CLF-C02 Practice Exam 62 — 20 Questions

Question 1

A company stores sensitive documents in Amazon S3. The security team wants a preventive control that ensures no S3 bucket in the AWS account can ever be configured with a bucket policy that grants public read or write access. This control must apply automatically to all newly created buckets and to existing buckets, without requiring changes to individual bucket policies. Which AWS feature should the security team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 Block Public Access at the account level. Amazon S3 Block Public Access at the account level is a preventive control that, when enabled, overrides any bucket policies or ACLs that would grant public read or write access. It applies automatically to all existing and newly created buckets in the account without requiring changes to individual bucket policies. This meets the security team's requirement for a blanket, account-wide preventive control.

Answer

AWS Config with the s3-bucket-public-read-prohibited managed rule

Answer

AWS Identity and Access Management (IAM) policy with a condition that denies s3:PutBucketPolicy for any action that grants public access

Answer

Amazon GuardDuty with a finding suppression rule for S3 public access events

Question 2

A company wants to implement a serverless web application with no server management. They need a database that scales automatically without managing cluster capacity. Which combination best supports this?

Accepted Answer

AWS Lambda + API Gateway + Amazon DynamoDB on-demand. AWS Lambda + API Gateway + Amazon DynamoDB on-demand provides a fully serverless architecture where Lambda handles compute without server management, API Gateway serves as the HTTP endpoint, and DynamoDB on-demand scales automatically based on traffic without requiring capacity planning or cluster management. This combination meets the requirement for zero server management and automatic scaling of the database.

Answer

Amazon EC2 + RDS MySQL

Answer

AWS Fargate + Amazon Aurora Serverless

Answer

Amazon EC2 + DynamoDB on-demand

Question 3

A company runs an e-commerce platform on Amazon EC2 instances in a single AWS Region. The company wants to ensure that the platform remains available even if a natural disaster disrupts the entire geographic area of that Region. Which approach should the company take to meet this requirement?

Accepted Answer

Deploy the application across multiple AWS Regions.. Deploying the application across multiple AWS Regions ensures fault tolerance and disaster recovery even if an entire geographic area is disrupted. A natural disaster affecting a single Region would impact all Availability Zones within that Region, so multi-Region deployment is the only approach that provides geographic isolation and continuous availability.

Answer

Deploy the application across multiple Availability Zones within the same Region.

Answer

Deploy the application across multiple Edge Locations of Amazon CloudFront.

Answer

Deploy the application on a larger instance type within the same Availability Zone.

Question 4

A financial institution has regulatory requirements to store sensitive customer data on-premises in its own data center. However, it wants to use AWS for compute-intensive analytics that need to access this data. The company plans to establish a dedicated, encrypted network connection between its data center and AWS. Which cloud deployment model does this scenario describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud deployment model because it combines on-premises infrastructure (the financial institution's own data center for storing sensitive customer data) with AWS public cloud resources (for compute-intensive analytics). The dedicated, encrypted network connection (such as AWS Direct Connect with IPSec or a VPN) securely bridges the two environments, allowing data to be accessed from AWS without being stored there, which meets regulatory requirements. Hybrid cloud is defined as a mixed computing environment where on-premises and public cloud resources are orchestrated together, often via a private network link.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 5

Which AWS service enables you to run containerized applications without managing the underlying servers?

Accepted Answer

AWS Fargate. AWS Fargate is a serverless compute engine for containers that allows you to run containers without managing the underlying servers or clusters. You define your container images, CPU, memory, and networking, and Fargate automatically handles the infrastructure, including patching and scaling.

Answer

Amazon EC2 with Docker

Answer

AWS Lambda

Answer

Amazon EKS on EC2

Question 6

A development team is migrating a monolithic application to a microservices architecture. Each microservice will run in a separate container. The team wants to deploy and scale these containers without managing any underlying servers or clusters. The team also wants to pay only for the vCPU and memory resources consumed by each container, not for any idle capacity. Which AWS compute service should the team use?

Accepted Answer

AWS Fargate. AWS Fargate is the correct choice because it is a serverless compute engine for containers that allows you to run containers without managing any underlying servers or clusters. With Fargate, you pay only for the vCPU and memory resources consumed by each container, not for any idle capacity, which directly matches the team's requirements.

Answer

Amazon ECS with the EC2 launch type

Answer

Amazon EKS with managed node groups

Answer

AWS Lambda

Question 7

A company currently uses the AWS Basic Support plan. The CTO wants to access the complete set of AWS Trusted Advisor checks, including those related to cost optimization and performance. Additionally, the CTO requires a guaranteed response time of less than 15 minutes for critical business-impairing issues. Which AWS Support plan should the company choose to meet all of these requirements?

Accepted Answer

AWS Enterprise Support. The AWS Enterprise Support plan is the only plan that provides a guaranteed response time of less than 15 minutes for critical business-impairing issues. While both the Business and Enterprise Support plans include the full set of Trusted Advisor checks, only Enterprise meets the response time requirement. The Business Support plan offers a 1-hour response time for critical issues. The Developer Support plan has a 12-hour response time for critical issues and does not include the full set of Trusted Advisor checks. Basic Support has no technical support and limited Trusted Advisor checks.

Answer

AWS Business Support

Answer

AWS Developer Support

Answer

AWS Basic Support

Question 8

A company has an AWS Basic Support plan. The operations team wants to use AWS Trusted Advisor to receive recommendations for cost optimization, such as identifying idle load balancers and underutilized Amazon EC2 instances. They log into the AWS Management Console and navigate to Trusted Advisor, but they only see a limited set of checks, such as S3 bucket permissions and service limits. Which action should the team take to access the complete library of Trusted Advisor checks, including the cost optimization recommendations?

Accepted Answer

Upgrade to a Business or Enterprise Support plan.. AWS Trusted Advisor provides a full set of checks, including cost optimization recommendations (e.g., idle load balancers, underutilized EC2 instances), only to customers with a Business or Enterprise Support plan. The Basic Support plan restricts Trusted Advisor to a limited subset of checks, such as S3 bucket permissions and service limits. Therefore, upgrading to a Business or Enterprise Support plan is required to access the complete library of checks.

Answer

Enable AWS Config to perform the cost optimization and underutilization checks.

Answer

Upgrade to a Developer Support plan.

Answer

No action is needed; the full set of Trusted Advisor checks is already available for all AWS Support plans.

Question 9

A company needs 24/7 phone and chat access to AWS support engineers, full access to all AWS Trusted Advisor checks, and a response time of less than 1 hour for production system outages. Which is the minimum AWS Support plan that meets all these requirements?

Accepted Answer

Business Support. The Business Support plan is the minimum plan that provides 24/7 phone and chat access to AWS support engineers, full access to all AWS Trusted Advisor checks, and a response time of less than 1 hour for production system outages. The Basic and Developer plans lack 24/7 phone/chat and full Trusted Advisor checks, while the Enterprise On-Ramp plan offers these features but is not the minimum because Business Support already meets all requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Enterprise On-Ramp Support

Question 10

A company runs a containerized application on Amazon ECS using a mix of Amazon EC2 On-Demand instances from different instance families (e.g., M5, C5, R5). The workload is consistent, and the company is willing to commit to a 1-year term to reduce costs. However, the team expects to change instance families within the next 12 months due to new hardware requirements and wants the flexibility to switch instance families without incurring a financial penalty. Which pricing option best meets these requirements?

Accepted Answer

Compute Savings Plans. Compute Savings Plans provide the most flexibility by applying a discounted hourly commitment (e.g., $10/hour) across any EC2 instance family, region, OS, or tenancy, and also cover Fargate and Lambda usage. Since the company expects to change instance families within the 1-year term, Compute Savings Plans allow switching without penalty, unlike instance-specific plans.

Answer

EC2 Instance Savings Plans

Answer

Convertible Reserved Instances

Answer

Standard Reserved Instances

Question 11

A company is developing a web application that uses Node.js, Express, and a MySQL database. The development team wants to deploy the application to AWS without manually configuring Amazon EC2 instances, load balancers, or Auto Scaling groups. They want AWS to automatically manage the underlying infrastructure, monitor application health, and allow them to deploy new versions by simply uploading a zip file. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is the correct choice because it provides a Platform-as-a-Service (PaaS) offering that automatically handles the provisioning of EC2 instances, load balancers, and Auto Scaling groups based on the application's environment configuration. The team can upload a zip file containing their Node.js/Express application code, and Elastic Beanstalk will deploy it, monitor health via integrated CloudWatch alarms, and manage the underlying infrastructure without manual intervention.

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 12

A company wants to allow its developers to provision virtual servers in AWS without needing to submit a ticket to an IT administrator or wait for manual approval. The developers need to be able to spin up instances directly from the AWS Management Console, CLI, or SDKs, and the resources should be available immediately after the request is submitted. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning virtual servers directly from the AWS Management Console, CLI, or SDKs without manual intervention or approval. This aligns with the on-demand self-service characteristic of cloud computing, where users can provision computing resources automatically as needed without requiring human interaction with the service provider. The key is that the resources are available immediately after the request, which is the hallmark of self-service, not elasticity.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Question 13

A development team is building a web application and wants to minimize operational overhead. The team wants to focus solely on writing and deploying code without managing the underlying operating system, runtime, or middleware. The team needs the ability to simply upload their application code and have it run, with the cloud provider automatically handling capacity provisioning, load balancing, and patching of the platform. Which cloud computing service model best describes this approach?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it abstracts the underlying infrastructure, runtime, and middleware, allowing the team to simply upload code and have it executed. The cloud provider automatically handles capacity provisioning, load balancing, and patching, which directly matches the requirement to minimize operational overhead by focusing solely on code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 14

A company operates a social media analytics platform that runs on AWS. The platform experiences unpredictable traffic spikes during major events. The company wants to ensure that compute capacity automatically increases during these spikes without any manual intervention, and decreases when traffic subsides to avoid paying for idle resources. Which characteristic of cloud computing does this business requirement directly rely on?

Accepted Answer

Rapid elasticity. The requirement to automatically scale compute capacity up during traffic spikes and down when traffic subsides directly relies on rapid elasticity, a key characteristic of cloud computing defined by the NIST SP 800-145 standard. Rapid elasticity enables resources to be provisioned and released elastically, often automatically, to match demand at any scale, which is essential for handling unpredictable traffic on a social media analytics platform without manual intervention.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 15

A startup is designing a new application on AWS. They have selected specific Amazon EC2 instance types, Amazon EBS volumes, and estimated data transfer. The team wants to compare the monthly cost of running the application using On-Demand instances versus 1-year All Upfront Reserved Instances before they commit to any resources. Which AWS tool should they use to generate this cost estimate?

Accepted Answer

AWS Pricing Calculator. AWS Pricing Calculator (option C) is the correct tool because it allows users to estimate the monthly cost of AWS services, including EC2 instances, EBS volumes, and data transfer, before deployment. It supports comparing pricing models such as On-Demand and 1-year All Upfront Reserved Instances by letting you input specific instance types, storage, and transfer details to generate a detailed cost breakdown. This matches the startup's need to compare costs without committing to resources.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Question 16

A retail company uses Amazon EC2 Auto Scaling to automatically launch hundreds of EC2 instances when CPU utilization exceeds 70% during a flash sale. When traffic subsides, the Auto Scaling group terminates the excess instances. This ability to dynamically provision and release compute resources in response to changes in demand best demonstrates which fundamental characteristic of cloud computing?

Accepted Answer

Rapid elasticity. The scenario describes the ability to automatically scale compute resources up and down in response to real-time demand changes, which is the definition of rapid elasticity. In AWS, this is implemented through EC2 Auto Scaling, which dynamically launches or terminates instances based on CloudWatch alarms (e.g., CPU utilization > 70%). This on-demand provisioning and release of resources without manual intervention is a core characteristic of cloud computing as defined by NIST SP 800-145.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 17

A company is developing a microservices-based application using Docker containers. The development team wants to run these containers on AWS without having to provision or manage any servers. The solution must automatically scale the containers based on demand and integrate with an Application Load Balancer for traffic distribution. Which AWS service should the team use to meet these requirements?

Accepted Answer

AWS Fargate. AWS Fargate is the correct choice because it is a serverless compute engine for containers that allows you to run Docker containers without provisioning or managing servers. It automatically scales containers based on demand and integrates natively with an Application Load Balancer (ALB) for traffic distribution, meeting all the stated requirements.

Answer

AWS Lambda

Answer

Amazon ECS on Amazon EC2

Answer

Amazon Lightsail

Question 18

A company's security team is concerned about the risk of compromised Amazon EC2 instances being used for crypto-mining activities. They want a managed AWS service that can automatically detect unusual outbound network traffic patterns that are characteristic of crypto-mining, without requiring the installation of any agents on the instances. The team needs continuous monitoring and the ability to receive findings that include details about the suspicious activity. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor for malicious activity, including unusual outbound network traffic patterns like those associated with crypto-mining. It operates at the AWS account and VPC level by analyzing DNS logs, VPC Flow Logs, and CloudTrail events, and it does not require any agents to be installed on EC2 instances. When suspicious activity is detected, GuardDuty generates detailed findings that include information about the affected resource, the type of threat, and recommended remediation steps.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon Detective

Question 19

Which AWS service provides a managed in-memory caching layer to reduce database load and improve application response times?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct answer because it provides a managed in-memory caching service that supports both Redis and Memcached, allowing applications to retrieve data from a fast, in-memory cache instead of querying a slower disk-based database. This reduces database load and improves application response times by serving frequently accessed data directly from the cache.

Answer

Amazon DynamoDB Accelerator (DAX)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 20

A company runs a critical web application on AWS behind an Application Load Balancer. The security team is concerned about the risk of Distributed Denial of Service (DDoS) attacks that could deplete application resources and incur high costs due to auto scaling. The company wants a managed service that provides enhanced DDoS detection, access to the AWS DDoS Response Team (DRT), and financial protection against scaling costs associated with DDoS attacks. Which AWS service should the company use?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS detection and mitigation beyond what Shield Standard offers, includes 24/7 access to the AWS DDoS Response Team (DRT) for custom mitigations, and offers financial protection (cost protection) against scaling costs incurred due to DDoS attacks on resources like Application Load Balancers. This directly addresses the company's need for a managed service that covers detection, expert support, and cost coverage.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Firewall Manager