CLF-C02 Practice Exam 63 — 20 Questions

Question 1

A financial services company must keep customer financial records on-premises to comply with data residency regulations. The company wants to use AWS services such as Amazon SageMaker and Amazon Athena to run analytics on anonymized subsets of the data. The company establishes a dedicated AWS Direct Connect connection between its on-premises data center and its VPC, and uses AWS Storage Gateway to cache frequently accessed data locally while storing all data in Amazon S3. Which cloud deployment model does this architecture represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hybrid cloud. This architecture combines on-premises infrastructure (customer data center with AWS Storage Gateway caching) with AWS cloud services (SageMaker, Athena, S3) connected via AWS Direct Connect, which is the defining characteristic of a hybrid cloud deployment. A hybrid cloud model integrates private on-premises resources with public cloud services, allowing data to remain on-premises for compliance while leveraging cloud analytics.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 2

A company hosts a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS), using a managed service that requires no underlying infrastructure management. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers and requires no underlying infrastructure management, making it the correct choice for this use case.

Answer

AWS Shield Advanced

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 3

A startup is migrating its infrastructure to AWS. The CTO notices that the hourly rate for an Amazon EC2 instance is significantly lower than the cost of purchasing and maintaining a comparable physical server in their own data center. The CTO explains that AWS can offer lower prices because it aggregates demand from thousands of customers and optimizes its data center operations. Which benefit of cloud computing does this scenario primarily illustrate?

Accepted Answer

Economies of scale. The scenario describes AWS aggregating demand from thousands of customers to optimize data center operations, which directly reduces per-unit costs. This is the definition of economies of scale, where larger operational scale leads to lower average costs. The CTO's observation that the hourly EC2 rate is lower than purchasing a physical server illustrates how cloud providers pass these savings to customers.

Answer

High availability

Answer

Elasticity

Answer

Global reach

Question 4

A company wants to ensure their containerized microservices can discover each other by name without hard-coding IP addresses. Which AWS service provides DNS-based service discovery for ECS and EKS?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that enables microservices to dynamically discover each other by name using DNS queries or API calls. It integrates directly with Amazon ECS and EKS, allowing containers to register and resolve service endpoints without hard-coded IP addresses, making it the correct choice for DNS-based service discovery.

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Answer

Amazon VPC

Question 5

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans (including CVEs) and network reachability assessments on EC2 instances. It uses a combination of AWS security best practices and common vulnerability databases to identify software vulnerabilities and unintended network access paths, such as open ports or overly permissive security groups.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Shield

Question 6

A company wants to ensure that their AWS account root user is protected with the highest level of security. Which two actions should they take? (Choose the answer that covers both.)

Accepted Answer

Enable MFA on the root account and delete any existing root access keys. To protect the AWS account root user with the highest level of security, you should enable MFA on the root account and delete any existing root access keys (Option B). This prevents unauthorized access using stolen credentials and eliminates the risk of long-term programmatic access. Sharing the root password (Option C) is a security anti-pattern because it increases the attack surface and violates the principle of least privilege. Instead, use IAM roles and users for day-to-day operations. Therefore, only Option B is a recommended best practice. Note that the question asks for two actions, but based on the options provided, only Option B is correct; Option C is incorrect.

Answer

Create IAM user access keys for the root account to enable programmatic access

Answer

Share the root password with the security team for emergency access

Answer

Use the root account for all day-to-day AWS operations to avoid delegation complexity

Question 7

A company runs multiple workloads on AWS and must ensure that all Amazon S3 buckets have server-side encryption enabled. The compliance team wants to automatically detect any S3 bucket that is created without encryption and receive an alert. They also want to continuously monitor existing buckets for compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-side-encryption-enabled', which automatically checks whether each S3 bucket has server-side encryption enabled. When a non-compliant bucket is detected (either newly created or existing), AWS Config can trigger an Amazon SNS notification to alert the compliance team, meeting both the detection and alerting requirements.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 8

A company's development team frequently needs temporary test environments. A developer can log into the AWS Management Console, select an Amazon EC2 instance type, configure storage, and launch the instance within minutes without any interaction with the IT infrastructure team. This capability is an example of which essential characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes a developer independently provisioning EC2 instances without requiring IT intervention. This directly matches the 'on-demand self-service' characteristic of cloud computing, where users can provision computing resources as needed automatically, without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 9

A company has been using AWS for six months and wants to predict their expected spending for the next quarter. They have historical cost data and need to use an AWS tool that can analyze past usage patterns and generate a monthly cost forecast. Which AWS tool should they use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built dashboard with historical cost data and the ability to generate forecasts for future spending based on past usage patterns. It uses machine learning models to analyze your historical usage and produce a monthly cost forecast, making it the correct tool for predicting expected spending for the next quarter.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Report

Question 10

A company stores compliance logs in Amazon S3. After 90 days, logs are never accessed again but must be retained for 7 years to meet regulatory requirements. Which S3 storage class provides the lowest storage cost for this long-term archival requirement?

Accepted Answer

S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is designed for long-term retention of data that is accessed extremely rarely, with a retrieval time of 12 hours or more. It offers the lowest storage cost among all S3 storage classes, making it the most cost-effective choice for compliance logs that must be retained for 7 years but are never accessed after 90 days.

Answer

S3 Standard

Answer

S3 Standard-IA

Answer

S3 Glacier Flexible Retrieval

Question 11

A company runs a web application that processes customer orders. During flash sales, the application's backend servers become overwhelmed because orders are submitted faster than they can be processed. The company needs a fully managed, highly available service that can buffer incoming orders so that the backend can process them at its own pace without losing any data. The service must automatically scale to handle any volume of orders without requiring manual provisioning. Which AWS service meets these requirements?

Accepted Answer

Amazon Simple Queue Service (Amazon SQS). Amazon Simple Queue Service (SQS) is a fully managed, highly available message queuing service that decouples application components. It buffers incoming orders by storing them in a queue, allowing the backend to process messages at its own pace without losing data. SQS automatically scales to handle any volume of messages, eliminating the need for manual provisioning.

Answer

Amazon Simple Notification Service (Amazon SNS)

Answer

Amazon Kinesis Data Streams

Answer

Amazon MQ

Question 12

A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is a managed service that automates the process of patching managed nodes with both security-related and other types of updates. It can be configured to run on a schedule (e.g., every Tuesday at 2 AM) using a Systems Manager maintenance window, and it generates compliance reports via Systems Manager Inventory and Compliance. Patch Manager works without requiring SSH or RDP access because it uses the AWS Systems Manager Agent (SSM Agent), which is pre-installed on many Amazon EC2 AMIs and can be installed without interactive logon, and it does not require custom agents beyond the SSM Agent itself.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS OpsWorks

Question 13

A company is designing a critical web application that must remain available even if an entire data center goes offline due to a power outage. The application will run on Amazon EC2 instances in the us-east-1 Region. Which AWS infrastructure strategy should the company use to meet this high-availability requirement?

Accepted Answer

Deploy the EC2 instances across two or more Availability Zones within the us-east-1 Region.. Deploying EC2 instances across two or more Availability Zones (AZs) within a single AWS Region protects against an entire data center failure. Each AZ is physically separated, with independent power, cooling, and networking, so if one AZ goes offline, the application continues running in the other AZs. This design meets the high-availability requirement without the complexity and latency of multi-Region deployment.

Answer

Launch all EC2 instances in a single Availability Zone to ensure low latency between instances.

Answer

Deploy the EC2 instances in multiple AWS Regions, such as us-east-1 and eu-west-1.

Answer

Use separate AWS accounts for each EC2 instance to isolate the workload from a data center failure.

Question 14

A company's sales team uses a cloud-based CRM application. Sales representatives access the CRM from their laptops in the office, from tablets at customer sites, and from their smartphones while traveling, all over the internet. The application works consistently across all devices without requiring any custom client software on each device. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Accepted Answer

Broad network access. The scenario describes sales representatives accessing the CRM application from laptops, tablets, and smartphones over the internet without needing custom client software. This directly illustrates broad network access, which is the cloud computing characteristic that resources are available over the network and can be accessed by standard mechanisms (e.g., HTTPS, REST APIs) from a wide range of heterogeneous client platforms (e.g., mobile phones, tablets, laptops). The consistent experience across devices without custom software is the hallmark of broad network access.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 15

A company uses AWS to host its web application. The company's IT manager learns that multiple AWS customers may have virtual machines running on the same physical server within an AWS data center. However, the manager is confident that each customer's data is securely isolated from others and that customers have no visibility into or control over the underlying physical infrastructure. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes the cloud characteristic where the provider's computing resources (such as physical servers) are pooled to serve multiple customers using a multi-tenant model. AWS uses hypervisor-based isolation (e.g., Xen or Nitro) to ensure that each customer's virtual machine has no visibility into or control over the underlying physical hardware or other tenants' workloads, while still sharing the same physical server. This directly matches the scenario's description of multiple customers running VMs on the same physical host with secure isolation.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Measured service

Question 16

A startup is considering moving its infrastructure to AWS. The CTO explains that AWS can offer lower pay-as-you-go prices than what the startup would pay for equivalent on-premises hardware because AWS aggregates usage from millions of customers. Which benefit of the AWS Cloud does this scenario describe?

Accepted Answer

Economies of scale. The scenario describes economies of scale, a core AWS Cloud benefit where AWS aggregates compute and storage usage from millions of customers, allowing it to purchase hardware in bulk at significantly lower per-unit costs. These savings are passed on to customers as lower pay-as-you-go prices compared to what a startup would pay for equivalent on-premises hardware. This is a fundamental economic advantage of cloud computing, distinct from operational benefits like elasticity or high availability.

Answer

Elasticity

Answer

High availability

Answer

Global reach

Question 17

A new AWS customer wants to explore AWS services for the first time. They launch a t2.micro EC2 instance and use up to 5 GB of Amazon S3 storage. They want to understand if these will incur charges. Which AWS programme provides limited free usage of many services for new accounts during the first 12 months?

Accepted Answer

AWS Free Tier. The AWS Free Tier is designed specifically for new AWS customers, offering limited free usage of select services—including t2.micro EC2 instances and 5 GB of Amazon S3 storage—for the first 12 months after account creation. This program allows users to explore AWS services without incurring charges, as long as they stay within the defined usage limits. The scenario matches the Free Tier's eligibility criteria exactly, making option B correct.

Answer

AWS Enterprise Support

Answer

AWS Credits Programme

Answer

Reserved Instance discount

Question 18

A company runs a retail website on AWS. During a promotional event, the website's traffic spikes from 1,000 concurrent users to 100,000 concurrent users in under 5 minutes. The AWS infrastructure automatically provisions additional Amazon EC2 instances to handle the increased load and terminates them when the event ends. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

Rapid elasticity. The scenario describes the automatic scaling of EC2 instances from 1,000 to 100,000 concurrent users in under 5 minutes, and then terminating them when the event ends. This directly demonstrates rapid elasticity, which is the ability to provision and release cloud resources quickly and automatically in response to demand, a core characteristic defined by the NIST SP 800-145 standard.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 19

A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?

Accepted Answer

AWS App Mesh. AWS App Mesh is a service mesh that provides application-level networking, enabling microservices to communicate securely with mutual TLS (mTLS) and offering observability through metrics, logs, and traces. It integrates with AWS services like AWS X-Ray and Amazon CloudWatch to track network traffic between services, making it the correct choice for this requirement.

Answer

Amazon VPC with security groups

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Question 20

A company runs a production web application that uses Amazon EC2 instances, AWS Lambda functions, and Amazon ECS tasks. The application runs 24/7 and the company expects steady usage for the next three years. The company wants to commit to a flexible pricing model that provides significant discounts compared to On-Demand and automatically applies to usage across all three compute services. The company also wants the flexibility to change instance families, regions, or even migrate between compute services (e.g., from EC2 to Lambda) without needing to modify the commitment. Which AWS pricing model should the company choose?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the required flexibility: they automatically apply to EC2 instances, Lambda functions, and ECS Fargate usage, provide significant discounts (up to 66%) compared to On-Demand, and allow changes to instance families, regions, or compute services without modifying the commitment. This model is ideal for steady 24/7 workloads over a three-year term, as it combines broad compute coverage with automatic discount application.

Answer

Amazon EC2 Reserved Instances (Standard)

Answer

Amazon EC2 Reserved Instances (Convertible)

Answer

AWS Savings Plans (EC2 Instance Savings Plans)