CLF-C02 Practice Exam 57 — 20 Questions

Question 1

A company manages 20 AWS accounts under AWS Organizations. The security team wants to ensure that no security group in any account allows unrestricted inbound RDP access (0.0.0.0/0). They need to automatically detect any security group that violates this rule and receive a notification. They also want to track the configuration history of security group changes for forensic analysis. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules like 'restricted-common-ports' or a custom Lambda rule to detect security groups with inbound RDP access from 0.0.0.0/0. It continuously evaluates resource configurations, sends Amazon SNS notifications on noncompliant resources, and automatically records a configuration history of all security group changes, enabling forensic analysis. This directly meets the requirements for detection, notification, and historical tracking.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 2

A company operates over 100 AWS accounts consolidated under AWS Organizations. The finance team needs to analyze the company's historical AWS spending across all accounts for the past 6 months. They want to understand which services and regions drive the most costs, and they also need a 3-month forecast of future spending to inform budget planning. The team needs a visual dashboard that allows interactive filtering by account, service, and region without requiring custom scripts. Which AWS tool should the finance team use to meet these requirements?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built, interactive dashboard that visualizes historical cost data (up to 12 months) and generates forecasts (up to 12 months) without requiring custom scripts. It supports filtering by account, service, and region, making it ideal for the finance team's requirements. This tool directly meets the need for a visual, filterable dashboard with built-in forecasting.

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Answer

AWS Trusted Advisor

Question 3

A company is evaluating a move to the AWS Cloud. The finance team learns that AWS can offer lower per-unit prices for compute and storage because AWS purchases hardware in very large volumes and operates at a massive scale. This cost advantage, which is then passed on to customers, is a direct benefit of which fundamental cloud computing concept?

Accepted Answer

Economies of scale. The scenario describes AWS leveraging its massive purchasing power to negotiate lower hardware costs, which are then passed to customers as lower per-unit prices. This is the direct definition of economies of scale, a fundamental cloud concept where average costs decrease as the scale of operations increases. Elasticity, high availability, and resource pooling are distinct concepts that do not inherently create the cost advantage described.

Answer

Elasticity

Answer

High availability

Answer

Resource pooling

Question 4

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple Amazon EC2 instances concurrently. The EC2 instances run Amazon Linux and are deployed across multiple Availability Zones for high availability. The file system must grow and shrink automatically as files are added or removed, and the company wants to avoid provisioning storage capacity in advance. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up and down as files are added or removed, eliminating the need to provision storage in advance. EFS supports the NFSv4.1 and NFSv4.0 protocols, making it ideal for shared file workloads on Amazon Linux.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon FSx for Windows File Server

Question 5

A company is preparing for a third-party security audit. The auditors require the company to provide up-to-date AWS compliance reports, such as the SOC 2 report and the ISO 27001 certificate, as part of the evidence. The company needs to access these documents from a centralized, self-service portal within their AWS account. They also need to accept the terms and conditions for the reports. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for accessing AWS compliance reports, such as SOC 2 and ISO 27001 certificates, directly within the AWS Management Console. It also allows users to accept the terms and conditions for these reports, fulfilling the audit requirements without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 6

A company manages multiple AWS accounts, each used by a separate business unit. The finance team wants to obtain a single monthly bill that aggregates charges from all accounts and to benefit from volume discount pricing tiers on services like Amazon EC2 and Amazon S3 across the entire organization. Which AWS feature or service should the company use to meet these requirements?

Accepted Answer

AWS Organizations consolidated billing. AWS Organizations consolidated billing allows you to combine usage across multiple accounts to receive a single monthly bill and aggregate usage for volume discount pricing tiers (e.g., for EC2 and S3). This feature enables the finance team to benefit from lower rates as total usage across all accounts increases, without requiring any architectural changes.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 7

A company is planning to migrate its on-premises workloads to AWS. The cloud architect needs to create a detailed estimate of the monthly AWS bill based on specific configuration details, such as the number of Amazon EC2 instances with particular instance types, storage volumes, data transfer amounts, and Amazon RDS database instances. The architect wants to input these known specifications and obtain an estimated monthly cost breakdown before launching any resources. Which AWS tool should the architect use to meet this requirement?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly AWS Simple Monthly Calculator) allows users to input specific configuration details such as EC2 instance types, storage volumes, data transfer amounts, and RDS database instances to generate a detailed monthly cost estimate before launching any resources. This tool is designed for upfront cost planning and provides a breakdown of estimated charges based on the user's exact specifications, making it the correct choice for the architect's requirement.

Answer

AWS TCO Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 8

A company is migrating its on-premises application to AWS. The application currently runs on a single server and experiences occasional traffic spikes that cause performance degradation. The company wants to take advantage of cloud computing benefits to handle these spikes automatically without manual intervention. Which AWS Cloud concept would directly address this requirement?

Accepted Answer

Elasticity. Elasticity is the correct concept because it refers to the ability of an AWS infrastructure to automatically scale resources up or down based on demand. In this scenario, the company needs to handle occasional traffic spikes without manual intervention, which is directly addressed by AWS Auto Scaling groups and services like Amazon EC2 Auto Scaling or AWS Lambda's concurrency scaling. This ensures that additional compute capacity is provisioned during spikes and released when demand decreases, optimizing both performance and cost.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 9

A company operates three separate AWS accounts, one for production, one for development, and one for testing. The finance team wants to receive a single monthly invoice that shows the total charges from all three accounts combined. They also want to aggregate usage across accounts to benefit from volume discounts on Amazon S3 and Amazon EC2. Additionally, the team wants to apply a single payment method (credit card) to cover charges for all accounts. Which AWS feature should the finance team use to meet these requirements?

Accepted Answer

Consolidated Billing through AWS Organizations. Consolidated Billing through AWS Organizations is the correct feature because it allows the finance team to link multiple AWS accounts under a single organization, enabling a single monthly invoice that aggregates charges from all accounts. This aggregation also combines usage across accounts for services like Amazon S3 and Amazon EC2, allowing the team to benefit from volume discounts. Additionally, Consolidated Billing supports a single payment method (credit card) that covers charges for all linked accounts, meeting all stated requirements.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Cost and Usage Report

Question 10

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 11

A company operates a global e-commerce website behind Amazon CloudFront. Security analysts have noticed a pattern of SQL injection attempts and cross-site scripting attacks targeting the web application. The company needs a fully managed service that can inspect incoming HTTP(S) requests and block these common web exploits before they reach the application origin. The solution must integrate with CloudFront and allow the security team to author custom rules. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that integrates directly with Amazon CloudFront to inspect HTTP(S) requests. It provides pre-configured rule groups (e.g., the SQL injection and cross-site scripting rule sets) and allows the security team to author custom rules to block common web exploits before they reach the origin. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 12

A company is migrating its legacy Java web application to AWS. The application consists of a stateless web tier that receives HTTP traffic. The company wants to minimize operational overhead. The development team wants to simply upload a WAR file and have AWS automatically handle the deployment, capacity provisioning, load balancing, and auto-scaling based on traffic. The team does not want to manage the underlying EC2 instances or configure the load balancer manually. Which AWS service should the company use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform as a Service (PaaS) offering that automatically handles deployment, capacity provisioning, load balancing, and auto-scaling for Java web applications. The team can simply upload a WAR file, and Elastic Beanstalk manages the underlying EC2 instances and Application Load Balancer (ALB) without requiring manual configuration. This directly meets the requirement to minimize operational overhead while supporting stateless web tiers.

Answer

Amazon EC2 Auto Scaling

Answer

AWS OpsWorks

Answer

Amazon Lightsail

Question 13

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 14

A company operates 10 AWS accounts under AWS Organizations. Each account runs multiple projects, and the company tags all resources with a 'Project' tag (e.g., 'Project-A', 'Project-B'). The finance team wants to view the consolidated monthly bill broken down by the value of the 'Project' tag across all accounts. Which AWS feature should the team use to achieve this?

Accepted Answer

Activate the 'Project' tag as a cost allocation tag in the AWS Organizations payer account's Billing and Cost Management console.. Option B is correct because cost allocation tags in the AWS Organizations payer account's Billing and Cost Management console allow you to activate user-defined tags (like 'Project') so that AWS can break down the consolidated monthly bill by those tag values across all linked accounts. Once activated, the cost data is available in Cost Explorer and the Cost & Usage Report, enabling the finance team to view spending per project without manual aggregation.

Answer

Create an AWS Budget for each 'Project' tag value and set cost alerts to track spending per project.

Answer

Use AWS Trusted Advisor to generate a cost optimization report that shows which projects are over-spending based on the 'Project' tag.

Answer

Configure AWS Compute Optimizer to analyze costs per project and recommend resource downsizing based on the 'Project' tag.

Question 15

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 16

A company is refactoring its legacy application into a microservices architecture using Docker containers. The operations team wants to deploy and manage these containers on AWS without the need to provision, patch, or manage the underlying servers. The solution must automatically scale containers based on demand and integrate with services like Application Load Balancer and Amazon RDS. Which AWS compute service should the company use?

Accepted Answer

Amazon ECS with AWS Fargate launch type. Amazon ECS with AWS Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, patch, or manage underlying servers. Fargate automatically scales containers based on demand and integrates natively with services like Application Load Balancer and Amazon RDS, meeting all the stated requirements.

Answer

Amazon ECS with Amazon EC2 launch type

Answer

AWS Lambda

Answer

Amazon EC2 instances with Docker installed

Question 17

A company is planning to migrate its on-premises infrastructure to AWS. The operations team wants to compare the total cost of ownership (TCO) between running workloads on-premises and running them on AWS. They need a tool that can accept details about their current on-premises servers (number of servers, CPU, memory, storage) and produce a detailed report comparing costs over a specified period, including savings from avoided hardware purchases, IT labor, and data center costs. Which AWS tool should the operations team use?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of running on-premises infrastructure versus AWS. It accepts detailed inputs about existing on-premises servers (such as CPU, memory, and storage) and generates a comprehensive report that includes savings from avoided hardware purchases, IT labor, and data center costs over a user-specified period. This directly matches the operations team's requirement for a detailed TCO comparison.

Answer

AWS Cost Explorer

Answer

AWS Pricing Calculator

Answer

AWS Cost and Usage Report

Question 18

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 19

A company is migrating a three-tier web application to AWS. The application will run on Amazon EC2 instances using a custom Linux distribution, and a self-managed MySQL database will be installed on the same instances. The company's security team needs to understand which security responsibilities belong to AWS and which belong to the company under the AWS Shared Responsibility Model. According to this model, who is responsible for applying operating system security patches to the EC2 instances and for updating the MySQL database software?

Accepted Answer

The company is responsible for both the operating system patches and the MySQL database updates.. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor), while the customer is responsible for security in the cloud (e.g., guest OS, applications, and data). Since the company is using a custom Linux distribution on EC2 instances and installing a self-managed MySQL database, both the operating system patches and the MySQL database updates fall under the customer's responsibility. AWS does not manage or patch the guest operating system or any software installed by the customer on EC2 instances.

Answer

AWS is responsible for both the operating system patches and the MySQL database updates.

Answer

AWS is responsible for the operating system patches, and the company is responsible for the MySQL database updates.

Answer

The company is responsible for the operating system patches, and AWS is responsible for the MySQL database updates.

Question 20

A company manages a fleet of hundreds of Amazon EC2 instances running across multiple AWS Regions. The company's security policy requires that all instances be patched with the latest security updates within 7 days of release. The operations team currently logs in to each instance manually to apply patches, which is time-consuming and error-prone. The team wants to automate the patching process, track compliance across all instances, and receive reports on patch status. The solution must not require any changes to the existing application code or the use of additional third-party software. Which AWS service should the operations team use to meet these requirements?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct choice because it provides Patch Manager, a native capability that automates the patching of EC2 instances across multiple Regions without requiring any changes to application code or third-party software. It also integrates with Systems Manager Compliance to track patch status and generate reports, meeting all stated requirements.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor