CLF-C02 Cloud Technology and Services Practice Question
A company manages a fleet of hundreds of EC2 instances and needs to automate patching across all instances, run commands remotely without SSH, and store configuration parameters centrally. Which AWS service provides these operational management capabilities?
⚠ Common exam trap
It's easy for candidates to confuse AWS Systems Manager with AWS Config because both deal with 'management' and 'configuration,' but Config is only for compliance auditing and drift detection, not for patching or remote command execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager
AWS Systems Manager is the correct choice because it provides a unified interface for operational management tasks, including automated patching via Patch Manager, remote command execution without SSH using Run Command, and centralized parameter storage with Parameter Store. These capabilities directly address the need to manage fleets of EC2 instances at scale without requiring direct network access to each instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is a monitoring and observability service that collects metrics, logs, and alarms for resources, which can help you detect an OS-level issue or patch-related failure after the fact. However, it has no mechanism to initiate patching, to execute commands interactively or at scale on running instances, or to store configuration parameters securely. It is purely a data plane for observation, not an operations/management plane for remediation.
- ✗
AWS Config
Why it's wrong here
AWS Config is a governance and compliance service that records configuration changes for supported AWS resources and can evaluate those configurations against rules, including detection of unapproved software or managed instance inventory. But it is a detective control: it can alert you that an instance is out of compliance, yet it lacks the ability to remediate by installing patches, cannot open a shell session or run ad hoc scripts, and does not offer a parameter store for application configuration. Its role ends at visibility and auditing.
- ✓
AWS Systems Manager
Why this is correct
AWS Systems Manager is the native operations hub that delivers exactly the capabilities described in the question: Patch Manager automates both scanning and installation of missing OS patches across EC2 and hybrid fleets; Run Command provides agent-based remote command execution without requiring SSH/RDP; Session Manager offers short-lived, browser-based interactive shells; and Parameter Store securely centralizes configuration data and secrets for applications. Its SSM Agent, running on managed instances, is what makes in-guest operations and patching possible, tying the entire set of features together. In the CLF-C02 context, when a question asks for one service that covers patching, remote execution, and parameter storage, Systems Manager is the only answer.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code (IaC) service that models and provisions AWS resources in a declarative template, but it operates at the infrastructure provisioning layer, not the guest OS layer. While it can launch and configure instances via user-data scripts at boot, it provides no ongoing OS patch lifecycle management, no on-demand remote command execution across running fleets, and no centralized parameter store for secrets. Patch compliance and maintenance are outside its scope.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.