CLF-C02 Cloud Technology and Services Practice Question
A company's IT team manually provisions S3 buckets, EC2 instances, security groups, and IAM roles for each new project using the AWS Management Console. This process often results in configuration errors, such as overly permissive security rules or incorrect tagging, which the security team then has to fix manually. The company wants to define its entire infrastructure in a declarative template file, store it in version control, and have AWS automatically create or update the resources based on that template. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse AWS Elastic Beanstalk as an infrastructure-as-code solution because it automates deployment, but it does not provide the declarative template control over all AWS resources that CloudFormation offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation
AWS CloudFormation is the correct service because it allows you to define your entire infrastructure—including S3 buckets, EC2 instances, security groups, and IAM roles—in a declarative JSON or YAML template. You can store this template in version control, and CloudFormation automatically provisions or updates the resources to match the template, eliminating manual configuration errors like overly permissive security rules or incorrect tagging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudFormation
Why this is correct
AWS CloudFormation is the correct service for infrastructure as code. It allows you to define all AWS resources in a declarative template, version-control the template, and automatically create or update the resources as a stack.
- ✗
AWS Elastic Beanstalk
Why it's wrong here
AWS Elastic Beanstalk is a platform-as-a-service (PaaS) that handles application deployment and scaling, but it does not allow you to define arbitrary resources like S3 buckets or IAM roles in a template. It abstracts the underlying infrastructure, which does not fit the requirement for full control over resource definitions.
When this WOULD be correct
A company wants to quickly deploy a web application without managing the underlying infrastructure, and needs automatic scaling, load balancing, and monitoring. The question would specify that they only need to deploy application code, not define all resources like S3 buckets or IAM roles.
- ✗
AWS OpsWorks
Why it's wrong here
AWS OpsWorks is a configuration management service that uses Chef and Puppet to manage server configurations. It is not designed for declaratively provisioning a broad set of AWS resources (e.g., S3 buckets, IAM roles) from a template.
When this WOULD be correct
A company uses Chef recipes to manage configuration of EC2 instances and on-premises servers, and needs a managed service to automate server configuration, deployment, and lifecycle management. AWS OpsWorks would be the correct choice for such a scenario.
- ✗
AWS CodeDeploy
Why it's wrong here
AWS CodeDeploy is a deployment automation service that pushes application revisions to already-provisioned compute resources such as EC2 instances, on-premises servers, or Lambda functions. It can perform in-place or blue/green deployments and manage lifecycle hooks, but it cannot create or declare cloud infrastructure like S3 buckets or EC2 instances from a template. The question is about provisioning infrastructure resources, so CodeDeploy's post-provisioning code deployment role is out of scope.
When this WOULD be correct
A company wants to automate the deployment of application code to EC2 instances in a rolling update fashion, ensuring zero downtime and automatic rollback on failure. They need a service that integrates with their CI/CD pipeline to deploy code from a repository.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS CloudFormationCorrect answer▾
Why this is correct
AWS CloudFormation is the correct service for infrastructure as code. It allows you to define all AWS resources in a declarative template, version-control the template, and automatically create or update the resources as a stack.
✗AWS Elastic BeanstalkWrong answer — click to see why▾
Why this is wrong here
AWS Elastic Beanstalk is a PaaS service for deploying and scaling web applications, not for declaratively defining all infrastructure resources (like S3 buckets, IAM roles) in a template. It abstracts infrastructure management rather than providing full control via a declarative template.
★ When this WOULD be the correct answer
A company wants to quickly deploy a web application without managing the underlying infrastructure, and needs automatic scaling, load balancing, and monitoring. The question would specify that they only need to deploy application code, not define all resources like S3 buckets or IAM roles.
Why candidates choose this
Candidates may confuse Elastic Beanstalk's ability to provision resources automatically with the declarative infrastructure-as-code approach of CloudFormation, not realizing Elastic Beanstalk does not allow full control over all resource definitions in a single template.
✗AWS OpsWorksWrong answer — click to see why▾
Why this is wrong here
AWS OpsWorks is a configuration management service that uses Chef or Puppet, not a declarative template service for defining infrastructure as code. It does not store templates in version control and automatically create/update resources based on a declarative template file.
★ When this WOULD be the correct answer
A company uses Chef recipes to manage configuration of EC2 instances and on-premises servers, and needs a managed service to automate server configuration, deployment, and lifecycle management. AWS OpsWorks would be the correct choice for such a scenario.
Why candidates choose this
Candidates may confuse OpsWorks with CloudFormation because both are infrastructure automation services, but OpsWorks focuses on configuration management using Chef/Puppet, not declarative infrastructure provisioning.
✗AWS CodeDeployWrong answer — click to see why▾
Why this is wrong here
AWS CodeDeploy automates code deployments to running instances, not infrastructure provisioning. It does not define or manage infrastructure resources like S3 buckets, EC2 instances, or IAM roles from a declarative template.
★ When this WOULD be the correct answer
A company wants to automate the deployment of application code to EC2 instances in a rolling update fashion, ensuring zero downtime and automatic rollback on failure. They need a service that integrates with their CI/CD pipeline to deploy code from a repository.
Why candidates choose this
Candidates may confuse CodeDeploy with infrastructure-as-code tools because both involve automation and templates, but CodeDeploy focuses on application deployment, not infrastructure creation.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.