CLF-C02 Practice Exam 64 — 20 Questions

Question 1

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.

Answer

S3 Block Public Access account-level settings

Answer

AWS Config managed rule s3-bucket-public-read-prohibited

Answer

Amazon Macie with a sensitive data discovery job

Question 2

A company operates multiple Amazon VPCs across several AWS accounts for different business units. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the connectivity between all VPCs and the on-premises network. Currently, they manage individual VPC peering connections, which is becoming complex as more VPCs are added. They need a single network hub that can scale to connect hundreds of VPCs and the on-premises network, with centralized routing management. Which AWS service should the network team use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a single, scalable network hub that connects multiple VPCs and on-premises networks via Direct Connect, using a centralized routing table. This eliminates the need for complex, meshed VPC peering connections and provides transitive routing across all attached networks, which directly addresses the requirement for a hub that scales to hundreds of VPCs.

Answer

Amazon VPC peering

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 3

A company deploys their web application across two Availability Zones using an Application Load Balancer. If one AZ experiences an outage, traffic is automatically routed to the other AZ and the application continues to function. Which cloud benefit does this demonstrate?

Accepted Answer

High availability and fault tolerance. This scenario demonstrates high availability and fault tolerance because the application is deployed across two Availability Zones with an Application Load Balancer (ALB) distributing traffic. If one AZ fails, the ALB automatically reroutes traffic to the healthy AZ, ensuring continuous operation. This design eliminates a single point of failure and maintains service availability, which is the core of fault tolerance in AWS.

Answer

Economies of scale

Answer

On-demand self-service

Answer

Rapid elasticity

Question 4

A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated hardware security modules (HSMs) that are under the customer's sole control, meeting PCI DSS requirements for storing encryption keys in a dedicated HSM. It allows you to generate and manage your own encryption keys within a single-tenant, FIPS 140-2 Level 3 validated device, ensuring compliance with the mandate for dedicated hardware.

Answer

AWS KMS with automatic key rotation

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 5

A company runs non-critical batch analytics jobs that can be paused and restarted if interrupted. The jobs are flexible regarding when they run. Which EC2 purchasing option offers the lowest possible cost for this workload?

Accepted Answer

Spot Instances. Spot Instances offer the lowest possible cost because they use spare AWS EC2 capacity at a steep discount (up to 90% off On-Demand). Since the batch analytics jobs are non-critical, can be paused and restarted, and are flexible regarding when they run, they are an ideal fit for Spot Instances, which can be interrupted with a 2-minute warning when capacity is reclaimed.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 6

A company runs a business-critical workload on AWS. The workload must have a 15-minute response time from AWS Support if it becomes unavailable. Additionally, the company wants a dedicated technical account manager (TAM) who will proactively review the architecture and provide best practice recommendations. Which AWS Support plan should the company choose?

Accepted Answer

Enterprise Support. The Enterprise Support plan is the only AWS Support plan that provides a 15-minute response time for business-critical workloads and includes a dedicated Technical Account Manager (TAM). The TAM proactively reviews the architecture and offers best practice recommendations, which directly matches the company's requirements.

Answer

Basic Support

Answer

Developer Support

Answer

Business Support

Question 7

A company uses AWS Organizations with multiple accounts. The finance team needs to generate custom cost and usage reports that include every line item, all user-defined cost allocation tags, and resource-level details. The team also needs the ability to query the data using standard SQL tools for in-depth analysis. Which AWS feature should the team use to meet these requirements?

Accepted Answer

AWS Cost and Usage Report. The AWS Cost and Usage Report (CUR) is the only AWS feature that provides comprehensive, granular cost and usage data including every line item, all user-defined cost allocation tags, and resource-level details. It delivers this data to an Amazon S3 bucket in a CSV or Parquet format, which can then be queried using standard SQL tools via Amazon Athena or other SQL engines. This directly matches the requirement for custom reports and SQL-based analysis.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 8

A company wants to provide employees with secure, managed virtual Windows or Linux desktops accessible from any device, without purchasing physical computers or managing on-premises VDI infrastructure. Which AWS service provides cloud-based virtual desktops?

Accepted Answer

Amazon WorkSpaces. Amazon WorkSpaces is a fully managed, cloud-based virtual desktop infrastructure (VDI) service that provides secure, persistent Windows or Linux desktops accessible from any supported device. It eliminates the need to purchase physical hardware or manage on-premises VDI, aligning directly with the scenario described.

Answer

Amazon AppStream 2.0

Answer

Amazon EC2 with Remote Desktop

Answer

AWS Connect

Question 9

A healthcare company stores patient records in Amazon S3 buckets across multiple accounts and needs to automatically discover and classify any objects containing personally identifiable information (PII) or protected health information (PHI). Which AWS service provides this capability?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is specifically designed to identify personally identifiable information (PII) and protected health information (PHI) by analyzing object metadata and content, making it the correct choice for this healthcare compliance use case.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 10

A company runs a customer relationship management (CRM) application on a single Amazon RDS for PostgreSQL instance. The application experiences heavy read traffic during business hours, often causing the primary database to become overloaded with SELECT queries. The company needs a solution that offloads read queries to a separate database endpoint and provides automatic failover to a standby database in a different Availability Zone if the primary fails. Which combination of Amazon RDS features should the company use to meet these requirements?

Accepted Answer

Multi-AZ deployment with one or more Read Replicas. It combines Multi-AZ deployment for automatic failover to a standby in a different Availability Zone with Read Replicas to offload SELECT queries to a separate database endpoint. Multi-AZ ensures high availability by synchronously replicating data to a standby instance, while Read Replicas asynchronously replicate data to handle read-heavy traffic without burdening the primary.

Answer

Multi-AZ deployment only

Answer

Read Replicas only

Answer

Cross-Region Read Replicas only

Question 11

A company runs a containerized application that uses multiple Docker containers. The development team wants to run these containers on AWS without provisioning or managing any EC2 instances. They also do not want to manage the container orchestration control plane. The application requires consistent access to persistent storage volumes that can be attached to containers. Which AWS service should the team use to run the containers with the least operational overhead?

Accepted Answer

AWS Fargate. AWS Fargate is a serverless compute engine for containers that allows you to run containers without provisioning or managing EC2 instances or the underlying container orchestration control plane (Amazon EKS or Amazon ECS). It directly meets the requirement of zero infrastructure management while supporting persistent storage through Amazon EFS filesystems or Docker volumes that can be attached to Fargate tasks, providing consistent access to storage volumes.

Answer

Amazon EC2 with a container-optimized AMI

Answer

AWS Lambda

Answer

Amazon ECR (Amazon Elastic Container Registry)

Question 12

A new AWS customer wants to explore AWS services for the first time. They launch a t2.micro EC2 instance and use up to 5 GB of Amazon S3 storage. They want to understand if these will incur charges. Which AWS programme provides limited free usage of many services for new accounts during the first 12 months?

Accepted Answer

AWS Free Tier. The AWS Free Tier is designed specifically for new AWS customers, offering limited free usage of select services—including t2.micro EC2 instances and 5 GB of Amazon S3 storage—for the first 12 months after account creation. This program allows users to explore AWS services without incurring charges, as long as they stay within the defined usage limits. The scenario matches the Free Tier's eligibility criteria exactly, making option B correct.

Answer

AWS Enterprise Support

Answer

AWS Credits Programme

Answer

Reserved Instance discount

Question 13

A financial services company keeps sensitive customer data in an on-premises data center. Regulatory requirements prohibit this data from being stored in the cloud. However, the company needs to run compute-intensive analytics jobs that periodically require more processing power than its on-premises servers can provide. The company wants to use AWS for these burst capacity needs while keeping the sensitive data on premises. Which cloud deployment model best describes this approach?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it combines on-premises infrastructure (private cloud) with public cloud resources (AWS) while keeping sensitive data on-premises. The company uses AWS for burst compute capacity via services like AWS Batch or EC2 Auto Scaling, but the data never leaves the on-premises data center, satisfying regulatory requirements.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 14

A company is building a global e-commerce application that requires a database with single-digit millisecond latency, seamless scaling to handle millions of requests per second, and the ability to replicate data across multiple AWS Regions for disaster recovery and low-latency reads. The database must be fully managed with automatic backup and restores. Which AWS service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, supports automatic multi-Region replication via DynamoDB Global Tables for disaster recovery and low-latency reads, and provides built-in backup and restore capabilities. This combination of performance, seamless scaling to millions of requests per second, and global replication aligns perfectly with the requirements of a global e-commerce application.

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Question 15

A company uses multiple AWS accounts. The security team wants to enforce two requirements for all Amazon S3 buckets: first, server-side encryption must be enabled using AWS KMS; second, no bucket can be publicly accessible. The team needs a service that continuously monitors the configuration of S3 buckets across all accounts, detects when a bucket violates either requirement, and automatically applies corrective actions (such as enabling default encryption or removing public access). Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, evaluation, and automated remediation of resource configurations across multiple accounts. With AWS Config rules (e.g., managed rules like `s3-bucket-server-side-encryption-enabled` and `s3-bucket-public-read-prohibited`), you can detect noncompliant S3 buckets and trigger AWS Systems Manager Automation documents or Lambda functions to automatically enable default encryption or remove public access. AWS Config also supports multi-account aggregation via an aggregator, allowing the security team to enforce these requirements across all accounts from a single management account.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 16

A company runs a fleet of 100 EC2 instances and needs to remotely execute commands, apply patches, and collect inventory data across all instances without opening SSH ports. Which AWS service enables this?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct service because it provides a unified interface to remotely execute commands, apply patches, and collect inventory data across EC2 instances without requiring SSH access. It uses the Systems Manager Agent (SSM Agent) installed on the instances and communicates over HTTPS (port 443), eliminating the need to open inbound SSH ports (port 22). This aligns directly with the requirement to manage a fleet of 100 instances securely and at scale.

Answer

AWS CloudShell

Answer

Amazon EC2 Instance Connect

Answer

AWS Config

Question 17

A company needs a managed workflow service to coordinate long-running business processes that may require human approval steps and can run for up to one year. Which AWS service handles this?

Accepted Answer

AWS Step Functions (Standard Workflows). AWS Step Functions Standard Workflows are designed for long-running, durable, and auditable workflows that can run for up to one year, making them ideal for coordinating business processes that require human approval steps. They provide built-in error handling, retries, and state management, which are essential for orchestrating multi-step processes with human intervention.

Answer

AWS Lambda

Answer

Amazon SQS

Answer

Amazon EventBridge

Question 18

A company needs to process and analyze streaming log data from thousands of servers in near real-time, loading the results into Amazon Redshift for dashboards. Which AWS service is designed for this streaming ETL delivery use case?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed specifically for streaming ETL (extract, transform, load) delivery. It can capture, transform (e.g., convert to Parquet/ORC, perform Lambda-based data transformation), and automatically load streaming data into Amazon Redshift, Amazon S3, or Amazon OpenSearch Service in near real-time, with no ongoing administration required.

Answer

Amazon Kinesis Data Streams

Answer

AWS Glue

Answer

Amazon MSK

Question 19

A company has been using AWS for six months and wants to predict their expected spending for the next quarter. They have historical cost data and need to use an AWS tool that can analyze past usage patterns and generate a monthly cost forecast. Which AWS tool should they use?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides a pre-built dashboard with historical cost data and the ability to generate forecasts for future spending based on past usage patterns. It uses machine learning models to analyze your historical usage and produce a monthly cost forecast, making it the correct tool for predicting expected spending for the next quarter.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost and Usage Report

Question 20

A company is planning to migrate to AWS. Their CTO wants to understand how AWS's massive scale benefits smaller customers. Which AWS cloud economic concept explains this benefit?

Accepted Answer

Economies of scale. Economies of scale is the correct answer because it describes how AWS's massive infrastructure investments (data centers, hardware, networking) allow them to spread fixed costs across millions of customers, resulting in lower per-unit costs that are passed down to smaller customers. This is a core cloud economic concept where the provider's scale directly benefits all tenants, unlike elasticity which focuses on resource scaling.

Answer

Elasticity

Answer

Capital expenditure avoidance

Answer

Global reach