CLF-C02 Practice Exam 61 — 20 Questions

Question 1

A company runs a set of Amazon EC2 instances that handle a consistent, predictable workload 24 hours a day, 7 days a week. The company expects to continue running this workload for the next three years. The finance team wants to minimize the total cost of these EC2 instances while maintaining flexibility to change instance families if needed. Which AWS pricing option should the company choose to meet these requirements?

Accepted Answer

Compute Savings Plans (3-year, all upfront). Compute Savings Plans (3-year, all upfront) provide the highest discount (up to 66%) for consistent, predictable workloads running 24/7 for three years, and they offer flexibility to change instance families, operating systems, or regions within the compute scope. This matches the requirement to minimize cost while maintaining the ability to switch instance families.

Answer

On-Demand instances

Answer

EC2 Instance Savings Plans (1-year, no upfront)

Answer

Spot Instances

Question 2

A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is a managed service that automates the process of patching managed nodes with both security-related and other types of updates. It can be configured to run on a schedule (e.g., every Tuesday at 2 AM) using a Systems Manager maintenance window, and it generates compliance reports via Systems Manager Inventory and Compliance. Patch Manager works without requiring SSH or RDP access because it uses the AWS Systems Manager Agent (SSM Agent), which is pre-installed on many Amazon EC2 AMIs and can be installed without interactive logon, and it does not require custom agents beyond the SSM Agent itself.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS OpsWorks

Question 3

A company runs a monthly batch data analytics job that requires 50 compute instances for exactly 2 hours. On AWS, the company launches 50 Amazon EC2 instances, runs the job, and then terminates all instances. The company's AWS bill shows a charge for only 100 instance-hours (50 instances × 2 hours). Which essential characteristic of cloud computing does this billing model best demonstrate?

Accepted Answer

Measured service. The billing model charges only for the actual compute time consumed (100 instance-hours), which is a direct application of the 'measured service' characteristic. Measured service means cloud providers meter and bill customers based on actual resource usage (e.g., EC2 instance-hours, storage GB-months), enabling pay-as-you-go pricing. In this scenario, the company is charged precisely for the 50 instances × 2 hours of runtime, with no upfront or fixed costs, demonstrating usage-based metering.

Answer

Resource pooling

Answer

On-demand self-service

Answer

Rapid elasticity

Question 4

A company runs a data processing job once per month. The job takes approximately 3 hours to complete when run on a single server. The company wants to minimize operational overhead and pay only for the compute time used during the job. The job does not require user interaction and must be able to automatically retry if a task fails. Which AWS service should the company use?

Accepted Answer

AWS Batch. AWS Batch is designed for batch computing workloads that run to completion without user interaction. It automatically provisions the necessary compute resources (e.g., EC2 instances or Fargate), scales them to zero when idle, and provides built-in retry logic for failed tasks. This matches the requirement of a monthly 3-hour job with minimal operational overhead and pay-per-use billing.

Answer

AWS Lambda

Answer

Amazon EC2

Answer

AWS Elastic Beanstalk

Question 5

A company runs a multi-tier web application on Amazon EC2 instances across multiple Availability Zones. The application has separate backend services for serving images and handling API requests, each running on different sets of EC2 instances. The company needs a load balancer that can inspect incoming HTTP/HTTPS requests and route them to the correct target group based on the URL path (e.g., /images to one group, /api to another). The solution must also offload SSL/TLS termination and perform health checks on the instances. Which AWS service should the company use?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model, allowing it to inspect HTTP/HTTPS headers and route traffic based on URL path patterns (e.g., /images vs /api). It natively supports SSL/TLS termination and can perform health checks on target instances, making it the correct choice for this multi-tier web application.

Answer

Network Load Balancer

Answer

Classic Load Balancer

Answer

AWS CloudFront

Question 6

A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized dashboard that aggregates findings from multiple AWS security services, including GuardDuty, Inspector, and Macie. It also offers a consolidated security score and supports automated compliance checks against standards like CIS AWS Foundations, making it the ideal choice for this use case.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 7

A company uses AWS Organizations to manage multiple accounts. The finance team needs to perform a detailed cost analysis by joining AWS usage data with their internal accounting system. They require hourly-level billing data that includes resource IDs, operation types, and cost allocation tags. The data must be available in a CSV file that can be imported into their financial software. Which AWS tool or service should the finance team use to meet this requirement?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the correct choice because it provides the most granular billing data available, including hourly-level usage, resource IDs, operation types, and cost allocation tags. The report can be delivered to an Amazon S3 bucket in CSV format, making it directly importable into the finance team's financial software for detailed cost analysis.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 8

A company stores sensitive audit reports in an Amazon S3 bucket. An external auditor needs to download a specific report for a compliance review. The auditor does not have an AWS account and will only need access for 48 hours. The company wants to provide a secure, time-limited link that allows the auditor to download the file directly from S3 without making the bucket public or requiring the auditor to authenticate with AWS. Which AWS feature should the company use to meet these requirements?

Accepted Answer

S3 presigned URL generated with a 48-hour expiration. An S3 presigned URL allows the company to grant temporary, time-limited access to a specific object in a private S3 bucket without requiring the auditor to have AWS credentials. By generating the URL with a 48-hour expiration, the company meets the exact requirement for secure, time-bound access. The auditor can download the file directly via HTTPS using the presigned URL, which embeds the necessary authentication information.

Answer

S3 bucket policy with a condition that restricts access by IP address

Answer

IAM role with cross-account access for the auditor's AWS account

Answer

CloudFront signed URL using a trusted key group

Question 9

A company runs a production workload on AWS and needs technical support that includes phone and email access with a response time of less than 1 hour for critical system failures. The company also wants architectural guidance for cost optimization and performance improvement. The company currently has an AWS account with the Basic Support plan. Which AWS Support plan should the company choose to meet these requirements at the most cost-effective price?

Accepted Answer

Business Support. The Business Support plan is the most cost-effective option that provides phone and email support with a response time of under 1 hour for critical system failures, along with architectural guidance for cost optimization and performance improvement. The Basic and Developer plans lack phone support and the required response time SLA, while the Enterprise plan offers additional features (e.g., a Technical Account Manager) that are not needed here, making it more expensive than necessary.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise Support

Question 10

A company uses Amazon EC2 instances and Amazon S3 for its workloads. The finance team reviews the monthly AWS bill and notices it includes line items for EC2 instance hours, data transfer out from EC2, and S3 storage usage. The bill shows exactly how many hours each instance ran and how much data was transferred. The company uses this detailed usage data to allocate costs to different departments and to optimize resource utilization. This scenario best demonstrates which essential characteristic of cloud computing?

Accepted Answer

Measured service. The correct answer is A (Measured service) because the scenario explicitly describes how the company uses detailed usage data—EC2 instance hours, data transfer out, and S3 storage—to allocate costs and optimize resource utilization. This aligns with the cloud computing characteristic where resource usage is metered, monitored, and reported transparently, enabling pay-per-use billing and cost allocation.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 11

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Accepted Answer

Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag.. Option C is correct because the condition key 'aws:PrincipalTag' in an IAM policy allows you to control access based on tags attached to the IAM principal (the role). By adding a condition that requires 'aws:PrincipalTag/Environment' to equal 'Production', the 'kms:Decrypt' permission is only effective when the IAM role has that specific tag. This directly enforces the security team's requirement at the IAM policy level, which is the appropriate place to restrict permissions based on principal attributes.

Answer

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Answer

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Answer

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Question 12

A company runs a fleet of production Amazon EC2 instances that operate 24/7 throughout the year. The CFO wants to reduce compute costs by committing to a consistent usage level. The finance team needs a tool that analyzes the company's historical EC2 usage and provides recommendations for the most cost-effective purchase options, including recommendations for both Reserved Instances and Savings Plans, with support for instance size flexibility. Which AWS tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a comprehensive analysis of historical EC2 usage and generates tailored recommendations for both Reserved Instances (RI) and Savings Plans, including support for instance size flexibility. This directly meets the CFO's requirement to commit to a consistent usage level while optimizing costs based on actual usage patterns.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Pricing Calculator

Question 13

A company uses AWS Organizations with multiple accounts for different departments (Engineering, Marketing, Sales). The finance team needs to create detailed monthly chargeback reports showing each department's usage and costs, broken down by service (e.g., Amazon EC2, Amazon S3) and by custom tags (e.g., Project). The reports must be in a machine-readable format (CSV) so they can be ingested into the company's internal billing system. The team wants the most comprehensive, granular cost data available from AWS, including line items for individual resources. Which AWS tool should the finance team configure to meet these requirements?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the correct choice because it provides the most comprehensive, granular cost data available, including line items for individual resources broken down by service, custom tags, and time period. It can be delivered to an Amazon S3 bucket in CSV format, which is machine-readable and suitable for ingestion into the company's internal billing system for detailed monthly chargeback reports.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

Consolidated Billing

Question 14

A company runs a stateless web application on a single Amazon EC2 instance in the us-east-1a Availability Zone. The application stores session data in an external Amazon ElastiCache cluster. Due to a power failure in the data center hosting us-east-1a, the EC2 instance becomes unavailable. The company wants to redesign the architecture so that the application recovers automatically in minutes if a single Availability Zone fails. Which design principle should the company implement?

Accepted Answer

Place the EC2 instance in an Auto Scaling group with a minimum capacity of 1, and configure the Auto Scaling group to span multiple Availability Zones.. Option B is correct because placing the EC2 instance in an Auto Scaling group with a minimum capacity of 1 and spanning multiple Availability Zones ensures that if us-east-1a fails, the Auto Scaling group automatically launches a new instance in a healthy Availability Zone (e.g., us-east-1b). Since the application is stateless and session data is stored externally in ElastiCache, the new instance can immediately serve traffic without data loss, achieving recovery within minutes.

Answer

Deploy the application across multiple AWS Regions and use Amazon Route 53 latency-based routing to failover.

Answer

Use a larger EC2 instance type with dedicated tenancy to reduce the risk of hardware failure.

Answer

Enable termination protection on the EC2 instance to prevent accidental stopping.

Question 15

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum available permissions for all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action when the request includes a public IP address assignment (using the ec2:AssociatePublicIpAddress condition key), you can prevent any EC2 instance from being launched with a public IPv4 address. This control applies automatically to all existing and future member accounts without requiring per-account configuration.

Answer

AWS Config rule with an automatic remediation action that terminates the instance after launch

Answer

IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned

Answer

AWS Firewall Manager security group policy

Question 16

A development team is building a serverless application that processes image uploads to Amazon S3. The application needs to automatically generate a thumbnail version of each uploaded image and store it in a separate S3 bucket. The team wants to minimize operational overhead and only pay for the compute time used during thumbnail generation. Which AWS service should the team use to execute the thumbnail generation code in response to S3 upload events?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that can be triggered directly by S3 events (e.g., s3:ObjectCreated:*). This allows the thumbnail generation code to run automatically in response to each image upload, with no servers to manage and billing based only on the compute time consumed during execution.

Answer

Amazon EC2 Auto Scaling group

Answer

Amazon ECS with Fargate

Answer

Amazon Elastic Beanstalk

Question 17

A company uses Amazon S3 to store raw data files for a data analytics platform. The company requires that files remain immediately accessible for the first 30 days after upload. After 30 days, files must be automatically moved to a lower-cost storage class for archival access. After 7 years, files must be automatically deleted. The company wants to implement this data management strategy with minimal ongoing effort. Which AWS S3 feature should the company use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Glacier Deep Archive) and expire (delete) objects based on object age. This directly meets the requirement to keep files immediately accessible for 30 days, move them to a lower-cost archival class after 30 days, and delete them after 7 years, all with minimal ongoing effort.

Answer

S3 Intelligent-Tiering

Answer

S3 Object Lock

Answer

S3 Versioning

Question 18

A company uses AWS Organizations with separate accounts for development, testing, and production. The finance team wants to track monthly spending by internal project, but a single project may use resources across multiple accounts. The team has applied a 'Project' tag to all resources. They need a detailed billing report that shows costs grouped by this Project tag, combining data from all accounts. Which AWS feature should they enable to meet this requirement?

Accepted Answer

AWS Cost and Usage Reports with cost allocation tags activated. AWS Cost and Usage Reports (CUR) with cost allocation tags activated is the correct choice because it provides the most detailed billing data, including all tags, and can be delivered to an S3 bucket for analysis. This allows the finance team to group costs by the 'Project' tag across all accounts in the AWS Organization, meeting the requirement for a detailed, combined report.

Answer

AWS Consolidated Billing

Answer

AWS Cost Explorer with tag filtering

Answer

AWS Budgets with tag-based alerts

Question 19

A financial services company must keep customer financial records on-premises to comply with data residency regulations. The company wants to use AWS services such as Amazon SageMaker and Amazon Athena to run analytics on anonymized subsets of the data. The company establishes a dedicated AWS Direct Connect connection between its on-premises data center and its VPC, and uses AWS Storage Gateway to cache frequently accessed data locally while storing all data in Amazon S3. Which cloud deployment model does this architecture represent?

Accepted Answer

Hybrid cloud. This architecture combines on-premises infrastructure (customer data center with AWS Storage Gateway caching) with AWS cloud services (SageMaker, Athena, S3) connected via AWS Direct Connect, which is the defining characteristic of a hybrid cloud deployment. A hybrid cloud model integrates private on-premises resources with public cloud services, allowing data to remain on-premises for compliance while leveraging cloud analytics.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 20

A company uses AWS Organizations to manage multiple AWS accounts. The security team must ensure that all API activity across all accounts, including any new accounts added in the future, is recorded and delivered to a centralized S3 bucket for auditing. The solution should require minimal ongoing manual effort. Which AWS feature should the security team use?

Accepted Answer

Create an AWS CloudTrail organization trail that logs events for all accounts in the organization.. Option B is correct because AWS CloudTrail organization trails automatically log events for all accounts in an AWS Organization, including any new accounts added in the future, and deliver them to a single S3 bucket without requiring per-account configuration. This satisfies the requirement for minimal ongoing manual effort and centralized auditing.

Answer

Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

Answer

Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

Answer

Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.