CLF-C02 Practice Exam 58 — 20 Questions

Question 1

Which AWS service provides a landing zone and automated multi-account setup with pre-configured security baselines and guardrails for AWS Organizations?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct service because it provides a pre-configured landing zone and automates the setup of a multi-account environment based on AWS Organizations. It enforces security baselines and guardrails (preventive and detective controls) using AWS Service Catalog and AWS Config rules, ensuring compliance from the start.

Answer

AWS Organizations

Answer

AWS CloudFormation StackSets

Answer

AWS Service Catalog

Question 2

A company runs workloads for multiple teams in a single AWS account and wants to track and report costs per team in their monthly AWS bill. Which feature allows them to categorise and report AWS costs by team?

Accepted Answer

AWS Cost Allocation Tags. AWS Cost Allocation Tags allow you to tag AWS resources with team-specific metadata (e.g., 'Team: Engineering') and then activate those tags in the Billing and Cost Management console. Once activated, AWS generates cost reports that group and summarize charges by those tags, enabling per-team cost tracking in the monthly bill. This is the correct feature because it directly categorizes costs at the resource level and reports them in billing data.

Answer

AWS Budgets

Answer

AWS Organisations consolidated billing

Answer

AWS Cost and Usage Report

Question 3

Which AWS service provides DDoS protection for all AWS customers at no additional charge and automatically protects resources at Layers 3 and 4?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides always-on detection and inline mitigation of DDoS attacks targeting Layers 3 (network) and 4 (transport) of the OSI model. It protects common AWS resources such as Amazon CloudFront, Elastic Load Balancing, and Amazon Route 53 from common infrastructure-layer attacks like SYN floods and UDP reflection attacks.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

Amazon CloudFront with geo-restriction

Question 4

A company runs a data analytics workload on a cluster of Amazon EC2 instances. The application requires a shared file system that can be mounted by multiple EC2 instances simultaneously. The workload is bursty: during data processing jobs, the instances write and read large datasets, but between jobs the file system is mostly idle. The company wants a fully managed, highly available, and durable file storage solution that automatically scales capacity up and down and charges only for the storage used. The solution must be accessible from EC2 instances across multiple Availability Zones in the same AWS Region. Which AWS service should the company use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS is a fully managed, highly available, and durable NFS file system that automatically scales storage capacity up and down as files are added or removed, charging only for the storage used. It can be mounted by multiple EC2 instances across different Availability Zones simultaneously, making it ideal for bursty, shared-file workloads that require concurrent access and automatic scaling.

Answer

Amazon Elastic Block Store (EBS) with Multi-Attach enabled

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon FSx for Windows File Server

Question 5

A financial services company uses AWS CloudTrail to log all API calls in its AWS account. The company must demonstrate to auditors that the CloudTrail log files have not been tampered with after they were delivered to the Amazon S3 bucket. The company wants to use a feature that automatically creates digest files containing a hash of each log file, allowing the auditor to mathematically verify the integrity of the logs. Which AWS feature should the company enable to meet this requirement?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation is the correct feature because it automatically creates digest files that contain a hash of each log file. These digest files are themselves signed using a private key, and the corresponding public key is published by AWS, enabling auditors to mathematically verify that the log files have not been tampered with after delivery to S3.

Answer

S3 Object Lock

Answer

AWS Config conformance packs

Answer

Amazon Detective

Question 6

A company operates a seasonal e-commerce website. During holiday sales, traffic can increase by 500% within minutes. The company uses AWS Auto Scaling to automatically add Amazon EC2 instances when CPU utilization exceeds a threshold and remove instances during off-peak hours. The company pays only for the compute capacity it actually consumes, with no upfront commitment. This scenario best demonstrates which essential characteristics of cloud computing?

Accepted Answer

Rapid elasticity and measured service. The scenario demonstrates rapid elasticity because the Auto Scaling group can instantly add hundreds of EC2 instances to handle a 500% traffic surge, and then remove them when demand drops. It also demonstrates measured service because the company pays only for the compute capacity actually consumed, with no upfront commitment, which is metered and billed based on usage.

Answer

On-demand self-service and broad network access

Answer

Resource pooling and high availability

Answer

Fault tolerance and disaster recovery

Question 7

A company runs a microservices-based application on Amazon ECS. The application stores database credentials and API keys in plaintext configuration files that are baked into container images. A security audit reveals that this practice violates the company's compliance policy, which mandates that secrets must be stored separately from code, centrally managed, and automatically rotated every 90 days. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is designed specifically for storing, managing, and automatically rotating database credentials, API keys, and other secrets throughout their lifecycle. It meets the compliance requirements by storing secrets separately from code, providing a central management console and API, and supporting automatic rotation every 90 days via built-in integration with AWS RDS, Redshift, and DocumentDB, or custom Lambda functions.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 8

A development team builds Docker container images as part of their CI/CD pipeline and needs a managed, private registry to store and version these images, integrated with Amazon ECS and EKS for deployment. Which AWS service provides this container image registry?

Accepted Answer

Amazon ECR. Amazon ECR (Elastic Container Registry) is the correct choice because it is a fully managed Docker container registry that stores, manages, and deploys container images. It integrates natively with Amazon ECS and Amazon EKS, allowing seamless image pulls during deployment without needing to manage underlying infrastructure.

Answer

Amazon ECS

Answer

Amazon S3

Answer

AWS CodeBuild

Question 9

What is the purpose of an AWS Region when designing a global cloud architecture?

Accepted Answer

To define geographic boundaries for deploying resources, meeting compliance requirements, and minimizing end-user latency. An AWS Region is a distinct geographic area that contains multiple, isolated Availability Zones. Its purpose is to allow customers to deploy resources close to their end users to minimize latency, and to meet data residency and compliance requirements by keeping data within specific geographic boundaries. Each Region operates independently, ensuring fault isolation and regulatory adherence.

Answer

To provide a single physical location for all AWS resources worldwide

Answer

To automatically replicate all data and compute resources across the globe

Answer

To limit the availability of AWS services to specific enterprise customers

Question 10

A company runs a production web application on Amazon EC2 and Amazon RDS. The internal IT team needs a support plan that provides a guaranteed response time of less than one hour for a production system outage. Additionally, the company wants access to AWS Infrastructure Event Management, which includes guidance from AWS experts during planned events such as product launches or migrations. The company does not require a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

Accepted Answer

Business Support. The Business Support plan is the correct choice because it provides a guaranteed response time of less than one hour for production system outages (production system impaired) and includes access to AWS Infrastructure Event Management for guidance during planned events. The company does not need a dedicated Technical Account Manager (TAM), which is only available with the Enterprise Support plan, making Business Support the most cost-effective option that meets all stated requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise Support

Question 11

A company runs a web application on Amazon EC2 instances. The company wants to ensure that they are billed only for the exact compute capacity they consume, down to the second, for each running instance. They also want to receive a detailed breakdown of their usage, including CPU time, storage, and data transfer, so they can analyze costs per department. Which essential characteristic of cloud computing enables this granular tracking and billing?

Accepted Answer

Measured service. Measured service is the correct answer because it is the cloud characteristic that enables providers to monitor, control, and report on resource usage (CPU time, storage, data transfer) with granularity down to the second. This metering capability allows AWS to bill customers only for the exact compute capacity consumed and provide detailed usage breakdowns for cost analysis per department.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 12

A company operates 10 AWS accounts, each managed by a different department. The finance team wants to combine the usage of all accounts to qualify for lower volume-based pricing tiers for services such as Amazon S3 and Amazon EC2. Additionally, they want a single monthly bill that aggregates charges from all accounts. Which AWS feature should the company use to meet these requirements?

Accepted Answer

AWS Organizations with consolidated billing. AWS Organizations with consolidated billing is the correct feature because it allows the company to combine usage across all 10 AWS accounts into a single aggregated bill. This enables the finance team to qualify for lower volume-based pricing tiers for services like Amazon S3 and Amazon EC2, as AWS aggregates usage across all accounts in the organization. Consolidated billing also provides a single monthly bill that itemizes charges from each account, meeting both requirements.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 13

A company wants to proactively monitor its AWS spending and receive email notifications when actual or forecasted costs exceed a defined threshold. The company has a monthly budget of $10,000 and wants to be alerted when costs reach 80% of the budget. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and configure alerts that trigger when actual or forecasted costs exceed a defined threshold (e.g., 80% of a $10,000 monthly budget). It can send email notifications via Amazon SNS when the threshold is breached, meeting the proactive monitoring requirement.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Consolidated Billing

Question 14

A company runs a mix of Amazon EC2 instances across multiple AWS Regions to support its e-commerce platform. The finance team wants to reduce compute costs by right-sizing resources. They need a managed tool that analyzes historical CPU and memory utilization over 30 days, uses machine learning to identify over-provisioned and under-provisioned instances, and provides actionable recommendations to adjust instance sizes. Which AWS tool should the finance team use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct choice because it is a managed service that uses machine learning to analyze historical utilization metrics (CPU, memory, etc.) over up to 93 days, identifies over-provisioned and under-provisioned EC2 instances, and generates actionable rightsizing recommendations. The question specifically requires a tool that analyzes 30 days of historical CPU and memory data with ML-driven insights, which aligns exactly with Compute Optimizer's core functionality.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 15

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS SSO

Question 16

A company runs a multiplayer gaming application on AWS. The application uses UDP for real-time communication between players. Players in different geographic regions report high latency and connection instability. The company wants to improve performance by directing user traffic to the nearest healthy application endpoint and using a static IP address for the application. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route UDP traffic over optimized paths to the nearest healthy application endpoint, reducing latency and jitter. It provides two static anycast IP addresses that act as a fixed entry point, masking changes to underlying infrastructure. This directly addresses the need for low-latency UDP communication and a static IP for the gaming application.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 17

A company wants to implement governance controls that prevent their developers from provisioning expensive instance types. Which approach is most effective?

Accepted Answer

Apply an SCP or IAM policy that denies launching specific expensive instance types. Service Control Policies (SCPs) or IAM policies can explicitly deny the launch of specific expensive instance types (e.g., `p3.2xlarge` or `x1e.32xlarge`) at the API level, preventing the action before any resources are created. This proactive governance approach enforces compliance in real time, unlike reactive or advisory methods. By attaching a deny effect for `ec2:RunInstances` with a condition on `ec2:InstanceType`, the policy blocks unauthorized instance provisioning regardless of the user's role or account.

Answer

Set an AWS Budget alert for when expensive instances are launched

Answer

Enable AWS Cost Explorer recommendations

Answer

Enable Trusted Advisor and review weekly

Question 18

Which AWS offering provides free, self-paced online training courses, videos, and labs to help customers learn AWS services and pass certification exams?

Accepted Answer

AWS Skill Builder. AWS Skill Builder is the official AWS training portal that offers free, self-paced online training courses, videos, and hands-on labs. It is specifically designed to help individuals learn AWS services and prepare for AWS Certification exams, including the CLF-C02. Unlike other options, Skill Builder directly provides the described learning resources at no cost.

Answer

AWS Partner Network (APN)

Answer

AWS Certification

Answer

AWS Marketplace

Question 19

A company's application needs to process streaming data from IoT sensors in real time and store processed results in S3. Which AWS service is designed for ingesting and processing real-time streaming data?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is purpose-built for ingesting and processing real-time streaming data at scale. It can continuously capture gigabytes of data per second from hundreds of thousands of sources, such as IoT sensors, and integrate with downstream consumers like AWS Lambda or Kinesis Data Analytics for real-time processing before storing results in Amazon S3.

Answer

Amazon SQS

Answer

AWS Batch

Answer

Amazon EMR

Question 20

A company runs a production web application on Amazon EC2 and Amazon RDS instances. The company's IT team needs technical support from AWS engineers with a guaranteed response time of less than one hour for issues where production systems are impaired. Additionally, the team wants to receive cost optimization recommendations through AWS Trusted Advisor. Which AWS Support plan should the company choose?

Accepted Answer

AWS Business Support. AWS Business Support provides a response time of less than one hour for production system impaired cases (severity level 'high') and includes full access to AWS Trusted Advisor, which offers cost optimization recommendations. This plan meets both the guaranteed response time and the cost optimization requirements specified in the question.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise Support