates the global reach benefit of cloud computing. AWS provides a global infrastructure with Regions and Edge Locations that allow the startup to serve users from geographically distributed points without building physical data centers. This enables the company to achieve low-latency access and rapid regional expansion, which is a core advantage of cloud over on-premises architectures.

Answer

Pay-as-you-go pricing

Answer

Economies of scale

Answer

Agility

Question 2

A retail company runs its e-commerce platform on AWS. The platform uses multiple Amazon EC2 instances behind an Application Load Balancer. To ensure the application remains available during an Availability Zone failure, the company distributes the instances across three Availability Zones. The load balancer automatically reroutes traffic away from an unhealthy zone. This design primarily addresses which pillar of the AWS Well-Architected Framework?

Accepted Answer

Reliability. Distributing EC2 instances across multiple Availability Zones and using an Application Load Balancer to automatically reroute traffic away from unhealthy zones ensures that the application remains available even if an entire AZ fails. This design directly addresses the 'Reliability' pillar of the AWS Well-Architected Framework, which focuses on the ability of a workload to recover from infrastructure or service disruptions and dynamically acquire computing resources to meet demand.

Answer

Security

Answer

Performance Efficiency

Answer

Cost Optimization

Question 3

A manufacturing company collects sensor data from thousands of IoT devices every second. The data includes temperature, pressure, and vibration readings. The company needs to store this time-series data and perform real-time queries to detect anomalies, as well as run historical analysis. The data volume is extremely high and will grow continuously. The company wants a fully managed, serverless solution that can automatically scale to handle the data volume and provide built-in analytics functions for time-series. Which AWS service should the company use?

Accepted Answer

Amazon Timestream. Amazon Timestream is a fully managed, serverless time-series database service designed specifically for IoT and operational applications. It automatically scales to handle trillions of events per day, provides built-in time-series analytics functions (e.g., smoothing, approximation, interpolation), and supports both real-time queries and historical analysis with separate storage tiers (in-memory for recent data and magnetic for historical data). This makes it the ideal choice for the company's high-volume sensor data requirements.

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Question 4

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

Amazon Macie

Question 5

A company plans to migrate a three-tier web application to AWS. The application will run on Amazon EC2 instances, use an Amazon RDS database, and an Application Load Balancer. The CFO needs a detailed monthly cost estimate before migration. The solutions architect needs to model different instance types, storage sizes, and data transfer volumes, and then share the estimate with the finance team. Which AWS service should the solutions architect use to meet these requirements?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator allows the solutions architect to model different EC2 instance types, RDS storage sizes, and data transfer volumes to generate a detailed monthly cost estimate. It provides granular control over pricing assumptions, including reserved vs. on-demand instances, and produces a shareable estimate link for the finance team. This makes it the correct tool for pre-migration cost modeling.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Question 6

A company wants an automated tool that analyses their AWS account and provides recommendations across five categories: cost optimisation, performance, security, fault tolerance, and service limits. Which AWS service provides this analysis?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct service because it is specifically designed to analyze an AWS account and provide recommendations across the five categories listed: cost optimization, performance, security, fault tolerance, and service limits. It evaluates resources against AWS best practices and offers actionable guidance, making it the only service that covers all these domains in a single, automated tool.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon CloudWatch

Question 7

A company needs to run scheduled jobs that execute SQL queries on their Amazon RDS database every night. Which AWS service provides fully managed job scheduling without maintaining dedicated compute resources?

Accepted Answer

AWS Lambda triggered by Amazon EventBridge Scheduler. AWS Lambda triggered by Amazon EventBridge Scheduler is the correct choice because EventBridge Scheduler provides fully managed, serverless job scheduling that can invoke Lambda functions to execute SQL queries on Amazon RDS. This eliminates the need to provision or maintain any dedicated compute resources, as the scheduling and execution are handled entirely by AWS.

Answer

Amazon EC2 with cron jobs

Answer

Amazon ECS with scheduled tasks

Answer

AWS OpsWorks

Question 8

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS Config managed rules with automatic remediation

Answer

IAM Access Analyzer

Question 9

A company runs a stateless web application on a single Amazon EC2 instance in the us-east-1a Availability Zone. The application stores session data in an external Amazon ElastiCache cluster. Due to a power failure in the data center hosting us-east-1a, the EC2 instance becomes unavailable. The company wants to redesign the architecture so that the application recovers automatically in minutes if a single Availability Zone fails. Which design principle should the company implement?

Accepted Answer

Place the EC2 instance in an Auto Scaling group with a minimum capacity of 1, and configure the Auto Scaling group to span multiple Availability Zones.. Placing the EC2 instance in an Auto Scaling group with a minimum capacity of 1 and spanning multiple Availability Zones ensures that if us-east-1a fails, the Auto Scaling group automatically launches a new instance in a healthy Availability Zone (e.g., us-east-1b). Since the application is stateless and session data is stored externally in ElastiCache, the new instance can immediately serve traffic without data loss, achieving recovery within minutes.

Answer

Deploy the application across multiple AWS Regions and use Amazon Route 53 latency-based routing to failover.

Answer

Use a larger EC2 instance type with dedicated tenancy to reduce the risk of hardware failure.

Answer

Enable termination protection on the EC2 instance to prevent accidental stopping.

Question 10

A company wants to migrate their on-premises applications to AWS but is concerned about losing visibility into their infrastructure. Which AWS service provides a centralized inventory of all AWS resources and tracks configuration changes over time?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides a centralized inventory of all AWS resources and continuously tracks configuration changes over time. It enables you to assess, audit, and evaluate the configurations of your AWS resources against desired policies, giving you full visibility into infrastructure state and history.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

AWS Systems Manager Inventory

Question 11

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

Accepted Answer

AWS Config with the required-tags rule. AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 12

A company wants to monitor the CPU utilisation of their EC2 instances and automatically send an email alert when utilisation exceeds 80% for more than 5 consecutive minutes. Which AWS service provides this monitoring and alerting capability?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides both monitoring of EC2 CPU utilization metrics and the ability to create CloudWatch Alarms that trigger actions, such as sending an email via Amazon SNS, when a metric like CPUUtilization exceeds a threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 5 minutes). This directly fulfills the requirement for monitoring and alerting on CPU utilization.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS X-Ray

Question 13

A company has predictable workloads running 24/7. Which EC2 pricing option would provide the most significant cost savings compared to On-Demand pricing?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) provide a significant discount (up to 72%) over On-Demand pricing in exchange for a one- or three-year commitment. Since the company has predictable, 24/7 workloads, RIs are the ideal choice because they match the steady-state usage pattern and offer the highest cost savings for always-on instances.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 14

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a cloud-native, serverless business intelligence (BI) service that enables users to create interactive dashboards and visualizations from data sources such as Amazon S3, Amazon RDS, and Amazon Redshift. It requires no BI server infrastructure management, supports SPICE (Super-fast, Parallel, In-memory Calculation Engine) for high-performance data caching, and allows sharing dashboards with business users across an organization via a web browser or mobile app.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon CloudWatch

Question 15

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

Accepted Answer

AWS, because RDS is a managed service that abstracts OS and engine management. Amazon RDS is a fully managed database service that automates the patching of the underlying database engine software. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes managing the host operating system and the database engine patches. The customer is responsible for data, access management, and application-level security, not the engine software patching.

Answer

The customer, because they chose to run a relational database

Answer

A shared responsibility where AWS and the customer each patch different components

Answer

A third-party DBA contracted by the customer

Question 16

A company's AWS bill has increased significantly. The finance team wants to implement cost governance best practices. Which action represents a foundational cost governance control?

Accepted Answer

Implement a tagging strategy and enforce tags with AWS Config rules. Implementing a tagging strategy and enforcing tags with AWS Config rules is a foundational cost governance control because it enables cost allocation, tracking, and accountability. Tags allow the finance team to categorize resources by project, environment, or cost center, and AWS Config rules can automatically enforce tag compliance, preventing untagged resources from being launched. This directly supports cost governance by providing visibility and control over spending, which is the first step in optimizing costs.

Answer

Delete all non-production resources immediately

Answer

Switch all resources to Spot Instances

Answer

Enable all AWS services to trigger CloudWatch alarms

Question 17

A start-up is evaluating cloud providers for its new application. The company's CTO learns that the cloud provider negotiates bulk discounts with hardware vendors and data center operators, and passes these savings on to customers through lower service prices. The CTO also notes that the provider's vast infrastructure allows customers to benefit from the provider's operational expertise in running large-scale data centers. Which benefit of cloud computing does this scenario BEST represent?

Accepted Answer

Economies of scale. Economies of scale is the benefit where a cloud provider's massive scale allows it to negotiate lower prices from hardware vendors and data center operators, and pass those savings to customers. The scenario explicitly describes bulk discounts and operational expertise from vast infrastructure, which are the defining characteristics of economies of scale. This is a core economic benefit of cloud computing, distinct from pricing models or technical capabilities.

Answer

Pay-as-you-go pricing

Answer

Resource pooling

Answer

High availability

Question 18

A company manages user access to AWS resources using IAM users. The security team wants to automatically detect if an IAM user's access key is being used from a geographic location that is unusual for that user, which could indicate a compromised credential. The team needs a managed threat detection service that monitors API activity and raises alerts for such anomalies. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS API activity, including IAM user access key usage, and uses machine learning to establish baseline behavior. When it detects access from an unusual geographic location, it generates a finding alerting the security team to a potentially compromised credential. This directly meets the requirement for automated anomaly detection without manual configuration.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 19

A company is calculating the Total Cost of Ownership (TCO) for migrating to AWS vs. staying on-premises. Which costs are typically REDUCED when migrating to AWS?

Accepted Answer

Physical hardware, data center facilities, and infrastructure management costs. Migrating to AWS shifts capital expenditures (CapEx) like physical servers, storage, and networking hardware to operational expenditures (OpEx) because AWS owns and maintains the infrastructure. This eliminates costs for data center facilities (power, cooling, real estate) and reduces the operational burden of infrastructure management (patching, racking, hardware failures). Thus, option B correctly identifies the primary cost categories that decrease.

Answer

Software licensing costs always decrease when moving to AWS

Answer

Developer salaries and application development costs

Answer

Data transfer costs are eliminated in the cloud

Question 20

A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?

Accepted Answer

Create an IAM group, attach the required policies to the group, and add all 10 users to the group. AWS best practice for assigning identical permissions to multiple users is to create an IAM group, attach the required policies to the group, and add users to the group. This centralizes permission management, ensures consistency, and simplifies updates — changing the group policy automatically affects all members.

Answer

Attach an inline policy to each of the 10 IAM users individually

Answer

Create one IAM user account and share the credentials with all 10 developers

Answer

Grant the developers root account access with MFA enabled