CLF-C02 Practice Test 7 — 10 Questions

Question 1

A company manages multiple AWS accounts through AWS Organizations. The finance team wants to receive a consolidated view of costs across all accounts and track costs against a monthly budget of $50,000 for the entire organization. They want to be alerted when actual costs reach 90% of the budget and again when they exceed 100%. Which combination of AWS services should the finance team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Budgets to create a budget and configure alerts, and AWS Cost Explorer to view consolidated cost data.. AWS Budgets is the correct service for setting a monthly budget of $50,000 and configuring alerts at 90% and 100% thresholds. AWS Cost Explorer provides the consolidated view of costs across all accounts in AWS Organizations. Together, they meet both requirements: Budgets handles the alerting, and Cost Explorer provides the consolidated cost visualization.

Answer

AWS Cost Explorer to create a budget alert and AWS Budgets to view consolidated costs.

Answer

AWS Trusted Advisor to set a cost optimization budget and AWS Cost Explorer to send alerts.

Answer

AWS Cost and Usage Report to generate a daily report and Amazon Simple Email Service (Amazon SES) to send email alerts.

Question 2

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A company is expanding its AWS environment from a single account to multiple accounts using AWS Organizations. The security team wants to enforce a baseline set of permissions across all accounts, ensuring that users in any account cannot disable AWS CloudTrail or modify Amazon S3 bucket policies that prevent public access. Which feature of AWS Organizations should the security team use to achieve this control?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce baseline permissions across all accounts in an AWS Organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrative privileges within their own account. By creating an SCP that explicitly denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:PutBucketPolicy` actions (or similar), the security team can prevent disabling CloudTrail and modifying S3 bucket policies that block public access across the entire organization.

Answer

Consolidated Billing

Answer

AWS Config rules

Answer

IAM roles

Question 4

A company runs a web application that accepts customer orders. During peak hours, the order processing component often becomes overloaded, causing orders to be dropped. The company wants to ensure that every order is reliably stored and processed, and that the web tier and the processing tier can scale independently without losing data. Which AWS service should the company use to decouple the application components and provide a durable buffer for incoming orders?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed, durable, and scalable message queue that decouples the web tier from the processing tier. Orders are reliably stored in an SQS queue until the processing component retrieves them, ensuring no orders are dropped even during peak loads. SQS guarantees at-least-once delivery and supports independent scaling of producers and consumers without data loss.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 5

A healthcare organization stores sensitive patient records in Amazon S3. The organization's compliance team learns that AWS stores data from multiple customers on the same physical hardware. They are concerned that data from different customers could be mixed or accessed by another customer. Which fundamental characteristic of cloud computing explains how AWS allows customers to share physical infrastructure while keeping each customer's data logically isolated?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes how AWS aggregates computing resources (including storage) from multiple customers into a shared pool, then logically isolates each customer's data through software-defined boundaries. In Amazon S3, this isolation is achieved via bucket policies, IAM roles, and object ACLs that enforce strict access controls, ensuring that even though physical hardware is shared, no customer can access another's data. This characteristic directly addresses the compliance team's concern about data mixing or unauthorized cross-tenant access.

Answer

Rapid elasticity

Answer

On-demand self-service

Answer

Measured service

Question 6

A company has a web application deployed on AWS in the us-west-2 Region. The application is accessed by users across the globe, including Europe, Asia, and South America. The company wants to improve the application's performance for international users by reducing latency and packet loss. The solution must route user traffic over the AWS global network to the closest edge location. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network to route user traffic to the closest edge location via Anycast IP addresses, reducing latency and packet loss. It optimizes the path from users to the application by directing traffic to the nearest edge endpoint, then forwarding it over the AWS backbone to the application in us-west-2. This improves performance for international users without caching content, unlike a CDN.

Answer

Amazon CloudFront

Answer

Amazon Route 53 (with latency-based routing)

Answer

AWS Direct Connect

Question 7

A company hosts a public-facing web application behind an Application Load Balancer (ALB). The development team has recently identified that the application is vulnerable to common web attacks such as SQL injection and cross-site scripting (XSS). The security team wants to deploy a managed solution that can inspect incoming HTTP requests and block malicious traffic before it reaches the application. The solution must integrate directly with the existing ALB and provide pre-configured rule sets that can be customized. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests. It provides pre-configured rule sets, such as those for SQL injection and cross-site scripting (XSS), which can be customized to block malicious traffic before it reaches the application. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 8

A company runs a multiplayer gaming application on Amazon EC2 instances in the us-east-1 Region. The application uses the UDP protocol for real-time communication between players and game servers. Players in Asia and Europe report high latency and packet loss. The company wants to improve performance by directing player traffic from the nearest edge location to the application over the AWS global network, without modifying the application code. Which AWS service should the company use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route UDP traffic from the nearest edge location to the application, reducing latency and packet loss without requiring code changes. It leverages Anycast IP addresses to direct player traffic to the closest edge location, then transports it over the optimized AWS backbone to the EC2 instances in us-east-1.

Answer

Amazon CloudFront

Answer

Amazon Route 53 latency routing

Answer

AWS Site-to-Site VPN

Question 9

A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it allows the company to create and manage a customer managed key (CMK) with annual rotation, and it integrates with AWS CloudTrail to deliver tamper-proof logs of every KMS API call (e.g., Decrypt, Encrypt, GenerateDataKey). These logs record the key ID, the IAM user or role that made the request, and the S3 object ARN (via encryption context), satisfying both key management and audit logging requirements.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 10

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager