Core Services Overview — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Cloud Technology and Services ·100 questions · 30 easy · 40 intermediate · 30 hard · page 1 of 7

Question 1 clf-core-services-overview-001

Easy · Choose one

Which AWS service allows an operations team to model and provision a complete set of AWS resources from a declarative template file, so that identical environments can be recreated on demand?

  1. a AWS CloudFormation
  2. b AWS Systems Manager
  3. c AWS Config
  4. d AWS Control Tower
Show answer & explanation

Answer: A

Why A is correct

AWS CloudFormation is the AWS infrastructure as code (IaC) service. You describe the desired resources in a JSON or YAML template, and CloudFormation provisions and configures them as a single unit called a stack. Because the template is a file, it can be stored in version control and reused to build identical development, test, and production environments.

Why the others are wrong

  • B — AWS Systems Manager operates and manages existing instances and resources (patching, run command, parameter store). It is an operations tool, not a template-driven provisioning engine.
  • C — AWS Config records and evaluates the configuration of resources that already exist and reports on compliance drift. It does not provision resources.
  • D — AWS Control Tower automates the set-up of a secure multi-account landing zone with guardrails. It orchestrates accounts, not the individual resource stacks inside a workload.

Last verified: 2026-09-02

Question 2 clf-core-services-overview-002

Easy · Choose one

An administrator must run the same sequence of AWS operations every night from a Linux server, driven by a shell script that is scheduled with cron. Which method of accessing AWS services is most appropriate?

  1. a AWS Artifact
  2. b AWS Command Line Interface (AWS CLI)
  3. c AWS Management Console
  4. d AWS Health Dashboard
Show answer & explanation

Answer: B

Why B is correct

The AWS CLI is a unified tool that issues AWS service commands from a terminal. Because the commands are text, they can be placed in a shell script and scheduled, which makes the CLI the standard choice for repeatable, automated operational tasks. The three primary access methods are the AWS Management Console, the AWS CLI, and the AWS SDKs.

Why the others are wrong

  • A — AWS Artifact is a self-service portal for downloading AWS compliance reports and agreements. It does not operate AWS resources.
  • C — The AWS Management Console is a graphical web interface driven by a human clicking through pages. It cannot be invoked by a cron job or scripted.
  • D — The AWS Health Dashboard reports on the health of AWS services and on events affecting the account. It is an information source, not an automation interface.

Last verified: 2026-09-02

Question 3 clf-core-services-overview-003

Easy · Select 2 answers

Which of the following are valid ways to interact with and manage AWS services? (Choose TWO.)

  1. a AWS Management Console
  2. b Amazon CloudWatch
  3. c AWS Trusted Advisor
  4. d AWS Artifact
  5. e AWS Command Line Interface (AWS CLI)
Show answer & explanation

Answer: A and E

Why A and E are correct

AWS provides three primary access methods: the AWS Management Console (graphical web interface), the AWS CLI (command line), and the AWS SDKs (programmatic access from application code). The console and the CLI are two of these three.

Why the others are wrong

  • B — Amazon CloudWatch is a monitoring and observability service for metrics, logs, and alarms. It is not an interface for managing AWS resources broadly.
  • C — AWS Trusted Advisor is an inspection service that gives recommendations on cost, performance, security, fault tolerance, service limits, and operational excellence. It is a service you consume, not an access method.
  • D — AWS Artifact is a self-service portal for downloading AWS compliance reports and agreements. It is not an access method for managing services.

Last verified: 2026-09-02

Question 4 clf-core-services-overview-004

Intermediate · Choose one

A manufacturing company keeps its ERP system in its own data center because of contractual data residency terms, while running its new customer-facing web application on AWS. The two environments are connected with AWS Direct Connect. Which cloud deployment model does this describe?

  1. a On-premises (private cloud) deployment
  2. b Multi-cloud deployment
  3. c Cloud-native (all-in cloud) deployment
  4. d Hybrid deployment
Show answer & explanation

Answer: D

Why D is correct

A hybrid deployment connects resources that run in an on-premises data center with resources that run in the AWS Cloud, so the two act as a single extended environment. Direct Connect or AWS Site-to-Site VPN is the usual connectivity layer. This is the standard pattern when some workloads must stay on-premises for latency, licensing, or data residency reasons.

Why the others are wrong

  • A — An on-premises or private cloud deployment uses virtualization and resource management within the company's own data center only. This scenario clearly includes AWS.
  • B — Multi-cloud means using two or more public cloud providers. Only one public cloud provider, AWS, is described here.
  • C — An all-in cloud deployment means every part of the application is provisioned in the cloud. Here the ERP system deliberately remains in the company's data center.

Last verified: 2026-09-02

Question 5 clf-core-services-overview-005

Intermediate · Choose one

A startup wants to deploy a Java web application to AWS. The team does not want to manually configure EC2 instances, load balancers, or Auto Scaling groups, but they do want the ability to inspect and adjust the underlying resources later if needed. Which service best fits?

  1. a AWS Lambda
  2. b AWS CloudFormation
  3. c AWS Elastic Beanstalk
  4. d Amazon Lightsail
Show answer & explanation

Answer: C

Why C is correct

AWS Elastic Beanstalk lets you upload application code and automatically handles capacity provisioning, load balancing, Auto Scaling, and application health monitoring. Crucially, it provisions standard AWS resources (EC2, ELB, Auto Scaling groups) in your account, so you retain full visibility and control over them if you need to tune the environment.

Why the others are wrong

  • A — AWS Lambda is event-driven and function-based. Running a traditional Java web application on it would require re-architecting, and there are no underlying EC2 instances or load balancers for the team to inspect.
  • B — AWS CloudFormation would provision the resources, but the team would have to author the templates themselves. It does not remove the need to define the load balancer and Auto Scaling configuration.
  • D — Amazon Lightsail bundles compute, storage, and networking into simplified plans and intentionally abstracts the underlying resources, which conflicts with the requirement to inspect and adjust them.

Last verified: 2026-09-02

Question 6 clf-core-services-overview-006

Intermediate · Choose one

A financial services firm must transfer large volumes of market data between its data center and AWS every trading day. The firm requires consistent, predictable network throughput and wants the traffic to avoid the public internet. Which connectivity option should be used?

  1. a AWS Direct Connect
  2. b An internet gateway attached to the VPC
  3. c Amazon Route 53 Resolver
  4. d AWS Site-to-Site VPN
Show answer & explanation

Answer: A

Why A is correct

AWS Direct Connect establishes a dedicated, private physical network connection between the customer's premises and AWS. Because the traffic does not traverse the public internet, it delivers more consistent network performance and reduced, predictable bandwidth costs, which is exactly what a daily large-volume, latency-sensitive transfer needs.

Why the others are wrong

  • B — An internet gateway simply allows VPC resources to send and receive traffic over the public internet. It provides no dedicated bandwidth or private path.
  • C — Route 53 Resolver handles DNS resolution between on-premises networks and VPCs. It does not carry application data traffic.
  • D — A Site-to-Site VPN creates an encrypted tunnel over the public internet. It is quick and inexpensive to set up, but throughput and latency depend on internet conditions and are therefore not consistent.

Last verified: 2026-09-02

Question 7 clf-core-services-overview-007

Intermediate · Choose one

A small business needs to connect its office network to a VPC within a few hours, with encrypted traffic, and with minimal upfront cost. Occasional variability in throughput is acceptable. Which option should the business choose?

  1. a AWS Site-to-Site VPN
  2. b Amazon CloudFront with a custom origin
  3. c AWS Direct Connect with a 1 Gbps dedicated connection
  4. d AWS Global Accelerator
Show answer & explanation

Answer: A

Why A is correct

AWS Site-to-Site VPN creates an IPsec encrypted tunnel between the customer gateway and the VPC over the existing internet connection. It can be provisioned in minutes to hours, has no dedicated circuit to order, and has a low hourly cost, which matches the requirement for speed, encryption, and low upfront investment.

Why the others are wrong

  • B — Amazon CloudFront is a content delivery network for distributing content to end users. It does not connect a corporate office network to a VPC.
  • C — Direct Connect requires ordering a physical cross-connect at a Direct Connect location, which typically takes weeks to months and carries port and installation costs. That contradicts the few-hours requirement.
  • D — AWS Global Accelerator improves availability and performance for internet-facing applications using the AWS global network. It is not a site-to-site corporate connectivity solution.

Last verified: 2026-09-02

Question 8 clf-core-services-overview-008

Intermediate · Choose one

An operations team must apply a security patch to a fleet that includes both Amazon EC2 instances and physical servers still running in the company data center. They want a single console and a single automation workflow for both. Which AWS service should they use?

  1. a AWS Systems Manager
  2. b AWS Config
  3. c Amazon Inspector
  4. d AWS CloudFormation
Show answer & explanation

Answer: A

Why A is correct

AWS Systems Manager provides operational management across hybrid environments. With the SSM Agent installed, on-premises servers and virtual machines can be registered as managed nodes alongside EC2 instances, and capabilities such as Patch Manager and Run Command then apply uniformly to both.

Why the others are wrong

  • B — AWS Config tracks resource configuration changes and compliance. It is a recording and evaluation service, not a patch deployment tool.
  • C — Amazon Inspector continually scans workloads for software vulnerabilities and unintended network exposure. It reports findings but does not perform the patching workflow.
  • D — AWS CloudFormation provisions AWS resources from templates. It does not patch operating systems, and it does not manage on-premises servers.

Last verified: 2026-09-02

Question 9 clf-core-services-overview-009

Hard · Select 2 answers

Which TWO statements describe genuine advantages of using infrastructure as code instead of manually creating resources in the AWS Management Console? (Choose TWO.)

  1. a Environments can be recreated consistently, which reduces configuration drift between development, test, and production
  2. b It guarantees that deployments will never cause application downtime
  3. c It removes the need to define IAM permissions for the resources being created
  4. d Infrastructure definitions can be stored in source control, peer reviewed, and rolled back like application code
  5. e It eliminates the charges for the AWS resources that are provisioned
Show answer & explanation

Answer: A and D

Why A and D are correct

Infrastructure as code turns environment definitions into machine-readable files. Because the same template produces the same resources every time, environments stay consistent and configuration drift is reduced. And because the definition is a text file, it can live in a Git repository where changes are reviewed, versioned, and reverted using the same practices the team already uses for application code.

Why the others are wrong

  • B — Infrastructure as code does not by itself guarantee zero downtime. Achieving that depends on the deployment strategy chosen, such as blue/green or rolling deployments.
  • C — IAM permissions are still required. The principal running the deployment must be authorized to create each resource, and the resources themselves still need appropriate roles and policies.
  • E — Resources provisioned by a template are billed exactly the same as resources created by hand. IaC changes how resources are created, not what they cost.

Last verified: 2026-09-02

Question 10 clf-core-services-overview-010

Hard · Choose one

A large enterprise wants its application teams to be able to self-service deploy only from a curated set of pre-approved, pre-configured architectures that meet corporate security and compliance standards. Which AWS service is designed for this?

  1. a AWS Service Catalog
  2. b AWS Organizations
  3. c AWS Trusted Advisor
  4. d AWS Marketplace
Show answer & explanation

Answer: A

Why A is correct

AWS Service Catalog lets a central team create and manage portfolios of approved IT products (typically backed by CloudFormation templates), grant specific users access to those portfolios, and let them launch products themselves. This gives teams self-service speed while the organization keeps governance over what can be deployed.

Why the others are wrong

  • B — AWS Organizations centrally manages multiple AWS accounts, consolidated billing, and service control policies. It restricts what accounts may do, but it does not publish launchable product templates.
  • C — AWS Trusted Advisor provides best-practice recommendations against existing resources. It does not provision anything.
  • D — AWS Marketplace is a digital catalog for discovering and purchasing third-party software from independent vendors. It is not a mechanism for publishing an organization's own internally approved architectures.

Last verified: 2026-09-02

Question 11 clf-core-services-overview-011

Hard · Choose one

A company is expanding from one AWS account to dozens. It wants a repeatable way to provision new accounts with a pre-configured baseline of identity, logging, and preventive and detective controls already in place. Which service most directly addresses this?

  1. a AWS IAM Identity Center used on its own
  2. b AWS Organizations used on its own
  3. c AWS Control Tower
  4. d AWS CloudTrail
Show answer & explanation

Answer: C

Why C is correct

AWS Control Tower automates the set-up of a well-architected multi-account environment known as a landing zone. It provisions accounts through Account Factory and applies guardrails, which are pre-packaged preventive and detective controls, along with centralized logging and identity configuration, so every new account starts from a governed baseline.

Why the others are wrong

  • A — IAM Identity Center provides centralized workforce single sign-on and permission sets across accounts. It handles identity only, not the full account baseline.
  • B — AWS Organizations provides the account structure, organizational units, consolidated billing, and service control policies, but the administrator must design and apply the whole baseline manually. Control Tower is built on top of Organizations and automates that work.
  • D — AWS CloudTrail records API activity for auditing. It is one component of a governed baseline, not the mechanism that provisions and governs accounts.

Last verified: 2026-09-02

Question 12 clf-core-services-overview-012

Hard · Choose one

A development team is writing a Python application that must create and query AWS resources at run time. They need language-native objects, automatic request signing, and built-in retry handling. Which access method is most appropriate?

  1. a An AWS SDK for Python
  2. b Shelling out to the AWS CLI from the application code
  3. c The AWS Management Console
  4. d AWS CloudFormation
Show answer & explanation

Answer: A

Why A is correct

AWS SDKs are language-specific libraries that expose AWS service APIs as native objects and methods. They handle credential resolution, request signing, retries with exponential backoff, and response parsing, which makes them the intended way to call AWS from inside application code.

Why the others are wrong

  • B — Invoking the CLI as a subprocess means parsing text output, depending on the CLI being installed on every host, and losing type safety and structured error handling. The CLI is designed for interactive and scripting use, not as an in-application API layer.
  • C — The AWS Management Console is a human-facing web interface. An application cannot use it programmatically.
  • D — AWS CloudFormation provisions resources from a declarative template. It is well suited to standing up infrastructure, but it is not a library the running application calls to create and query resources dynamically.

Last verified: 2026-09-02

Question 13 clf-core-services-overview-013

Easy · Choose one

Which statement best describes an AWS Availability Zone?

  1. a A rack of AWS-managed hardware installed inside a customer's own data center
  2. b One or more discrete data centers with redundant power, networking, and connectivity within an AWS Region
  3. c A caching site that Amazon CloudFront uses to deliver content to end users
  4. d A geographic area that contains multiple isolated AWS Regions
Show answer & explanation

Answer: B

Why B is correct

An Availability Zone (AZ) consists of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities within a Region. AZs in a Region are physically separated by a meaningful distance yet connected by high-bandwidth, low-latency, fully redundant private networking.

Why the others are wrong

  • A — That describes AWS Outposts, which brings AWS infrastructure into a customer facility.
  • C — That describes an edge location, which is part of the Amazon CloudFront and AWS global edge network, not an Availability Zone.
  • D — This reverses the relationship. A Region contains multiple Availability Zones, not the other way around.

Last verified: 2026-09-02

Question 14 clf-core-services-overview-014

Easy · Choose one

Which component of the AWS global infrastructure does Amazon CloudFront use to cache copies of content close to end users?

  1. a Availability Zones
  2. b AWS Outposts
  3. c AWS Regions
  4. d Edge locations
Show answer & explanation

Answer: D

Why D is correct

Amazon CloudFront delivers content through a worldwide network of edge locations. When a user requests content, the request is routed to the edge location that provides the lowest latency, and cached content is served from there instead of from the origin.

Why the others are wrong

  • A — Availability Zones host the origin infrastructure such as EC2 instances and databases. They are not the caching tier for CloudFront.
  • B — AWS Outposts extends AWS infrastructure into a customer's data center. It is not part of the CloudFront caching network.
  • C — Regions are the geographic groupings that contain Availability Zones. There are far fewer Regions than edge locations, so serving from a Region alone would not minimize latency for global users.

Last verified: 2026-09-02

Question 15 clf-core-services-overview-015

Easy · Choose one

Which statement correctly describes an AWS Region?

  1. a A network of caching servers positioned close to end users
  2. b A separate geographic area that contains multiple, physically isolated Availability Zones
  3. c A logical grouping of AWS accounts under one payer account
  4. d A single data center facility operated by AWS
Show answer & explanation

Answer: B

Why B is correct

An AWS Region is a separate geographic area, such as eu-west-1 or ap-southeast-1. Each Region contains multiple Availability Zones that are physically isolated from one another but interconnected with fast, private networking. Regions are isolated from each other, and AWS does not replicate data between Regions unless the customer configures it.

Why the others are wrong

  • A — That describes edge locations used for content delivery and DNS.
  • C — A logical grouping of accounts under one payer is an AWS Organization, which is an account management construct, not a physical location.
  • D — A single facility is smaller than an Availability Zone, and an AZ is in turn only one part of a Region.

Last verified: 2026-09-02