CLF-C02 Practice Exam 64 — 20 Questions

Question 1

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 2

A media company processes user-uploaded images to generate thumbnails and metadata. The current solution runs a script on a single Amazon EC2 instance, which becomes overloaded during peak hours, causing delays. The company wants a solution that automatically scales to handle spikes in upload volume, requires no server management, and charges only for the processing time consumed. Which AWS service should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it provides a serverless compute service that automatically scales with incoming upload volume, requires no server management, and charges only for the actual processing time (in 1ms increments). The media company's need for automatic scaling, zero server management, and pay-per-use billing aligns perfectly with Lambda's event-driven architecture, where each image upload can trigger a Lambda function to generate thumbnails and metadata without provisioning or managing any underlying infrastructure.

Answer

Amazon EC2 Auto Scaling

Answer

AWS Batch

Answer

Amazon Lightsail

Question 3

A healthcare startup is migrating its patient records database to Amazon RDS for PostgreSQL. The company must comply with HIPAA and ensure that all protected health information (PHI) is encrypted at rest and in transit. Which task is the company responsible for under the AWS shared responsibility model?

Accepted Answer

Enabling encryption at rest for the Amazon RDS instance and configuring SSL for connections.. Under the AWS shared responsibility model, the customer is responsible for encryption in transit and at rest for the data they store in AWS services. For Amazon RDS, enabling encryption at rest (via AWS KMS) and configuring SSL/TLS for client connections are customer-side tasks. AWS handles the physical security of data centers and the underlying infrastructure, but the customer must explicitly enable these encryption features to meet HIPAA compliance.

Answer

Encrypting the physical disk drives in the AWS data center that host the database.

Answer

Applying operating system patches to the Amazon RDS database engine.

Answer

Configuring network ACLs to block all traffic except from authorized sources.

Question 4

A healthcare company runs a production application on AWS that stores protected health information (PHI). The company needs a support plan that provides a designated Technical Account Manager (TAM) who will perform quarterly business reviews, offer proactive architectural guidance, and help optimize the environment. The company also requires a 15-minute response time for critical system failures. Which AWS Support plan should the company choose?

Accepted Answer

AWS Enterprise Support. AWS Enterprise Support is the only plan that provides a designated Technical Account Manager (TAM) who conducts quarterly business reviews, offers proactive architectural guidance, and helps optimize the environment. It also guarantees a 15-minute response time for critical system failures, meeting the healthcare company's requirements for handling protected health information (PHI) with high availability and compliance.

Answer

AWS Basic Support

Answer

AWS Developer Support

Answer

AWS Business Support

Question 5

A retail company runs its e-commerce platform on AWS. The platform uses multiple Amazon EC2 instances behind an Application Load Balancer. To ensure the application remains available during an Availability Zone failure, the company distributes the instances across three Availability Zones. The load balancer automatically reroutes traffic away from an unhealthy zone. This design primarily addresses which pillar of the AWS Well-Architected Framework?

Accepted Answer

Reliability. Distributing EC2 instances across multiple Availability Zones and using an Application Load Balancer to automatically reroute traffic away from unhealthy zones ensures that the application remains available even if an entire AZ fails. This design directly addresses the 'Reliability' pillar of the AWS Well-Architected Framework, which focuses on the ability of a workload to recover from infrastructure or service disruptions and dynamically acquire computing resources to meet demand.

Answer

Security

Answer

Performance Efficiency

Answer

Cost Optimization

Question 6

A developer needs to launch a test EC2 instance for a new prototype. The developer logs into the AWS Management Console, selects an instance type, and launches the instance without contacting AWS support or waiting for approval. Which cloud computing characteristic does this demonstrate?

Accepted Answer

On-demand self-service. The scenario describes a developer independently provisioning an EC2 instance through the AWS Management Console without requiring human interaction with AWS support. This directly aligns with the NIST definition of on-demand self-service, a core characteristic of cloud computing where users can unilaterally provision computing capabilities as needed automatically.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 7

A small e-commerce company currently hosts its website on a single physical server in a colocation facility. The company pays a fixed monthly fee for the server, power, and bandwidth, regardless of actual usage. The CTO is evaluating AWS and notes that AWS operates millions of servers across multiple data centers, allowing it to negotiate lower prices for hardware and pass those savings to customers. The CTO expects that migrating to AWS will reduce the company's per-unit costs. Which benefit of cloud computing does this scenario BEST describe?

Accepted Answer

Economy of scale. The scenario describes how AWS leverages its massive scale of operations—millions of servers across multiple data centers—to negotiate lower hardware prices from suppliers and pass those savings to customers. This is the definition of economy of scale: as the volume of production increases, the cost per unit decreases. The CTO expects that migrating to AWS will reduce the company's per-unit costs, which directly aligns with this cloud computing benefit.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 8

A solutions architect is reviewing an application design to ensure the system can automatically recover from failures, scale horizontally to increase availability, and prevent failures from cascading to other components. Which pillar of the AWS Well-Architected Framework is the architect applying?

Accepted Answer

Reliability. The question focuses on automatic recovery from failures, horizontal scaling for availability, and preventing cascading failures. These are core design principles of the Reliability pillar, which ensures a workload performs its intended function correctly and consistently when expected. The Reliability pillar specifically addresses foundations like distributed system design, recovery procedures, and change management to handle and recover from infrastructure or service disruptions.

Answer

Performance Efficiency

Answer

Operational Excellence

Answer

Security

Question 9

A financial services company is required by regulation to keep all customer transaction data on-premises. However, they want to use AWS to run analytics workloads on this data using Amazon EMR and Amazon S3 for temporary storage of intermediate results. They need a solution that connects their on-premises network to AWS securely and allows them to extend their on-premises environment into the AWS Cloud. Which cloud computing deployment model does this scenario BEST describe?

Accepted Answer

Hybrid cloud. Option C is correct because the scenario describes a hybrid cloud deployment model, where the company maintains on-premises infrastructure for regulatory compliance (keeping customer transaction data on-premises) while leveraging AWS public cloud services (Amazon EMR and Amazon S3) for analytics workloads. The requirement to connect the on-premises network to AWS securely and extend the on-premises environment into the AWS Cloud is a defining characteristic of hybrid cloud, often implemented using AWS Direct Connect or VPN connections to create a unified network.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 10

A startup is migrating a web application to AWS. The application runs on Amazon EC2 instances that use a custom Amazon Machine Image (AMI) with the company's proprietary software. The security team needs to understand which security tasks the company must perform. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

Accepted Answer

Configuring security groups to control inbound traffic to the instances. Configuring security groups is a customer responsibility because security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Under the AWS Shared Responsibility Model, the customer is responsible for configuring network access controls, while AWS manages the underlying infrastructure. This includes defining rules based on IP protocols, ports, and source/destination CIDR ranges.

Answer

Patching the hypervisor that hosts the EC2 instances

Answer

Physical security of the data center where the instances run

Answer

Maintaining the underlying network infrastructure

Question 11

A media company runs a video-on-demand platform on AWS. Video files (.mp4) and thumbnail images (.jpg) are stored in the same Amazon S3 bucket. The company uses Amazon CloudFront to deliver content to users globally. The video files are large and do not change frequently, so the company wants them to be cached at CloudFront edge locations for 30 days. Thumbnails change more often when new uploads are processed, so the company wants them to be cached for only 1 day. The company wants a single CloudFront distribution to serve both types of content from the same S3 bucket. Which configuration should the company use to meet these requirements with minimal operational overhead?

Accepted Answer

Create two CloudFront behaviors: one for the path pattern /videos/* and one for /thumbnails/*. Associate a cache policy with a TTL of 30 days to the video behavior and a cache policy with a TTL of 1 day to the thumbnail behavior. Both behaviors point to the same S3 origin.. Option B is correct because CloudFront allows multiple behaviors within a single distribution, each with its own path pattern and cache policy. By configuring path patterns /videos/* and /thumbnails/*, the company can apply a 30-day TTL cache policy to video requests and a 1-day TTL cache policy to thumbnail requests, both pointing to the same S3 origin. This meets the caching requirements with minimal operational overhead, as it avoids custom code or multiple distributions.

Answer

Create one CloudFront behavior for all content. Set a cache policy with a TTL of 30 days. Create a Lambda@Edge function to override the TTL to 1 day for requests with .jpg extension.

Answer

Create two separate CloudFront distributions: one for videos with a cache policy of 30 days, and one for thumbnails with a cache policy of 1 day. Point both to the same S3 bucket.

Answer

In the S3 bucket, create two folders: /videos and /thumbnails. Use S3 Cross-Region Replication to replicate thumbnails to a separate bucket in a different Region. Create a single CloudFront behavior with a cache policy of 1 day for the thumbnail bucket and a separate behavior for the original bucket.

Question 12

A company wants to run a MySQL database on AWS. They require full control over the operating system, MySQL version selection, storage layout, and network configuration. Which cloud service model provides this level of control?

Accepted Answer

Infrastructure as a Service (IaaS). C is correct because Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the customer full control over the operating system, database software (including MySQL version selection), storage layout (e.g., instance store vs. EBS volumes), and network configuration (e.g., VPC, subnets, security groups). This is the only service model that allows you to manage the underlying OS and database stack directly, similar to running a physical server.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 13

A company runs a web application where requests to /api/* should be routed to one group of EC2 instances and requests to /images/* should be routed to another group. Which AWS load balancer type supports this URL path-based routing?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports content-based routing, including path-based routing rules that direct requests to different target groups based on URL paths such as /api/* and /images/*. This makes ALB the correct choice for the described use case.

Answer

Network Load Balancer (NLB)

Answer

Classic Load Balancer (CLB)

Answer

Gateway Load Balancer (GWLB)

Question 14

A web application queries a relational database for a product catalogue that changes infrequently but is requested thousands of times per second. Database query latency is becoming a bottleneck. Which AWS service can the company use to cache frequently accessed query results in memory and reduce database load?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides an in-memory caching layer (using Redis or Memcached) that can store frequently accessed query results, reducing the need to repeatedly query the relational database. This dramatically lowers latency for high-throughput read workloads (thousands of requests per second) and offloads database pressure, directly addressing the bottleneck described.

Answer

Amazon RDS Read Replica

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 15

A company runs database servers that require consistent EC2 capacity 24/7 for the next 3 years. Which EC2 purchasing option provides the greatest discount compared to On-Demand pricing?

Accepted Answer

Reserved Instances (3-year, all upfront). Reserved Instances (RIs) with a 3-year term and all upfront payment provide the highest discount compared to On-Demand pricing because they commit to a consistent, predictable workload for an extended period. AWS offers significant pricing tiers for RIs, with the 3-year all upfront option yielding up to 72% discount over On-Demand, which is the greatest among all purchasing options for steady-state usage.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 16

A company hosts a website in the US East (N. Virginia) AWS region. Users in Europe and Asia Pacific report slow page load times because content must travel long distances from the origin server. Which AWS service should the company deploy to reduce latency for global users?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations worldwide, including Europe and Asia Pacific. By serving content from the edge location closest to each user, CloudFront significantly reduces latency and improves page load times for global users without requiring changes to the origin infrastructure.

Answer

AWS Direct Connect

Answer

Amazon Route 53 with latency routing

Answer

Amazon VPC peering

Question 17

A company has migrated all of its workloads to AWS and has decommissioned all of its on-premises data centres. All compute, storage, databases, and networking are now managed in AWS. Which cloud deployment model describes this architecture?

Accepted Answer

Public cloud. Option D is correct because the company has migrated all workloads to AWS and decommissioned all on-premises data centers, meaning all infrastructure is hosted entirely on AWS's shared infrastructure. This is the definition of a public cloud deployment model, where resources are owned and operated by a third-party cloud provider (AWS) and delivered over the internet to multiple tenants. No private or on-premises components remain, so the architecture is purely public cloud.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Multi-cloud

Question 18

A solutions architect needs to isolate an application in its own virtual network within AWS, with full control over IP address ranges, subnet definitions, route tables, and internet gateway configuration. Which AWS service provides this capability?

Accepted Answer

Amazon VPC. Amazon VPC (Virtual Private Cloud) enables you to provision a logically isolated section of the AWS cloud where you can define your own IP address range (using CIDR notation, e.g., 10.0.0.0/16), create subnets, configure route tables, and attach an Internet Gateway for public internet access. This gives you full control over the virtual networking environment, exactly matching the requirement.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Question 19

AWS builds and operates large physical data centres and uses virtualisation to serve thousands of customers simultaneously on shared hardware while keeping each customer's data logically isolated. Which cloud computing characteristic does this describe?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because AWS uses virtualization to aggregate physical hardware from its data centers into a shared pool of compute, storage, and network resources that can be dynamically assigned and reassigned to multiple customers. Each customer's data remains logically isolated through hypervisor-level isolation (e.g., using Xen or Nitro hypervisors), but the underlying hardware is shared, which is the essence of resource pooling as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Measured service

Answer

Rapid elasticity

Question 20

A company's employees access AWS services using the AWS Management Console from their office laptops, the AWS mobile app on their smartphones, and the AWS CLI from their home computers. Which cloud computing characteristic does this illustrate?

Accepted Answer

Broad network access. Broad network access is the correct answer because the scenario describes employees accessing AWS services from multiple types of devices (office laptops, smartphones, home computers) using different access methods (AWS Management Console, AWS mobile app, AWS CLI). This directly illustrates the cloud characteristic that resources are available over the network and can be accessed by standard protocols (e.g., HTTPS for the console and mobile app, HTTP/HTTPS for CLI API calls) from a wide range of client platforms, including mobile phones, laptops, and workstations.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service