CLF-C02 Practice Exam 58 — 20 Questions

Question 1

A company is migrating its on-premises data center to AWS. The Chief Financial Officer (CFO) wants to understand how this migration will change the company's financial structure. Historically, the company purchased servers, networking equipment, and software licenses upfront, with costs depreciating over several years. The CFO notes that the move to AWS will replace these large upfront capital expenditures with smaller, recurring operational expenses based on actual usage. Which essential characteristic of cloud computing enables this shift from capital expenditure (CAPEX) to operational expenditure (OPEX)?

Accepted Answer

Measured service. Measured service is the cloud characteristic that allows providers to track and bill customers for actual resource usage (e.g., compute hours, storage GB-months, data transfer). This pay-as-you-go model directly replaces the need for large upfront capital purchases (CAPEX) with variable, usage-based operational expenses (OPEX), as the CFO requires. Without measured service, AWS would have no mechanism to meter consumption and charge proportionally, making the financial shift impossible.

Answer

Elasticity

Answer

High availability

Answer

Resource pooling

Question 2

A company needs to analyze its AWS spending at the most granular level, including every resource usage line item and custom tags applied to resources. The company wants to download a raw, uncompressed CSV file of this data for integration with its on-premises business intelligence (BI) tool. The file must be automatically delivered to an Amazon S3 bucket on a daily basis. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Cost and Usage Report (CUR). AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular data, including every resource usage line item and custom tags, and can be delivered in raw, uncompressed CSV format to an S3 bucket on a daily basis. This meets the requirement for deep integration with an on-premises BI tool, as CUR supports detailed cost allocation and tag-based analysis that other tools like Cost Explorer or Budgets cannot match.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 3

A company is developing a REST API that processes customer orders. The API receives JSON payloads via HTTPS and performs short-lived operations, such as data validation, transformation, and writing to a database. The workload is very unpredictable: sometimes there are long periods of inactivity, but during flash sales the API may receive thousands of requests per second for a few minutes. The company wants a fully managed compute service that automatically scales to handle any request volume, charges only for the compute time used during execution, and requires no server provisioning or ongoing infrastructure management. Which AWS service should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a fully managed, event-driven compute service that automatically scales from zero to thousands of concurrent executions in response to incoming HTTPS requests. It charges only for the compute time consumed during execution (in 1ms increments), requires no server provisioning, and is ideal for short-lived operations like data validation, transformation, and database writes. The unpredictable, bursty workload pattern—long idle periods followed by flash sales—maps perfectly to Lambda's pay-per-use model and automatic scaling.

Answer

Amazon EC2 with Auto Scaling

Answer

Amazon ECS with Fargate launch type

Answer

Amazon Lightsail

Question 4

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for downloading AWS compliance reports, including SOC 2 Type II reports, without needing to contact AWS Support. It offers on-demand access to AWS’s security and compliance documents, directly meeting the requirement for auditor evidence.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 5

A company is planning to migrate a legacy application to AWS. The solutions architect needs to estimate the monthly cost of running Amazon EC2 instances, Amazon RDS databases, and Amazon S3 storage. The architect wants to compare different instance types, storage classes, and pricing models (e.g., On-Demand vs. Reserved Instances) to find the most cost-effective configuration. The team requires a tool that provides a detailed, itemized cost estimate without incurring any actual charges, and allows saving and sharing the estimate with stakeholders. Which AWS tool should the solutions architect use?

Accepted Answer

AWS Pricing Calculator. The AWS Pricing Calculator (formerly AWS Simple Monthly Calculator) is the correct tool because it allows users to build a detailed, itemized cost estimate for AWS services like EC2, RDS, and S3 without incurring any actual charges. It supports comparing different instance types, storage classes, and pricing models (On-Demand vs. Reserved Instances), and provides a shareable link to save and share the estimate with stakeholders.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Cost and Usage Report

Question 6

A company plans to migrate its on-premises workload to AWS. The finance team wants to compare the total cost of ownership between running the workload on-premises and running it on AWS. They need to estimate monthly costs for different Amazon EC2 instance types, pricing models (On-Demand, Reserved, Spot), and storage options before making any commitment. Which AWS tool should the finance team use to create this detailed cost estimate?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator is the correct tool because it allows users to create detailed cost estimates for AWS services, including EC2 instance types, pricing models (On-Demand, Reserved, Spot), and storage options, before any commitment. It provides a granular breakdown of monthly costs, enabling a total cost of ownership (TCO) comparison between on-premises and AWS workloads. This aligns directly with the finance team's requirement to estimate costs without incurring actual usage.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 7

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in an organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrator permissions via IAM policies. By applying an SCP that denies the `cloudtrail:DeleteTrail` and `cloudtrail:StopLogging` actions, the security team can enforce that CloudTrail cannot be disabled or deleted across all development accounts, regardless of individual IAM configurations.

Answer

IAM policies

Answer

AWS Config rules

Answer

Amazon CloudWatch Events

Question 8

A company processes credit card transactions and must comply with PCI DSS requirements. Customer payment data is stored in Amazon RDS for MySQL. The security team needs to ensure that all automated database snapshots are encrypted at rest using customer-managed encryption keys that are automatically rotated every 365 days. The team wants a fully managed AWS service to create and control these encryption keys. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct service because it provides a fully managed, centralized way to create and control customer-managed keys (CMKs) that can be used to encrypt Amazon RDS automated snapshots. KMS supports automatic annual key rotation (365 days) as a built-in feature, and it integrates directly with RDS to enforce encryption at rest for snapshots without requiring any manual key management. This meets the PCI DSS requirement for customer-controlled encryption keys with automated rotation.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 9

A company is designing a highly available web application on AWS. The application must remain available and continue serving traffic even if an entire physical data center experiences a complete outage. Which AWS global infrastructure component should the solutions architect use to meet this requirement?

Accepted Answer

Deploy the application across multiple Availability Zones within a single AWS Region.. Option B is correct because deploying across multiple Availability Zones (AZs) within a single AWS Region protects against the failure of an entire physical data center. Each AZ is a distinct, isolated location with independent power, cooling, and networking, so if one AZ goes down, the application continues serving traffic from the other AZs. This design meets the requirement for high availability without the complexity and cost of multi-Region deployment.

Answer

Deploy the application across multiple AWS Regions.

Answer

Deploy the application to an AWS Local Zone.

Answer

Use an AWS Edge Location to cache the application's content.

Question 10

A company is refactoring its monolithic e-commerce application into multiple microservices. The order-processing service must send messages to the inventory service to reserve stock. The company needs a fully managed service that can durably store these messages, handle high throughput, and allow the inventory service to poll for messages at its own pace. The company wants to avoid any message loss. Which AWS service should the company use?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon SQS is the correct choice because it is a fully managed message queuing service that durably stores messages across multiple Availability Zones, ensuring no message loss. It supports high throughput and allows the inventory service to poll for messages at its own pace using long or short polling, decoupling the order-processing and inventory services.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 11

A company operates 10 AWS accounts, each managed by a separate team. Each account runs its own Amazon EC2 instances and stores data in Amazon S3. The CFO wants to minimize overall costs by taking advantage of volume discount pricing tiers that AWS offers (e.g., lower per-GB storage costs as total S3 usage increases). Which AWS feature should the company use to combine usage from all accounts so they benefit from the highest possible volume discounts?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing allows you to aggregate usage from all member accounts into a single payer account. This combined usage qualifies for volume discount pricing tiers (e.g., lower S3 per-GB storage costs as total usage increases), enabling the company to benefit from the highest possible discounts across all 10 accounts.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 12

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The security team needs to understand their responsibilities under the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility?

Accepted Answer

Configuring security group rules to control network access to the database. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security group rules to control network access to the database. Security groups act as a virtual firewall that controls inbound and outbound traffic at the instance level, and the customer must define the rules (e.g., source IP, port 3306 for MySQL) to restrict access appropriately.

Answer

Applying minor version patches to the MySQL database engine

Answer

Managing the physical security of the data center where the RDS instance is hosted

Answer

Replacing failed hardware components in the RDS host server

Question 13

A company is migrating its IT operations to AWS. Previously, when a developer needed a new server for a project, the developer had to submit a formal request to the IT department. The request would be reviewed, approved, and then a physical server would be procured, configured, and deployed—a process that often took several weeks. After migrating to AWS, the developer can log in to the AWS Management Console and launch a new Amazon EC2 instance with the exact required configuration within minutes, without any interaction with IT staff. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning an EC2 instance directly via the AWS Management Console without any human intervention from IT staff. This aligns with the NIST-defined characteristic of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 14

A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations allows the company to consolidate multiple AWS accounts under a single management account, enabling consolidated billing for a single monthly invoice and volume pricing discounts. Service Control Policies (SCPs) provide centralized governance by restricting the AWS services and Regions that member accounts can use, such as preventing EC2 instances from being launched outside us-east-1 and eu-west-1. This combination directly addresses both the CFO's billing consolidation needs and the security team's data residency compliance requirements.

Answer

AWS Budgets

Answer

AWS Identity and Access Management (IAM) cross-account roles

Answer

AWS Cost and Usage Reports

Question 15

A company recently signed up for AWS and is using the 12-month Free Tier offer. In the first month, they launched a single Amazon EC2 t2.micro instance and used it for exactly 750 hours. In the second month, they launched a second t2.micro instance and ran both instances simultaneously for 500 hours each (a total of 1,000 instance-hours for the month). Which statement accurately describes the charges for the second month under the Free Tier?

Accepted Answer

The first 750 hours of combined usage across both instances are free, and the remaining 250 hours are charged.. Option C is correct because the AWS Free Tier for EC2 provides 750 hours of t2.micro (or t3.micro) instance usage per month across all regions, aggregated across all instances. In the second month, the combined usage of both instances is 1,000 hours, so the first 750 hours are free, and the remaining 250 hours are charged at standard On-Demand rates. The Free Tier applies each month for the first 12 months, not just the first month, and the 750-hour limit is a pool shared by all eligible instances.

Answer

The entire 1,000 hours are free because each instance is eligible for 750 free hours per month.

Answer

The first 500 hours of each instance are free, and the remaining 500 hours are charged.

Answer

The entire 1,000 hours are charged because the Free Tier only applies to the first month.

Question 16

A company operates three separate AWS accounts: development, testing, and production. Each account independently incurs Amazon S3 data transfer charges. The company signs up for AWS Organizations and enables consolidated billing. How does consolidated billing affect the S3 data transfer pricing for the company?

Accepted Answer

It aggregates the data transfer usage across all accounts, allowing the company to benefit from lower pricing tiers that are based on total usage.. Consolidated billing in AWS Organizations aggregates usage across all linked accounts. For S3 data transfer, AWS applies tiered pricing based on total monthly data transfer volume. By combining usage from the development, testing, and production accounts, the company can reach higher volume tiers, reducing the per-GB cost for all accounts. This is the primary benefit of consolidated billing for data transfer charges.

Answer

It applies a flat 20% discount to all S3 data transfer charges across accounts.

Answer

It allows the company to use a single payment method and automatically applies Reserved Instance pricing to data transfer.

Answer

It creates a single combined bill and automatically applies an enterprise discount negotiated with AWS.

Question 17

A company runs a containerized application that uses multiple Docker containers. The development team wants to run these containers on AWS without provisioning or managing any EC2 instances. They also do not want to manage the container orchestration control plane. The application requires consistent access to persistent storage volumes that can be attached to containers. Which AWS service should the team use to run the containers with the least operational overhead?

Accepted Answer

AWS Fargate. AWS Fargate is a serverless compute engine for containers that allows you to run containers without provisioning or managing EC2 instances or the underlying container orchestration control plane (Amazon EKS or Amazon ECS). It directly meets the requirement of zero infrastructure management while supporting persistent storage through Amazon EFS filesystems or Docker volumes that can be attached to Fargate tasks, providing consistent access to storage volumes.

Answer

Amazon EC2 with a container-optimized AMI

Answer

AWS Lambda

Answer

Amazon ECR (Amazon Elastic Container Registry)

Question 18

A company is migrating its customer-facing web application to AWS. The Chief Information Security Officer (CISO) is reviewing the division of security responsibilities. The CISO understands that AWS is responsible for the security of the physical data centers, hardware, and network infrastructure. The company, as the customer, is responsible for securing the application code, customer data, and operating system patches on Amazon EC2 instances. This division of security responsibilities is an example of which fundamental cloud computing concept?

Accepted Answer

Shared responsibility model. The correct answer is B, the shared responsibility model. This model delineates security obligations between AWS and the customer: AWS secures the cloud infrastructure (physical data centers, hardware, network), while the customer secures what is in the cloud (application code, customer data, OS patches on EC2 instances). The scenario directly describes this division, making it a textbook example of the shared responsibility model.

Answer

Resource pooling

Answer

Elasticity

Answer

Measured service

Question 19

A company operates multiple AWS accounts for separate departments. The finance team wants to simplify monthly billing by receiving a single consolidated invoice that covers all accounts. Additionally, the company wants to aggregate usage across accounts to qualify for lower volume-based pricing tiers. Which AWS feature should the company enable to meet these requirements?

Accepted Answer

Consolidated billing through AWS Organizations. AWS Organizations enables consolidated billing by allowing you to combine multiple AWS accounts under a single paying account, which aggregates usage across all accounts. This aggregation qualifies the company for lower volume-based pricing tiers (e.g., AWS volume discounts for services like S3 or EC2) because usage is summed across all member accounts. The master account receives a single consolidated invoice covering all accounts, simplifying monthly billing.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 20

A company runs a batch processing workload on an on-premises data center. The servers are powerful machines that are used at maximum capacity only for a few days each month during financial reporting periods. For the rest of the month, the servers run at very low utilization. The CFO wants to migrate this workload to AWS to reduce costs. Which characteristic of AWS cloud computing is most directly aligned with the CFO's goal of paying only for the compute capacity actually used?

Accepted Answer

Pay-as-you-go pricing model. The pay-as-you-go pricing model (Option C) directly aligns with the CFO's goal because it allows the company to pay only for the compute capacity they actually consume, with no upfront costs or long-term commitments. In this scenario, the batch processing workload runs at maximum capacity only a few days per month, so the company can provision resources during those peaks and stop them during low-utilization periods, avoiding the cost of idle on-premises servers. This model eliminates the need to pay for unused capacity, directly reducing costs as the CFO desires.

Answer

High availability across multiple Availability Zones

Answer

Elasticity to automatically scale resources up and down

Answer

The ability to choose from a wide variety of instance types