Core Services Overview — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Cloud Technology and Services ·100 questions · 30 easy · 40 intermediate · 30 hard · page 4 of 7

Question 46 clf-core-services-overview-046

Easy · Choose one

Which Amazon RDS feature provisions a synchronous standby replica in a different Availability Zone and automatically fails over to it if the primary database instance becomes unavailable?

  1. a Read replica
  2. b Multi-AZ deployment
  3. c Automated backup
  4. d Database snapshot
Show answer & explanation

Answer: B

Why B is correct

An Amazon RDS Multi-AZ deployment maintains a synchronously replicated standby in a different Availability Zone. If the primary fails or the Availability Zone becomes unavailable, RDS automatically fails over by pointing the database endpoint at the standby, usually without any application change beyond a reconnect.

Why the others are wrong

  • A — Read replicas use asynchronous replication and are intended to scale read traffic. Promoting one is a manual action and can involve data loss because replication lags.
  • C — Automated backups enable point-in-time recovery. Restoring from a backup creates a new instance and takes time; it is not an automatic failover.
  • D — A snapshot is a manual point-in-time copy used to restore a new instance. It provides no automatic failover.

Last verified: 2026-09-02

Question 47 clf-core-services-overview-047

Intermediate · Choose one

An e-commerce application on Amazon RDS is slowing down because a nightly reporting job runs heavy SELECT queries against the production database. The company wants to move that read traffic off the primary instance. What should it implement?

  1. a Create an Amazon RDS read replica and point the reporting job at it
  2. b Enable a Multi-AZ DB instance deployment and run the reports against the single standby
  3. c Convert the database to Amazon DynamoDB
  4. d Increase the automated backup retention period
Show answer & explanation

Answer: A

Why A is correct

Read replicas are asynchronous copies of the source database that serve read-only traffic. Directing the reporting workload to a replica removes that load from the primary instance, which continues serving transactional traffic. Read replicas are the standard mechanism for scaling reads in Amazon RDS.

Why the others are wrong

  • B — In a Multi-AZ DB instance deployment the single standby exists purely for failover and does not serve read traffic, so it cannot run the reporting queries. (The separate Multi-AZ DB cluster deployment does provide two readable standbys, but that is not what this option describes.)
  • C — Migrating to DynamoDB would require a full re-architecture and would not naturally support the ad hoc analytical SQL that a reporting job uses.
  • D — Backup retention controls how far back point-in-time recovery can go. It has no effect on query performance.

Last verified: 2026-09-02

Question 48 clf-core-services-overview-048

Intermediate · Choose one

Which AWS database service is MySQL-compatible and PostgreSQL-compatible, delivers significantly higher throughput than the standard community engines, and automatically maintains six copies of the data across three Availability Zones?

  1. a Amazon RDS for MariaDB
  2. b Amazon Redshift
  3. c Amazon Aurora
  4. d Amazon DocumentDB
Show answer & explanation

Answer: C

Why C is correct

Amazon Aurora is a MySQL-compatible and PostgreSQL-compatible relational database built for the cloud. AWS states it delivers up to six times the throughput of stock MySQL and up to six times the throughput of stock PostgreSQL on similar hardware, and its distributed, fault-tolerant storage layer replicates each 10 GB chunk of the volume six ways across three Availability Zones, with continuous backup to Amazon S3.

Why the others are wrong

  • A — RDS for MariaDB runs the community engine on a conventional storage volume. It does not use the Aurora distributed storage architecture or its six-way replication.
  • B — Amazon Redshift is a columnar data warehouse for analytics workloads, not a transactional relational engine.
  • D — Amazon DocumentDB is a document database with MongoDB compatibility. It is not MySQL or PostgreSQL compatible.

Last verified: 2026-09-02

Question 49 clf-core-services-overview-049

Intermediate · Choose one

A web application repeatedly issues the same expensive database query, and the database instance is under pressure. The company wants to add a managed in-memory caching layer that is compatible with open source engines such as Valkey, Memcached, or Redis OSS. Which service should it use?

  1. a Amazon EBS with a Provisioned IOPS volume
  2. b Amazon ElastiCache
  3. c Amazon CloudFront
  4. d Amazon S3
Show answer & explanation

Answer: B

Why B is correct

Amazon ElastiCache is a fully managed in-memory caching service. It provides Valkey-, Memcached-, and Redis OSS-compatible engines and is commonly placed in front of a database so that repeated read queries are served from memory in microseconds to milliseconds, which reduces load on the database and improves application response times.

Why the others are wrong

  • A — A faster EBS volume improves disk throughput for the database, but it still means the query runs against the database engine each time rather than being cached.
  • C — CloudFront caches HTTP responses at edge locations for end users. It does not cache internal database query results.
  • D — Amazon S3 is durable object storage. It is not an in-memory cache and would not deliver sub-millisecond query results.

Last verified: 2026-09-02

Question 50 clf-core-services-overview-050

Intermediate · Choose one

An application built on Amazon DynamoDB experiences a read-heavy workload and needs response times measured in microseconds rather than milliseconds. Which fully managed option should be added?

  1. a Amazon DynamoDB Global Tables
  2. b An Amazon RDS read replica
  3. c Amazon DynamoDB Accelerator (DAX)
  4. d Amazon DynamoDB Streams
Show answer & explanation

Answer: C

Why C is correct

Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available in-memory cache purpose-built for DynamoDB. It sits in front of the table and delivers microsecond read latency for cached items, with an API-compatible client so application code changes are minimal.

Why the others are wrong

  • A — Global Tables replicate a table across Regions for multi-Region access and resilience. Within a Region, read latency remains in the single-digit millisecond range.
  • B — An RDS read replica belongs to Amazon RDS and has no relationship to a DynamoDB table.
  • D — DynamoDB Streams captures an ordered record of item-level changes for downstream processing. It does not accelerate reads.

Last verified: 2026-09-02

Question 51 clf-core-services-overview-051

Intermediate · Select 2 answers

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL and needs to both translate the database schema and stored procedures and move the data while the source database keeps serving users. Which TWO services should be used? (Choose TWO.)

  1. a AWS Schema Conversion Tool (AWS SCT)
  2. b AWS Glue DataBrew
  3. c AWS Database Migration Service (AWS DMS)
  4. d AWS Application Discovery Service
  5. e Amazon Redshift Spectrum
Show answer & explanation

Answer: A and C

Why A and C are correct

This is a heterogeneous migration because the source and target engines differ. The AWS Schema Conversion Tool converts the source schema, views, stored procedures, and functions to the target engine's format and reports the parts that need manual work. AWS DMS then migrates the data and supports ongoing replication, so the source database remains fully operational during the migration and cutover downtime is minimized.

Why the others are wrong

  • B — AWS Glue DataBrew is a visual data preparation tool for cleaning and normalizing data for analytics. It is not a database migration tool.
  • D — AWS Application Discovery Service collects usage and configuration data from on-premises servers to help plan a migration. It informs planning; it neither converts a schema nor moves data.
  • E — Redshift Spectrum queries data in Amazon S3 from Amazon Redshift. It has no role in migrating an Oracle database.

Last verified: 2026-09-02

Question 52 clf-core-services-overview-052

Hard · Choose one

Which statement correctly contrasts an Amazon RDS Multi-AZ deployment with an Amazon RDS read replica?

  1. a Multi-AZ can only be used with Amazon Aurora, while read replicas can only be used with Amazon DynamoDB
  2. b Multi-AZ scales read traffic across Availability Zones, while read replicas provide automatic failover
  3. c Multi-AZ provides high availability through synchronous replication and automatic failover, while read replicas use asynchronous replication to scale read traffic
  4. d Both use synchronous replication, but only read replicas can fail over automatically
Show answer & explanation

Answer: C

Why C is correct

Multi-AZ is a high availability and durability feature: data is replicated synchronously to a standby in another Availability Zone, and RDS fails over automatically when the primary is impaired. Read replicas are a scalability feature: data is replicated asynchronously to one or more replicas that serve read-only queries, and promoting a replica is a manual operation.

Why the others are wrong

  • A — Both features apply across Amazon RDS engines. Neither is exclusive to Aurora, and DynamoDB does not use RDS read replicas at all.
  • B — This reverses the two features. The standby in a standard Multi-AZ deployment does not serve reads, and read replica promotion is not automatic.
  • D — Read replicas replicate asynchronously, which is why they can lag behind the source, and they do not fail over automatically.

Last verified: 2026-09-02

Question 53 clf-core-services-overview-053

Hard · Choose one

A global mobile application needs users in North America, Europe, and Asia to read and write to a DynamoDB table with local low latency, and it must keep operating if one Region becomes unavailable. Which DynamoDB feature meets this requirement?

  1. a DynamoDB Accelerator (DAX)
  2. b Global Tables
  3. c On-demand capacity mode
  4. d Point-in-time recovery
Show answer & explanation

Answer: B

Why B is correct

DynamoDB Global Tables provide a fully managed, multi-Region, multi-active database. AWS replicates the table to the Regions you select, and applications can read and write in whichever Region is closest to the user. If one Region becomes unavailable, traffic can be served from the remaining replica Regions.

Why the others are wrong

  • A — DAX is an in-memory cache that reduces read latency within a single Region. It provides no cross-Region replication or Regional failover.
  • C — On-demand capacity mode changes how throughput is billed and scaled. It does not place data in additional Regions.
  • D — Point-in-time recovery protects against accidental writes and deletes by allowing restores to a previous time. It is a backup feature, not a Regional availability feature.

Last verified: 2026-09-02

Question 54 clf-core-services-overview-054

Hard · Choose one

A company runs a self-managed MongoDB cluster and wants to move to a fully managed AWS database. Its applications must keep working with their existing MongoDB drivers, queries, and tools without being rewritten. Which service should the company use?

  1. a Amazon DynamoDB
  2. b Amazon Neptune
  3. c Amazon RDS for PostgreSQL
  4. d Amazon DocumentDB
Show answer & explanation

Answer: D

Why D is correct

Amazon DocumentDB is a fully managed document database service that is designed to be compatible with MongoDB workloads. Because it implements the MongoDB API, existing drivers, queries, and tools continue to work, so the migration does not require the applications to be rewritten. AWS manages the underlying hardware, patching, backups, and scaling.

Why the others are wrong

  • A — Amazon DynamoDB is a managed NoSQL key-value and document database, but it uses its own API. Every query and driver call in the application would have to be rewritten.
  • B — Amazon Neptune is a graph database for highly connected data. It does not implement the MongoDB API or the document data model these applications use.
  • C — Amazon RDS for PostgreSQL is a relational engine. Moving to it would require redesigning the document data model into tables and rewriting the queries in SQL.

Last verified: 2026-09-02

Question 55 clf-core-services-overview-055

Hard · Select 2 answers

Which TWO statements about Amazon DynamoDB are TRUE? (Choose TWO.)

  1. a It automatically replicates data across multiple Availability Zones within a Region
  2. b It offers both on-demand and provisioned throughput capacity modes
  3. c It supports complex multi-table SQL joins as its primary query pattern
  4. d It requires a Multi-AZ option to be enabled before it becomes highly available
  5. e The customer must choose an instance class and apply database engine patches
Show answer & explanation

Answer: A and B

Why A and B are correct

DynamoDB is a serverless database that stores data redundantly across multiple Availability Zones in a Region by default, giving built-in high availability and durability. For throughput, it offers on-demand capacity mode, which scales automatically and charges per request, and provisioned capacity mode, in which you specify read and write capacity units and can apply auto scaling.

Why the others are wrong

  • C — DynamoDB is a NoSQL key-value and document store. Access patterns are designed around partition and sort keys and secondary indexes, not ad hoc relational joins.
  • D — Multi-Availability Zone redundancy is automatic and cannot be turned off. There is no separate Multi-AZ setting to enable.
  • E — DynamoDB has no instances to size and no engine to patch. AWS handles all of the underlying infrastructure, which is a defining feature of a serverless database.

Last verified: 2026-09-02

Question 56 clf-core-services-overview-056

Easy · Choose one

Which AWS service provides a logically isolated section of the AWS Cloud in which a customer can launch resources into a virtual network that they define, including their own IP address range, subnets, and route tables?

  1. a AWS Direct Connect
  2. b Amazon Virtual Private Cloud (Amazon VPC)
  3. c AWS Transit Gateway
  4. d Amazon Route 53
Show answer & explanation

Answer: B

Why B is correct

Amazon VPC lets you provision a logically isolated virtual network in AWS. You control the IP address range (CIDR block), create subnets across Availability Zones, and configure route tables, internet gateways, NAT gateways, security groups, and network ACLs, closely mirroring a traditional on-premises network.

Why the others are wrong

  • A — AWS Direct Connect provides a dedicated private network connection from a data center into AWS. It connects to a VPC; it is not the virtual network itself.
  • C — AWS Transit Gateway is a network hub that interconnects VPCs and on-premises networks. It joins networks together rather than providing the isolated network itself.
  • D — Amazon Route 53 is a DNS and domain registration service. It resolves names to addresses and does not define a network.

Last verified: 2026-09-02

Question 57 clf-core-services-overview-057

Easy · Choose one

Which AWS service is a highly available and scalable Domain Name System (DNS) web service that can also be used to register domain names?

  1. a Elastic Load Balancing
  2. b Amazon CloudFront
  3. c Amazon Route 53
  4. d AWS Certificate Manager
Show answer & explanation

Answer: C

Why C is correct

Amazon Route 53 is AWS's DNS web service. It translates human-readable domain names into IP addresses, supports domain registration and transfer, offers health checks, and provides several routing policies for directing users to the appropriate endpoint.

Why the others are wrong

  • A — Elastic Load Balancing distributes traffic to targets within a Region. It is given a DNS name by AWS but is not a DNS service.
  • B — Amazon CloudFront is a content delivery network. It uses DNS to route users to edge locations but does not itself host DNS zones or register domains.
  • D — AWS Certificate Manager provisions and manages SSL/TLS certificates. It validates domain ownership but does not provide DNS hosting or registration.

Last verified: 2026-09-02

Question 58 clf-core-services-overview-058

Easy · Choose one

Which AWS service is a global content delivery network that securely delivers data, videos, applications, and APIs to users with low latency by caching copies at edge locations?

  1. a Amazon API Gateway
  2. b AWS Global Accelerator
  3. c Amazon CloudFront
  4. d Amazon S3 Transfer Acceleration
Show answer & explanation

Answer: C

Why C is correct

Amazon CloudFront is AWS's content delivery network (CDN). It caches content at a worldwide network of edge locations so that requests are served from a nearby edge instead of the origin, which lowers latency for viewers and reduces load and data transfer cost at the origin.

Why the others are wrong

  • A — Amazon API Gateway creates, publishes, and secures APIs. It is not a general content delivery network.
  • B — AWS Global Accelerator improves availability and performance by routing traffic over the AWS global network to Regional endpoints using static anycast IP addresses. It does not cache content.
  • D — S3 Transfer Acceleration speeds up uploads into a single S3 bucket over long distances by using edge locations. It accelerates transfers into S3 rather than delivering content broadly to end users.

Last verified: 2026-09-02

Question 59 clf-core-services-overview-059

Easy · Choose one

Which Amazon VPC component must be attached to a VPC and referenced in a route table so that resources in a public subnet can send and receive traffic over the internet?

  1. a Virtual private gateway
  2. b Internet gateway
  3. c NAT gateway
  4. d VPC endpoint
Show answer & explanation

Answer: B

Why B is correct

An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between resources in the VPC and the internet. A subnet becomes public when its route table sends 0.0.0.0/0 traffic to the internet gateway and the resources have public IP addresses.

Why the others are wrong

  • A — A virtual private gateway is the AWS-side VPN endpoint for a Site-to-Site VPN connection to an on-premises network, not for general internet access.
  • C — A NAT gateway allows instances in private subnets to initiate outbound connections to the internet, but it does not allow inbound connections from the internet, and it still relies on an internet gateway to reach the internet.
  • D — A VPC endpoint provides private connectivity to supported AWS services without traversing the internet, which is the opposite of what is being asked.

Last verified: 2026-09-02

Question 60 clf-core-services-overview-060

Intermediate · Choose one

Which statement accurately describes an Amazon VPC security group?

  1. a It is stateless, operates at the instance level, and requires explicit return-traffic rules
  2. b It is stateful, operates at the instance or network interface level, and supports allow rules only
  3. c It is stateful, operates at the subnet level, and evaluates rules in numbered order
  4. d It is stateless, operates at the subnet level, and supports both allow and deny rules
Show answer & explanation

Answer: B

Why B is correct

A security group acts as a virtual firewall attached to an elastic network interface, so it protects individual resources such as EC2 instances. It is stateful, which means that if inbound traffic is allowed, the corresponding response traffic is automatically permitted regardless of outbound rules. Security groups contain only allow rules; anything not explicitly allowed is implicitly denied.

Why the others are wrong

  • A — Security groups are stateful, so return traffic is allowed automatically and no explicit return rule is needed.
  • C — Security groups do not operate at the subnet level, and all rules are evaluated together rather than in numbered order. Rule numbering is a network ACL characteristic.
  • D — That describes a network ACL, which is the stateless, subnet-level control that supports both allow and deny rules.

Last verified: 2026-09-02