CLF-C02 Free Practice Questions — Page 8 (2026)

Question 72

What is the MOST secure way to store passwords on AWS?

A. Store passwords in an Amazon S3 bucket.

B. Store passwords as AWS CloudFormation parameters.

C. Store passwords in AWS Storage Gateway.

D. Store passwords in AWS Secrets Manager.

Show Answer

Correct Answer: D

Explanation:
AWS Secrets Manager is purpose-built for securely storing, encrypting, rotating, and controlling access to sensitive information like passwords using IAM and KMS. The other options are not designed for secret management and lack equivalent security controls.

Question 73

An AWS user wants to proactively detect when an instance or account might be compromised or if there are threats from attacks. Which AWS service should the user choose?

A. Amazon GuardDuty

B. AWS WAF

C. AWS Shield

D. Amazon Inspector

Show Answer

Correct Answer: A

Explanation:
Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior, helping proactively detect compromised instances, accounts, and attack threats. AWS WAF and Shield focus on protecting web applications from attacks, and Amazon Inspector focuses on vulnerability assessment, not active threat detection.

Question 74

A company is building an application that will receive millions of database queries each second. The company needs the data store for the application to scale to meet these needs. Which AWS service will meet this requirement?

A. Amazon DynamoDB

B. AWS Cloud9

C. Amazon ElastiCache for Memcached

D. Amazon Neptune

Show Answer

Correct Answer: A

Explanation:
Amazon DynamoDB is a fully managed, serverless NoSQL database designed to scale automatically and handle millions of requests per second with low latency. The other options are not primary scalable databases for massive query workloads (Cloud9 is an IDE, ElastiCache is an in-memory cache, and Neptune is a specialized graph database).

Question 75

Which AWS service or feature supports governance, compliance, and risk auditing of AWS accounts?

A. Multi-factor authentication (MFA)

B. AWS Lambda

C. Amazon Simple Notification Service (Amazon SNS)

D. AWS CloudTrail

Show Answer

Correct Answer: D

Explanation:
AWS CloudTrail records and logs all account activity, including actions taken through the AWS Management Console, CLI, SDKs, and APIs. This provides a detailed audit trail that supports governance, compliance, and risk auditing of AWS accounts.

Question 76

Which AWS service or feature requires an internet service provider (ISP) and a colocation facility to be implemented?

A. AWS VPN

B. Amazon Connect

C. AWS Direct Connect

D. Internet gateway

Show Answer

Correct Answer: C

Explanation:
AWS Direct Connect requires a physical, dedicated network connection between on‑premises infrastructure and AWS. Implementing it typically involves working with an ISP or Direct Connect partner and connecting at an AWS Direct Connect location, which is usually a colocation facility. The other options rely on standard internet connectivity or are purely AWS-managed services and do not require colocation.

Question 77

A company wants a solution that will automatically adjust the number of Amazon EC2 instances that are being used based on the current load. Which AWS offering will meet these requirements?

A. Dedicated Hosts

B. Placement groups

C. Auto Scaling groups

D. Reserved Instances

Show Answer

Correct Answer: C

Explanation:
Auto Scaling groups automatically increase or decrease the number of EC2 instances based on demand or defined scaling policies, meeting the requirement to adjust capacity according to current load. Dedicated Hosts, Placement Groups, and Reserved Instances do not provide automatic scaling.

Question 78

A company that operates on-premises servers decides to start a new line of business. The company determines that additional servers are required for the new workloads. Which advantage of cloud computing can help the company to provision additional infrastructure as quickly as possible?

A. Benefit from massive economies of scale

B. Increase speed and agility

C. Trade fixed expense for variable expense

D. Go global in minutes

Show Answer

Correct Answer: B

Explanation:
The key requirement is provisioning additional infrastructure as quickly as possible. Cloud computing’s advantage of increased speed and agility allows resources like servers to be provisioned on demand in minutes, unlike on‑premises environments that require procurement and setup time.

Question 79

Which AWS service can manage permissions for AWS resources by using policies?

A. Amazon Inspector

B. Amazon Detective

C. AWS Identity and Access Management (IAM)

D. Amazon GuardDuty

Show Answer

Correct Answer: C

Explanation:
AWS Identity and Access Management (IAM) is the service used to manage permissions for AWS resources through policies that define allowed or denied actions for users, groups, roles, and services.

Question 80

A company needs to run some of its workload in the AWS Cloud. The company needs to keep some of the workload in its own on-site data center due to compliance reasons. Which AWS service will meet these requirements?

A. AWSConfig

B. AWS Outposts

C. Amazon Lightsail

D. Amazon Connect

Show Answer

Correct Answer: B

Explanation:
AWS Outposts extends AWS infrastructure and services to an on-premises data center, allowing workloads to run locally while remaining integrated with the AWS Cloud, which satisfies compliance requirements to keep some workloads on-site.

Question 81

A company wants to connect its supported AWS services and VPCs. The company does not want to expose its internal traffic to the public internet. Which AWS service will meet these requirements?

A. Amazon Inspector

B. AWS PrivateLink

C. Amazon Connect

D. AWS Internet Gateway

Show Answer

Correct Answer: B

Explanation:
AWS PrivateLink provides private connectivity between VPCs and supported AWS services over the AWS network using interface VPC endpoints, keeping traffic off the public internet. The other options do not provide private service-to-VPC connectivity.