Free Practice Questions for Amazon Web Services CLF-C02 Exam

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

AWS cost allocation tags are the feature designed to organize resources and attribute their costs at a detailed level. A tag is a key-value label applied either by the customer or by AWS. After an eligible cost allocation tag is activated in the Billing and Cost Management console, AWS can use that tag in cost-management data and reports, allowing charges to be grouped by values such as application, project, department, environment, or cost center. This makes option A the direct match for both “track” and “categorize expenditures.” Consolidated billing combines billing and usage across accounts in AWS Organizations, but it is not itself a resource-labeling mechanism. AWS Budgets compares cost or usage against thresholds and can generate alerts or actions; it does not provide the requested detailed categorization method. AWS Marketplace is a catalog and procurement channel for third-party and AWS software, data, and professional services, not a cost-allocation feature. Therefore, cost allocation tags are the specific AWS capability described in the question.

AWS Outposts extend AWS infrastructure and services to on-premises locations, providing low-latency access to AWS resources and ensuring data residency. This service is suitable for hybrid environments that require the same AWS services and infrastructure to be available locally. Wavelength, Transit Gateway, and Ground Station do not specifically address low-latency access to on-premises resources or data residency.

AWS CloudHSM provides cloud-based hardware security modules that securely generate, store, and use cryptographic keys. Customers have control over the HSM users and keys in their CloudHSM clusters and can use supported interfaces and libraries to perform cryptographic operations and manage key material. Therefore, option C is correct among the supplied choices. AWS License Manager helps organizations track and manage software licenses and licensing rules. AWS Certificate Manager provisions, manages, and deploys public and private TLS certificates, but it is not the general-purpose customer-controlled encryption-key management service described here. AWS Directory Service provides managed directory capabilities such as Microsoft Active Directory integration and is unrelated to cryptographic key storage. In many normal AWS architectures, AWS Key Management Service would be the primary managed service used to create and control encryption keys; however, AWS KMS is not included in the options. CloudHSM is the valid listed service because it provides dedicated HSMs and gives customers extensive control over cryptographic keys and operations. The exam distinction is between certificate lifecycle management in ACM and cryptographic key management and storage in CloudHSM.

AWS Config enables users to assess, audit, and evaluate the configurations of AWS resources. It provides information that can be used by external auditors to ensure compliance with various regulatory requirements by tracking changes and maintaining configuration history. Amazon Cognito, FSx, and Inspector do not provide detailed configuration tracking for audit purposes.

AWS Marketplace is a digital catalog that offers third-party software, including security solutions like intrusion detection systems, which can be deployed directly within an AWS environment. By using AWS Marketplace, companies can find, purchase, and deploy ISP intrusion detection systems or other security tools that meet their specific requirements. Other services, such as AWS Security Hub and Quick Starts, do not directly provide third-party application deployment.

Application Load Balancer (ALB) integrates with AWS WAF to deploy and manage WAF rules for incoming traffic. ALB can route HTTP and HTTPS traffic and apply WAF rules to protect applications from common web exploits. Network Load Balancer does not support AWS WAF, and Trusted Advisor does not deploy WAF rules.

Amazon EC2 Reserved Instances provide a billing discount in exchange for a one-year or three-year commitment to specified EC2 usage attributes and payment terms. Because the company can commit for one year and expects specific usage, Reserved Instances are the most cost-effective choice among the listed options. A Reserved Instance is not a separate physical instance; its billing benefit is applied to qualifying running EC2 instances that match the reservation’s attributes. Dedicated Hosts provide an entire physical host for one customer and are appropriate for host-level compliance or licensing requirements, but those requirements are not stated here. Spot Instances can provide larger discounts by using spare EC2 capacity, but AWS can interrupt them, and the question describes a predictable committed workload rather than an interruption-tolerant workload. On-Demand Instances require no long-term commitment and are appropriate for short-term, irregular, or unpredictable workloads, but their normal usage price is higher than a matching Reserved Instance commitment. Although AWS also offers Savings Plans, they are not included in the options. Therefore, Reserved Instances are the intended answer for a one-year EC2 usage commitment.

To follow the principle of least privilege, the company should create an IAM user with only programmatic access since the access is limited to AWS CLI and SDKs, not the Management Console. Additionally, a custom IAM policy granting specific Amazon RDS permissions should be created and attached to this user to restrict access solely to necessary actions. Providing programmatic access only ensures adherence to security best practices by limiting access to the required interfaces.

An Application Load Balancer is the Elastic Load Balancing option designed for application-layer traffic, including HTTP and HTTPS. It acts as a single point of contact for clients and distributes incoming application requests across healthy registered targets in one or more Availability Zones. Targets can include Amazon EC2 instances, IP addresses, and Lambda functions. Application Load Balancers also support content-based routing through listener rules, such as routing by URL path or host name. A Network Load Balancer primarily operates at the transport layer and is intended for protocols such as TCP, TLS, UDP, and TCP_UDP, although it can carry traffic used by applications. The question explicitly identifies incoming HTTP and HTTPS requests, making the Application Load Balancer the best answer. A NAT gateway enables resources, commonly those in private subnets, to initiate outbound network connections; it does not distribute inbound requests among application targets. AWS Transit Gateway connects VPCs and on-premises networks through a central network hub. It likewise is not an HTTP or HTTPS request-distribution service.

Enforcing multi-factor authentication (MFA) for privileged users enhances account security by requiring a second form of authentication. It reduces the risk of unauthorized access, even if credentials are compromised. Removing the root account is not possible, and creating access keys for the root account or privileged users can increase security risks rather than reduce them.