CLF-C02 Practice Exam 62 — 20 Questions

Question 1

A company runs a critical web application on AWS behind an Application Load Balancer. The security team is concerned about the risk of Distributed Denial of Service (DDoS) attacks that could deplete application resources and incur high costs due to auto scaling. The company wants a managed service that provides enhanced DDoS detection, access to the AWS DDoS Response Team (DRT), and financial protection against scaling costs associated with DDoS attacks. Which AWS service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS detection and mitigation beyond what Shield Standard offers, includes 24/7 access to the AWS DDoS Response Team (DRT) for custom mitigations, and offers financial protection (cost protection) against scaling costs incurred due to DDoS attacks on resources like Application Load Balancers. This directly addresses the company's need for a managed service that covers detection, expert support, and cost coverage.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Firewall Manager

Question 2

A financial services company must keep customer financial records on-premises to comply with data residency regulations. The company wants to use AWS services such as Amazon SageMaker and Amazon Athena to run analytics on anonymized subsets of the data. The company establishes a dedicated AWS Direct Connect connection between its on-premises data center and its VPC, and uses AWS Storage Gateway to cache frequently accessed data locally while storing all data in Amazon S3. Which cloud deployment model does this architecture represent?

Accepted Answer

Hybrid cloud. This architecture combines on-premises infrastructure (customer data center with AWS Storage Gateway caching) with AWS cloud services (SageMaker, Athena, S3) connected via AWS Direct Connect, which is the defining characteristic of a hybrid cloud deployment. A hybrid cloud model integrates private on-premises resources with public cloud services, allowing data to remain on-premises for compliance while leveraging cloud analytics.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 3

A company hosts a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS), using a managed service that requires no underlying infrastructure management. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers and requires no underlying infrastructure management, making it the correct choice for this use case.

Answer

AWS Shield Advanced

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 4

A startup is migrating its infrastructure to AWS. The CTO notices that the hourly rate for an Amazon EC2 instance is significantly lower than the cost of purchasing and maintaining a comparable physical server in their own data center. The CTO explains that AWS can offer lower prices because it aggregates demand from thousands of customers and optimizes its data center operations. Which benefit of cloud computing does this scenario primarily illustrate?

Accepted Answer

Economies of scale. The scenario describes AWS aggregating demand from thousands of customers to optimize data center operations, which directly reduces per-unit costs. This is the definition of economies of scale, where larger operational scale leads to lower average costs. The CTO's observation that the hourly EC2 rate is lower than purchasing a physical server illustrates how cloud providers pass these savings to customers.

Answer

High availability

Answer

Elasticity

Answer

Global reach

Question 5

A company wants to ensure their containerized microservices can discover each other by name without hard-coding IP addresses. Which AWS service provides DNS-based service discovery for ECS and EKS?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that enables microservices to dynamically discover each other by name using DNS queries or API calls. It integrates directly with Amazon ECS and EKS, allowing containers to register and resolve service endpoints without hard-coded IP addresses, making it the correct choice for DNS-based service discovery.

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Answer

Amazon VPC

Question 6

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans (including CVEs) and network reachability assessments on EC2 instances. It uses a combination of AWS security best practices and common vulnerability databases to identify software vulnerabilities and unintended network access paths, such as open ports or overly permissive security groups.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Shield

Question 7

A company runs multiple workloads on AWS and must ensure that all Amazon S3 buckets have server-side encryption enabled. The compliance team wants to automatically detect any S3 bucket that is created without encryption and receive an alert. They also want to continuously monitor existing buckets for compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-side-encryption-enabled', which automatically checks whether each S3 bucket has server-side encryption enabled. When a non-compliant bucket is detected (either newly created or existing), AWS Config can trigger an Amazon SNS notification to alert the compliance team, meeting both the detection and alerting requirements.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 8

A company's development team frequently needs temporary test environments. A developer can log into the AWS Management Console, select an Amazon EC2 instance type, configure storage, and launch the instance within minutes without any interaction with the IT infrastructure team. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes a developer independently provisioning EC2 instances without requiring IT intervention. This directly matches the 'on-demand self-service' characteristic of cloud computing, where users can provision computing resources as needed automatically, without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 9

A company uses AWS for multiple workloads across several linked accounts under AWS Organizations. The finance team needs to analyze historical cost and usage data to identify monthly spending trends by service (e.g., Amazon EC2, Amazon S3) and by linked account. They also need to filter the data by date range and view the top cost drivers. The team prefers a built-in AWS tool that provides an interactive interface with graphs and tables, without requiring them to download or process raw data. Which AWS service or tool should the finance team use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the correct choice because it provides a built-in, interactive interface with pre-built graphs and tables that allow the finance team to analyze historical cost and usage data without downloading or processing raw data. It supports filtering by service (e.g., Amazon EC2, Amazon S3), linked account, and date range, and can identify top cost drivers through customizable views and filtering options.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Reports

Question 10

A company stores compliance logs in Amazon S3. After 90 days, logs are never accessed again but must be retained for 7 years to meet regulatory requirements. Which S3 storage class provides the lowest storage cost for this long-term archival requirement?

Accepted Answer

S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is designed for long-term retention of data that is accessed extremely rarely, with a retrieval time of 12 hours or more. It offers the lowest storage cost among all S3 storage classes, making it the most cost-effective choice for compliance logs that must be retained for 7 years but are never accessed after 90 days.

Answer

S3 Standard

Answer

S3 Standard-IA

Answer

S3 Glacier Flexible Retrieval

Question 11

A company runs a web application that processes customer orders. During flash sales, the application's backend servers become overwhelmed because orders are submitted faster than they can be processed. The company needs a fully managed, highly available service that can buffer incoming orders so that the backend can process them at its own pace without losing any data. The service must automatically scale to handle any volume of orders without requiring manual provisioning. Which AWS service meets these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is a fully managed, highly available message queuing service that decouples application components. It buffers incoming orders by storing them in a queue, allowing the backend to process messages at its own pace without losing data. SQS automatically scales to handle any volume of messages, eliminating the need for manual provisioning.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 12

A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is a managed service that automates the process of patching managed nodes with both security-related and other types of updates. It can be configured to run on a schedule (e.g., every Tuesday at 2 AM) using a Systems Manager maintenance window, and it generates compliance reports via Systems Manager Inventory and Compliance. Patch Manager works without requiring SSH or RDP access because it uses the AWS Systems Manager Agent (SSM Agent), which is pre-installed on many Amazon EC2 AMIs and can be installed without interactive logon, and it does not require custom agents beyond the SSM Agent itself.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS OpsWorks

Question 13

A company's marketing team needs a temporary compute environment to run a one-week data analysis for a campaign. The developer uses the AWS CLI to automatically provision an Amazon EC2 instance and an Amazon RDS database without any manual approval or interaction from the AWS support team. This ability to provision resources automatically without requiring human interaction from the cloud provider best demonstrates which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes a developer using the AWS CLI to provision an EC2 instance and an RDS database without any manual approval or interaction from AWS support. This ability to automatically obtain and configure computing resources as needed, without requiring human intervention from the provider, is the defining characteristic of on-demand self-service. It allows users to provision and manage resources through a self-service interface (like the AWS Management Console, CLI, or SDKs) at any time, without needing to submit a request to AWS staff.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 14

A company is designing a critical web application that must remain available even if an entire data center goes offline due to a power outage. The application will run on Amazon EC2 instances in the us-east-1 Region. Which AWS infrastructure strategy should the company use to meet this high-availability requirement?

Accepted Answer

Deploy the EC2 instances across two or more Availability Zones within the us-east-1 Region.. Deploying EC2 instances across two or more Availability Zones (AZs) within a single AWS Region protects against an entire data center failure. Each AZ is physically separated, with independent power, cooling, and networking, so if one AZ goes offline, the application continues running in the other AZs. This design meets the high-availability requirement without the complexity and latency of multi-Region deployment.

Answer

Launch all EC2 instances in a single Availability Zone to ensure low latency between instances.

Answer

Deploy the EC2 instances in multiple AWS Regions, such as us-east-1 and eu-west-1.

Answer

Use separate AWS accounts for each EC2 instance to isolate the workload from a data center failure.

Question 15

A company's sales team uses a cloud-based CRM application. Sales representatives access the CRM from their laptops in the office, from tablets at customer sites, and from their smartphones while traveling, all over the internet. The application works consistently across all devices without requiring any custom client software on each device. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes sales representatives accessing the CRM application from laptops, tablets, and smartphones over the internet without needing custom client software. This directly illustrates broad network access, which is the cloud computing characteristic that resources are available over the network and can be accessed by standard mechanisms (e.g., HTTPS, REST APIs) from a wide range of heterogeneous client platforms (e.g., mobile phones, tablets, laptops). The consistent experience across devices without custom software is the hallmark of broad network access.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 16

A company uses AWS to host its web application. The company's IT manager learns that multiple AWS customers may have virtual machines running on the same physical server within an AWS data center. However, the manager is confident that each customer's data is securely isolated from others and that customers have no visibility into or control over the underlying physical infrastructure. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes the cloud characteristic where the provider's computing resources (such as physical servers) are pooled to serve multiple customers using a multi-tenant model. AWS uses hypervisor-based isolation (e.g., Xen or Nitro) to ensure that each customer's virtual machine has no visibility into or control over the underlying physical hardware or other tenants' workloads, while still sharing the same physical server. This directly matches the scenario's description of multiple customers running VMs on the same physical host with secure isolation.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Measured service

Question 17

A startup is considering moving its infrastructure to AWS. The CTO explains that AWS can offer lower pay-as-you-go prices than what the startup would pay for equivalent on-premises hardware because AWS aggregates usage from millions of customers. Which benefit of the AWS Cloud does this scenario describe?

Accepted Answer

Economies of scale. The scenario describes economies of scale, a core AWS Cloud benefit where AWS aggregates compute and storage usage from millions of customers, allowing it to purchase hardware in bulk at significantly lower per-unit costs. These savings are passed on to customers as lower pay-as-you-go prices compared to what a startup would pay for equivalent on-premises hardware. This is a fundamental economic advantage of cloud computing, distinct from operational benefits like elasticity or high availability.

Answer

Elasticity

Answer

High availability

Answer

Global reach

Question 18

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Answer

AWS Directory Service

Answer

Amazon Cognito

Answer

AWS Control Tower

Question 19

A company runs a retail website on AWS. During a promotional event, the website's traffic spikes from 1,000 concurrent users to 100,000 concurrent users in under 5 minutes. The AWS infrastructure automatically provisions additional Amazon EC2 instances to handle the increased load and terminates them when the event ends. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Rapid elasticity. The scenario describes the automatic scaling of EC2 instances from 1,000 to 100,000 concurrent users in under 5 minutes, and then terminating them when the event ends. This directly demonstrates rapid elasticity, which is the ability to provision and release cloud resources quickly and automatically in response to demand, a core characteristic defined by the NIST SP 800-145 standard.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 20

A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?

Accepted Answer

AWS App Mesh. AWS App Mesh is a service mesh that provides application-level networking, enabling microservices to communicate securely with mutual TLS (mTLS) and offering observability through metrics, logs, and traces. It integrates with AWS services like AWS X-Ray and Amazon CloudWatch to track network traffic between services, making it the correct choice for this requirement.

Answer

Amazon VPC with security groups

Answer

Amazon API Gateway

Answer

AWS Transit Gateway