CLF-C02 Timed Practice Test 1 — 10 Questions

Question 1

A media company produces video content and stores all videos in Amazon S3. New videos are accessed frequently for the first 30 days after release. After that, access drops significantly, but the company must retain all videos for 5 years for archival purposes. The company wants to minimize storage costs without compromising retrieval speed for the frequently accessed period. Which S3 storage class strategy should the company implement?

10 minute time limit — choose an answer to begin.

Accepted Answer

Store newly uploaded videos in S3 Standard, then use an S3 Lifecycle policy to transition them to S3 Glacier Deep Archive after 30 days.. It uses S3 Standard for the first 30 days to ensure low-latency retrieval for frequently accessed content, then an S3 Lifecycle policy automatically transitions objects to S3 Glacier Deep Archive, which offers the lowest storage cost for long-term archival data. This balances cost and performance by matching the storage class to the access pattern, and the lifecycle transition is seamless with no manual intervention required.

Answer

Store all videos in S3 Standard for the entire 5-year retention period.

Answer

Store all videos in S3 Glacier Deep Archive immediately upon upload.

Answer

Store newly uploaded videos in S3 One Zone-IA, then transition to S3 Glacier Flexible Retrieval after 30 days.

Question 2

A company moves its infrastructure to AWS. The company's IT team notices that they have no control over which specific physical server their virtual machines run on, and they are unaware of the exact hardware location except at the regional level. The underlying physical resources are shared across multiple AWS customers. Which essential characteristic of cloud computing does this scenario BEST describe?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to customer demand. The scenario describes the customer having no control over the exact physical server or hardware location beyond the regional level, which is the essence of resource pooling. This allows AWS to achieve economies of scale while abstracting the underlying hardware from the customer.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 3

Which AWS service provides managed Microsoft Windows file storage that supports SMB protocol, Active Directory integration, and Windows ACL permissions?

Accepted Answer

Amazon FSx for Windows File Server. Amazon FSx for Windows File Server provides fully managed native Microsoft Windows file storage that supports the Server Message Block (SMB) protocol, integrates with Active Directory for identity-based access, and enforces Windows NTFS ACL permissions. This makes it the only AWS service designed specifically to offer these Windows-native features out of the box.

Answer

Amazon EFS

Answer

Amazon S3

Answer

AWS Storage Gateway

Question 4

A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations allows the company to consolidate multiple AWS accounts under a single management account, enabling consolidated billing for a single monthly invoice and volume pricing discounts. Service Control Policies (SCPs) provide centralized governance by restricting the AWS services and Regions that member accounts can use, such as preventing EC2 instances from being launched outside us-east-1 and eu-west-1. This combination directly addresses both the CFO's billing consolidation needs and the security team's data residency compliance requirements.

Answer

AWS Budgets

Answer

AWS Identity and Access Management (IAM) cross-account roles

Answer

AWS Cost and Usage Reports

Question 5

A gaming company runs a multiplayer game backend on Amazon EC2 instances. The game experiences variable traffic patterns: low usage during weekday mornings and high usage during evenings and weekends. The company uses an Auto Scaling group to automatically add instances during peak hours and remove them during low traffic. The company is billed only for the compute capacity actually consumed during each hour. Which characteristic of cloud computing does this usage-based billing model best illustrate?

Accepted Answer

Measured service. The usage-based billing model, where the company pays only for the compute capacity consumed each hour, is a direct example of measured service. This characteristic of cloud computing involves metering resource usage (e.g., CPU hours, data transfer) and charging based on that consumption, which is exactly what the Auto Scaling group enables by dynamically adjusting instance count and billing only for active hours.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 6

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 7

A company uses AWS Organizations with separate accounts for development, testing, and production. The finance team wants to track monthly spending by internal project, but a single project may use resources across multiple accounts. The team has applied a 'Project' tag to all resources. They need a detailed billing report that shows costs grouped by this Project tag, combining data from all accounts. Which AWS feature should they enable to meet this requirement?

Accepted Answer

AWS Cost and Usage Reports with cost allocation tags activated. AWS Cost and Usage Reports (CUR) with cost allocation tags activated is the correct choice because it provides the most detailed billing data, including all tags, and can be delivered to an S3 bucket for analysis. This allows the finance team to group costs by the 'Project' tag across all accounts in the AWS Organization, meeting the requirement for a detailed, combined report.

Answer

AWS Consolidated Billing

Answer

AWS Cost Explorer with tag filtering

Answer

AWS Budgets with tag-based alerts

Question 8

A company runs a monthly data processing job that requires 100 Amazon EC2 instances to complete within 4 hours. The job is not needed at any other time. The company previously ran this job on its on-premises servers, which required maintaining enough capacity to handle the peak load year-round, leading to low average utilization. The company has now migrated the job to AWS. Each month, the company automatically provisions the 100 instances, runs the job, and then terminates the instances. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Rapid elasticity. This scenario best illustrates rapid elasticity because the company provisions 100 EC2 instances only when needed for the monthly job, scaling up from zero to 100 instances in minutes and then scaling back down to zero after the job completes. Rapid elasticity allows cloud resources to be quickly scaled out (increased) and scaled in (decreased) to match demand, eliminating the need to maintain idle capacity for peak loads.

Answer

Resource pooling

Answer

Measured service

Answer

On-demand self-service

Question 9

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Accepted Answer

Attach an IAM role with the appropriate S3 permissions to the EC2 instance. Attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.

Answer

Hardcode the IAM user access keys in the application code

Answer

Store IAM access keys in environment variables on the EC2 instance

Answer

Create an IAM user and configure the instance with its credentials

Question 10

A company uses multiple AWS accounts. The security team wants to enforce two requirements for all Amazon S3 buckets: first, server-side encryption must be enabled using AWS KMS; second, no bucket can be publicly accessible. The team needs a service that continuously monitors the configuration of S3 buckets across all accounts, detects when a bucket violates either requirement, and automatically applies corrective actions (such as enabling default encryption or removing public access). Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, evaluation, and automated remediation of resource configurations across multiple accounts. With AWS Config rules (e.g., managed rules like `s3-bucket-server-side-encryption-enabled` and `s3-bucket-public-read-prohibited`), you can detect noncompliant S3 buckets and trigger AWS Systems Manager Automation documents or Lambda functions to automatically enable default encryption or remove public access. AWS Config also supports multi-account aggregation via an aggregator, allowing the security team to enforce these requirements across all accounts from a single management account.

Answer

AWS Trusted Advisor

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail