CLF-C02 Hard Questions — 25 Difficult Questions

Question 1

A company wants to improve their application's reliability by ensuring it can handle the failure of a single Availability Zone. According to AWS Well-Architected Framework, what architectural pattern achieves this?

Accepted Answer

Distribute resources across multiple Availability Zones with automatic failover. Option C is correct because distributing resources across multiple Availability Zones (AZs) with automatic failover is the core pattern for high availability and fault tolerance as defined by the AWS Well-Architected Framework. By deploying application instances and data in at least two AZs and using services like an Application Load Balancer (ALB) with cross-zone load balancing or Amazon RDS Multi-AZ, the application can automatically redirect traffic to healthy resources if a single AZ fails, ensuring continued operation without manual intervention.

Answer

Deploy all resources to the largest EC2 instance type available

Answer

Use Amazon S3 for all data storage

Answer

Enable AWS CloudTrail in all regions

Question 2

A company has unpredictable, short-lived batch processing workloads that can be interrupted. Which EC2 purchasing option would provide the lowest cost for these workloads?

Accepted Answer

Spot Instances. Spot Instances (Option C) are the correct choice because they offer unused EC2 capacity at steep discounts (up to 90% off On-Demand) and are ideal for fault-tolerant, flexible, short-lived, or interruptible workloads. Since the company's batch processing jobs are unpredictable and can be interrupted, Spot Instances provide the lowest cost while tolerating the risk of termination when AWS needs the capacity back.

Answer

On-Demand Instances

Answer

Reserved Instances (1-year, No Upfront)

Answer

Dedicated Hosts

Question 3

A company is designing a microservices architecture on AWS. According to the AWS Well-Architected Framework's Operational Excellence pillar, which practice best supports the ability to safely make frequent, small changes to production?

Accepted Answer

Making frequent, small, reversible changes through automated CI/CD pipelines. Option B is correct because the Operational Excellence pillar emphasizes the ability to make frequent, small, reversible changes to reduce the blast radius of failures and enable rapid recovery. Automated CI/CD pipelines enforce consistent deployment practices, allowing teams to safely iterate on production with minimal risk. This approach aligns with the principle of 'perform operations as code' and supports the 'make frequent, small, reversible changes' design principle.

Answer

Performing large batch deployments monthly to minimize change frequency

Answer

Requiring manual approval for every code change

Answer

Deploying all microservices simultaneously in coordinated releases

Question 4

A company is evaluating the AWS Sustainability pillar in the Well-Architected Framework. Which action aligns with AWS cloud sustainability best practices?

Accepted Answer

Right-sizing instances and using managed services to maximize resource utilization. Option C is correct because right-sizing instances and using managed services directly aligns with the AWS Sustainability pillar, which focuses on minimizing the environmental impact of cloud workloads. By matching instance capacity to actual demand and leveraging services like AWS Lambda or Amazon RDS, you reduce wasted compute cycles and energy consumption, improving resource utilization and lowering carbon footprint.

Answer

Provisioning maximum instance sizes to ensure peak performance at all times

Answer

Running workloads 24/7 even when not needed to maintain warm state

Answer

Replicating all data to multiple regions for maximum redundancy

Question 5

A company is using Amazon EC2 and wants to understand the difference between Compute Savings Plans and EC2 Instance Savings Plans. Which statement is accurate?

Accepted Answer

Compute Savings Plans apply to any EC2 instance, Fargate, and Lambda usage, while EC2 Instance Savings Plans apply to a specific instance family and region. Option C is correct because Compute Savings Plans offer the broadest flexibility, automatically applying to any EC2 instance (regardless of family, size, or region), as well as AWS Fargate and AWS Lambda usage. In contrast, EC2 Instance Savings Plans are restricted to a specific instance family within a chosen region, providing a narrower scope of coverage. This distinction is fundamental to understanding how each plan optimizes costs based on workload flexibility.

Answer

Compute Savings Plans provide higher discounts than EC2 Instance Savings Plans

Answer

EC2 Instance Savings Plans are more flexible and apply across all instance families

Answer

Both Savings Plans types require specifying the exact instance size at purchase

Question 6

A company architect is designing a new system on AWS. They want to implement the Well-Architected Framework principle of 'loosely coupled components.' Which architecture pattern best achieves this?

Accepted Answer

Use Amazon SQS or Amazon SNS between services to decouple them. Option B is correct because Amazon SQS (message queue) and Amazon SNS (pub/sub) enable asynchronous communication between services, allowing them to operate independently without direct dependencies. This decoupling aligns with the Well-Architected Framework's principle of loosely coupled components, as services can fail, scale, or be updated without impacting others.

Answer

Have all services call each other directly via synchronous API calls

Answer

Deploy all application components on a single large EC2 instance

Answer

Use a single shared database for all microservices

Question 7

A company is designing a cloud architecture and wants to follow the Well-Architected Framework principle of 'stop guessing capacity.' Which AWS feature directly supports this principle?

Accepted Answer

Amazon EC2 Auto Scaling based on CloudWatch metrics. Amazon EC2 Auto Scaling directly supports the 'stop guessing capacity' principle by automatically adjusting the number of EC2 instances in response to real-time demand using CloudWatch metrics (e.g., CPU utilization, memory). This eliminates the need to manually provision for peak loads, ensuring you only pay for what you need while maintaining performance.

Answer

AWS CloudFormation for repeatable deployments

Answer

AWS Trusted Advisor cost optimization checks

Answer

AWS Cost Explorer right-sizing recommendations

Question 8

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

Accepted Answer

SSE-KMS with a customer-managed CMK. Option C is correct because SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Answer

SSE-S3 (Amazon S3-managed keys)

Answer

SSE-KMS with an AWS managed CMK (aws/s3)

Answer

S3 Versioning with MFA Delete

Question 9

A company is designing a resilient multi-tier web application on AWS. The architect wants to implement the Well-Architected Framework Reliability pillar design principle of 'automatically recover from failure.' Which combination of services implements this most completely?

Accepted Answer

EC2 Auto Scaling + ELB health checks + RDS Multi-AZ. Option B is correct because it combines EC2 Auto Scaling to automatically replace unhealthy instances, ELB health checks to detect failures and route traffic away from them, and RDS Multi-AZ to automatically failover to a standby database in a different Availability Zone. This trio directly implements the 'automatically recover from failure' principle by enabling self-healing at both the compute and database tiers without manual intervention.

Answer

Manual restart procedures documented in a runbook

Answer

AWS CloudTrail + Amazon CloudWatch

Answer

AWS Config rules with manual remediation

Question 10

A company's cloud finance team wants to implement cloud financial management (FinOps) on AWS. Which combination of AWS services provides the most comprehensive cost visibility, budgeting, and optimization capabilities?

Accepted Answer

CUR + Cost Explorer + Budgets + Cost Allocation Tags + Savings Plans. Option B is correct because it combines AWS Cost and Usage Reports (CUR) for granular cost data, Cost Explorer for visualization and analysis, Budgets for proactive alerts, Cost Allocation Tags for cost attribution, and Savings Plans for discounted rates. This integrated set provides end-to-end FinOps capabilities—visibility, budgeting, and optimization—that no single service or partial combination can achieve.

Answer

AWS Cost Explorer only

Answer

AWS Pricing Calculator + CloudWatch Billing Alarms

Answer

AWS Trusted Advisor only

Question 11

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

Accepted Answer

AWS Config with the access-keys-rotated rule. AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 12

A company architect is reviewing their architecture for the Operational Excellence pillar of the Well-Architected Framework. Which practice is a core recommendation of this pillar?

Accepted Answer

Perform operations as code using infrastructure-as-code and automated runbooks. The Operational Excellence pillar focuses on running and monitoring systems to deliver business value and continually improve supporting processes and procedures. Performing operations as code—using infrastructure-as-code (e.g., AWS CloudFormation, AWS CDK) and automated runbooks (e.g., AWS Systems Manager Automation)—is a core recommendation because it enables consistent, repeatable, and auditable operations, reducing human error and enabling rapid recovery.

Answer

Encrypt all data at rest using AWS KMS

Answer

Use Reserved Instances to minimize cost

Answer

Deploy across multiple Availability Zones

Question 13

According to the AWS Well-Architected Framework, which design principle is most closely associated with the recommendation to 'stop spending money on undifferentiated heavy lifting'?

Accepted Answer

Use managed services to reduce operational burden. The AWS Well-Architected Framework's principle of 'stop spending money on undifferentiated heavy lifting' directly advocates for using managed services to offload operational tasks like patching, scaling, and hardware maintenance. By leveraging services such as Amazon RDS (instead of self-managed databases) or AWS Lambda (instead of managing servers), you reduce the operational burden and focus on business differentiation. This aligns with the Operational Excellence pillar's goal of minimizing manual overhead.

Answer

Design for failure

Answer

Implement least-privilege access controls

Answer

Automate infrastructure provisioning

Question 14

A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config to detect violations. Option B is correct because S3 Block Public Access at the account level provides a centralized, enforceable guardrail that prevents any bucket or object from being made publicly accessible, overriding any bucket-level policies or ACLs. AWS Config can then continuously monitor for configuration violations, such as a bucket policy that grants public access, and trigger remediation or alerts. Together, these controls create a defense-in-depth approach that both prevents accidental exposure and detects non-compliance.

Answer

Enable S3 server-side encryption on all buckets

Answer

Enable S3 versioning on all buckets

Answer

Enable S3 Transfer Acceleration for all buckets

Question 15

A company has 10 EC2 On-Demand instances running. They purchase a 1-year Compute Savings Plan for a commitment equivalent to 6 instances. What happens to the remaining 4 instances' cost?

Accepted Answer

The remaining 4 instances are charged at On-Demand rates. A Compute Savings Plan applies to any EC2 instance usage up to the committed hourly amount (in this case, equivalent to 6 instances). Usage beyond that commitment is charged at standard On-Demand rates. Therefore, the remaining 4 instances are billed at On-Demand prices because the Savings Plan does not cover usage exceeding the commitment.

Answer

The remaining 4 instances are free since the Savings Plan covers all usage

Answer

The remaining 4 instances are charged at Spot Instance rates

Answer

AWS suspends the 4 excess instances to enforce the Savings Plan limit

Question 16

A customer is evaluating moving to AWS and asks about the total cost of ownership (TCO) benefits. Which of the following is NOT a factor that reduces TCO when migrating to AWS?

Accepted Answer

Staff training costs for cloud technologies. Option C is correct because staff training costs for cloud technologies are an additional investment required when migrating to AWS, not a factor that reduces total cost of ownership (TCO). While AWS reduces hardware and facility costs, training represents a new expense for upskilling teams on cloud services like EC2, S3, and IAM, which increases rather than decreases TCO.

Answer

Eliminating hardware refresh cycles

Answer

Reducing data center facility costs

Answer

Pay-as-you-go pricing model

Question 17

A security team needs to continuously assess their AWS resources for security vulnerabilities and deviations from security best practices. Which service provides automated security assessments?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of your security posture across AWS accounts by aggregating, organizing, and prioritizing security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It continuously assesses your environment against security standards and best practices (e.g., CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices) and generates automated security assessments and compliance checks. This directly matches the requirement for continuous, automated security assessments.

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Answer

AWS Config

Question 18

Which AWS service provides a petabyte-scale data transfer solution for moving large amounts of data into AWS when network transfer is not feasible?

Accepted Answer

AWS Snowball. AWS Snowball is a petabyte-scale data transport solution that uses physical storage devices to transfer large amounts of data into and out of AWS when network transfer is not feasible due to high latency, low bandwidth, or high costs. It is specifically designed for moving massive datasets (up to 80 TB per device) where network uploads would take weeks or months, making it the correct choice for this scenario.

Answer

AWS DataSync

Answer

AWS Transfer Family

Answer

Amazon S3 Multipart Upload

Question 19

Which AWS pricing model allows customers to commit to a consistent amount of compute usage (measured in $/hour) for a 1 or 3-year term in exchange for significant discounts, without being locked to specific instance types?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the flexibility to commit to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, providing significant discounts (up to 66%) without requiring you to lock into specific instance types, families, or regions. This model automatically applies the discount to any EC2 instance, Fargate, or Lambda usage within the committed compute commitment, making it the correct answer.

Answer

Standard Reserved Instances

Answer

Spot Instances

Answer

Convertible Reserved Instances

Question 20

A company runs a payment processing application on AWS that must comply with the Payment Card Industry Data Security Standard (PCI DSS). An external auditor requests a copy of the AWS SOC 2 report and the PCI DSS Attestation of Compliance (AOC) to verify the security controls of the underlying AWS infrastructure. The company needs to obtain these documents directly from AWS. Which AWS service should the company use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 reports and PCI DSS Attestations of Compliance (AOC). These documents are published directly by AWS and can be downloaded from the AWS Artifact console without needing to contact AWS support, meeting the auditor's requirement for direct retrieval.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor