Free CLF-C02 practice test

Fault tolerance is the ability of a system to continue operating without any perceptible interruption even when components fail — achieved through full redundancy at every layer, typically at higher cost, which matches the first architect's proposal. High availability is the ability to minimize downtime and remain operational the vast majority of the time, accepting brief recovery periods during failures, which matches the colleague's simpler, less costly design. Option B reverses the definitions, incorrectly labeling the colleague's simpler design as fault tolerance. Options A and C describe unrelated concepts: elasticity/scalability relate to capacity management, and disaster recovery/business continuity relate to recovering from large-scale outages, not continuous operation during component failures.

Security, Sustainability, and Performance Efficiency is correct. (1) Protecting user data from unauthorized access maps to the Security pillar, which covers confidentiality, integrity, and access control. (2) Minimizing environmental impact maps to the Sustainability pillar, which focuses on reducing the environmental footprint of cloud workloads. (3) Adapting resource usage based on demand maps to the Performance Efficiency pillar, which covers using the right resource types and sizes and scaling appropriately. Option E is incorrect: Reliability addresses failure recovery, Cost Optimization addresses spend, and Operational Excellence addresses operations processes. Option C is incorrect because Reliability addresses availability/failure recovery, not demand-based resource adaptation. Option B is incorrect because Cost Optimization is about financial efficiency, not adapting resource types based on demand (though related, Performance Efficiency is the more precise match). Option D is incorrect because Elasticity is an AWS Cloud benefit, not a Well-Architected Framework pillar.

The People perspective of the AWS CAF focuses on culture, organizational structure, leadership, cloud fluency, workforce transformation, and change management — all of which directly address the described challenges. The Platform perspective covers architecture, provisioning, and modern application development practices. The Governance perspective focuses on managing risk, compliance, cloud financial management, and program oversight. The Operations perspective covers event management, incident management, and ensuring business operations continue and improve.

Correct: IaaS (Infrastructure as a Service) provides virtual machines where the customer manages the OS and above. PaaS (Platform as a Service) provides a managed platform where the provider handles OS, runtime, and middleware. SaaS (Software as a Service) delivers fully managed, ready-to-use software applications. Wrong: A) PaaS, IaaS, SaaS reverses the first two — hosting your own VMs is IaaS, not PaaS. B) IaaS, SaaS, PaaS swaps the second and third scenarios — a managed platform is PaaS, and ready-to-use software is SaaS, not the reverse. D) SaaS, PaaS, IaaS is the complete reverse of the correct order.

Deploying resources across at least two AZs within the same Region is the standard recommendation for high availability against AZ-level failures. Each AZ has independent power, cooling, and networking, so a failure in one AZ does not affect another. Option C fails because a single-AZ deployment cannot survive an AZ-level outage. Option D is incorrect because AZs within a Region do NOT share power grids — each is physically isolated — making multi-Region unnecessarily costly for this requirement. Option A is incorrect because CloudTrail and CloudWatch are monitoring/logging services; they detect issues but do not by themselves provide redundancy or failover.

The two highest-priority IAM best practices for a new account are: (1) enabling MFA on the root account to protect it from unauthorized access, and (2) creating a separate IAM administrative identity so the root account is not used for daily tasks. Option E is explicitly prohibited by AWS—root account access keys should never be created. Option A violates least privilege; not all users need administrative access. Option C violates individual accountability and is a severe security risk—root credentials must never be shared.

Correct: 'Enable MFA on the AWS account root user' — the root user has unrestricted access to all resources, so enabling MFA immediately is a critical first step to protect it. Correct: 'Create individual IAM users for each person who needs AWS access' — creating individual IAM users allows unique credentials, individual permissions, and auditability for each person. | Wrong: 'Create IAM access keys for the root user' — AWS explicitly recommends never creating root user access keys; use IAM users or roles for programmatic access. | Wrong: 'Share the root user credentials' — credentials should never be shared; this violates the principle of least privilege and makes auditing impossible. | Wrong: 'Attach AdministratorAccess to every user' — this violates least privilege; users should receive only the permissions they need to perform their job functions.

AWS Artifact is the self-service portal where customers can download AWS compliance reports, including PCI DSS AOCs, SOC reports, ISO certifications, and more, as well as accept agreements like the BAA for HIPAA. — AWS Trusted Advisor (C) provides cost, performance, and security best-practice checks but does not host compliance documentation. Amazon GuardDuty (B) is a threat detection service and has no compliance report downloads. AWS Security Hub (A) aggregates security findings from multiple services but does not provide AWS's own third-party audit reports.

Correct: 'AWS Secrets Manager' is purpose-built for storing, retrieving, and automatically rotating secrets such as API keys, database credentials, and other application secrets. It supports configurable automatic rotation schedules and integrates natively with Lambda for custom rotation logic, requiring no application code changes. | Wrong: 'AWS Systems Manager Parameter Store (Standard tier)' can store secrets securely but does NOT support automatic rotation — the team would need to build custom rotation logic themselves. | Wrong: 'AWS KMS' manages cryptographic keys used for encryption/decryption; it does not store application secrets or manage rotation of API keys. | Wrong: 'AWS Certificate Manager' manages SSL/TLS certificates for AWS services and handles their renewal; it is not designed to store or rotate application API keys.

Correct: 'AWS Inspector' is an automated vulnerability management service that continuously scans EC2 instances and Lambda functions for software vulnerabilities (CVEs) and unintended network reachability. It produces prioritized findings with severity scores and recommended remediations. | Wrong: 'Amazon Macie' is focused on discovering and classifying sensitive data in Amazon S3, such as PII and financial data; it does not perform vulnerability scanning on compute resources. | Wrong: 'AWS Config' tracks resource configuration changes and evaluates them against compliance rules; it does not scan for CVEs or software vulnerabilities. | Wrong: 'Amazon GuardDuty' detects active threats and anomalous behavior by analyzing logs; it does not perform proactive vulnerability assessments of software packages.

Correct: 'AWS CloudTrail integration' — every KMS API call (Encrypt, Decrypt, GenerateDataKey, etc.) is automatically recorded in CloudTrail, providing a complete historical audit trail of key usage, including who used the key and when. Correct: 'KMS key policies with aws:sourceVpce condition' — key policies support IAM condition keys such as aws:sourceVpce, which restricts key usage to requests arriving through a specific VPC endpoint, enforcing the VPC boundary requirement. Correct: 'AWS Config integration' — AWS Config tracks changes to KMS key policies, key enablement/disablement, and other configuration changes, supporting auditability of the key's configuration history. | Wrong: 'Automatic key rotation' rotates the backing key material for security purposes but does not enforce VPC restrictions or serve as an audit mechanism for key usage. | Wrong: 'KMS key deletion waiting period' is a safeguard against accidental deletion; it is not an audit mechanism. | Wrong: 'Amazon Macie' classifies sensitive data in S3 and does not interact with or audit KMS key metadata.

AWS Snowball Edge is correct for the data transfer. At 80 TB, transferring data over the internet or Direct Connect would take an extremely long time and incur high data transfer costs. Snowball Edge is a physical device that AWS ships to the customer; data is loaded locally and shipped back to AWS for high-speed ingestion — the ideal approach for large-scale, one-time migrations. Amazon Redshift is correct as the target platform. It is AWS's fully managed, petabyte-scale cloud data warehouse specifically optimized for OLAP (complex analytical queries) with columnar storage and massively parallel processing (MPP) — the direct modern replacement for an on-premises Oracle data warehouse. AWS DMS is a strong tool for ongoing, incremental data replication and schema conversion but for an 80 TB initial bulk load, Snowball Edge is far more practical and efficient; DMS alone would be very slow at this scale. Amazon RDS for Oracle is a managed relational database service but is designed for OLTP workloads, not data warehousing — it would not provide the analytical query performance of Redshift and still uses an Oracle license cost. Amazon SageMaker is a machine learning platform for building and deploying ML models — it is not a data warehouse or general analytics query engine. Amazon DynamoDB is a NoSQL key-value and document database optimized for millisecond-latency OLTP workloads, not for complex multi-table analytical queries typical of a data warehouse.

Amazon Aurora is the correct answer. It is MySQL- and PostgreSQL-compatible, provides up to five times the throughput of standard MySQL, and automatically replicates data six ways across three Availability Zones. Amazon RDS for MySQL is managed but does not offer the same performance multiplier or the same multi-AZ replication architecture as Aurora. Amazon DynamoDB is a NoSQL key-value and document database — it is not MySQL-compatible. Amazon Redshift is a data warehousing service optimized for analytical queries on large datasets, not an OLTP relational database.

SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct when the customer must manage and retain full control of the encryption keys outside of AWS. The customer provides the key with each request; AWS uses it to encrypt/decrypt and then discards it without storing it. SSE-S3 uses keys fully managed by Amazon S3 — the customer has no control over the keys, which does not satisfy the requirement. SSE-KMS uses keys managed within AWS Key Management Service; while customers can control KMS key policies and audit usage via CloudTrail, the keys are stored and managed within AWS, meaning AWS retains some level of access — this may not satisfy requirements for keys that must be entirely outside AWS control. Client-side encryption is another valid option for external key control, but the question specifies server-side encryption ('encrypted at rest' via S3's encryption mechanism), and SSE-C is the server-side option that gives customers full key control.

An S3 Lifecycle policy can automatically transition objects to S3 Standard-Infrequent Access (Standard-IA) after 30 days, which maintains millisecond retrieval latency at a lower storage cost, and then expire (delete) objects at 365 days — exactly matching the requirements. | S3 Glacier Deep Archive provides the lowest storage cost but has retrieval times of 12–48 hours, which violates the millisecond access requirement after day 30. | S3 Versioning maintains multiple versions of objects for data protection but does not automate tiering or deletion by age. Transfer Acceleration speeds up uploads and is unrelated to storage cost management. | S3 Replication copies objects to another bucket but does not automate deletion or reduce costs based on age.

Amazon CloudFront is AWS's Content Delivery Network (CDN). It caches static content (images, CSS, JS) at edge locations around the world, so international users retrieve content from a nearby edge location rather than all the way from us-east-1. This dramatically reduces latency for static asset delivery. | Wrong options: AWS Global Accelerator (D) improves availability and performance for dynamic, non-cacheable traffic by routing through the AWS global network, but it does not cache content at the edge — it is not a CDN and won't eliminate the latency of fetching static files from a single origin bucket. Route 53 with latency-based routing (B) routes DNS queries to the nearest regional endpoint, but if the S3 bucket only exists in us-east-1, all users still fetch content from that one region; it also does not cache content. Elastic Load Balancing (C) distributes traffic across multiple targets within a region; it is not designed to reduce latency for globally distributed users and does not cache content.

A VPC Gateway Endpoint for Amazon S3 allows traffic between the VPC and S3 to flow privately over the AWS network without traversing the public internet. No internet gateway, NAT device, VPN connection, or Direct Connect connection is required. Configuring an internet gateway routes S3 traffic over the public internet, which violates the security requirement. A NAT gateway allows instances in private subnets to initiate outbound connections to the internet, including to S3 public endpoints — this still sends traffic over the public internet. An Application Load Balancer cannot be placed in front of an S3 bucket to proxy requests; ALBs route traffic to EC2 targets, IP targets, or Lambda functions, not to S3.

Reserved Instances (3-year term) for the production database offer the deepest discount (up to 72%) for a steady, predictable, always-on workload running for 3 years — this is the classic use case for Reserved Instances. Spot Instances for the nightly batch job are ideal because the job can tolerate interruptions (it can be stopped and restarted), and Spot Instances offer discounts of up to 90% off On-Demand prices for fault-tolerant, flexible workloads. On-Demand Instances for the production database would be significantly more expensive than Reserved for a 3-year continuous workload. Spot Instances for the development environment are not ideal because Spot Instances can be interrupted at any time; a development environment used during business hours benefits from predictable availability, making On-Demand more appropriate (though On-Demand for dev is not selected here, it is more suitable than Spot for interactive use). On-Demand Instances for the development environment are more appropriate than Spot for interactive dev use, but not as cost-optimal as the two correct answers in the context of this question. Reserved Instances (1-year term) for the nightly batch job would be wasteful — a 4-hour nightly job does not need a reservation commitment when Spot provides massive savings for interruptible workloads.

Consolidated billing (option C) is correct—AWS Marketplace charges are included in the customer's AWS bill, simplifying procurement by eliminating separate vendor invoices. Pre-configured deployments (option B) is correct—Marketplace listings often include AMIs, CloudFormation templates, and SaaS integrations that enable rapid deployment without manual installation. Contract pricing models (option A) is correct—AWS Marketplace supports multiple pricing models including annual subscriptions, pay-as-you-go, free trials, and private offers negotiated between buyers and sellers. First-party only (option E) is wrong—AWS Marketplace is specifically a platform for third-party independent software vendors (ISVs); AWS's own services are accessed through the console, not the Marketplace. No additional cost (option D) is wrong—most third-party software on Marketplace carries its own software licensing fee on top of underlying AWS infrastructure costs. Replacing Support plans (option F) is wrong—AWS Marketplace vendors may offer their own support, but this is entirely separate from AWS Support plans, which cover AWS infrastructure and services.

Spot Instances are correct because they offer up to 90% discount off On-Demand pricing and are ideal for fault-tolerant, interruption-tolerant workloads like batch processing. Since the job can be restarted if interrupted, the risk of Spot interruption is acceptable. On-Demand Instances have no discount and are best for short-term, unpredictable workloads—not for cost-minimization on a repeatable batch job. Reserved Instances provide significant savings but require a 1- or 3-year commitment; since the batch job runs only 3 hours per night, committing to full reserved capacity 24/7 is wasteful. Savings Plans (Compute) also require a 1- or 3-year hourly spend commitment and would provide less savings than Spot for a workload that can tolerate interruptions.