AWS Certified Cloud Practitioner CLF-C02 (CLF-C02) — Questions 976–988

AWS CloudTrail records API activity but does not continuously evaluate resource configurations like MFA status or trigger notifications for non-compliant users.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for verifying IAM user MFA status or sending notifications about new users without MFA.

AWS Trusted Advisor provides best-practice checks, including MFA on root account, but it does not automatically verify MFA for all IAM users or trigger notifications when a new user is created without MFA. It lacks the continuous compliance monitoring and custom rule enforcement needed for this requirement.

A security team needs to audit all IAM user creation events and receive real-time alerts when a new user is created without MFA. CloudTrail can be used with CloudWatch Events to trigger a notification on the CreateUser API call, and then a custom Lambda function can check MFA status.

A company needs to continuously monitor AWS accounts for suspicious API calls, such as unusual IAM user creation patterns or potential credential compromise, and receive alerts for security findings. GuardDuty would be the correct service to detect and notify about such threats.

A company wants a high-level assessment of their AWS account against best practices, including checking if MFA is enabled on the root account, and needs a summary report with recommendations. Trusted Advisor would be the correct service for this advisory check.

Candidates may think CloudTrail can monitor user creation events and trigger notifications, but they overlook that it does not natively evaluate MFA configuration compliance without additional custom logic.

Candidates may confuse GuardDuty's monitoring and alerting capabilities with the compliance checking and notification requirements, assuming it can be used to track IAM user configurations.

Trusted Advisor includes a security check for MFA on the root account, leading candidates to assume it covers all IAM users. They overlook that it does not monitor per-user MFA status or provide event-driven notifications for new users.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating resource configurations against internal security policies like encryption or public access settings.

AWS Trusted Advisor provides best-practice checks and recommendations, but it does not continuously monitor resource configurations against custom internal policies or provide a compliance dashboard over time; it focuses on AWS-recommended best practices, not user-defined rules.

AWS CloudTrail records API activity for auditing, but it does not evaluate resource configurations against rules or provide a compliance dashboard for resource settings like encryption or public access.

A company wants to automatically assess EC2 instances for common software vulnerabilities and network exposures, and receive a detailed report of findings with remediation guidance.

A company wants a service that automatically checks their AWS account against AWS best practices (e.g., cost optimization, performance, security) and provides recommendations to improve their environment. They need a high-level overview of potential issues without defining custom rules.

A company needs to audit all API calls made to the AWS environment, track changes to resources, and detect unauthorized access or anomalous activity for security investigation.

Candidates may confuse 'security assessment' with 'configuration compliance', assuming Inspector covers all security checks, including resource configuration rules.

Candidates may confuse Trusted Advisor's best-practice checks with compliance monitoring, assuming it can evaluate custom policies, or they may think its dashboard provides the required compliance status tracking.

Candidates may confuse CloudTrail's logging of API calls with the configuration monitoring and compliance evaluation provided by AWS Config, as both are related to governance and security.

Broad network access refers to capabilities being available over the network and accessed by standard mechanisms, not to the ability to provision resources without human interaction. The scenario emphasizes self-provisioning, not network accessibility.

Resource pooling refers to multi-tenant computing resources that are dynamically assigned and reassigned to serve multiple customers, which is not demonstrated by a single developer provisioning a server without IT interaction.

The scenario emphasizes the ability to provision resources without human interaction, which is on-demand self-service. Measured service refers to metering and billing based on usage, not the provisioning process.

A question describing how users can access cloud services from various devices (e.g., laptops, smartphones, tablets) over the internet using standard protocols would make broad network access the correct answer.

A question describing how multiple customers share the same physical infrastructure while their data remains isolated, or how AWS dynamically allocates compute resources across different users based on demand, would make resource pooling the correct answer.

A company uses AWS to track and bill each department for its exact resource consumption, with detailed usage reports. The question asks which characteristic enables pay-per-use billing and resource monitoring.

Candidates may confuse the ability to access AWS via the internet (broad network access) with the self-service provisioning aspect, especially since both involve logging into the console.

Candidates may confuse the ability to quickly provision resources (on-demand self-service) with the underlying multi-tenant architecture (resource pooling) that enables cloud providers to offer such services efficiently.

Candidates may confuse the automated provisioning with the metering aspect, thinking that 'measured' implies the ability to get resources quickly, or they may not distinguish between provisioning and usage tracking.

S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, but it does not support time-based transitions to a specific lower-cost storage class after a fixed period (e.g., 30 days) or automatic deletion after a fixed retention period (e.g., 7 years).

S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed retention period, not to automate transitions between storage classes or schedule deletions based on age.

S3 Versioning is used to preserve, retrieve, and restore every version of an object, not to automate transitions between storage classes or schedule deletions. It does not provide lifecycle management for moving or deleting files based on time.

A company stores data with unpredictable access patterns and wants to optimize storage costs without manually managing lifecycle rules. S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, and can archive to Deep Archive after a set number of days if not accessed.

A company must store sensitive financial records that cannot be modified or deleted for 7 years to meet regulatory compliance. S3 Object Lock with a retention mode (e.g., COMPLIANCE) would enforce this immutability.

A company needs to protect against accidental deletion or overwrite of critical data files and must be able to recover previous versions. S3 Versioning would be the correct feature to enable version control and restore capabilities.

Candidates may confuse Intelligent-Tiering's automatic cost optimization with the time-based transitions and deletions provided by Lifecycle policies, assuming it can handle fixed schedules when it is designed for dynamic access patterns.

Candidates may confuse Object Lock's retention capabilities with lifecycle management, thinking it can also handle automatic transitions and deletions, but Object Lock only enforces write-once-read-many (WORM) protection.

Candidates may confuse versioning with lifecycle policies because both involve managing object states over time, but versioning focuses on version preservation rather than automated storage transitions or deletions.

AWS Trusted Advisor provides best-practice checks, including S3 bucket permissions, but it does not allow you to define custom rules or evaluate compliance continuously across all accounts from a single dashboard. It also does not integrate with AWS Organizations to aggregate compliance status.

Amazon Inspector is designed for vulnerability management and network security assessments of EC2 instances and container workloads, not for evaluating S3 bucket policies or compliance across multiple accounts.

AWS Shield is a managed DDoS protection service, not a configuration compliance or auditing tool. It does not check S3 bucket policies for public access or provide a compliance dashboard across multiple accounts.

A company wants a quick, no-configuration overview of their AWS account's adherence to AWS best practices, including S3 bucket public access checks, and they only need a summary report without custom rules or cross-account aggregation.

An exam question where the requirement is to automatically assess EC2 instances for software vulnerabilities, unintended network exposure, or deviations from security best practices, and you need to view findings in a single dashboard.

A company wants to protect its web applications from DDoS attacks and needs a managed service that provides always-on detection and automatic mitigations. AWS Shield would be the correct answer in that scenario.

Candidates may confuse Trusted Advisor's security checks (like S3 bucket permissions) with the ability to define and enforce custom rules, and they might overlook the requirement for custom rules and cross-account dashboard aggregation.

Candidates may confuse Inspector's security assessment capabilities with the broader compliance evaluation needed for S3 bucket policies, or assume it can check all AWS resources.

Candidates may confuse AWS Shield with a security service that monitors all types of security threats, including misconfigurations, due to its name implying broad protection.

On-demand self-service refers to a user's ability to provision computing resources without human interaction, not to data residency or physical server location constraints.

Broad network access refers to the ability to access cloud resources over the network via standard protocols, not to data residency or physical server location constraints.

Rapid elasticity refers to the ability to quickly scale resources up or down based on demand, not to data residency or physical server location constraints.

A question describing a scenario where a user can provision and manage AWS resources via a web portal without needing to contact AWS support would make on-demand self-service the correct answer.

A question asking which cloud characteristic enables users to access resources from various devices (e.g., laptops, smartphones) over the internet using standard protocols would have broad network access as the correct answer.

A company experiences unpredictable spikes in traffic and needs to automatically provision and de-provision compute resources to match demand without manual intervention. Rapid elasticity would be the correct characteristic describing this ability.

Candidates may confuse the ability to choose a region (self-service) with the underlying physical location constraints, but on-demand self-service is about provisioning, not data residency.

Candidates may confuse 'broad network access' with the idea that data can be accessed from anywhere, but the question is about where data is stored, not how it is accessed.

Candidates may confuse the dynamic nature of cloud resources with the need to control data location, assuming that elasticity implies flexibility in where data is stored.

AWS CloudFormation is an Infrastructure as Code (IaC) service that provisions and manages AWS resources, but it does not automatically handle capacity provisioning, load balancing, auto-scaling, or health monitoring out of the box. The team would need to manually define and configure these components in templates, which contradicts the requirement for a fully managed service that abstracts EC2 management.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, requiring manual management of EC2 instances and application stacks, which contradicts the requirement for a fully managed service without underlying infrastructure management.

Amazon EC2 Auto Scaling only handles scaling EC2 instances based on demand, but it does not provide a fully managed platform for deploying web applications, nor does it handle capacity provisioning, load balancing, or application health monitoring automatically without additional configuration.

A company needs to deploy a standardized multi-tier application across multiple AWS accounts and regions with strict compliance requirements. They want to define the entire infrastructure as code, version-control it, and ensure consistent, repeatable deployments. AWS CloudFormation would be the correct choice for this scenario.

A company needs to manage infrastructure as code with configuration management using Chef or Puppet, and requires fine-grained control over the application stack and operating system, while still benefiting from AWS integration.

An exam question asking which service automatically adjusts the number of EC2 instances to handle changes in demand, without requiring manual intervention, and where the team is already managing the application stack separately.

Candidates may confuse CloudFormation's ability to automate resource provisioning with the fully managed application platform provided by Elastic Beanstalk, overlooking that CloudFormation requires manual configuration of scaling and health monitoring.

Candidates may confuse OpsWorks with Elastic Beanstalk because both are application management services, but OpsWorks requires more manual configuration and is not fully managed like Elastic Beanstalk.

Candidates may confuse auto-scaling with a fully managed application platform, thinking that EC2 Auto Scaling alone can deploy and manage the entire web application stack.

Under the AWS Shared Responsibility Model, AWS is responsible for applying minor version patches to the RDS database engine. The customer only controls patching for the EC2 instance or self-managed databases.

Under the AWS Shared Responsibility Model, AWS manages the physical security of data centers, including where RDS instances are hosted. The customer is not responsible for data center physical security.

Under the AWS Shared Responsibility Model, AWS is responsible for the physical infrastructure, including replacing failed hardware components in the RDS host server. The customer does not manage hardware replacements.

A question asks: 'A company is running MySQL on an EC2 instance. Which task is the customer's responsibility?' In that scenario, the customer manages the OS and database, including applying minor version patches.

If the question asked about responsibilities for an on-premises data center or a hybrid setup where the customer owns the physical infrastructure, then managing physical security would be the customer's responsibility.

In a question about an on-premises database migration where the customer retains full control over the underlying hardware (e.g., using dedicated hosts or EC2 instances), the customer would be responsible for replacing failed hardware components.

Candidates may confuse RDS (managed service) with self-managed databases on EC2, assuming patching is always the customer's responsibility.

Candidates may confuse physical security as a shared responsibility, not realizing that AWS fully handles physical security for managed services like RDS.

Candidates may confuse the shared responsibility model, thinking that since they are responsible for the database configuration and data, they also handle hardware maintenance, especially if they are used to managing on-premises infrastructure.

High availability ensures system uptime and fault tolerance, but does not directly relate to paying only for used compute capacity; the CFO's goal is cost reduction based on usage, not availability.

The question asks for the characteristic most directly aligned with paying only for compute capacity actually used, which is the pay-as-you-go pricing model. Elasticity enables scaling but does not itself determine the pricing model; you could have elasticity but still pay for reserved capacity.

The question asks for the characteristic most directly aligned with paying only for compute capacity actually used. While choosing from a wide variety of instance types can help optimize costs, it does not directly enable paying only for what you use; that is the pay-as-you-go model.

A question asking which AWS feature ensures minimal downtime during failures, such as 'A company needs its application to remain accessible even if an entire data center fails. Which characteristic of AWS cloud computing addresses this requirement?'

A question that asks: 'Which AWS feature allows a workload to automatically add or remove compute resources in response to changing demand, without manual intervention?' In that context, elasticity would be the correct answer.

A question asks: 'Which AWS feature allows a company to select the most cost-effective compute resources for a specific workload, such as choosing between compute-optimized and memory-optimized instances?' In that context, the ability to choose from a wide variety of instance types would be the correct answer.

Candidates may associate high availability with AWS's ability to provide resources on demand, mistakenly thinking it enables paying only for what you use, but it actually focuses on redundancy and uptime.

Candidates confuse the mechanism (elasticity) with the financial benefit (pay-as-you-go). They think that because elasticity allows scaling to match usage, it directly leads to paying only for what you use, but the pricing model is what actually determines the cost.

Candidates may think that selecting the right instance type is key to cost savings, confusing the optimization of resource selection with the fundamental pricing model that charges only for consumed resources.

Resource pooling refers to the provider's ability to serve multiple customers from shared physical resources, but the cost advantage described in the question is specifically due to the scale of operations lowering per-unit costs, which is economies of scale.

Measured service refers to the ability to monitor and control resource usage (pay-per-use), not the cost advantage from spreading infrastructure costs across many customers.

Broad network access refers to the ability to access cloud resources over the network via standard protocols, not to cost advantages from shared infrastructure.

A question that asks: 'Which cloud characteristic allows multiple customers to share the same physical infrastructure while maintaining logical isolation?' would make resource pooling the correct answer.

A question asking which AWS concept allows customers to pay only for the resources they consume, with usage metered and billed accordingly, would have measured service as the correct answer.

A question asking which AWS characteristic allows resources to be accessed from anywhere via the internet, such as 'Which concept describes the ability to access cloud services from various devices over the network?'

Candidates may confuse resource pooling with economies of scale because both involve sharing resources across many customers, but resource pooling focuses on multi-tenancy and isolation, not cost reduction from large-scale operations.

Candidates may confuse 'measured service' with cost efficiency because both involve pricing, but measured service is about usage tracking, not the underlying cost advantage of scale.

Candidates may confuse 'broad network access' with the idea of spreading costs across many users, misinterpreting 'broad' as relating to a large customer base rather than network accessibility.

AWS Budgets allows you to set cost and usage budgets and receive alerts, but it does not provide a graphical dashboard for historical cost analysis by service, region, or tags, nor does it generate cost forecasts.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not offer a graphical dashboard for analyzing historical spending by service, region, or tags, nor does it generate cost forecasts.

AWS Consolidated Billing aggregates costs across multiple accounts but does not provide a graphical dashboard, cost breakdown by service/region/tags, or cost forecasting.

A finance team needs to set a monthly budget for EC2 costs and receive alerts when spending exceeds 80% of the budget. AWS Budgets would be the correct tool for creating cost budgets and sending notifications.

A company wants to identify underutilized EC2 instances and receive recommendations to reduce costs. Trusted Advisor would be correct because it checks for idle instances and provides cost optimization recommendations.

A company needs to centrally manage payment and aggregate costs for multiple AWS accounts, and wants to receive a single monthly bill. The question would ask for a tool to simplify billing across accounts, not for analysis or forecasting.

Candidates may confuse AWS Budgets with cost analysis tools because the name suggests it involves cost tracking, but its primary function is budgeting and alerts, not historical analysis or forecasting.

Candidates may confuse Trusted Advisor's cost optimization checks with cost analysis and forecasting capabilities, assuming it can provide historical spending insights and forecasts.

Candidates may confuse consolidated billing with cost analysis tools, thinking that combining bills automatically provides cost breakdowns and forecasts, but it only aggregates invoices without analytical features.

AWS Site-to-Site VPN uses the public internet to establish encrypted tunnels, so it does not bypass the public internet and cannot guarantee consistent high throughput and low latency like a dedicated private connection.

AWS VPN CloudHub is a hub-and-spoke VPN topology that connects multiple remote sites via the internet, not a dedicated private connection. It does not bypass the public internet or provide consistent high throughput and low latency like Direct Connect.

AWS Transit Gateway is a network transit hub to interconnect VPCs and on-premises networks, but it does not provide a dedicated private connection itself; it requires an underlying connection like AWS Direct Connect or VPN. The question specifically asks for a dedicated private network connection that bypasses the public internet, which Transit Gateway alone cannot fulfill.

A company needs to securely connect its on-premises network to AWS over the internet with encryption, and is willing to accept variable throughput and latency, while prioritizing cost savings over dedicated bandwidth.

A company has multiple branch offices with existing VPN connections to AWS and wants to enable inter-site communication through a central hub in AWS. The question would specify using existing VPN connections and needing a hub-and-spoke model.

A company has multiple VPCs and on-premises networks that need to be interconnected with centralized management. They want to simplify routing and reduce peering complexity. In this scenario, AWS Transit Gateway would be the correct answer because it acts as a hub to connect all networks.

Candidates may confuse VPN with a dedicated connection, assuming that encryption implies a private link, or they may overlook the requirement to bypass the public internet.

Candidates may confuse CloudHub as a dedicated connection solution because it involves VPNs and 'hub' terminology, but it still relies on the public internet and lacks the private, dedicated nature of Direct Connect.

Candidates may confuse Transit Gateway as a direct replacement for Direct Connect because it can integrate with Direct Connect, but they overlook that Transit Gateway is a routing service, not a physical connection.