CLF-C02 Practice Exam 58 — 20 Questions

Question 1

A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every day and must be highly available and durable. Which S3 storage class is most appropriate for this workload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Standard. S3 Standard is the most appropriate storage class because it offers high durability (99.999999999%) and high availability (99.99%) with low-latency access, making it ideal for frequently accessed, critical data like video thumbnails that are read multiple times daily. It provides automatic replication across a minimum of three Availability Zones, ensuring both high availability and durability without retrieval fees or minimum storage duration penalties.

Answer

S3 One Zone-IA

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard-IA

Question 2

A company manages multiple AWS accounts under AWS Organizations. The finance team needs to set a monthly spending limit for each account, receive automatic email alerts when spending reaches 80% of that limit, and also view a graphical dashboard showing historical cost trends across all accounts. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS Budgets and AWS Cost Explorer. AWS Budgets allows you to set custom monthly spending limits per AWS account and configure alerts (via Amazon SNS or email) when actual or forecasted costs exceed a threshold, such as 80% of the budget. AWS Cost Explorer provides a graphical dashboard with historical cost trends and enables filtering by linked accounts, making it the correct service for visualizing trends across all accounts under AWS Organizations. Together, they satisfy the requirements for per-account limits, email alerts at 80%, and a historical cost dashboard.

Answer

AWS Budgets and Amazon QuickSight

Answer

AWS Cost Explorer and Amazon CloudWatch

Answer

AWS Cost Explorer and AWS Trusted Advisor

Question 3

A company runs multiple workloads on AWS. At the end of each month, the finance team receives a detailed invoice that shows exactly how many GB-hours of Amazon EBS storage each workload used and how many hours each Amazon EC2 instance was running. This granular usage data is used to allocate costs back to the respective business units. Which essential characteristic of cloud computing does this capability best demonstrate?

Accepted Answer

Measured service. The ability to track and report granular usage data—such as GB-hours of EBS storage and EC2 instance hours—directly corresponds to the measured service characteristic of cloud computing. Measured service means cloud resources are metered at an abstraction level appropriate to the service type (e.g., storage, compute), enabling usage-based billing and cost allocation. In this scenario, the detailed invoice provides precise consumption metrics that allow the finance team to allocate costs to specific business units, which is the core function of measured service.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 4

Which AWS service provides a fully managed environment to run Apache Spark, Hadoop, and other big data frameworks for data processing and analytics?

Accepted Answer

Amazon EMR. Amazon EMR (Elastic MapReduce) is the correct answer because it is a fully managed big data platform that natively supports Apache Spark, Hadoop, Hive, Presto, and other distributed processing frameworks. It automatically provisions EC2 instances, configures the cluster, and handles scaling, patching, and monitoring, allowing you to run large-scale data processing and analytics workloads without manual infrastructure management.

Answer

Amazon Redshift

Answer

Amazon Athena

Answer

AWS Glue

Question 5

A startup has a development AWS account and wants the minimum paid AWS Support plan that provides email-based technical support from AWS staff. They do not need 24/7 phone access. Which is the minimum support plan that provides access to AWS technical support engineers?

Accepted Answer

Developer Support. The Developer Support plan is the minimum AWS Support plan that provides access to AWS technical support engineers via email during business hours. Basic Support offers no technical support from AWS staff, only account and billing assistance. Business and Enterprise Support include 24/7 phone and chat support, which exceeds the stated requirement for email-only access.

Answer

Basic Support

Answer

Business Support

Answer

Enterprise Support

Question 6

A company is migrating its internal email system to a cloud-based solution. After the migration, the company's IT team no longer needs to manage the email servers, apply operating system patches, or upgrade the email software. The cloud provider handles all underlying infrastructure, the platform, and the application itself. Users access their email through a web browser or a mobile app. Which cloud service model does this scenario describe?

Accepted Answer

Software as a Service (SaaS). This scenario describes Software as a Service (SaaS) because the cloud provider delivers the entire email application, including the underlying infrastructure, platform, and software, to end users. The IT team has no responsibility for managing servers, applying OS patches, or upgrading the email software—users simply access the email via a web browser or mobile app. This matches the SaaS model, where the provider manages everything from the hardware to the application, and the customer only consumes the software.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

On-premises deployment

Question 7

A company runs a batch processing application in Docker containers. The application runs for several hours at a time and requires significant CPU and memory resources. The company wants to run these containers on AWS without provisioning or managing any underlying EC2 instances or cluster capacity. They need a service that automatically scales based on demand and charges only for the resources consumed by the containers. Which AWS service should the company use?

Accepted Answer

AWS Fargate. AWS Fargate is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision or manage EC2 instances. It automatically scales based on demand and charges only for the CPU and memory resources consumed by the containers, which aligns perfectly with the requirement to run long-running batch processing without managing underlying infrastructure.

Answer

Amazon ECS with EC2 launch type

Answer

Amazon EKS with managed node groups

Answer

AWS Lambda

Question 8

A company runs a microservices-based application on Amazon ECS. The application stores database credentials and API keys in plaintext configuration files that are baked into container images. A security audit reveals that this practice violates the company's compliance policy, which mandates that secrets must be stored separately from code, centrally managed, and automatically rotated every 90 days. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is designed specifically for storing, managing, and automatically rotating database credentials, API keys, and other secrets throughout their lifecycle. It meets the compliance requirements by storing secrets separately from code, providing a central management console and API, and supporting automatic rotation every 90 days via built-in integration with AWS RDS, Redshift, and DocumentDB, or custom Lambda functions.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 9

A company uses AWS Organizations with multiple accounts for different departments (Engineering, Marketing, Sales). The finance team needs to create detailed monthly chargeback reports showing each department's usage and costs, broken down by service (e.g., Amazon EC2, Amazon S3) and by custom tags (e.g., Project). The reports must be in a machine-readable format (CSV) so they can be ingested into the company's internal billing system. The team wants the most comprehensive, granular cost data available from AWS, including line items for individual resources. Which AWS tool should the finance team configure to meet these requirements?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the correct choice because it provides the most comprehensive, granular cost data available, including line items for individual resources broken down by service, custom tags, and time period. It can be delivered to an Amazon S3 bucket in CSV format, which is machine-readable and suitable for ingestion into the company's internal billing system for detailed monthly chargeback reports.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

Consolidated Billing

Question 10

A company's security team wants to identify all Amazon S3 buckets that are shared with external AWS accounts or publicly accessible. The team needs a continuous evaluation that reports findings in a centralized dashboard and sends alerts when new unintended external shares are created. Which AWS service should the security team use to meet these requirements?

Accepted Answer

IAM Access Analyzer. IAM Access Analyzer is the correct choice because it continuously monitors resource policies, including S3 bucket policies, to identify resources shared with external AWS accounts or publicly. It provides a centralized dashboard in the IAM console to view findings and integrates with Amazon EventBridge to send alerts via Amazon SNS when new unintended external shares are created, meeting all stated requirements.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 11

A company hosts its corporate website entirely as static content (HTML, CSS, JavaScript, images) in an Amazon S3 bucket. The website currently has no authentication requirements and is accessible to the public. The company wants to serve this content to users around the world with low latency. Additionally, the company wants to enforce HTTPS for all traffic using a custom domain name (www.example.com). The company does not want to manage SSL/TLS certificates on any servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It supports custom domain names and can enforce HTTPS by using AWS Certificate Manager (ACM) to provision and renew SSL/TLS certificates automatically, eliminating the need for server-side certificate management. CloudFront integrates directly with an S3 bucket as the origin, allowing the bucket to remain private while serving content securely via HTTPS.

Answer

AWS Global Accelerator

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Lambda@Edge

Question 12

A company runs an e-commerce application on AWS that experiences unpredictable traffic spikes during flash sales. The application currently runs on a fixed number of Amazon EC2 instances, which leads to performance degradation during spikes and wasted capacity during low traffic. The company wants to automatically adjust the number of instances based on real-time demand, only paying for the resources it uses. This need best represents which cloud computing concept?

Accepted Answer

Elasticity. (Elasticity) is correct because the scenario describes automatically scaling EC2 instances up and down based on real-time demand, which is the definition of elasticity in cloud computing. AWS Auto Scaling and Amazon EC2 Auto Scaling groups enable this by adding or removing instances in response to CloudWatch metrics, ensuring the application only pays for resources consumed during traffic spikes and low traffic periods.

Answer

High availability

Answer

Fault tolerance

Answer

Durability

Question 13

A company uses three separate AWS accounts for development, testing, and production workloads. The security team needs to enforce a policy that prevents users in any account from disabling AWS CloudTrail or deleting CloudTrail log files. The team also wants to consolidate billing and have a single payment method for all accounts. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Organizations. AWS Organizations is the correct service because it allows the security team to create a multi-account structure with a single consolidated billing method and a single payment method across all accounts. Additionally, Organizations supports service control policies (SCPs), which can be applied to the root or individual accounts to explicitly deny actions such as disabling CloudTrail or deleting CloudTrail log files, ensuring enforcement across the development, testing, and production accounts.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A media company runs a video-on-demand platform on AWS. Video files (.mp4) and thumbnail images (.jpg) are stored in the same Amazon S3 bucket. The company uses Amazon CloudFront to deliver content to users globally. The video files are large and do not change frequently, so the company wants them to be cached at CloudFront edge locations for 30 days. Thumbnails change more often when new uploads are processed, so the company wants them to be cached for only 1 day. The company wants a single CloudFront distribution to serve both types of content from the same S3 bucket. Which configuration should the company use to meet these requirements with minimal operational overhead?

Accepted Answer

Create two CloudFront behaviors: one for the path pattern /videos/* and one for /thumbnails/*. Associate a cache policy with a TTL of 30 days to the video behavior and a cache policy with a TTL of 1 day to the thumbnail behavior. Both behaviors point to the same S3 origin.. CloudFront allows multiple behaviors within a single distribution, each with its own path pattern and cache policy. By configuring path patterns /videos/* and /thumbnails/*, the company can apply a 30-day TTL cache policy to video requests and a 1-day TTL cache policy to thumbnail requests, both pointing to the same S3 origin. This meets the caching requirements with minimal operational overhead, as it avoids custom code or multiple distributions.

Answer

Create one CloudFront behavior for all content. Set a cache policy with a TTL of 30 days. Create a Lambda@Edge function to override the TTL to 1 day for requests with .jpg extension.

Answer

Create two separate CloudFront distributions: one for videos with a cache policy of 30 days, and one for thumbnails with a cache policy of 1 day. Point both to the same S3 bucket.

Answer

In the S3 bucket, create two folders: /videos and /thumbnails. Use S3 Cross-Region Replication to replicate thumbnails to a separate bucket in a different Region. Create a single CloudFront behavior with a cache policy of 1 day for the thumbnail bucket and a separate behavior for the original bucket.

Question 15

Which AWS service provides managed, automated workflows for coordinating migration tasks such as tracking migration status, grouping servers into migration waves, and coordinating cutover?

Accepted Answer

AWS Migration Hub. AWS Migration Hub is the correct service because it provides a single location to track the progress of application migrations across multiple AWS and partner solutions. It offers managed, automated workflows for grouping servers into migration waves, tracking migration status, and coordinating cutover activities, which directly matches the question's requirements.

Answer

AWS Application Discovery Service

Answer

AWS Control Tower

Answer

AWS Organizations

Question 16

Which AWS service provides a landing zone and automated multi-account setup with pre-configured security baselines and guardrails for AWS Organizations?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct service because it provides a pre-configured landing zone and automates the setup of a multi-account environment based on AWS Organizations. It enforces security baselines and guardrails (preventive and detective controls) using AWS Service Catalog and AWS Config rules, ensuring compliance from the start.

Answer

AWS Organizations

Answer

AWS CloudFormation StackSets

Answer

AWS Service Catalog

Question 17

A company runs workloads for multiple teams in a single AWS account and wants to track and report costs per team in their monthly AWS bill. Which feature allows them to categorise and report AWS costs by team?

Accepted Answer

AWS Cost Allocation Tags. AWS Cost Allocation Tags allow you to tag AWS resources with team-specific metadata (e.g., 'Team: Engineering') and then activate those tags in the Billing and Cost Management console. Once activated, AWS generates cost reports that group and summarize charges by those tags, enabling per-team cost tracking in the monthly bill. This is the correct feature because it directly categorizes costs at the resource level and reports them in billing data.

Answer

AWS Budgets

Answer

AWS Organisations consolidated billing

Answer

AWS Cost and Usage Report

Question 18

Which AWS service provides DDoS protection for all AWS customers at no additional charge and automatically protects resources at Layers 3 and 4?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides always-on detection and inline mitigation of DDoS attacks targeting Layers 3 (network) and 4 (transport) of the OSI model. It protects common AWS resources such as Amazon CloudFront, Elastic Load Balancing, and Amazon Route 53 from common infrastructure-layer attacks like SYN floods and UDP reflection attacks.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

Amazon CloudFront with geo-restriction

Question 19

A small company operates a single AWS account and currently uses the Basic Support plan. The company's administrator needs to be able to contact AWS Support by phone for urgent billing and account issues. Additionally, the administrator wants to request service limit increases through the AWS Support console. The company wants to minimize costs while meeting these requirements. Which AWS Support plan should the company choose?

Accepted Answer

AWS Business Support. AWS Business Support is the correct choice because it is the lowest-tier plan that provides phone support for urgent billing and account issues, along with the ability to request service limit increases through the AWS Support console. Basic Support does not offer phone support, and Developer Support only provides email-based support for technical issues, not phone support for billing and account matters. Enterprise Support, while offering these features, is significantly more expensive and not necessary for a small company seeking to minimize costs.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise Support

Question 20

A company runs a data analytics workload on a cluster of Amazon EC2 instances. The application requires a shared file system that can be mounted by multiple EC2 instances simultaneously. The workload is bursty: during data processing jobs, the instances write and read large datasets, but between jobs the file system is mostly idle. The company wants a fully managed, highly available, and durable file storage solution that automatically scales capacity up and down and charges only for the storage used. The solution must be accessible from EC2 instances across multiple Availability Zones in the same AWS Region. Which AWS service should the company use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS is a fully managed, highly available, and durable NFS file system that automatically scales storage capacity up and down as files are added or removed, charging only for the storage used. It can be mounted by multiple EC2 instances across different Availability Zones simultaneously, making it ideal for bursty, shared-file workloads that require concurrent access and automatic scaling.

Answer

Amazon Elastic Block Store (EBS) with Multi-Attach enabled

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon FSx for Windows File Server