CLF-C02 practice questions and answers

Correct answer: B — Variable expense instead of capital expense

Trading capital expense for variable expense means you stop buying data centre hardware ahead of time and instead pay for what you consume. Economies of scale is about AWS's bulk purchasing lowering prices. Global reach and agility are separate benefits.

Correct answer: A — Regions and Availability Zones

A Region is a geographic area, and each Region contains multiple Availability Zones — separate groups of data centres. Deploying across AZs survives one data centre failure, and using several Regions puts the app near users. Edge locations cache content, VPCs are networking constructs, and accounts are for organization.

Correct answer: C — Configuring security groups and patching the guest operating system on EC2

AWS is responsible for security *of* the cloud — hardware, hypervisor, facilities, and the global network. The customer is responsible for security *in* the cloud — the guest OS, security groups, IAM settings, and their own data.

Correct answer: C — Enable MFA on it, lock it away, and use IAM identities for daily work.

The root user can do everything in the account, so AWS says to enable multi-factor authentication, avoid root access keys, and do daily work with IAM users or IAM Identity Center identities that have only the permissions they need.

Correct answer: A — Amazon EC2

Amazon EC2 gives virtual machines you choose, size, and manage. S3 is object storage, Lambda runs code without servers you manage, and RDS is a managed relational database.

Correct answer: B — AWS Lambda

Lambda is the serverless compute service: you upload a function, AWS runs it when an event arrives, and billing is based on requests and run duration. Auto Scaling still manages EC2 servers, Lightsail is simplified virtual servers, and Batch schedules batch jobs on compute you configure.

Correct answer: A — AWS Cost Explorer

Cost Explorer shows past and forecast spend with graphs and filters. Budgets sends alerts when spend passes a threshold you set. The Pricing Calculator estimates the cost of an architecture before you build it. Trusted Advisor gives best-practice checks, including some cost ones.

Correct answer: D — Enterprise

A designated technical account manager and a 15-minute response for business-critical outages come with the Enterprise plan. Enterprise On-Ramp offers a 30-minute response and pooled TAM access. Business has a one-hour response for production down. Developer is for testing and has no such guarantees.

Correct answer: C — Amazon S3

Amazon S3 is object storage built for any amount of data, reachable over HTTPS. EBS is block storage for a single EC2 instance, EFS is a shared file system for Linux instances, and Storage Gateway connects on-premises systems to AWS storage.

Correct answer: A — AWS Artifact

AWS Artifact is the self-service portal for AWS audit reports and agreements. Config records resource configuration changes, CloudTrail records API activity, and Inspector scans workloads for vulnerabilities.

Correct answer: A — Operational Excellence

Operational Excellence covers running workloads, gaining insight into them, and improving processes over time. Reliability is about recovering from failure, Performance Efficiency about using resources well, and Sustainability about reducing environmental impact.

Correct answer: B — AWS CloudTrail

CloudTrail is the audit log of API activity — the identity, the action, the source IP, and the time. CloudWatch collects metrics and logs about performance, Config tracks resource configuration history, and X-Ray traces requests through an application.

Correct answer: B — Usage from all accounts is combined, which can qualify the group for volume discounts.

Consolidated billing produces one bill for the organization and adds up usage across accounts, so the group can reach volume pricing tiers sooner. Reserved Instance and Savings Plans benefits can also be shared across accounts when sharing is enabled. Regions are not a factor.

Correct answer: B — Amazon RDS

Amazon RDS runs managed relational engines such as MySQL, PostgreSQL and SQL Server, and handles backups, patching, and failover. DynamoDB is a NoSQL key-value database, Redshift is a data warehouse for analytics, and ElastiCache is an in-memory cache.

Correct answer: A — Amazon GuardDuty

GuardDuty analyses CloudTrail, VPC flow logs and DNS logs to detect threats such as compromised credentials and crypto-mining. Shield defends against DDoS, WAF filters web requests, and Macie discovers sensitive data such as personal information in S3.

Correct answer: B — Hybrid

A hybrid deployment mixes cloud resources with existing on-premises infrastructure, usually connected by VPN or AWS Direct Connect. Cloud-native means everything runs in the cloud, and on-premises means nothing does.

Correct answer: A — AWS CloudFormation

CloudFormation describes AWS resources in a template and creates or updates them as a stack, so environments are repeatable. Systems Manager operates existing instances, OpsWorks is managed Chef/Puppet, and EventBridge routes events between services.

Correct answer: C — Spot Instances

Spot Instances use spare EC2 capacity at up to about 90% off On-Demand, but AWS can reclaim them with a short warning — fine for interruptible work. Reserved Instances and Savings Plans need a one- or three-year commitment, and Dedicated Hosts cost more, not less.

Correct answer: A — AWS IAM

IAM manages identities and permissions for AWS resources. Directory Service runs managed Microsoft Active Directory, Cognito handles sign-up and sign-in for application end users, and Secrets Manager stores credentials.

Correct answer: A, B — AWS Site-to-Site VPN · AWS Direct Connect

Site-to-Site VPN builds an encrypted tunnel over the internet, and Direct Connect provides a dedicated private circuit into AWS. CloudFront is a content delivery network, Transfer Family runs managed SFTP/FTPS endpoints, and Route 53 is DNS.

Correct answer: A — Stop guessing capacity — scale up or down as demand changes

Guessing capacity is the specific problem described: in the cloud you provision what you need now and change it later. The other options are real benefits, but they describe global reach, AWS's bulk pricing, and getting out of data centre operations.

Correct answer: A — Scalability is the ability to grow to handle more load; elasticity is automatically adding and removing resources as demand changes.

Scalability is capacity to grow. Elasticity adds the automatic, two-way part — resources appear when demand rises and go away when it falls, which is what keeps costs matched to use.

Correct answer: A — Deploy the application across at least two Availability Zones

Availability Zones are separate groups of data centres inside one Region, so spreading across two or more survives a single data centre failure. Two Regions also works but goes beyond the question. A bigger instance is still one instance, and edge locations only cache content.

Correct answer: A — Cost Optimization

Cost Optimization is about running systems at the lowest price point — right-sizing, buying the right pricing model, and turning off what you do not use. Performance Efficiency is about using resources effectively as demand changes.

Correct answer: A, B — Latency to the company's users · Data governance and legal requirements about where data is stored

Region choice comes down to latency to users, compliance rules about data location, which services are available there, and price, since prices differ by Region. IAM is a global service and the other options are not real considerations.

Correct answer: A — To cache content close to users so it is delivered with lower latency

Edge locations are sites used by services such as CloudFront and Route 53 to serve cached content and DNS responses near the user. They are not Regions, do not host databases, and are not archive storage.

Correct answer: A — You do not provision, patch or manage servers, and you pay for what you use.

Serverless means AWS runs and scales the underlying servers so you never see them — Lambda, S3, DynamoDB and SQS are examples. Servers still exist; you just have no responsibility for them.

Correct answer: A — Horizontal scaling (scaling out)

Adding more instances of the same size is scaling out, or horizontal scaling. Moving to a bigger instance type is scaling up, or vertical scaling.

Correct answer: A — Platform as a Service (PaaS)

A managed platform where AWS runs the operating system and engine while you use the database is PaaS. Running a database yourself on EC2 would be IaaS, and a finished application such as Amazon WorkMail is SaaS.

Correct answer: A — A failure or slowdown in one component does not immediately break the other.

Loosely coupled components communicate through something like an SQS queue or a load balancer, so one side can fail, restart or scale without taking the other down with it.

Correct answer: A — AWS Cloud Adoption Framework (AWS CAF)

AWS CAF organizes cloud migration planning into six perspectives across business and technical teams. The Well-Architected Framework reviews the design of an individual workload, and Trusted Advisor checks live resources against best practices.

Correct answer: A — Going global in minutes by deploying to multiple Regions

AWS operates Regions worldwide, so deploying near users in several continents is a configuration task rather than a construction project. The expense benefit is real but describes how you pay, not how quickly you reach new markets.

Correct answer: A — IAM groups

An IAM group is a collection of users that shares attached policies, so permissions are managed once for the whole group. Roles are assumed temporarily by users, applications or services rather than belonging to a person.

Correct answer: A — Attach an IAM role to the instance

An IAM role supplies temporary credentials that rotate automatically, so nothing long-lived is stored on the instance. Access keys in files can be copied or leaked, and root credentials should never be used by applications.

Correct answer: A — Least privilege

Least privilege limits the damage a mistake or a stolen credential can do. Defence in depth is about layering multiple controls, and shared responsibility divides duties between AWS and the customer.

Correct answer: A — AWS WAF

AWS WAF inspects web requests and blocks those matching rules you choose, including AWS managed rule groups for common exploits. Shield defends against DDoS attacks, and Inspector scans workloads for software vulnerabilities.

Correct answer: A — AWS Shield Standard

Shield Standard is automatic and free for every AWS customer, defending against common network and transport layer attacks. Shield Advanced is a paid subscription adding the DDoS Response Team, cost protection and richer reporting.

Correct answer: A — AWS Key Management Service (AWS KMS)

KMS creates and manages encryption keys and integrates with most AWS services for encryption at rest. Certificate Manager handles TLS certificates, Secrets Manager stores credentials, and Cognito manages application user sign-in.

Correct answer: A — AWS CloudHSM

CloudHSM gives you dedicated hardware security modules that you control, which is what strict regulatory requirements usually ask for. KMS is a shared, fully managed service, which is the right default for everything else.

Correct answer: A — Security groups act at the instance level and allow rules only; network ACLs act at the subnet level and support allow and deny rules.

Security groups attach to instances (their network interfaces) and can only allow traffic. Network ACLs attach to subnets and can explicitly deny, which makes them useful for blocking a specific IP address.

Correct answer: A — AWS

RDS is a managed service, so AWS patches the operating system and database engine. If the same database ran on EC2, patching would be the customer's job — the responsibility line moves with how managed the service is.

Correct answer: A — AWS Config

AWS Config keeps a history of resource configurations and evaluates them with rules, answering questions such as 'was this bucket ever public?'. CloudTrail records who called which API, and CloudWatch handles metrics and logs.

Correct answer: A — AWS Security Hub

Security Hub aggregates findings from AWS security services and runs automated checks against standards such as the AWS Foundational Security Best Practices. Detective helps investigate a specific finding, and Artifact provides compliance reports.

Correct answer: A — Amazon Macie

Macie scans S3 objects to find sensitive data such as names, addresses and credit card numbers. GuardDuty detects threats from log activity, and Inspector looks for software vulnerabilities.

Correct answer: A — AWS Firewall Manager

Firewall Manager applies and enforces firewall rules across accounts and resources centrally. Network Firewall is the firewall itself for a VPC, and Control Tower sets up and governs a multi-account landing zone.

Correct answer: A — A second proof of identity, such as a code from a device, in addition to the password

MFA requires something you know (the password) plus something you have (a device generating a code), so a stolen password alone is not enough to sign in.

Correct answer: A — Amazon VPC

Amazon VPC is your private network in AWS, where you define CIDR ranges, subnets, routing and gateways. Direct Connect is a dedicated link from your data centre, Route 53 is DNS, and Transit Gateway connects networks together.

Correct answer: A — Amazon Route 53

Route 53 provides DNS, health checks, routing policies and domain registration. CloudFront caches content at the edge, and load balancers distribute traffic across targets.

Correct answer: A — Elastic Load Balancing

Elastic Load Balancing spreads requests across healthy targets in one or more Availability Zones. Auto Scaling changes how many instances exist — the two are usually used together.

Correct answer: A — Amazon EC2 Auto Scaling

EC2 Auto Scaling keeps a group of instances at the desired size and can scale on metrics or schedules. Compute Optimizer only recommends better instance types; it does not change capacity.

Correct answer: A — AWS Snowball

Snow Family devices are physically shipped to you, loaded with data, and returned to AWS — the practical option when the network would take weeks. Direct Connect takes time to provision, and the other options still depend on the slow link.

Correct answer: A — Amazon DynamoDB

DynamoDB is the managed NoSQL option, with no servers to manage and predictable low latency. RDS and Aurora are relational, and Redshift is a data warehouse for analytics.

Correct answer: A — Amazon Redshift

Redshift is AWS's data warehouse for analytics and business intelligence workloads. DynamoDB serves fast key-value lookups, ElastiCache is an in-memory cache, and Neptune is a graph database.

Correct answer: A — Amazon Athena

Athena is serverless and queries S3 data in place, charging for the data each query scans. Redshift and RDS require provisioned clusters or instances, and DataBrew is a visual data preparation tool.

Correct answer: A — Amazon SQS and Amazon SNS

SQS queues messages until a consumer processes them, and SNS publishes messages to many subscribers — both let components work independently. The other pairs are storage, governance and networking services.

Correct answer: A — AWS Elastic Beanstalk

Elastic Beanstalk takes your code and runs the platform underneath it, while you keep full access to the resources it creates. CloudFormation provisions infrastructure from templates but does not manage the application platform for you.

Correct answer: A — Amazon EKS

Amazon EKS runs the Kubernetes control plane for you. ECS is AWS's own container orchestrator, and Fargate is the serverless compute engine that can run containers for either ECS or EKS.

Correct answer: A, B — The AWS Management Console · The AWS Command Line Interface (AWS CLI) and SDKs

AWS is accessed through the console, the CLI, the SDKs and the underlying APIs. Customers never touch the hypervisor or the host operating system — that layer is AWS's responsibility.

Correct answer: A — Amazon CloudWatch

CloudWatch is the monitoring service: metrics, logs, dashboards and alarms. CloudTrail records API activity for audit, and the Health Dashboard reports AWS service events affecting your account.

Correct answer: A — Amazon Lightsail

Lightsail bundles compute, storage and networking into predictable monthly plans with a simplified console. EC2 offers far more control and choice, Outposts brings AWS hardware on premises, and Wavelength targets 5G edge applications.

Correct answer: A — Amazon Transcribe and Amazon Translate

Transcribe converts speech to text and Translate converts text between languages — both are ready-to-use AI services with no model training. SageMaker is for building your own models, Rekognition analyses images and video, and Polly turns text into speech.

Correct answer: A — Amazon EFS

EFS is a managed NFS file system that many instances can mount concurrently and that grows automatically. EBS volumes are normally attached to one instance, Glacier is archive storage, and Storage Gateway links on-premises systems to AWS storage.

Correct answer: A — The data is lost, because instance store is ephemeral storage.

Instance store is physically attached, temporary disk: stopping or terminating the instance loses the data. Use Amazon EBS when data must survive the instance lifecycle.

Correct answer: A — AWS Marketplace

AWS Marketplace is the catalogue of third-party software with billing through your AWS account. Service Catalog manages approved internal products for your own organization, and Artifact provides AWS compliance documents.

Correct answer: A — Amazon Kinesis

Kinesis is built for real-time streaming data, including ingestion, delivery and analytics. SQS is a message queue rather than a stream, Batch runs batch jobs, and EMR runs big data frameworks such as Spark.

Correct answer: A — It includes always-free offers, 12-month free offers for new accounts, and short-term trials.

The Free Tier has three kinds of offer: always free (such as a monthly Lambda request allowance), 12 months free for new accounts, and time-limited trials. Usage beyond those limits is charged normally.

Correct answer: A — AWS Budgets

Budgets sends alerts when actual or forecast cost or usage crosses a threshold you set. Cost Explorer visualizes past spend, the Pricing Calculator estimates future architectures, and the Cost and Usage Report is the detailed billing data export.

Correct answer: A — Cost allocation tags activated in the Billing console

Tagging resources with a department key and activating those tags for cost allocation lets Cost Explorer and the billing reports group spend by department. IAM groups control access, and security groups control network traffic.

Correct answer: A — Access to AWS documentation, whitepapers, support forums, and 24/7 access to customer service for billing and account questions

Basic support includes documentation, forums, and customer service for account and billing issues, plus a limited set of Trusted Advisor checks. Technical support cases start with the Developer plan, and technical account managers come with Enterprise plans.