AWS CLF-C02 EXAM – QUESTIONS AND ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains:
• Cloud Concepts and Architecture
• Security and Compliance
• Core AWS Services and Infrastructure
• Billing, Pricing, and Support
• Cloud Migration and Deployment
• Shared Responsibility Model and Governance
Introduction: The purpose of this examination is to evaluate foundational knowledge of the
Amazon Web Services cloud platform and validate comprehensive understanding of cloud
concepts, core services, security, architecture, pricing, and support. This exam assesses
fundamental skills across cloud computing principles, shared responsibility frameworks,
regulatory standards, ethical practices, and cost management methodologies. Featuring
multiple-choice and scenario-based structures, the assessment emphasizes real-world
application, critical thinking, and professional decision-making to ensure candidates can
effectively design, secure, and operate compliant cloud environments.
SECTION ONE: QUESTIONS 1–100
Question 1 A cloud architect is designing a web application that requires high availability
across multiple isolated locations within a single geographic area. Which AWS infrastructure
component should the architect utilize? A. Edge Location B. Availability Zone C. Region D.
Direct Connect Location
B. Availability Zone Explanation: Availability Zones consist of one or more discrete
data centers with redundant power, networking, and connectivity within an AWS Region,
providing the high availability required for fault-tolerant applications.
Question 2 An enterprise must restrict access to its AWS account by ensuring that multi-
factor authentication is enforced for all IAM users accessing critical resources. Which service
or feature should be implemented to enforce this security control? A. AWS Trusted Advisor
B. AWS Identity and Access Management policies C. Amazon Inspector D. AWS Shield
B. AWS Identity and Access Management policies Explanation: IAM policies and
conditions can be configured to enforce multi-factor authentication requirements before
allowing users to execute privileged operations or access sensitive AWS resources.
,Question 3 Which AWS support plan provides access to a designated Technical Account
Manager (TAM) who provides proactive guidance and coordination of AWS resources? A.
Basic Support B. Developer Support C. Business Support D. Enterprise Support
D. Enterprise Support Explanation: Enterprise Support provides access to a dedicated
Technical Account Manager (TAM) who offers proactive support, architectural reviews, and
continuous guidance tailored to the organization's workloads.
Question 4 A financial services company is legally required to retain audit logs in an
immutable, write-once-read-many storage state to comply with regulatory standards. Which
Amazon S3 feature provides this capability? A. S3 Lifecycle Policies B. S3 Object Lock C. S3
Intelligent-Tiering D. S3 Cross-Region Replication
B. S3 Object Lock Explanation: Amazon S3 Object Lock enables users to store objects
in a Write Once, Read Many (WORM) model, preventing objects from being deleted or
overwritten for a fixed or legal hold duration to meet compliance mandates.
Question 5 An organization wants to migrate a monolithic relational database to AWS while
minimizing administrative overhead and automating tasks such as patching, backups, and
scaling. Which service should they choose? A. Amazon EC2 hosting a self-managed database
B. Amazon DynamoDB C. Amazon RDS D. Amazon Redshift
C. Amazon RDS Explanation: Amazon Relational Database Service manages time-
consuming database administration tasks such as provisioning, patching, backup, recovery,
failure detection, and repair.
Question 6 Which AWS tool provides real-time guidance to help organizations provision
resources following AWS best practices across cost optimization, security, performance, and
fault tolerance? A. AWS Cost Explorer B. AWS Trusted Advisor C. Amazon CloudWatch D.
AWS CloudTrail
B. AWS Trusted Advisor Explanation: AWS Trusted Advisor inspects AWS
environments and creates recommendations for saving money, improving system
performance, closing security gaps, and increasing reliability.
Question 7 Under the AWS Shared Responsibility Model, which component falls entirely
under the responsibility of the customer? A. Physical security of data centers B. Hardware
infrastructure maintenance C. Configuration of guest operating system firewall rules D.
Regional power grid redundancy
C. Configuration of guest operating system firewall rules Explanation: Under the
shared responsibility model, security in the cloud is the customer responsibility, which
includes guest operating system configuration, network and firewall configurations, and
patch management.
,Question 8 A development team needs to run containerized microservices without
managing underlying virtual machine clusters or infrastructure servers. Which AWS service is
best suited for this requirement? A. Amazon EC2 B. AWS Elastic Beanstalk C. AWS Fargate
with Amazon ECS D. Amazon Lightsail
C. AWS Fargate with Amazon ECS Explanation: AWS Fargate is a serverless compute
engine for containers that works with Amazon ECS, allowing developers to run containers
without having to manage servers or clusters.
Question 9 Which AWS pricing model allows customers to receive significant discounts, of up
to seventy-two percent, in exchange for a one-year or three-year commitment to a
consistent amount of compute usage? A. Spot Instances B. On-Demand Instances C.
Dedicated Hosts D. Savings Plans
D. Savings Plans Explanation: Savings Plans offer lower prices compared to On-
Demand pricing in exchange for a commitment to a consistent amount of compute usage
measured in dollar-per-hour for a one or three-year period.
Question 10 An administrator needs to track all API calls made within an AWS account for
security analysis and operational troubleshooting. Which AWS service should be enabled? A.
AWS CloudTrail B. Amazon CloudWatch C. Amazon GuardDuty D. AWS Config
A. AWS CloudTrail Explanation: AWS CloudTrail provides event history of your AWS
account activity, including actions taken through the AWS Management Console, SDKs,
command line tools, and other AWS services.
Question 11 Which service should an organization use to securely store and automatically
rotate database credentials, API keys, and other secrets throughout their lifecycle? A. AWS
Systems Manager Parameter Store B. AWS Secrets Manager C. AWS KMS D. Amazon S3
Glacier
B. AWS Secrets Manager Explanation: AWS Secrets Manager helps you easily rotate,
manage, and retrieve database credentials, API keys, and other secrets throughout their
lifecycle without custom code.
Question 12 A company is developing a global web application and needs to minimize
latency for users accessing static and dynamic content from different continents. Which AWS
service should be deployed? A. Amazon Route 53 B. AWS Direct Connect C. Amazon
CloudFront D. AWS Transit Gateway
C. Amazon CloudFront Explanation: Amazon CloudFront is a fast content delivery
network service that securely delivers data, videos, applications, and APIs to customers
globally with low latency and high transfer speeds using edge locations.
Question 13 An e-commerce company experiences unpredictable traffic spikes during major
promotional events and needs their compute capacity to automatically scale up and down
, based on actual demand. Which combination of services should they use? A. Amazon EC2
and Amazon S3 B. Amazon EC2 Auto Scaling and Elastic Load Balancing C. Amazon Route 53
and AWS Direct Connect D. Amazon EBS and Amazon EFS
B. Amazon EC2 Auto Scaling and Elastic Load Balancing Explanation: Elastic Load
Balancing distributes incoming application traffic across multiple targets, while Amazon EC2
Auto Scaling ensures you have the correct number of EC2 instances running to handle the
load.
Question 14 Which AWS feature enables customers to connect their on-premises data
center to an Amazon VPC with a dedicated, private network connection that does not
traverse the public internet? A. AWS VPN Gateway B. Amazon VPC Peering C. AWS Direct
Connect D. NAT Gateway
C. AWS Direct Connect Explanation: AWS Direct Connect lets you establish a
dedicated private connection between your data center and an AWS region, reducing
network costs and providing a more consistent network experience.
Question 15 Which AWS service provides managed distributed denial of service (DDoS)
protection for applications running on AWS? A. AWS Shield B. Amazon Inspector C. AWS
WAF D. Amazon GuardDuty
A. AWS Shield Explanation: AWS Shield is a managed DDoS protection service that
safeguards applications running on AWS, offering always-on detection and automatic inline
mitigations against common network and transport layer attacks.
Question 16 An auditor wants to evaluate the configuration settings of AWS resources over
time to verify adherence to internal compliance policies and regulatory standards. Which
service provides continuous monitoring of configuration changes? A. AWS Config B. Amazon
CloudWatch C. AWS Trusted Advisor D. AWS CloudTrail
A. AWS Config Explanation: AWS Config provides a detailed view of the configuration
of AWS resources in your AWS account, allowing you to track configuration changes and
evaluate compliance against desired settings.
Question 17 Which Amazon S3 storage class is designed for data with unknown or changing
access patterns, optimizing costs automatically without performance impact or operational
overhead? A. S3 Standard-Infrequent Access B. S3 Glacier Flexible Retrieval C. S3 Intelligent-
Tiering D. S3 Glacier Deep Archive
C. S3 Intelligent-Tiering Explanation: S3 Intelligent-Tiering automatically stores data
in access tiers that optimize costs when access patterns change, without operational
overhead, retrieval fees, or impact on performance.
ANSWERS | PLUS RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains:
• Cloud Concepts and Architecture
• Security and Compliance
• Core AWS Services and Infrastructure
• Billing, Pricing, and Support
• Cloud Migration and Deployment
• Shared Responsibility Model and Governance
Introduction: The purpose of this examination is to evaluate foundational knowledge of the
Amazon Web Services cloud platform and validate comprehensive understanding of cloud
concepts, core services, security, architecture, pricing, and support. This exam assesses
fundamental skills across cloud computing principles, shared responsibility frameworks,
regulatory standards, ethical practices, and cost management methodologies. Featuring
multiple-choice and scenario-based structures, the assessment emphasizes real-world
application, critical thinking, and professional decision-making to ensure candidates can
effectively design, secure, and operate compliant cloud environments.
SECTION ONE: QUESTIONS 1–100
Question 1 A cloud architect is designing a web application that requires high availability
across multiple isolated locations within a single geographic area. Which AWS infrastructure
component should the architect utilize? A. Edge Location B. Availability Zone C. Region D.
Direct Connect Location
B. Availability Zone Explanation: Availability Zones consist of one or more discrete
data centers with redundant power, networking, and connectivity within an AWS Region,
providing the high availability required for fault-tolerant applications.
Question 2 An enterprise must restrict access to its AWS account by ensuring that multi-
factor authentication is enforced for all IAM users accessing critical resources. Which service
or feature should be implemented to enforce this security control? A. AWS Trusted Advisor
B. AWS Identity and Access Management policies C. Amazon Inspector D. AWS Shield
B. AWS Identity and Access Management policies Explanation: IAM policies and
conditions can be configured to enforce multi-factor authentication requirements before
allowing users to execute privileged operations or access sensitive AWS resources.
,Question 3 Which AWS support plan provides access to a designated Technical Account
Manager (TAM) who provides proactive guidance and coordination of AWS resources? A.
Basic Support B. Developer Support C. Business Support D. Enterprise Support
D. Enterprise Support Explanation: Enterprise Support provides access to a dedicated
Technical Account Manager (TAM) who offers proactive support, architectural reviews, and
continuous guidance tailored to the organization's workloads.
Question 4 A financial services company is legally required to retain audit logs in an
immutable, write-once-read-many storage state to comply with regulatory standards. Which
Amazon S3 feature provides this capability? A. S3 Lifecycle Policies B. S3 Object Lock C. S3
Intelligent-Tiering D. S3 Cross-Region Replication
B. S3 Object Lock Explanation: Amazon S3 Object Lock enables users to store objects
in a Write Once, Read Many (WORM) model, preventing objects from being deleted or
overwritten for a fixed or legal hold duration to meet compliance mandates.
Question 5 An organization wants to migrate a monolithic relational database to AWS while
minimizing administrative overhead and automating tasks such as patching, backups, and
scaling. Which service should they choose? A. Amazon EC2 hosting a self-managed database
B. Amazon DynamoDB C. Amazon RDS D. Amazon Redshift
C. Amazon RDS Explanation: Amazon Relational Database Service manages time-
consuming database administration tasks such as provisioning, patching, backup, recovery,
failure detection, and repair.
Question 6 Which AWS tool provides real-time guidance to help organizations provision
resources following AWS best practices across cost optimization, security, performance, and
fault tolerance? A. AWS Cost Explorer B. AWS Trusted Advisor C. Amazon CloudWatch D.
AWS CloudTrail
B. AWS Trusted Advisor Explanation: AWS Trusted Advisor inspects AWS
environments and creates recommendations for saving money, improving system
performance, closing security gaps, and increasing reliability.
Question 7 Under the AWS Shared Responsibility Model, which component falls entirely
under the responsibility of the customer? A. Physical security of data centers B. Hardware
infrastructure maintenance C. Configuration of guest operating system firewall rules D.
Regional power grid redundancy
C. Configuration of guest operating system firewall rules Explanation: Under the
shared responsibility model, security in the cloud is the customer responsibility, which
includes guest operating system configuration, network and firewall configurations, and
patch management.
,Question 8 A development team needs to run containerized microservices without
managing underlying virtual machine clusters or infrastructure servers. Which AWS service is
best suited for this requirement? A. Amazon EC2 B. AWS Elastic Beanstalk C. AWS Fargate
with Amazon ECS D. Amazon Lightsail
C. AWS Fargate with Amazon ECS Explanation: AWS Fargate is a serverless compute
engine for containers that works with Amazon ECS, allowing developers to run containers
without having to manage servers or clusters.
Question 9 Which AWS pricing model allows customers to receive significant discounts, of up
to seventy-two percent, in exchange for a one-year or three-year commitment to a
consistent amount of compute usage? A. Spot Instances B. On-Demand Instances C.
Dedicated Hosts D. Savings Plans
D. Savings Plans Explanation: Savings Plans offer lower prices compared to On-
Demand pricing in exchange for a commitment to a consistent amount of compute usage
measured in dollar-per-hour for a one or three-year period.
Question 10 An administrator needs to track all API calls made within an AWS account for
security analysis and operational troubleshooting. Which AWS service should be enabled? A.
AWS CloudTrail B. Amazon CloudWatch C. Amazon GuardDuty D. AWS Config
A. AWS CloudTrail Explanation: AWS CloudTrail provides event history of your AWS
account activity, including actions taken through the AWS Management Console, SDKs,
command line tools, and other AWS services.
Question 11 Which service should an organization use to securely store and automatically
rotate database credentials, API keys, and other secrets throughout their lifecycle? A. AWS
Systems Manager Parameter Store B. AWS Secrets Manager C. AWS KMS D. Amazon S3
Glacier
B. AWS Secrets Manager Explanation: AWS Secrets Manager helps you easily rotate,
manage, and retrieve database credentials, API keys, and other secrets throughout their
lifecycle without custom code.
Question 12 A company is developing a global web application and needs to minimize
latency for users accessing static and dynamic content from different continents. Which AWS
service should be deployed? A. Amazon Route 53 B. AWS Direct Connect C. Amazon
CloudFront D. AWS Transit Gateway
C. Amazon CloudFront Explanation: Amazon CloudFront is a fast content delivery
network service that securely delivers data, videos, applications, and APIs to customers
globally with low latency and high transfer speeds using edge locations.
Question 13 An e-commerce company experiences unpredictable traffic spikes during major
promotional events and needs their compute capacity to automatically scale up and down
, based on actual demand. Which combination of services should they use? A. Amazon EC2
and Amazon S3 B. Amazon EC2 Auto Scaling and Elastic Load Balancing C. Amazon Route 53
and AWS Direct Connect D. Amazon EBS and Amazon EFS
B. Amazon EC2 Auto Scaling and Elastic Load Balancing Explanation: Elastic Load
Balancing distributes incoming application traffic across multiple targets, while Amazon EC2
Auto Scaling ensures you have the correct number of EC2 instances running to handle the
load.
Question 14 Which AWS feature enables customers to connect their on-premises data
center to an Amazon VPC with a dedicated, private network connection that does not
traverse the public internet? A. AWS VPN Gateway B. Amazon VPC Peering C. AWS Direct
Connect D. NAT Gateway
C. AWS Direct Connect Explanation: AWS Direct Connect lets you establish a
dedicated private connection between your data center and an AWS region, reducing
network costs and providing a more consistent network experience.
Question 15 Which AWS service provides managed distributed denial of service (DDoS)
protection for applications running on AWS? A. AWS Shield B. Amazon Inspector C. AWS
WAF D. Amazon GuardDuty
A. AWS Shield Explanation: AWS Shield is a managed DDoS protection service that
safeguards applications running on AWS, offering always-on detection and automatic inline
mitigations against common network and transport layer attacks.
Question 16 An auditor wants to evaluate the configuration settings of AWS resources over
time to verify adherence to internal compliance policies and regulatory standards. Which
service provides continuous monitoring of configuration changes? A. AWS Config B. Amazon
CloudWatch C. AWS Trusted Advisor D. AWS CloudTrail
A. AWS Config Explanation: AWS Config provides a detailed view of the configuration
of AWS resources in your AWS account, allowing you to track configuration changes and
evaluate compliance against desired settings.
Question 17 Which Amazon S3 storage class is designed for data with unknown or changing
access patterns, optimizing costs automatically without performance impact or operational
overhead? A. S3 Standard-Infrequent Access B. S3 Glacier Flexible Retrieval C. S3 Intelligent-
Tiering D. S3 Glacier Deep Archive
C. S3 Intelligent-Tiering Explanation: S3 Intelligent-Tiering automatically stores data
in access tiers that optimize costs when access patterns change, without operational
overhead, retrieval fees, or impact on performance.
