CLF-C02 Practice Exam 59 — 20 Questions

Question 1

A company operates 10 AWS accounts under AWS Organizations. Each account runs multiple projects, and the company tags all resources with a 'Project' tag (e.g., 'Project-A', 'Project-B'). The finance team wants to view the consolidated monthly bill broken down by the value of the 'Project' tag across all accounts. Which AWS feature should the team use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate the 'Project' tag as a cost allocation tag in the AWS Organizations payer account's Billing and Cost Management console.. Cost allocation tags in the AWS Organizations payer account's Billing and Cost Management console allow you to activate user-defined tags (like 'Project') so that AWS can break down the consolidated monthly bill by those tag values across all linked accounts. Once activated, the cost data is available in Cost Explorer and the Cost & Usage Report, enabling the finance team to view spending per project without manual aggregation.

Answer

Create an AWS Budget for each 'Project' tag value and set cost alerts to track spending per project.

Answer

Use AWS Trusted Advisor to generate a cost optimization report that shows which projects are over-spending based on the 'Project' tag.

Answer

Configure AWS Compute Optimizer to analyze costs per project and recommend resource downsizing based on the 'Project' tag.

Question 2

A company needs to implement a disaster recovery strategy where data is continuously replicated to AWS but AWS compute resources are only started during a declared disaster. Which DR strategy does this describe?

Accepted Answer

Pilot Light. The Pilot Light strategy involves continuously replicating data to AWS (e.g., using AWS Database Migration Service or S3 replication) while keeping only a minimal core set of AWS resources (like a small EC2 instance or RDS database) running. Compute resources are not fully provisioned until a disaster is declared, at which point they are scaled up to handle production traffic. This matches the description of data being continuously replicated but compute only started during a declared disaster.

Answer

Backup and Restore

Answer

Warm Standby

Answer

Multi-Site Active/Active

Question 3

A company's architecture team is evaluating their multi-tier application against the AWS Well-Architected Framework. They discover that their database has no backup and recovery procedure. Which pillar does this finding fall under?

Accepted Answer

Reliability. The Reliability pillar of the AWS Well-Architected Framework focuses on ensuring that workloads can recover from infrastructure or service disruptions, acquire computing resources to meet demand, and mitigate transient or persistent failures. A database without a backup and recovery procedure directly violates the 'Backup and Restore' design principle, which is a core component of reliability because it ensures data durability and the ability to restore operations after a failure. Without backups, any data corruption or loss event would result in permanent data loss, making the system unreliable.

Answer

Security

Answer

Operational Excellence

Answer

Cost Optimization

Question 4

A company wants to improve the performance of their global application by caching API responses closer to end users. Which AWS service provides an API proxy with built-in caching and CloudFront integration?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is correct because it provides a fully managed API proxy that can cache responses at the API endpoint level, reducing latency and backend load. It also natively integrates with Amazon CloudFront, allowing cached API responses to be distributed globally via CloudFront's edge locations for even lower latency.

Answer

Amazon CloudFront alone

Answer

Elastic Load Balancing

Answer

AWS AppSync

Question 5

A company runs hundreds of Amazon EC2 instances across multiple accounts. The finance team wants to identify over-provisioned instances that are using more memory or CPU than necessary, so that they can downsize them and reduce monthly costs. The team needs automated, ongoing recommendations based on the actual utilization metrics of the instances. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, and network) of EC2 instances and generates automated, ongoing recommendations for right-sizing or downsizing over-provisioned instances. This directly meets the finance team's requirement for automated, continuous recommendations based on actual utilization to reduce monthly costs.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 6

A company runs mixed workloads on AWS — some on EC2, some on Lambda, and some on Fargate — and wants to commit to a consistent hourly spend on compute to receive discounts similar to Reserved Instances, but with the flexibility to apply those discounts across different compute services and instance types. Which purchasing option provides this flexibility?

Accepted Answer

Savings Plans. Savings Plans (C) offer the flexibility to commit to a consistent hourly spend (e.g., $10/hour) and automatically apply the discount across EC2 instances, AWS Lambda, and AWS Fargate usage, regardless of instance family, size, OS, or region. This matches the requirement for a Reserved Instance-like discount with cross-service and cross-instance flexibility, which Reserved Instances cannot provide because they are tied to a specific instance family and region.

Answer

Reserved Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 7

A company runs multiple workloads on AWS, each in separate AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost threshold of $5,000 for the 'development' account. If the actual or forecasted costs exceed 80% of this threshold, the team wants to receive an email alert so they can review usage and take corrective action if needed. They also want to track costs against this threshold over time using a dashboard. Which AWS service should the finance team use to set up this threshold and receive the alerts?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets with alerts based on actual or forecasted costs. In this scenario, you can create a budget for the 'development' account with a $5,000 monthly threshold and configure an alert at 80% ($4,000) to send an email notification. AWS Budgets also integrates with Amazon QuickSight or Cost Explorer for historical tracking, but the budget itself provides a dashboard view of current and forecasted spend against the threshold.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Organizations

Question 8

A financial services company is preparing for an annual compliance audit. The compliance team needs to continuously assess whether their AWS environment adheres to industry standards such as PCI DSS. They want to automate the collection of evidence, such as IAM policy changes and S3 bucket configurations, and generate audit-ready reports. They also need to identify gaps in their controls and receive remediation recommendations. Which AWS service should the company use?

Accepted Answer

AWS Audit Manager. AWS Audit Manager is the correct choice because it is specifically designed to continuously assess compliance with industry standards like PCI DSS. It automates the collection of evidence (e.g., IAM policy changes, S3 bucket configurations) and generates audit-ready reports, while also identifying control gaps and providing remediation recommendations. This directly matches the company's need for automated evidence collection and gap analysis.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS Security Hub

Question 9

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action using an AWS Systems Manager Automation document. AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` continuously evaluates S3 buckets against the encryption requirement. When a non-compliant bucket is detected, an automatic remediation action can invoke an AWS Systems Manager Automation document to enable default encryption (SSE-S3 or SSE-KMS). AWS Config also provides a compliance score dashboard and allows the security team to review non-compliant resources, meeting all stated requirements.

Answer

Amazon GuardDuty with a finding type for S3 bucket encryption

Answer

AWS Trusted Advisor with the S3 Bucket Permissions check

Answer

AWS CloudTrail with a trail that logs S3 API calls and an Amazon CloudWatch alarm

Question 10

A fast-growing mobile game company uses a NoSQL database to store player profiles, leaderboards, and game state. The database must deliver consistent single-digit millisecond response times regardless of the number of concurrent players. The company wants a fully managed service that automatically scales throughput capacity up and down based on traffic and replicates data across multiple Availability Zones for high availability. Which AWS service should the company use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database service that delivers consistent single-digit millisecond latency at any scale. It supports automatic scaling of throughput capacity based on traffic patterns and replicates data across multiple Availability Zones (AZs) for high availability and durability, making it the ideal choice for a fast-growing mobile game company.

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon ElastiCache for Redis

Question 11

A startup company is using the AWS Free Tier to run a small web application. They want to ensure they receive a notification if their usage is about to exceed the Free Tier limits for any service, to avoid unexpected charges. Which AWS service or feature should they use to set up this alert?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets, and you can configure alerts to notify you when your actual or forecasted usage exceeds a defined threshold. For a startup on the Free Tier, you can create a budget with a zero-spend limit or a specific usage amount, and receive email notifications when you are about to exceed the Free Tier limits, helping you avoid unexpected charges.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Billing Conductor

Question 12

A company wants to ensure they never spend more than $500 per month on AWS services. Which AWS feature can automatically stop or terminate resources when cost projections reach a threshold?

Accepted Answer

AWS Budgets Actions. AWS Budgets Actions allow you to define cost and usage budgets with automated responses, such as stopping or terminating EC2 instances, when actual or forecasted costs exceed a specified threshold. This directly meets the requirement to enforce a $500 monthly spending limit without manual intervention. Budget alerts alone only notify you; they do not take automated actions.

Answer

AWS Budgets with budget alerts only

Answer

AWS Cost Explorer spending forecasts

Answer

AWS Service Quotas

Question 13

A company wants to deploy a web application and have AWS handle the infrastructure, OS, and runtime — they only want to manage the application code and configuration. Which AWS service provides this experience?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is a Platform as a Service (PaaS) offering that automatically handles the provisioning of underlying infrastructure (EC2 instances, load balancers, auto-scaling groups), the operating system, and the runtime environment (e.g., Java, Python, Node.js). The customer only needs to upload their application code and configuration, and Elastic Beanstalk manages the deployment, capacity provisioning, load balancing, and health monitoring, matching the requirement exactly.

Answer

Amazon EC2

Answer

AWS Lambda

Answer

Amazon ECS

Question 14

A company is deploying a new web application on AWS. The operations team needs to provision and manage AWS resources such as Amazon EC2 instances, Amazon RDS databases, and Amazon S3 buckets in a repeatable, consistent manner across development, test, and production environments. The team wants to define the entire infrastructure as code using declarative templates that can be version-controlled and reviewed. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire infrastructure as code using declarative templates (JSON or YAML). These templates can be version-controlled and reviewed, enabling repeatable and consistent provisioning of resources like EC2 instances, RDS databases, and S3 buckets across multiple environments. CloudFormation manages the lifecycle of these resources as stacks, ensuring idempotent deployments.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 15

A company is designing a microservices architecture on AWS. According to the AWS Well-Architected Framework's Operational Excellence pillar, which practice best supports the ability to safely make frequent, small changes to production?

Accepted Answer

Making frequent, small, reversible changes through automated CI/CD pipelines. The Operational Excellence pillar emphasizes the ability to make frequent, small, reversible changes to reduce the blast radius of failures and enable rapid recovery. Automated CI/CD pipelines enforce consistent deployment practices, allowing teams to safely iterate on production with minimal risk. This approach aligns with the principle of 'perform operations as code' and supports the 'make frequent, small, reversible changes' design principle.

Answer

Performing large batch deployments monthly to minimize change frequency

Answer

Requiring manual approval for every code change

Answer

Deploying all microservices simultaneously in coordinated releases

Question 16

A software development team uses AWS CloudFormation to define their test environments as infrastructure as code. Each developer can launch a complete environment containing multiple Amazon EC2 instances, an Application Load Balancer, and an Amazon RDS database in under five minutes. They run their test suite for a few hours and then delete the entire CloudFormation stack, releasing all resources. Which essential characteristic of cloud computing does this workflow best illustrate?

Accepted Answer

Rapid elasticity. The ability to provision and de-provision a complete environment—including EC2 instances, an ALB, and an RDS database—in minutes and then release all resources after a few hours directly demonstrates rapid elasticity. This characteristic allows cloud resources to scale out and in quickly, matching demand without manual intervention, which is exactly what the CloudFormation stack lifecycle achieves.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 17

Which AWS service provides a fully managed environment for creating, maintaining, and documenting APIs using REST, HTTP, and WebSocket protocols?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is the correct service because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure APIs at any scale. It specifically supports RESTful APIs, HTTP APIs (for lower-latency and simpler integrations), and WebSocket APIs (for real-time two-way communication), making it the only AWS service that natively covers all three protocol types in a managed environment.

Answer

AWS AppSync

Answer

Elastic Load Balancing

Answer

AWS Lambda

Question 18

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized management of firewall rules across all accounts in AWS Organizations. It can enforce a common security group rule to deny SSH access from 0.0.0.0/0, automatically apply this policy to new VPCs and security groups, and remediate non-compliant existing security groups by removing or replacing violating rules. This meets the requirement for both proactive enforcement and automated remediation at scale.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Identity and Access Management (IAM)

Question 19

A company is migrating its legacy Java web application to AWS. The application consists of a stateless web tier that receives HTTP traffic. The company wants to minimize operational overhead. The development team wants to simply upload a WAR file and have AWS automatically handle the deployment, capacity provisioning, load balancing, and auto-scaling based on traffic. The team does not want to manage the underlying EC2 instances or configure the load balancer manually. Which AWS service should the company use?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform as a Service (PaaS) offering that automatically handles deployment, capacity provisioning, load balancing, and auto-scaling for Java web applications. The team can simply upload a WAR file, and Elastic Beanstalk manages the underlying EC2 instances and Application Load Balancer (ALB) without requiring manual configuration. This directly meets the requirement to minimize operational overhead while supporting stateless web tiers.

Answer

Amazon EC2 Auto Scaling

Answer

AWS OpsWorks

Answer

Amazon Lightsail

Question 20

A company's data analytics team needs to process log files immediately after they are uploaded to an Amazon S3 bucket. The processing logic is implemented as a custom Python script that runs for about 10 seconds per file. The team wants a fully managed solution that does not require provisioning or managing servers, automatically scales with the number of incoming log files, and executes the script only when new files are uploaded. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Lambda with an S3 bucket notification trigger. AWS Lambda is the correct choice because it is a fully managed, serverless compute service that can be triggered directly by S3 bucket notifications (e.g., s3:ObjectCreated:* events). The custom Python script runs within the Lambda function, which automatically scales to handle concurrent invocations for each new log file, and the 10-second execution time is well within the 15-minute maximum duration for Lambda functions. This meets all requirements without provisioning or managing servers.

Answer

Amazon EC2 with an Auto Scaling group configured to launch instances based on S3 events

Answer

AWS Elastic Beanstalk configured with a worker environment

Answer

Amazon EMR with a scheduled step to process new files