CLF-C02 Practice Exam 56 — 20 Questions

Question 1

A company runs several applications in a single AWS account. Each application belongs to a different project (Project Alpha, Project Beta, Project Gamma). The company has already applied tags with the key "Project" and the corresponding project name to all AWS resources used by each project. The finance team wants to use AWS Cost Explorer to view and filter monthly costs by project. However, after tagging all resources, the "Project" tag does not appear as a filter option in Cost Explorer. What must the finance team do to make the "Project" tag available for cost filtering in Cost Explorer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate the "Project" cost allocation tag in the Billing and Cost Management console.. The 'Project' tag does not appear in Cost Explorer because AWS does not automatically activate user-defined tags for cost tracking. The finance team must manually activate the 'Project' cost allocation tag in the Billing and Cost Management console under 'Cost Allocation Tags'. Once activated, AWS will process the tag data and make it available as a filter in Cost Explorer within 24 hours.

Answer

Create a new AWS Budget with a cost filter for the "Project" tag.

Answer

Enable the AWS Cost and Usage Reports for the account.

Answer

Create a custom cost category with a rule that uses the "Project" tag.

Question 2

A company runs a production e-commerce application on AWS. The CIO requires that the company have access to AWS technical support with a response time of under 1 hour for critical production system failures. Additionally, the operations team wants to use AWS Trusted Advisor to get recommendations on cost optimization, performance, and security for all AWS resources. The company already pays for AWS Business Support for its development account but wants the minimum-cost support plan that meets these requirements for its production account. Which AWS Support plan should the company choose for the production account?

Accepted Answer

AWS Business Support. AWS Business Support is the minimum plan that provides a 1-hour response time for critical production system failures and full access to AWS Trusted Advisor, including cost optimization, performance, and security checks. AWS Basic and Developer Support do not offer a 1-hour response time for critical failures, and Developer Support only provides limited Trusted Advisor checks. Therefore, Business Support meets both requirements at the lowest cost for the production account.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise Support

Question 3

A company wants to run a MySQL database on AWS. They require full control over the operating system, MySQL version selection, storage layout, and network configuration. Which cloud service model provides this level of control?

Accepted Answer

Infrastructure as a Service (IaaS). C is correct because Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the customer full control over the operating system, database software (including MySQL version selection), storage layout (e.g., instance store vs. EBS volumes), and network configuration (e.g., VPC, subnets, security groups). This is the only service model that allows you to manage the underlying OS and database stack directly, similar to running a physical server.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 4

Which AWS service provides a managed message broker for Apache ActiveMQ and RabbitMQ to help migrate existing messaging systems to the cloud?

Accepted Answer

Amazon MQ. Amazon MQ is a managed message broker service that natively supports Apache ActiveMQ and RabbitMQ, making it the ideal choice for migrating existing messaging systems that rely on these protocols to the cloud without rewriting application code. It handles the provisioning, patching, and high availability of the broker infrastructure, allowing you to use standard JMS, AMQP, MQTT, and STOMP protocols.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon Kinesis

Question 5

Which AWS concept describes the practice of tracking and managing costs using software engineering principles — such as tagging, automation, and real-time visibility — to enable engineers and teams to make cost-aware decisions?

Accepted Answer

Cloud Financial Management (FinOps). Cloud Financial Management (FinOps) is the correct answer because it specifically refers to the practice of applying software engineering principles—such as tagging resources, automating cost controls, and providing real-time cost visibility—to manage cloud spending. This enables engineers and teams to make cost-aware decisions during development and operations, aligning with the question's description.

Answer

Total Cost of Ownership (TCO)

Answer

Reserved Instance optimization

Answer

Cost Avoidance

Question 6

A company runs mixed workloads on AWS — some on EC2, some on Lambda, and some on Fargate — and wants to commit to a consistent hourly spend on compute to receive discounts similar to Reserved Instances, but with the flexibility to apply those discounts across different compute services and instance types. Which purchasing option provides this flexibility?

Accepted Answer

Savings Plans. Savings Plans (C) offer the flexibility to commit to a consistent hourly spend (e.g., $10/hour) and automatically apply the discount across EC2 instances, AWS Lambda, and AWS Fargate usage, regardless of instance family, size, OS, or region. This matches the requirement for a Reserved Instance-like discount with cross-service and cross-instance flexibility, which Reserved Instances cannot provide because they are tied to a specific instance family and region.

Answer

Reserved Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 7

A web application queries a relational database for a product catalogue that changes infrequently but is requested thousands of times per second. Database query latency is becoming a bottleneck. Which AWS service can the company use to cache frequently accessed query results in memory and reduce database load?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides an in-memory caching layer (using Redis or Memcached) that can store frequently accessed query results, reducing the need to repeatedly query the relational database. This dramatically lowers latency for high-throughput read workloads (thousands of requests per second) and offloads database pressure, directly addressing the bottleneck described.

Answer

Amazon RDS Read Replica

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 8

A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?

Accepted Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key. SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Client-side encryption using the AWS Encryption SDK

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Question 9

A financial services company stores sensitive transaction data in Amazon S3. The company must encrypt the data at rest using keys that are stored in a hardware security module (HSM) validated under FIPS 140-2 Level 3. Additionally, the company requires full control over the key lifecycle, including rotation and deletion, and AWS must not have any access to the keys. Which AWS service should the company use to generate and store the encryption keys?

Accepted Answer

AWS CloudHSM. AWS CloudHSM is the correct choice because it provides dedicated hardware security modules (HSMs) that are validated under FIPS 140-2 Level 3, allowing you to generate and store encryption keys entirely within the HSM. With CloudHSM, AWS has no access to your keys, and you retain full control over key lifecycle operations such as rotation and deletion, meeting the strict compliance and security requirements of the financial services company.

Answer

AWS Key Management Service (KMS) with a customer managed key

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 10

A company is building a serverless order-processing application. The workflow consists of several steps that must run in a defined order: validate the order, check inventory, process payment, and then update the database. Some steps, such as shipping notification and invoice generation, can run in parallel after payment is confirmed. The company needs a managed service to orchestrate these steps, automatically handle retries if a step fails, and provide a visual representation of the workflow's execution state. Which AWS service should the company use?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is a fully managed serverless orchestration service that allows you to define workflows as state machines, specifying sequential steps (validate, check inventory, process payment, update database) and parallel branches (shipping notification, invoice generation). It automatically handles retries on failures with configurable backoff rates and provides a visual execution console to track the state of each workflow instance in real time, meeting all the company's requirements.

Answer

Amazon Simple Workflow Service (SWF)

Answer

Amazon MQ

Answer

AWS Glue

Question 11

A company currently owns and operates its own data center. They are considering moving to AWS. Which economic benefit describes the elimination of the costs associated with purchasing, maintaining, and cooling physical servers?

Accepted Answer

Stop spending money running and maintaining data centers. Moving to AWS eliminates the capital and operational expenses associated with owning and operating physical servers, including procurement, maintenance, cooling, and facility management. This aligns with the AWS value proposition of shifting from a capital expenditure (CapEx) model to an operational expenditure (OpEx) model, where customers pay only for the resources they consume.

Answer

Economies of scale

Answer

Go global in minutes

Answer

Increase speed and agility

Question 12

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 13

A financial services company has a core banking application that runs on-premises and stores sensitive customer data. Due to strict regulatory requirements, this application cannot be migrated to the cloud. However, the company wants to use AWS for its development and test environments to benefit from rapid provisioning and pay-per-use pricing. The company also wants to establish a dedicated private network connection between its on-premises data center and AWS to securely transfer data between the environments. Which cloud deployment model does this scenario describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud deployment model because it combines on-premises infrastructure (the core banking application) with AWS public cloud resources (development and test environments) connected via a dedicated private network, such as AWS Direct Connect. The hybrid cloud model allows the company to keep sensitive data on-premises for regulatory compliance while leveraging AWS's scalability and pay-per-use pricing for non-production workloads. The key enabler is the private, low-latency connection that securely transfers data between the two environments, which is a hallmark of hybrid cloud architecture.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 14

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

Accepted Answer

Enable MFA on the root account and create an IAM admin user for daily operations. The root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Answer

Create IAM users for all employees immediately

Answer

Create root access keys for programmatic access

Answer

Enable AWS Config in all regions

Question 15

A company runs a fleet of production Amazon EC2 instances that operate 24/7 throughout the year. The CFO wants to reduce compute costs by committing to a consistent usage level. The finance team needs a tool that analyzes the company's historical EC2 usage and provides recommendations for the most cost-effective purchase options, including recommendations for both Reserved Instances and Savings Plans, with support for instance size flexibility. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a comprehensive analysis of historical EC2 usage and generates tailored recommendations for both Reserved Instances (RI) and Savings Plans, including support for instance size flexibility. This directly meets the CFO's requirement to commit to a consistent usage level while optimizing costs based on actual usage patterns.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 16

A company runs database servers that require consistent EC2 capacity 24/7 for the next 3 years. Which EC2 purchasing option provides the greatest discount compared to On-Demand pricing?

Accepted Answer

Reserved Instances (3-year, all upfront). Reserved Instances (RIs) with a 3-year term and all upfront payment provide the highest discount compared to On-Demand pricing because they commit to a consistent, predictable workload for an extended period. AWS offers significant pricing tiers for RIs, with the 3-year all upfront option yielding up to 72% discount over On-Demand, which is the greatest among all purchasing options for steady-state usage.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 17

A global e-commerce company stores product images and videos in an Amazon S3 bucket located in the us-west-2 Region. Customers worldwide report slow page load times. The company also wants to protect its website against common distributed denial-of-service (DDoS) attacks without incurring additional costs for a dedicated DDoS protection service. Which AWS service should the company use to meet both requirements?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It also includes AWS Shield Standard at no additional cost, which provides always-on protection against common DDoS attacks (e.g., SYN floods, UDP reflection). This combination directly addresses both the slow page load times and the need for cost-effective DDoS protection.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Global Accelerator

Answer

AWS Shield Advanced

Question 18

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 19

A social media startup plans to launch its application to users across North America, Europe, and Asia. The CTO wants a single deployment approach that minimizes latency for end users in all geographic regions, provides high availability, and allows the company to add new regions within minutes as the user base expands. The startup has no existing data centers outside its home country. Which fundamental benefit of cloud computing does this requirement best illustrate?

Accepted Answer

Global reach. The requirement to deploy a single application across North America, Europe, and Asia with low latency, high availability, and the ability to add new regions within minutes directly illustrates the global reach benefit of cloud computing. AWS provides a global infrastructure with Regions and Edge Locations that allow the startup to serve users from geographically distributed points without building physical data centers. This enables the company to achieve low-latency access and rapid regional expansion, which is a core advantage of cloud over on-premises architectures.

Answer

Pay-as-you-go pricing

Answer

Economies of scale

Answer

Agility

Question 20

A retail company runs its e-commerce platform on AWS. The platform uses multiple Amazon EC2 instances behind an Application Load Balancer. To ensure the application remains available during an Availability Zone failure, the company distributes the instances across three Availability Zones. The load balancer automatically reroutes traffic away from an unhealthy zone. This design primarily addresses which pillar of the AWS Well-Architected Framework?

Accepted Answer

Reliability. Distributing EC2 instances across multiple Availability Zones and using an Application Load Balancer to automatically reroute traffic away from unhealthy zones ensures that the application remains available even if an entire AZ fails. This design directly addresses the 'Reliability' pillar of the AWS Well-Architected Framework, which focuses on the ability of a workload to recover from infrastructure or service disruptions and dynamically acquire computing resources to meet demand.

Answer

Security

Answer

Performance Efficiency

Answer

Cost Optimization