CLF-C02 Practice Exam 57 — 20 Questions

Question 1

A manufacturing company collects sensor data from thousands of IoT devices every second. The data includes temperature, pressure, and vibration readings. The company needs to store this time-series data and perform real-time queries to detect anomalies, as well as run historical analysis. The data volume is extremely high and will grow continuously. The company wants a fully managed, serverless solution that can automatically scale to handle the data volume and provide built-in analytics functions for time-series. Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Timestream. Amazon Timestream is a fully managed, serverless time-series database service designed specifically for IoT and operational applications. It automatically scales to handle trillions of events per day, provides built-in time-series analytics functions (e.g., smoothing, approximation, interpolation), and supports both real-time queries and historical analysis with separate storage tiers (in-memory for recent data and magnetic for historical data). This makes it the ideal choice for the company's high-volume sensor data requirements.

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Question 2

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

Amazon Macie

Question 3

A company plans to migrate a three-tier web application to AWS. The application will run on Amazon EC2 instances, use an Amazon RDS database, and an Application Load Balancer. The CFO needs a detailed monthly cost estimate before migration. The solutions architect needs to model different instance types, storage sizes, and data transfer volumes, and then share the estimate with the finance team. Which AWS service should the solutions architect use to meet these requirements?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator allows the solutions architect to model different EC2 instance types, RDS storage sizes, and data transfer volumes to generate a detailed monthly cost estimate. It provides granular control over pricing assumptions, including reserved vs. on-demand instances, and produces a shareable estimate link for the finance team. This makes it the correct tool for pre-migration cost modeling.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Cost and Usage Report

Question 4

A company wants an automated tool that analyses their AWS account and provides recommendations across five categories: cost optimisation, performance, security, fault tolerance, and service limits. Which AWS service provides this analysis?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct service because it is specifically designed to analyze an AWS account and provide recommendations across the five categories listed: cost optimization, performance, security, fault tolerance, and service limits. It evaluates resources against AWS best practices and offers actionable guidance, making it the only service that covers all these domains in a single, automated tool.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon CloudWatch

Question 5

A company stores sensitive financial data in Amazon S3. The company's security policy requires that all data be encrypted at rest using a key that the company creates and manages, with the ability to rotate the key annually. The company also needs an audit trail of when the key was used and by which AWS service. Which solution should the company use to meet these requirements?

Accepted Answer

Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with a customer managed key (CMK) allows the company to create and manage its own encryption key, enable automatic annual key rotation via AWS KMS, and provides detailed CloudTrail audit logs of every KMS API call (e.g., Decrypt, GenerateDataKey) showing which AWS service or user used the key. This satisfies all stated requirements: customer-managed key, annual rotation, and audit trail.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use client-side encryption with an AWS KMS managed key.

Question 6

A company needs to run scheduled jobs that execute SQL queries on their Amazon RDS database every night. Which AWS service provides fully managed job scheduling without maintaining dedicated compute resources?

Accepted Answer

AWS Lambda triggered by Amazon EventBridge Scheduler. AWS Lambda triggered by Amazon EventBridge Scheduler is the correct choice because EventBridge Scheduler provides fully managed, serverless job scheduling that can invoke Lambda functions to execute SQL queries on Amazon RDS. This eliminates the need to provision or maintain any dedicated compute resources, as the scheduling and execution are handled entirely by AWS.

Answer

Amazon EC2 with cron jobs

Answer

Amazon ECS with scheduled tasks

Answer

AWS OpsWorks

Question 7

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS Config managed rules with automatic remediation

Answer

IAM Access Analyzer

Question 8

A company runs a stateless web application on a single Amazon EC2 instance in the us-east-1a Availability Zone. The application stores session data in an external Amazon ElastiCache cluster. Due to a power failure in the data center hosting us-east-1a, the EC2 instance becomes unavailable. The company wants to redesign the architecture so that the application recovers automatically in minutes if a single Availability Zone fails. Which design principle should the company implement?

Accepted Answer

Place the EC2 instance in an Auto Scaling group with a minimum capacity of 1, and configure the Auto Scaling group to span multiple Availability Zones.. Placing the EC2 instance in an Auto Scaling group with a minimum capacity of 1 and spanning multiple Availability Zones ensures that if us-east-1a fails, the Auto Scaling group automatically launches a new instance in a healthy Availability Zone (e.g., us-east-1b). Since the application is stateless and session data is stored externally in ElastiCache, the new instance can immediately serve traffic without data loss, achieving recovery within minutes.

Answer

Deploy the application across multiple AWS Regions and use Amazon Route 53 latency-based routing to failover.

Answer

Use a larger EC2 instance type with dedicated tenancy to reduce the risk of hardware failure.

Answer

Enable termination protection on the EC2 instance to prevent accidental stopping.

Question 9

A company wants to migrate their on-premises applications to AWS but is concerned about losing visibility into their infrastructure. Which AWS service provides a centralized inventory of all AWS resources and tracks configuration changes over time?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides a centralized inventory of all AWS resources and continuously tracks configuration changes over time. It enables you to assess, audit, and evaluate the configurations of your AWS resources against desired policies, giving you full visibility into infrastructure state and history.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

AWS Systems Manager Inventory

Question 10

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

Accepted Answer

AWS Config with the required-tags rule. AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 11

A company wants to monitor the CPU utilisation of their EC2 instances and automatically send an email alert when utilisation exceeds 80% for more than 5 consecutive minutes. Which AWS service provides this monitoring and alerting capability?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides both monitoring of EC2 CPU utilization metrics and the ability to create CloudWatch Alarms that trigger actions, such as sending an email via Amazon SNS, when a metric like CPUUtilization exceeds a threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 5 minutes). This directly fulfills the requirement for monitoring and alerting on CPU utilization.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS X-Ray

Question 12

A company has predictable workloads running 24/7. Which EC2 pricing option would provide the most significant cost savings compared to On-Demand pricing?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) provide a significant discount (up to 72%) over On-Demand pricing in exchange for a one- or three-year commitment. Since the company has predictable, 24/7 workloads, RIs are the ideal choice because they match the steady-state usage pattern and offer the highest cost savings for always-on instances.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 13

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a cloud-native, serverless business intelligence (BI) service that enables users to create interactive dashboards and visualizations from data sources such as Amazon S3, Amazon RDS, and Amazon Redshift. It requires no BI server infrastructure management, supports SPICE (Super-fast, Parallel, In-memory Calculation Engine) for high-performance data caching, and allows sharing dashboards with business users across an organization via a web browser or mobile app.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon CloudWatch

Question 14

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

Accepted Answer

AWS, because RDS is a managed service that abstracts OS and engine management. Amazon RDS is a fully managed database service that automates the patching of the underlying database engine software. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes managing the host operating system and the database engine patches. The customer is responsible for data, access management, and application-level security, not the engine software patching.

Answer

The customer, because they chose to run a relational database

Answer

A shared responsibility where AWS and the customer each patch different components

Answer

A third-party DBA contracted by the customer

Question 15

A company's AWS bill has increased significantly. The finance team wants to implement cost governance best practices. Which action represents a foundational cost governance control?

Accepted Answer

Implement a tagging strategy and enforce tags with AWS Config rules. Implementing a tagging strategy and enforcing tags with AWS Config rules is a foundational cost governance control because it enables cost allocation, tracking, and accountability. Tags allow the finance team to categorize resources by project, environment, or cost center, and AWS Config rules can automatically enforce tag compliance, preventing untagged resources from being launched. This directly supports cost governance by providing visibility and control over spending, which is the first step in optimizing costs.

Answer

Delete all non-production resources immediately

Answer

Switch all resources to Spot Instances

Answer

Enable all AWS services to trigger CloudWatch alarms

Question 16

A company manages user access to AWS resources using IAM users. The security team wants to automatically detect if an IAM user's access key is being used from a geographic location that is unusual for that user, which could indicate a compromised credential. The team needs a managed threat detection service that monitors API activity and raises alerts for such anomalies. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS API activity, including IAM user access key usage, and uses machine learning to establish baseline behavior. When it detects access from an unusual geographic location, it generates a finding alerting the security team to a potentially compromised credential. This directly meets the requirement for automated anomaly detection without manual configuration.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 17

A company needs to transfer petabytes of data from an on-premises data center to Amazon S3. The network connection is too slow for online transfer and the data must arrive within two weeks. Which AWS service is most appropriate?

Accepted Answer

AWS Snowball Edge. AWS Snowball Edge is the most appropriate service because it provides physical storage devices that can be shipped to the on-premises data center, allowing petabyte-scale data to be loaded locally and shipped back to AWS, bypassing slow network connections entirely. This meets the two-week deadline since network transfer would be infeasible at that scale over a slow link.

Answer

AWS DataSync

Answer

AWS Direct Connect

Answer

Amazon S3 Transfer Acceleration

Question 18

A data engineering team processes petabytes of raw log data using Apache Spark and Hadoop frameworks. They need a managed AWS service that provisions the cluster, installs the big data frameworks, and terminates the cluster after the job completes to minimise cost. Which service should they use?

Accepted Answer

Amazon EMR. Amazon EMR is the correct choice because it is a managed big data platform that can provision Apache Spark and Hadoop clusters, install the required frameworks, and automatically terminate the cluster upon job completion using features like transient clusters and step-based lifecycle management. This minimizes cost by only paying for compute resources during active processing.

Answer

Amazon Redshift

Answer

AWS Glue

Answer

Amazon Athena

Question 19

A company has employees in field offices who need to manage AWS resources (e.g., launch EC2 instances, upload files to S3) using a web browser on their company-issued laptops. The laptops connect to the internet via public Wi-Fi or cellular hotspots. The employees do not have any VPN or direct corporate network connection. They can successfully access the AWS Management Console and perform all actions over standard HTTPS ports. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Broad network access. This scenario demonstrates broad network access because the employees can access and manage AWS resources from anywhere using standard web browsers over HTTPS (port 443) on public Wi-Fi or cellular hotspots, without requiring a VPN or dedicated corporate network. Broad network access means that cloud resources are available over the network through standard mechanisms (e.g., web browsers, REST APIs) from heterogeneous client platforms (laptops, phones, tablets). The ability to perform all actions via the AWS Management Console over HTTPS directly illustrates this characteristic.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 20

A company needs to implement DevOps practices and wants a fully managed service to store their application source code with version control. Which AWS service provides managed Git repositories?

Accepted Answer

AWS CodeCommit. AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own source control system by providing managed Git repositories that integrate with other AWS services, making it the correct choice for storing application source code with version control.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodeArtifact