CLF-C02 Practice Test 8 — 10 Questions

Question 1

A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.. AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.

Answer

Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.

Answer

Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.

Answer

Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.

Question 2

A company is building a serverless web application using AWS Lambda for compute. The application needs to expose RESTful API endpoints that allow users to perform CRUD operations on a database. The API must support authentication using API keys, throttle requests to prevent abuse, and validate incoming request payloads before they reach the Lambda functions. The company wants a fully managed service that handles these API management tasks and integrates directly with AWS Lambda. Which AWS service should the company use?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is a fully managed service that handles RESTful API creation, authentication via API keys, request throttling to prevent abuse, and request payload validation before invoking AWS Lambda functions. It integrates natively with Lambda, making it the ideal choice for serverless web applications requiring CRUD operations with built-in API management.

Answer

Amazon CloudFront

Answer

Application Load Balancer

Answer

AWS Step Functions

Question 3

A company operates hundreds of AWS accounts under AWS Organizations. The security team wants a single dashboard that aggregates security findings from Amazon GuardDuty, Amazon Inspector, and AWS Macie across all accounts. Additionally, they want to continuously assess the accounts against the CIS AWS Foundations Benchmark and receive a consolidated compliance score. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single dashboard that aggregates security findings from multiple AWS services, including GuardDuty, Inspector, and Macie, across all accounts in an AWS Organization. It also integrates with AWS Config rules to continuously assess accounts against the CIS AWS Foundations Benchmark and provides a consolidated compliance score, meeting both requirements.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 4

A company uses AWS to run its web application. A developer needs to add additional storage capacity to an Amazon EC2 instance that hosts the application's database. The developer logs in to the AWS Management Console, navigates to the Amazon EC2 dashboard, creates a new Amazon EBS volume, attaches it to the instance, and mounts it within the operating system. The entire process takes less than 10 minutes and does not require any interaction with AWS support or approval from the IT department. Which essential characteristic of cloud computing does this scenario best demonstrate?

Accepted Answer

On-demand self-service. The developer was able to provision and attach an EBS volume to an EC2 instance entirely through the AWS Management Console without requiring any human interaction with AWS support or IT approval. This ability to independently request and configure computing resources as needed is the defining characteristic of on-demand self-service, as defined by the NIST definition of cloud computing.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 5

A multinational corporation has a policy that all cloud resources must be provisioned through a centralized IT team. This has caused delays, as developers sometimes wait days for a test environment to be created. The company wants to migrate to AWS to allow individual project teams to provision their own resources (such as Amazon EC2 instances and Amazon S3 buckets) directly through the AWS Management Console or API, without any manual approval process from IT. Which characteristic of cloud computing does this desired capability best represent?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning AWS resources (EC2 instances, S3 buckets) directly via the AWS Management Console or API without requiring IT approval. This is the core definition of on-demand self-service, one of the five essential characteristics of cloud computing as defined by NIST SP 800-145: a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

Answer

High availability

Answer

Elasticity

Answer

Resource pooling

Question 6

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they allow AWS Organizations to centrally define permission guardrails that apply to all IAM users and roles across member accounts. SCPs can explicitly deny actions like s3:PutBucketPolicy to prevent any account administrator from modifying S3 bucket policies to grant public access, and these restrictions cannot be overridden by any IAM entity within the member account.

Answer

IAM permissions boundaries

Answer

AWS Config conformance packs

Answer

AWS CloudTrail Insights

Question 7

A company is planning to migrate its on-premises data center to AWS. The finance team needs to compare the current on-premises infrastructure costs (including servers, storage, networking, and personnel) against the projected costs of running identical workloads on AWS over a three-year period. The team wants to input detailed specifications of their existing hardware and get a comprehensive report that highlights potential savings and provides a total cost of ownership (TCO) comparison. Which AWS tool should the finance team use?

Accepted Answer

AWS Total Cost of Ownership (TCO) Calculator. The AWS Total Cost of Ownership (TCO) Calculator is specifically designed to compare the costs of on-premises infrastructure with AWS, allowing users to input detailed hardware specifications (servers, storage, networking) and generate a comprehensive report that highlights potential savings over a chosen period (e.g., three years). This tool directly addresses the finance team's need for a TCO comparison, including personnel costs, which is not a feature of other AWS calculators.

Answer

AWS Pricing Calculator

Answer

AWS Cost Explorer

Answer

AWS Simple Monthly Calculator

Question 8

A retail company runs a legacy application on a single on-premises server. The application experiences unpredictable traffic surges that degrade performance. The company is considering migrating to the AWS Cloud. Which cloud computing characteristic MOST directly addresses the ability to automatically adjust resources to meet changing demand without manual intervention?

Accepted Answer

Elasticity. Elasticity is the cloud computing characteristic that enables automatic resource provisioning and de-provisioning to match demand in real time, without manual intervention. For the retail company's legacy application with unpredictable traffic surges, elasticity directly addresses the need to dynamically scale resources up during spikes and down during lulls, which is distinct from the planned, manual scaling of scalability.

Answer

Scalability

Answer

High availability

Answer

Durability

Question 9

A company runs its primary database on an Amazon RDS for MySQL DB instance in the us-east-1 Region. The company's disaster recovery policy requires that the database be recoverable in a different AWS Region within 1 hour of a region-wide failure, with a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour. Which AWS feature should the company use to meet these requirements?

Accepted Answer

Create a cross-region read replica of the DB instance in us-west-2.. A cross-region read replica in us-west-2 meets the RPO of less than 5 minutes because replication is asynchronous with a lag typically under 1 minute, and the RTO of less than 1 hour is achievable by promoting the replica to a standalone primary in the event of a region-wide failure. This approach provides a ready-to-use database copy in another region without the need for manual snapshot restoration.

Answer

Deploy a Multi-AZ RDS DB instance in us-east-1.

Answer

Take manual DB snapshots daily and copy them to us-west-2.

Answer

Enable termination protection on the RDS instance.

Question 10

A startup is planning to build and launch a new mobile application on AWS. The team expects very low initial traffic but hopes to scale rapidly. They have a limited budget and want to avoid any upfront costs. They are unsure which AWS services they will need and want to estimate their monthly AWS charges before committing to an architecture. Additionally, they need access to technical support to help troubleshoot issues that arise during development and production, with a guaranteed response time of less than 12 hours for production-impacting issues. Which combination of AWS tool and support plan should the startup choose to meet these requirements?

Accepted Answer

AWS Pricing Calculator + Developer Support. The AWS Pricing Calculator allows the startup to estimate monthly costs without any upfront commitment, which aligns with their need to avoid upfront costs and predict charges before architecting. The Developer Support plan provides a response time of less than 12 hours for production-impacting issues (specifically, a response time of 12 hours for impaired production systems under the Developer plan), meeting their support requirement while keeping costs low for a startup with limited budget.

Answer

AWS Cost Explorer + Basic Support

Answer

AWS Budgets + Business Support

Answer

AWS Total Cost of Ownership (TCO) Calculator + Enterprise Support