CLF-C02 Practice Exam 60 — 20 Questions

Question 1

A company's security team needs to receive near-real-time notifications whenever an IAM user in their AWS account performs an action that violates a defined baseline of expected behavior. Examples include launching an Amazon EC2 instance in an unauthorized AWS Region or modifying a security group to allow public SSH access from the internet. The solution must analyze continuous streams of AWS API activity to identify suspicious patterns and known malicious IP addresses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors AWS API activity, including CloudTrail management events, VPC Flow Logs, and DNS logs, to identify suspicious patterns and known malicious IP addresses. It uses machine learning and integrated threat intelligence to detect anomalous behavior such as launching EC2 instances in unauthorized regions or modifying security groups for public SSH access, and can deliver near-real-time notifications via Amazon EventBridge or SNS. This makes it the correct choice for analyzing continuous streams of API activity and alerting on violations of a defined baseline.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 2

A company runs multiple workloads on AWS. At the end of each month, the finance team receives a detailed invoice that shows exactly how many GB-hours of Amazon EBS storage each workload used and how many hours each Amazon EC2 instance was running. This granular usage data is used to allocate costs back to the respective business units. Which essential characteristic of cloud computing does this capability best demonstrate?

Accepted Answer

Measured service. The correct answer is A because the ability to track and report granular usage data—such as GB-hours of EBS storage and EC2 instance hours—directly corresponds to the measured service characteristic of cloud computing. Measured service means cloud resources are metered at an abstraction level appropriate to the service type (e.g., storage, compute), enabling usage-based billing and cost allocation. In this scenario, the detailed invoice provides precise consumption metrics that allow the finance team to allocate costs to specific business units, which is the core function of measured service.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 3

A company's sales team uses a cloud-based CRM application. Sales representatives access the CRM from their laptops in the office, from tablets at customer sites, and from their smartphones while traveling, all over the internet. The application works consistently across all devices without requiring any custom client software on each device. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes sales representatives accessing the CRM application from laptops, tablets, and smartphones over the internet without needing custom client software. This directly illustrates broad network access, which is the cloud computing characteristic that resources are available over the network and can be accessed by standard mechanisms (e.g., HTTPS, REST APIs) from a wide range of heterogeneous client platforms (e.g., mobile phones, tablets, laptops). The consistent experience across devices without custom software is the hallmark of broad network access.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 4

A company runs several applications in a single AWS account. Each application belongs to a different project (Project Alpha, Project Beta, Project Gamma). The company has already applied tags with the key "Project" and the corresponding project name to all AWS resources used by each project. The finance team wants to use AWS Cost Explorer to view and filter monthly costs by project. However, after tagging all resources, the "Project" tag does not appear as a filter option in Cost Explorer. What must the finance team do to make the "Project" tag available for cost filtering in Cost Explorer?

Accepted Answer

Activate the "Project" cost allocation tag in the Billing and Cost Management console.. The 'Project' tag does not appear in Cost Explorer because AWS does not automatically activate user-defined tags for cost tracking. The finance team must manually activate the 'Project' cost allocation tag in the Billing and Cost Management console under 'Cost Allocation Tags'. Once activated, AWS will process the tag data and make it available as a filter in Cost Explorer within 24 hours.

Answer

Create a new AWS Budget with a cost filter for the "Project" tag.

Answer

Enable the AWS Cost and Usage Reports for the account.

Answer

Create a custom cost category with a rule that uses the "Project" tag.

Question 5

A company traditionally purchases physical servers every three years to host its internal applications. The company is migrating these applications to AWS and will pay a monthly fee based on the actual compute capacity consumed. The company no longer needs to make large upfront hardware purchases and can instead budget for smaller monthly payments. Which benefit of cloud computing does this scenario BEST describe?

Accepted Answer

Conversion of capital expense to operational expense. This scenario describes the conversion of capital expense (CapEx) to operational expense (OpEx). Traditionally, purchasing physical servers requires a large upfront capital investment, which is a capital expense. By migrating to AWS and paying a monthly fee based on actual compute capacity consumed, the company shifts to a pay-as-you-go model, which is an operational expense. This allows the company to budget for smaller, predictable monthly payments instead of large, infrequent hardware purchases.

Answer

Scalability

Answer

Elasticity

Answer

Economies of scale

Question 6

A company runs a web application that processes customer orders. During flash sales, the application's backend servers become overwhelmed because orders are submitted faster than they can be processed. The company needs a fully managed, highly available service that can buffer incoming orders so that the backend can process them at its own pace without losing any data. The service must automatically scale to handle any volume of orders without requiring manual provisioning. Which AWS service meets these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is a fully managed, highly available message queuing service that decouples application components. It buffers incoming orders by storing them in a queue, allowing the backend to process messages at its own pace without losing data. SQS automatically scales to handle any volume of messages, eliminating the need for manual provisioning.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 7

A company's security policy prohibits opening SSH (port 22) or RDP (port 3389) to the internet for any Amazon EC2 instance. The operations team needs a way to establish secure shell sessions to manage instances directly from the AWS Management Console without managing bastion hosts or SSH keys. Which AWS service provides this capability?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager enables secure shell access to EC2 instances directly from the AWS Management Console without opening inbound ports (22 or 3389) or managing bastion hosts. It uses the SSM Agent and AWS Identity and Access Management (IAM) policies to establish a bidirectional connection over HTTPS (port 443), eliminating the need for SSH keys or public IP addresses. This fully satisfies the security policy requirement while providing the desired management capability.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Question 8

A company traditionally operated an on-premises data center and purchased all server hardware and software licenses with upfront capital expenditure. After migrating its workloads to AWS, the company now receives a monthly invoice that reflects only the compute hours, storage, and data transfer that it actually used. The company can also stop paying for resources when they are no longer needed. Which key characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Pay-as-you-go pricing (variable expense). The scenario describes a shift from upfront capital expenditure (buying hardware and licenses) to a model where the company pays only for the compute hours, storage, and data transfer it actually uses, and can stop paying when resources are no longer needed. This directly illustrates the pay-as-you-go pricing characteristic of cloud computing, where costs are variable expenses based on consumption rather than fixed, upfront investments. This model is a fundamental aspect of AWS's pricing philosophy, enabling customers to align costs directly with usage.

Answer

Elasticity

Answer

Global reach

Answer

Security

Question 9

A company runs a production e-commerce application on AWS. The CIO requires that the company have access to AWS technical support with a response time of under 1 hour for critical production system failures. Additionally, the operations team wants to use AWS Trusted Advisor to get recommendations on cost optimization, performance, and security for all AWS resources. The company already pays for AWS Business Support for its development account but wants the minimum-cost support plan that meets these requirements for its production account. Which AWS Support plan should the company choose for the production account?

Accepted Answer

AWS Business Support. AWS Business Support is the minimum plan that provides a 1-hour response time for critical production system failures and full access to AWS Trusted Advisor, including cost optimization, performance, and security checks. AWS Basic and Developer Support do not offer a 1-hour response time for critical failures, and Developer Support only provides limited Trusted Advisor checks. Therefore, Business Support meets both requirements at the lowest cost for the production account.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Enterprise Support

Question 10

A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it can provision, manage, and automatically renew public SSL/TLS certificates for use with an Application Load Balancer at no additional cost. ACM integrates directly with ALB to handle certificate deployment and renewal, eliminating the need for manual renewal of third-party certificates. The service is free for public certificates used with supported AWS services like ALB, CloudFront, and API Gateway.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS WAF

Answer

AWS Secrets Manager

Question 11

A company runs a multi-region application on AWS with separate VPCs in us-east-1 and eu-west-1. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the routing topology so that traffic between all VPCs and the on-premises network flows through a central hub. They need a service that can manage many VPC attachments and provide transitive routing across all connected networks. Which AWS service should the network team use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks via a single gateway, enabling transitive routing between all attached networks. It supports many VPC attachments (up to thousands per gateway) and simplifies routing topology by eliminating the need for complex peering or VPN mesh configurations. This directly meets the requirement for a service that manages many VPC attachments and provides transitive routing across all connected networks.

Answer

Amazon Route 53

Answer

AWS Direct Connect Gateway

Answer

AWS PrivateLink

Question 12

A company runs an e-commerce application using Amazon RDS for MySQL. The database stores order and customer information. To achieve high availability, the company configures a Multi-AZ deployment. Which of the following describes a benefit of this configuration?

Accepted Answer

It automatically fails over to a standby instance in a different Availability Zone if the primary instance fails.. Option B is correct because a Multi-AZ deployment for Amazon RDS automatically synchronously replicates data to a standby instance in a different Availability Zone. If the primary instance fails (due to hardware failure, AZ outage, or patching), Amazon RDS automatically performs a failover to the standby, promoting it to become the new primary. This provides high availability by minimizing downtime without requiring manual intervention.

Answer

It automatically scales the database read capacity to handle traffic spikes.

Answer

It creates read replicas in multiple Regions to reduce latency for global users.

Answer

It encrypts data at rest using AWS KMS without any additional configuration.

Question 13

A company stores sensitive documents in Amazon S3. The security team wants a preventive control that ensures no S3 bucket in the AWS account can ever be configured with a bucket policy that grants public read or write access. This control must apply automatically to all newly created buckets and to existing buckets, without requiring changes to individual bucket policies. Which AWS feature should the security team use?

Accepted Answer

Amazon S3 Block Public Access at the account level. Amazon S3 Block Public Access at the account level is a preventive control that, when enabled, overrides any bucket policies or ACLs that would grant public read or write access. It applies automatically to all existing and newly created buckets in the account without requiring changes to individual bucket policies. This meets the security team's requirement for a blanket, account-wide preventive control.

Answer

AWS Config with the s3-bucket-public-read-prohibited managed rule

Answer

AWS Identity and Access Management (IAM) policy with a condition that denies s3:PutBucketPolicy for any action that grants public access

Answer

Amazon GuardDuty with a finding suppression rule for S3 public access events

Question 14

A company runs a multi-tier web application on Amazon EC2 instances. The security team wants to continuously monitor the configuration of the EC2 security groups to ensure that no security group allows inbound SSH (port 22) access from the entire internet (0.0.0.0/0). If a security group is modified to allow such access, the company must be automatically notified and provided with a detailed record of the change, including the user who made the change. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule to check for unrestricted SSH access, and Amazon Simple Notification Service (Amazon SNS) to send notifications when the rule is non-compliant.. AWS Config continuously monitors the configuration of AWS resources, including security groups, and can evaluate them against managed rules such as 'restricted-ssh' (which checks that inbound SSH traffic is not allowed from 0.0.0.0/0). When a security group becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the security team, and the detailed configuration history (including the user who made the change via CloudTrail integration) is available in the AWS Config timeline. This combination directly meets the requirements for continuous monitoring, automatic notification, and a detailed record of the change.

Answer

AWS CloudTrail to log all API calls, and Amazon CloudWatch Logs to analyze the logs for security group modifications and trigger a notification.

Answer

AWS Trusted Advisor to check for security groups with unrestricted SSH access on a periodic basis, and Amazon Simple Email Service (Amazon SES) to send email alerts.

Answer

AWS Systems Manager Inventory to collect configuration data from EC2 instances, and Amazon CloudWatch Events to trigger a Lambda function that checks security group rules.

Question 15

A company needs to run a data processing job that typically takes 2 hours to complete. The job is stateless and can be parallelized across multiple workers. The company wants to minimize operational overhead and only pay for the compute time consumed. The job runs only once a month. Which AWS compute service should the company use?

Accepted Answer

AWS Batch. AWS Batch is the correct choice because it is designed for running batch computing workloads that are stateless, parallelizable, and can run on a schedule. It automatically provisions and manages the underlying compute resources (EC2 or Fargate), scales to the required number of workers, and only charges for the compute time consumed. The 2-hour, once-a-month job fits perfectly within AWS Batch's capabilities, and it minimizes operational overhead by handling job queuing, retries, and dependency management.

Answer

AWS Lambda

Answer

Amazon EC2 Spot Instances

Answer

AWS Fargate

Question 16

A company runs a monthly data processing job that requires 100 Amazon EC2 instances to complete within 4 hours. The job is not needed at any other time. The company previously ran this job on its on-premises servers, which required maintaining enough capacity to handle the peak load year-round, leading to low average utilization. The company has now migrated the job to AWS. Each month, the company automatically provisions the 100 instances, runs the job, and then terminates the instances. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Rapid elasticity. This scenario best illustrates rapid elasticity because the company provisions 100 EC2 instances only when needed for the monthly job, scaling up from zero to 100 instances in minutes and then scaling back down to zero after the job completes. Rapid elasticity allows cloud resources to be quickly scaled out (increased) and scaled in (decreased) to match demand, eliminating the need to maintain idle capacity for peak loads.

Answer

Resource pooling

Answer

Measured service

Answer

On-demand self-service

Question 17

A company runs a critical e-commerce application that uses an Amazon RDS for MySQL database deployed in a single Availability Zone. The company needs to ensure that the database remains available if the underlying hardware or the entire Availability Zone fails. The solution must provide automatic failover with minimal downtime and must not require any changes to the application's database connection string. Which Amazon RDS feature should the company use to meet these requirements?

Accepted Answer

Configure a Multi-AZ deployment for the Amazon RDS database instance. Option D is correct because a Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, and the DNS record for the database endpoint is updated to point to the standby, so the application's connection string remains unchanged. This provides automatic failover with minimal downtime without requiring any manual intervention or application changes.

Answer

Deploy a Read Replica in another Availability Zone and configure the application to use it as a failover target

Answer

Enable automated backups with point-in-time recovery

Answer

Manually provision a standby database instance in another Availability Zone and configure a custom failover script

Question 18

A company stores sensitive financial data in Amazon S3 and must encrypt it at rest. The compliance team mandates that the encryption key must be rotated at least once per year, and the key material must be generated and managed by the company within AWS. The company wants a fully automated solution that requires no manual intervention for key rotation. Which AWS service or feature should the company use?

Accepted Answer

Create an AWS KMS customer managed key and enable automatic annual rotation.. Option B is correct because AWS KMS customer managed keys support automatic annual rotation, which satisfies the compliance requirement for key rotation without manual intervention. The company retains control over the key material since it is generated and managed within AWS KMS, meeting the mandate that the company manages the keys within AWS.

Answer

Use Amazon S3 server-side encryption with customer-provided encryption keys (SSE-C).

Answer

Use an AWS KMS AWS managed key (aws/s3) which automatically rotates the key every year.

Answer

Use AWS CloudHSM to generate and manage the key, and implement a custom cron job to rotate the key.

Question 19

A company runs a business-critical workload on AWS. The workload must have a 15-minute response time from AWS Support if it becomes unavailable. Additionally, the company wants a dedicated technical account manager (TAM) who will proactively review the architecture and provide best practice recommendations. Which AWS Support plan should the company choose?

Accepted Answer

Enterprise Support. The Enterprise Support plan is the only AWS Support plan that provides a 15-minute response time for business-critical workloads and includes a dedicated Technical Account Manager (TAM). The TAM proactively reviews the architecture and offers best practice recommendations, which directly matches the company's requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Business Support

Question 20

A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It supports automatic rotation every 90 days for Amazon RDS, Aurora, Redshift, and DocumentDB with built-in Lambda rotation functions, and it integrates with IAM for fine-grained access control via resource-based and identity-based policies.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)