CLF-C02 Practice Exam 61 — 20 Questions

Question 1

A financial services company is preparing for an annual third-party audit. The auditor has requested a copy of the AWS SOC 2 Type II report to evaluate the security controls of the AWS infrastructure. The company needs to retrieve the report as quickly as possible without raising a support ticket. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications, without needing to open a support ticket. The auditor's request for a SOC 2 Type II report is exactly the use case AWS Artifact is designed for, allowing the company to download the report immediately from the AWS Management Console or via the AWS CLI.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 2

A company manages a fleet of hundreds of Amazon EC2 instances running across multiple AWS Regions. The company's security policy requires that all instances be patched with the latest security updates within 7 days of release. The operations team currently logs in to each instance manually to apply patches, which is time-consuming and error-prone. The team wants to automate the patching process, track compliance across all instances, and receive reports on patch status. The solution must not require any changes to the existing application code or the use of additional third-party software. Which AWS service should the operations team use to meet these requirements?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct choice because it provides Patch Manager, a native capability that automates the patching of EC2 instances across multiple Regions without requiring any changes to application code or third-party software. It also integrates with Systems Manager Compliance to track patch status and generate reports, meeting all stated requirements.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 3

A company's security team needs to run automated vulnerability scans on all Amazon EC2 instances in their production environment. They require a managed service that checks for common vulnerabilities and exposures (CVEs) and identifies insecure network configurations. The scans must be scheduled to run weekly and the results must be viewable in the AWS Management Console. Which AWS service should the team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is a managed vulnerability management service that automatically scans EC2 instances for software vulnerabilities (CVEs) and unintended network exposure. It supports scheduled recurring scans (e.g., weekly) and integrates with the AWS Management Console to display findings, making it the correct choice for the team's requirements.

Answer

AWS Shield

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 4

A company runs a critical web application on a single Amazon EC2 instance in a single Availability Zone. The company wants to design the architecture so that the application continues to operate even if the physical server hosting the instance fails. Which AWS Cloud concept does this design objective primarily address?

Accepted Answer

Fault tolerance. Fault tolerance is the correct concept because the design objective is to ensure continuous operation despite the failure of a physical server hosting the EC2 instance. This is achieved by deploying the application across multiple Availability Zones (AZs) using an Auto Scaling group and an Elastic Load Balancer, so that if one instance or AZ fails, traffic is automatically routed to healthy instances in another AZ. The scenario explicitly focuses on surviving infrastructure failure, which is the core definition of fault tolerance.

Answer

Elasticity

Answer

Scalability

Answer

Cost optimization

Question 5

A company manages multiple AWS accounts using AWS Organizations. The company has an on-premises Microsoft Active Directory (AD) that contains employee credentials and group memberships. The company wants to grant employees access to the AWS Management Console and command-line interface (CLI) using their existing AD credentials, without creating IAM users for each employee. Additionally, the company wants to centrally manage permissions across all accounts by assigning policies to AD groups. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (formerly AWS Single Sign-On) is the correct service because it allows centralized management of user access to multiple AWS accounts and applications using existing corporate credentials from Microsoft Active Directory. It supports federation with AD via SAML 2.0 or SCIM, enabling employees to sign in to the AWS Management Console and CLI without creating IAM users. Permissions can be assigned to AD groups through permission sets, which map to IAM roles, ensuring consistent policy enforcement across all accounts in AWS Organizations.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service for Microsoft Active Directory

Answer

AWS Resource Access Manager (AWS RAM)

Question 6

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Answer

AWS Directory Service

Answer

Amazon Cognito

Answer

AWS Control Tower

Question 7

A company runs a globally distributed web application on Amazon EC2 instances behind Network Load Balancers in two AWS Regions: us-east-1 and eu-west-1. Users around the world access the application over the internet. The company wants to improve latency for all users by directing each user to the nearest healthy application endpoint. Additionally, the company requires two static IP addresses that clients can use for firewall whitelisting and that do not change even if the underlying infrastructure changes. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it provides two static anycast IP addresses that serve as fixed entry points, and it directs user traffic to the nearest healthy application endpoint via the AWS global network, reducing latency. Unlike CloudFront, it does not cache content but optimizes TCP/UDP traffic, making it ideal for non-HTTP or dynamic applications behind Network Load Balancers.

Answer

Amazon CloudFront

Answer

Amazon Route 53 latency-based routing

Answer

AWS Direct Connect

Question 8

A consulting firm has a global team of consultants who frequently travel to client sites. The firm hosts its critical business applications on AWS. The consultants need to access these applications from various locations (hotels, airports, client offices) using a variety of devices, including company laptops, personal smartphones, and tablets. They connect using standard web browsers and internet connections. This ability to access the same cloud resources from anywhere using different devices is an example of which essential characteristic of cloud computing?

Accepted Answer

Broad network access. The scenario describes consultants accessing the same cloud-hosted applications from different locations (hotels, airports, client offices) using various devices (laptops, smartphones, tablets) over standard internet connections. This directly matches the 'broad network access' characteristic, which means resources are available over the network and can be accessed by heterogeneous client platforms (e.g., mobile phones, laptops, workstations) using standard protocols (HTTP/HTTPS, TLS).

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 9

Which AWS service makes it easy for developers to create, publish, and manage APIs that act as the front door for applications to access backend services?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is a fully managed service that enables developers to create, publish, maintain, monitor, and secure APIs at any scale. It acts as a front door for applications to access backend services such as AWS Lambda, Amazon EC2, or any publicly accessible web endpoint, handling all the tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls.

Answer

Amazon CloudFront

Answer

Elastic Load Balancing

Answer

AWS App Runner

Question 10

A media company hosts its website on Amazon EC2 instances in the us-east-1 Region. Static assets such as images, CSS, and JavaScript files are stored in an Amazon S3 bucket. Users across the globe report slow page load times due to high latency when fetching these assets. The company wants to deliver the static content with low latency and high transfer speeds to users worldwide, reduce the load on the EC2 instances, and add protection against common DDoS attacks. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static assets (images, CSS, JavaScript) at edge locations worldwide, reducing latency for global users. It offloads requests from the EC2 origin by serving cached content directly from the edge, and it integrates with AWS Shield Standard to provide automatic protection against common DDoS attacks. This directly addresses the company's requirements for low latency, reduced EC2 load, and DDoS protection.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

AWS WAF

Question 11

A media processing company runs multiple Amazon EC2 instances in different Availability Zones. All instances need to read and write to a shared file system simultaneously. The file system must be fully managed, automatically replicated across multiple Availability Zones for durability, and accessible by all instances using standard file access protocols. The company does not want to provision or manage any file servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) is a fully managed, scalable NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically replicates data across multiple AZs for durability and uses standard NFSv4.1 and NFSv4.0 protocols, meeting all requirements without any server provisioning or management.

Answer

Amazon S3

Answer

Amazon EBS Multi-Attach

Answer

Amazon FSx for Windows File Server

Question 12

Which cloud concept describes the ability of cloud services to remain operational even when individual components fail, through techniques like redundancy, replication, and automatic failover?

Accepted Answer

Fault tolerance. Fault tolerance is the correct answer because it directly refers to a system's ability to continue operating without interruption when one or more of its components fail. This is achieved through techniques such as redundancy (e.g., deploying multiple EC2 instances across Availability Zones), replication (e.g., synchronously replicating data in Amazon RDS Multi-AZ), and automatic failover (e.g., Route 53 health checks triggering a switch to a standby resource). The core goal is to eliminate single points of failure and maintain service availability despite underlying failures.

Answer

Scalability

Answer

Elasticity

Answer

Agility

Question 13

A company uses multiple AWS accounts and needs to perform granular cost and usage analysis using standard SQL queries. The cloud operations team requires the most detailed data possible, including resource-level attributes such as instance type, usage quantity, and cost allocation tags. This data must be automatically delivered to an Amazon S3 bucket on a daily basis for long-term retention and querying. Which AWS service should the company use to generate this dataset?

Accepted Answer

AWS Cost and Usage Report. AWS Cost and Usage Report (CUR) is the correct choice because it provides the most detailed cost and usage data available, including resource-level attributes like instance type, usage quantity, and cost allocation tags. It can be automatically delivered to an Amazon S3 bucket on a daily basis and supports querying with standard SQL via AWS Athena or Amazon Redshift Spectrum, meeting the requirements for granular analysis and long-term retention.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Pricing Calculator

Question 14

A company has a strict data residency policy that requires all customer data to remain stored on-premises at all times. However, the company experiences unpredictable spikes in compute demand and wants to use an AWS cloud environment to handle this additional workload during peak periods. The company needs a solution that allows them to seamlessly run applications across their on-premises infrastructure and AWS, using consistent management tools and APIs. The company also needs a dedicated, private network connection between the two environments for low latency and security. Which cloud deployment model best describes this architecture?

Accepted Answer

Hybrid cloud. The architecture described combines on-premises infrastructure with AWS cloud resources, connected via a dedicated private network (likely AWS Direct Connect or VPN), while using consistent management tools and APIs. This is the defining characteristic of a hybrid cloud model, which enables workload portability and unified operations across both environments.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 15

A company's IT director wants to present a business case for migrating from on-premises infrastructure to AWS. They need to compare the full cost of running on-premises (hardware, facilities, power, labour) against the cost of running equivalent workloads on AWS. Which AWS tool helps create this comparison?

Accepted Answer

AWS TCO Calculator. The AWS TCO (Total Cost of Ownership) Calculator is specifically designed to compare the full costs of running on-premises infrastructure (including hardware, facilities, power, and labor) against the equivalent costs on AWS. It generates a detailed side-by-side cost comparison report, helping IT directors build a business case for migration by quantifying potential savings.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 16

A gaming company operates a mobile game with millions of active users. The game stores player profiles and session state in a key-value database. The database must provide single-digit millisecond latency for read and write operations at any scale. The company expects traffic to grow unpredictably, and the database must scale horizontally without downtime. The company wants a fully managed, highly available solution with built-in replication across multiple Availability Zones. Which AWS service should the company use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed, serverless, NoSQL key-value database that delivers single-digit millisecond latency at any scale. It supports horizontal scaling via automatic partitioning and replication across multiple Availability Zones (AZs) for high availability, with no downtime required for scaling. This directly matches the gaming company's requirements for low-latency reads/writes, unpredictable traffic growth, and built-in multi-AZ replication.

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Redshift

Answer

Amazon ElastiCache for Redis

Question 17

Which AWS service provides an immutable, cryptographically verifiable transaction log for tracking the complete history of changes to application data?

Accepted Answer

Amazon QLDB (Quantum Ledger Database). Amazon QLDB (Quantum Ledger Database) provides an immutable, append-only journal that records every change to application data. It uses cryptographic hashing to chain entries together, creating a verifiable history that cannot be altered or deleted, which is exactly what the question describes.

Answer

Amazon Managed Blockchain

Answer

Amazon RDS with point-in-time recovery

Answer

AWS CloudTrail

Question 18

A company is developing a REST API that processes customer orders. The API receives JSON payloads via HTTPS and performs short-lived operations, such as data validation, transformation, and writing to a database. The workload is very unpredictable: sometimes there are long periods of inactivity, but during flash sales the API may receive thousands of requests per second for a few minutes. The company wants a fully managed compute service that automatically scales to handle any request volume, charges only for the compute time used during execution, and requires no server provisioning or ongoing infrastructure management. Which AWS service should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a fully managed, event-driven compute service that automatically scales from zero to thousands of concurrent executions in response to incoming HTTPS requests. It charges only for the compute time consumed during execution (in 1ms increments), requires no server provisioning, and is ideal for short-lived operations like data validation, transformation, and database writes. The unpredictable, bursty workload pattern—long idle periods followed by flash sales—maps perfectly to Lambda's pay-per-use model and automatic scaling.

Answer

Amazon EC2 with Auto Scaling

Answer

Amazon ECS with Fargate launch type

Answer

Amazon Lightsail

Question 19

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?

Accepted Answer

Managing database user accounts and controlling data access. Under the AWS Shared Responsibility Model, AWS manages the infrastructure, including the underlying EC2 instances, physical storage, and database engine minor version patches for Amazon RDS. The customer is responsible for managing database user accounts, controlling data access, and securing the data itself, as these are within the customer's control and not managed by AWS.

Answer

Patching the underlying EC2 instances hosting the database

Answer

Managing the physical storage media and hardware

Answer

Applying database engine minor version patches

Question 20

A company is building a real-time chat application that relies on long-lived WebSocket connections between clients and backend servers. The application runs on Amazon EC2 instances across multiple Availability Zones. The company needs a load balancer that can distribute incoming WebSocket traffic while preserving the connection and supporting sticky sessions. Which AWS load balancing solution should the company use?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) supports WebSocket connections natively at the application layer (Layer 7) and can maintain persistent connections via its built-in sticky session (session affinity) feature, which uses a cookie to bind a client to a specific target for the duration of the WebSocket session. This makes ALB the correct choice for a real-time chat application requiring long-lived WebSocket connections and sticky sessions across multiple Availability Zones.

Answer

Network Load Balancer

Answer

Classic Load Balancer

Answer

Amazon Route 53