CLF-C02 Practice Test 6 — 10 Questions

Question 1

A company's IT director wants to present a business case for migrating from on-premises infrastructure to AWS. They need to compare the full cost of running on-premises (hardware, facilities, power, labour) against the cost of running equivalent workloads on AWS. Which AWS tool helps create this comparison?

Accepted Answer

AWS TCO Calculator. Option C is correct because the AWS TCO (Total Cost of Ownership) Calculator is specifically designed to compare the full costs of running on-premises infrastructure (including hardware, facilities, power, and labor) against the equivalent costs on AWS. It generates a detailed side-by-side cost comparison report, helping IT directors build a business case for migration by quantifying potential savings.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 2

A company's leadership team wants a structured framework for planning their AWS cloud migration that addresses organisational change management, skills development, governance, platform, security, and operations. Which AWS framework provides guidance across these perspectives?

Accepted Answer

AWS Cloud Adoption Framework (CAF). The AWS Cloud Adoption Framework (CAF) is specifically designed to guide organizations through their cloud migration journey by providing structured guidance across six core perspectives: Business, People, Governance, Platform, Security, and Operations. This framework directly addresses the leadership team's requirements for organizational change management, skills development, governance, platform, security, and operations, making it the correct choice.

Answer

AWS Well-Architected Framework

Answer

AWS Migration Hub

Answer

AWS Trusted Advisor

Question 3

A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it is designed to centralize log storage from multiple sources, including EC2 instances, via the CloudWatch agent. It provides built-in querying with Logs Insights, supports real-time monitoring, and offers configurable retention policies for long-term storage, meeting all requirements for searching, analysis, and retention.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 4

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

Accepted Answer

AWS, because RDS is a managed service that abstracts OS and engine management. Amazon RDS is a fully managed database service that automates the patching of the underlying database engine software. Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes managing the host operating system and the database engine patches. The customer is responsible for data, access management, and application-level security, not the engine software patching.

Answer

The customer, because they chose to run a relational database

Answer

A shared responsibility where AWS and the customer each patch different components

Answer

A third-party DBA contracted by the customer

Question 5

A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for OS updates) while preventing the internet from initiating inbound connections to those instances. It resides in a public subnet with an Elastic IP and uses Source Network Address Translation (SNAT) to replace the private source IP with the gateway's public IP, making the response traffic routable back without exposing the private instances.

Answer

Internet Gateway

Answer

VPN Gateway

Answer

VPC Endpoint

Question 6

A company has workloads that must remain on-premises due to data residency regulations but want to use the same AWS APIs, tools, and services they use in the cloud — including EC2, RDS, and S3 — on their on-premises hardware. Which AWS service enables this?

Accepted Answer

AWS Outposts. AWS Outposts is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises data center or co-location space. It allows customers to run EC2, RDS, and S3 locally on Outposts hardware while maintaining the same AWS control plane and APIs, satisfying data residency requirements without sacrificing cloud-native tooling.

Answer

AWS Direct Connect

Answer

AWS Snow Family

Answer

AWS Local Zones

Question 7

A company has two separate VPCs — one for development workloads and one for a shared services environment — and wants EC2 instances in both VPCs to communicate with each other using private IP addresses without traffic traversing the public internet. Which AWS feature enables this?

Accepted Answer

VPC Peering. VPC Peering enables direct network connectivity between two VPCs using private IP addresses, with traffic routed entirely within the AWS network backbone. This allows EC2 instances in the development VPC and the shared services VPC to communicate without traversing the public internet, as traffic stays within the AWS global infrastructure.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Direct Connect

Question 8

A financial institution needs a private, dedicated, high-bandwidth network connection from their on-premises data centre to AWS that does not traverse the public internet, provides consistent low latency, and supports up to 100 Gbps bandwidth. Which AWS service provides this?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a private, dedicated network connection from an on-premises data center to AWS that bypasses the public internet, ensuring consistent low latency and supporting bandwidths up to 100 Gbps (via 100 Gbps dedicated connections or link aggregation). This meets all the specified requirements for a high-bandwidth, private, and low-latency link.

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 9

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

Accepted Answer

Amazon QuickSight. Amazon QuickSight is a cloud-native, serverless business intelligence (BI) service that enables users to create interactive dashboards and visualizations from data sources such as Amazon S3, Amazon RDS, and Amazon Redshift. It requires no BI server infrastructure management, supports SPICE (Super-fast, Parallel, In-memory Calculation Engine) for high-performance data caching, and allows sharing dashboards with business users across an organization via a web browser or mobile app.

Answer

Amazon Athena

Answer

Amazon Redshift

Answer

Amazon CloudWatch

Question 10

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

Accepted Answer

Amazon Detective. Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub