CLF-C02 Cloud Technology and Services Practice Test 18 — 15 Questions

Question 1

Which Amazon S3 feature protects against accidental deletion by maintaining multiple versions of every object in a bucket?

Accepted Answer

S3 Versioning. S3 Versioning is the correct answer because it is the specific S3 feature designed to protect against accidental deletion by preserving multiple versions of every object in a bucket. When versioning is enabled, deleting an object does not permanently remove it; instead, S3 inserts a delete marker, and the previous versions remain recoverable. This directly addresses the scenario of preventing permanent data loss from accidental deletions.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

S3 Lifecycle policies

Question 2

A company needs to run scheduled jobs that execute SQL queries on their Amazon RDS database every night. Which AWS service provides fully managed job scheduling without maintaining dedicated compute resources?

Accepted Answer

AWS Lambda triggered by Amazon EventBridge Scheduler. AWS Lambda triggered by Amazon EventBridge Scheduler is the correct choice because EventBridge Scheduler provides fully managed, serverless job scheduling that can invoke Lambda functions to execute SQL queries on Amazon RDS. This eliminates the need to provision or maintain any dedicated compute resources, as the scheduling and execution are handled entirely by AWS.

Answer

Amazon EC2 with cron jobs

Answer

Amazon ECS with scheduled tasks

Answer

AWS OpsWorks

Question 3

Which AWS service provides managed Microsoft Windows file storage that supports SMB protocol, Active Directory integration, and Windows ACL permissions?

Accepted Answer

Amazon FSx for Windows File Server. Amazon FSx for Windows File Server provides fully managed native Microsoft Windows file storage that supports the Server Message Block (SMB) protocol, integrates with Active Directory for identity-based access, and enforces Windows NTFS ACL permissions. This makes it the only AWS service designed specifically to offer these Windows-native features out of the box.

Answer

Amazon EFS

Answer

Amazon S3

Answer

AWS Storage Gateway

Question 4

A company wants to centralize backup management across multiple AWS services (EC2, RDS, EFS, DynamoDB) from a single place. Which AWS service provides centralized backup management with policy-based scheduling?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, centralized backup solution that supports multiple AWS services including EC2, RDS, EFS, and DynamoDB. It allows you to define backup policies with schedule-based automation, retention rules, and lifecycle management from a single console, eliminating the need for custom scripts or per-service manual snapshots.

Answer

Amazon S3 Lifecycle policies

Answer

AWS DataSync

Answer

Amazon EBS Snapshots

Question 5

A company wants to accelerate their machine learning workloads using purpose-built ML chips instead of general-purpose GPUs. Which AWS compute option provides custom ML accelerator chips?

Accepted Answer

EC2 Inf and Trn instances (AWS Inferentia and Trainium). AWS Inferentia and Trainium are purpose-built ML accelerator chips designed specifically to optimize machine learning inference and training workloads, respectively. Unlike general-purpose GPUs, these custom chips provide higher performance per watt and lower cost for ML tasks, making them the ideal choice for accelerating ML workloads with dedicated hardware.

Answer

EC2 GPU instances (P and G family)

Answer

EC2 Compute-optimized instances (C family)

Answer

AWS Lambda with extended memory

Question 6

Which AWS service provides a private, dedicated network connection between an organization's on-premises environment and AWS through a colocation facility or telecommunications partner?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct answer because it provides a private, dedicated network connection from an on-premises data center to AWS, bypassing the public internet. This connection is established through a colocation facility or a telecommunications partner using industry-standard 802.1Q VLANs, offering consistent latency and higher bandwidth than internet-based VPNs.

Answer

AWS VPN CloudHub

Answer

Amazon CloudFront Private Content

Answer

AWS PrivateLink

Question 7

A SaaS company wants to expose their service to AWS customers through the AWS Marketplace and allow customers to access it privately without traversing the public internet. Which technology enables this?

Accepted Answer

AWS PrivateLink. AWS PrivateLink enables private connectivity between VPCs and AWS services without traversing the public internet. By creating a VPC Endpoint powered by PrivateLink, the SaaS company can expose their service via an internal Network Load Balancer (NLB) in their own VPC, and customers can access it privately using Elastic Network Interfaces (ENIs) in their VPCs. This ensures traffic stays within the AWS network, meeting the requirement for private, non-internet-based access through the AWS Marketplace.

Answer

Amazon VPC Peering

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 8

Which AWS service provides a fully managed environment for creating, maintaining, and documenting APIs using REST, HTTP, and WebSocket protocols?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is the correct service because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure APIs at any scale. It specifically supports RESTful APIs, HTTP APIs (for lower-latency and simpler integrations), and WebSocket APIs (for real-time two-way communication), making it the only AWS service that natively covers all three protocol types in a managed environment.

Answer

AWS AppSync

Answer

Elastic Load Balancing

Answer

AWS Lambda

Question 9

A company stores customer health records in an application database and needs a HIPAA-eligible AWS service for the database tier. Which relational database option on AWS is eligible for HIPAA workloads?

Accepted Answer

Amazon RDS with a signed Business Associate Agreement (BAA) with AWS. Amazon RDS can be used for HIPAA workloads when the customer has signed a Business Associate Agreement (BAA) with AWS and configures the RDS instance with encryption at rest (using AWS KMS) and encryption in transit (using TLS). The BAA is a contractual requirement under HIPAA that makes AWS a business associate, allowing covered entities to store protected health information (PHI) in RDS. Without a signed BAA, no AWS service is automatically HIPAA-eligible, even if technical security controls are in place.

Answer

Amazon RDS requires no special configuration for HIPAA compliance

Answer

Amazon Redshift only, because RDS does not support HIPAA workloads

Answer

Only self-managed databases on EC2 can be used for HIPAA workloads on AWS

Question 10

A company runs a fleet of 100 EC2 instances and needs to remotely execute commands, apply patches, and collect inventory data across all instances without opening SSH ports. Which AWS service enables this?

Accepted Answer

AWS Systems Manager. AWS Systems Manager is the correct service because it provides a unified interface to remotely execute commands, apply patches, and collect inventory data across EC2 instances without requiring SSH access. It uses the Systems Manager Agent (SSM Agent) installed on the instances and communicates over HTTPS (port 443), eliminating the need to open inbound SSH ports (port 22). This aligns directly with the requirement to manage a fleet of 100 instances securely and at scale.

Answer

AWS CloudShell

Answer

Amazon EC2 Instance Connect

Answer

AWS Config

Question 11

Which Amazon EC2 pricing option allows customers to bid for unused EC2 capacity with potential savings of up to 90%, while accepting that instances may be interrupted?

Accepted Answer

Spot Instances. Spot Instances allow customers to bid for unused EC2 capacity, offering potential savings of up to 90% compared to On-Demand pricing. However, these instances can be interrupted (terminated or hibernated) by AWS when the Spot price exceeds the customer's bid or when capacity is needed for On-Demand or Reserved Instance customers, making them ideal for fault-tolerant and flexible workloads.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 12

A company wants to migrate their on-premises VMware virtual machines to Amazon EC2. Which AWS service simplifies this lift-and-shift migration?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service (AWS MGN) is the correct choice because it is specifically designed to simplify and automate the lift-and-shift migration of on-premises VMware virtual machines to Amazon EC2. It continuously replicates source servers (including VMware VMs) to a staging area in AWS, then automatically converts and launches the instances on EC2, minimizing downtime and manual effort.

Answer

AWS Snowball

Answer

AWS Database Migration Service

Answer

Amazon EC2 Import/Export

Question 13

A gaming company needs ultra-low latency access to AWS compute for their mobile game players at 5G network edges. Which AWS infrastructure extension enables this?

Accepted Answer

AWS Wavelength Zones. AWS Wavelength Zones embed AWS compute and storage services at the edge of 5G networks, enabling ultra-low latency for mobile game players by minimizing the distance data must travel between the device and the application. This is specifically designed for applications that require single-digit millisecond latencies over 5G, such as real-time gaming, AR/VR, and live video processing.

Answer

AWS Local Zones

Answer

AWS Outposts

Answer

Amazon CloudFront Edge Locations

Question 14

Which AWS service provides a landing zone and automated multi-account setup with pre-configured security baselines and guardrails for AWS Organizations?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct service because it provides a pre-configured landing zone and automates the setup of a multi-account environment based on AWS Organizations. It enforces security baselines and guardrails (preventive and detective controls) using AWS Service Catalog and AWS Config rules, ensuring compliance from the start.

Answer

AWS Organizations

Answer

AWS CloudFormation StackSets

Answer

AWS Service Catalog

Question 15

A company's application receives images from users and needs to detect and blur any credit card numbers visible in the images for compliance. Which AWS AI service provides document text extraction from images?

Accepted Answer

Amazon Textract. Amazon Textract is specifically designed to extract text, including handwritten and printed text, from scanned documents and images. It goes beyond simple optical character recognition (OCR) by using machine learning to identify and extract key-value pairs, tables, and form data, making it the correct choice for extracting credit card numbers from images for compliance processing.

Answer

Amazon Rekognition

Answer

Amazon Comprehend

Answer

Amazon Macie