Core Services Overview — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Cloud Technology and Services ·100 questions · 30 easy · 40 intermediate · 30 hard · page 5 of 7

Question 61 clf-core-services-overview-061

Intermediate · Choose one

A security team must explicitly block traffic from a specific range of malicious IP addresses at the subnet boundary of a VPC. Which VPC feature should they use?

  1. a A route table entry pointing the range to a black hole
  2. b An IAM policy denying the source IP range
  3. c A security group with a deny rule
  4. d A network ACL with a deny rule
Show answer & explanation

Answer: D

Why D is correct

Network ACLs operate at the subnet level and are the only VPC firewall construct that supports explicit deny rules. Rules are numbered and evaluated in order from the lowest number, so a low-numbered deny rule for the malicious CIDR range blocks that traffic before any later allow rule is considered.

Why the others are wrong

  • A — Route tables control where traffic is sent, not whether it is permitted. Using routes as a security control is unreliable and does not filter inbound traffic at the subnet boundary.
  • B — IAM policies authorize API calls to AWS services. They do not filter network packets flowing to EC2 instances.
  • C — Security groups support allow rules only. There is no way to express a deny rule in a security group.

Last verified: 2026-09-02

Question 62 clf-core-services-overview-062

Intermediate · Choose one

Amazon EC2 instances in a private subnet must download operating system patches from the internet, but nothing on the internet should be able to initiate a connection to them. Which VPC component should be used?

  1. a An internet gateway attached directly to the private subnet
  2. b A virtual private gateway
  3. c A NAT gateway in a public subnet
  4. d An Elastic IP address assigned to each instance
Show answer & explanation

Answer: C

Why C is correct

A NAT gateway placed in a public subnet performs network address translation for instances in private subnets. It allows those instances to initiate outbound connections to the internet, for example to fetch patches, while preventing any unsolicited inbound connections from reaching them.

Why the others are wrong

  • A — Internet gateways are attached to the VPC, not to a subnet, and routing a private subnet directly to one would make those instances reachable from the internet if they had public addresses, which violates the requirement.
  • B — A virtual private gateway terminates a Site-to-Site VPN connection to an on-premises network. It does not provide internet access.
  • D — Assigning Elastic IP addresses would make the instances publicly addressable and therefore reachable from the internet, which is exactly what must be prevented.

Last verified: 2026-09-02

Question 63 clf-core-services-overview-063

Intermediate · Choose one

A company runs identical copies of its web application in three AWS Regions. It wants Amazon Route 53 to send each user to the Regional endpoint that gives that user the fastest response. Which routing policy should be configured?

  1. a Weighted routing policy
  2. b Simple routing policy
  3. c Geolocation routing policy
  4. d Latency routing policy
Show answer & explanation

Answer: D

Why D is correct

A latency routing policy is used when resources exist in multiple AWS Regions and you want traffic served from the Region that provides the lowest network latency for the requester. Route 53 uses measured latency data between users and Regions, so the choice reflects actual network performance rather than geography alone.

Why the others are wrong

  • A — Weighted routing splits traffic across endpoints in proportions you define. It ignores latency entirely.
  • B — Simple routing returns a single record with no logic for choosing between multiple endpoints.
  • C — Geolocation routing sends users to endpoints based on the geographic location the DNS query originates from. The nearest geographic endpoint is not always the lowest-latency one.

Last verified: 2026-09-02

Question 64 clf-core-services-overview-064

Intermediate · Choose one

A company maintains a primary application stack in one AWS Region and a standby stack in a second Region. It wants Amazon Route 53 to send all traffic to the primary while it is healthy and to switch to the standby automatically when a health check fails. Which routing policy should be used?

  1. a Multivalue answer routing policy
  2. b IP-based routing policy
  3. c Failover routing policy
  4. d Geoproximity routing policy
Show answer & explanation

Answer: C

Why C is correct

A failover routing policy implements an active-passive design. The primary record serves all traffic while its associated Route 53 health check passes, and Route 53 begins answering with the secondary record when the primary is judged unhealthy.

Why the others are wrong

  • A — Multivalue answer routing returns up to eight healthy records at random. It spreads traffic across all healthy endpoints instead of preferring a designated primary.
  • B — IP-based routing maps user IP address ranges (CIDR blocks) to endpoints. It is used for network-based traffic engineering, not failover.
  • D — Geoproximity routing routes based on the geographic location of resources and users, with an optional bias to shift traffic. It is not an active-passive failover mechanism.

Last verified: 2026-09-02

Question 65 clf-core-services-overview-065

Intermediate · Choose one

Which AWS service allows developers to create, publish, monitor, and secure REST, HTTP, and WebSocket APIs at any scale, acting as a managed front door to backend services such as AWS Lambda and Amazon EC2?

  1. a Amazon API Gateway
  2. b AWS Amplify
  3. c Elastic Load Balancing
  4. d Amazon CloudFront
Show answer & explanation

Answer: A

Why A is correct

Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs. It handles traffic management, authorization and access control, throttling, and API versioning, and it integrates natively with Lambda, EC2, and other AWS and HTTP backends.

Why the others are wrong

  • B — AWS Amplify helps developers build and host frontend web and mobile applications and their backends. It is aimed at frontend delivery rather than at publishing, throttling, and securing APIs for arbitrary backends.
  • C — Elastic Load Balancing distributes network connections across targets. It does not provide API keys, usage plans, request throttling, or API lifecycle management.
  • D — CloudFront caches and delivers content at the edge. It can sit in front of an API but does not create or manage API definitions.

Last verified: 2026-09-02

Question 66 clf-core-services-overview-066

Intermediate · Choose one

Which statement about Amazon VPC subnets is TRUE?

  1. a A VPC can contain only one subnet, which must be public
  2. b A subnet automatically spans every Availability Zone in the Region for high availability
  3. c A subnet resides entirely within a single Availability Zone, while the VPC that contains it spans all Availability Zones in the Region
  4. d A subnet can be shared across two AWS Regions to provide disaster recovery
Show answer & explanation

Answer: C

Why C is correct

A VPC is a Regional construct that spans all Availability Zones in its Region, but each subnet is created inside exactly one Availability Zone. This is why highly available designs create at least one subnet in each of two or more Availability Zones and distribute resources across them.

Why the others are wrong

  • A — A VPC can contain many subnets, and they may be public or private depending on their route table configuration.
  • B — Subnets never span Availability Zones. Spanning zones is achieved by creating multiple subnets, one per zone.
  • D — VPCs and subnets are Regional. A subnet cannot exist in two Regions; cross-Region designs use separate VPCs connected by peering or Transit Gateway.

Last verified: 2026-09-02

Question 67 clf-core-services-overview-067

Hard · Select 2 answers

Which TWO statements correctly compare AWS Direct Connect with AWS Site-to-Site VPN? (Choose TWO.)

  1. a A Site-to-Site VPN provides more consistent bandwidth than Direct Connect because it uses the AWS backbone
  2. b Direct Connect encrypts all traffic in transit by default without any additional configuration
  3. c Direct Connect provides a dedicated private connection with consistent, predictable network performance
  4. d Direct Connect is always the lower-cost option regardless of data volume
  5. e A Site-to-Site VPN can typically be provisioned in minutes to hours and has no physical circuit to order
Show answer & explanation

Answer: C and E

Why C and E are correct

AWS Direct Connect establishes a dedicated physical link between the customer's network and AWS that bypasses the public internet, so throughput and latency are consistent and predictable. AWS Site-to-Site VPN, by contrast, builds an IPsec tunnel over the customer's existing internet connection, so it can be configured quickly with no circuit to order and no long lead time.

Why the others are wrong

  • A — This is reversed. A VPN traverses the public internet, so its bandwidth and latency vary with internet conditions, whereas Direct Connect provides the dedicated path.
  • B — A standard Direct Connect connection is private but is not encrypted by default. Encryption requires running a VPN over Direct Connect or using MACsec on supported connections.
  • D — Direct Connect involves port-hour charges and cross-connect fees, so for small or intermittent data volumes a VPN is usually cheaper. Direct Connect tends to win on cost only at sustained high data transfer volumes.

Last verified: 2026-09-02

Question 68 clf-core-services-overview-068

Hard · Choose one

Amazon EC2 instances in a private subnet need to read and write objects in an Amazon S3 bucket. The security team requires that this traffic never traverse the public internet, and they do not want to run a NAT gateway for it. What should be implemented?

  1. a An Amazon S3 bucket policy that allows the private subnet CIDR
  2. b A VPC gateway endpoint for Amazon S3
  3. c An AWS Site-to-Site VPN connection
  4. d An internet gateway with a restrictive route table
Show answer & explanation

Answer: B

Why B is correct

A VPC gateway endpoint for Amazon S3 adds a route in the subnet's route table that sends S3-destined traffic across the AWS private network. No internet gateway, NAT device, or public IP address is required, and the traffic never leaves the AWS network.

Why the others are wrong

  • A — A bucket policy controls authorization once a request arrives. It does not create a network path, so instances with no route to S3 still could not reach the bucket.
  • C — A Site-to-Site VPN connects a VPC to an on-premises network. It does not provide private access to Amazon S3 from within the VPC.
  • D — An internet gateway by definition routes traffic to and from the public internet, which the security team has explicitly ruled out.

Last verified: 2026-09-02

Question 69 clf-core-services-overview-069

Hard · Choose one

A company has one VPC in the eu-west-1 Region and another in ap-southeast-1. Application servers in each VPC must communicate using private IP addresses without sending traffic over the public internet. Which option meets this requirement with the least configuration?

  1. a An internet gateway in each VPC with security group restrictions
  2. b An Amazon CloudFront distribution in front of each VPC
  3. c A NAT gateway in each VPC
  4. d Inter-Region VPC peering between the two VPCs
Show answer & explanation

Answer: D

Why D is correct

VPC peering creates a networking connection between two VPCs so that resources can communicate using private IP addresses as if they were on the same network. Inter-Region peering is supported, and the traffic travels over the AWS global backbone rather than the public internet, and it is encrypted by AWS.

Why the others are wrong

  • A — Internet gateways route traffic over the public internet, which the requirement rules out, and the servers would need public IP addresses.
  • B — CloudFront is a content delivery network for delivering content to end users. It is not a VPC-to-VPC connectivity mechanism.
  • C — NAT gateways provide outbound internet access for private subnets. They do not create private connectivity between two VPCs.

Last verified: 2026-09-02

Question 70 clf-core-services-overview-070

Hard · Choose one

A team is releasing a new version of its web application and wants to send 10 percent of user traffic to the new version and 90 percent to the current version, adjusting the split over time. Which Amazon Route 53 routing policy supports this?

  1. a Multivalue answer routing policy
  2. b Weighted routing policy
  3. c Failover routing policy
  4. d Latency routing policy
Show answer & explanation

Answer: B

Why B is correct

A weighted routing policy lets you associate multiple records with the same name and assign each a relative weight. Route 53 returns each record in proportion to its weight, so a 10 and 90 split sends roughly one in ten requests to the new version. Adjusting the weights shifts traffic gradually, which is the standard DNS-level canary or blue/green technique.

Why the others are wrong

  • A — Multivalue answer routing returns up to eight healthy records selected at random. It provides rough distribution but no configurable percentage split.
  • C — Failover routing is binary and health-check driven. It sends all traffic to the primary or all to the secondary, with no proportional split.
  • D — Latency routing chooses the Region with the best measured latency for each user. The proportion of traffic each version receives cannot be controlled.

Last verified: 2026-09-02

Question 71 clf-core-services-overview-071

Easy · Choose one

Which AWS service provides object storage designed for 99.999999999 percent (11 nines) durability, storing data as objects within buckets and accessible over the internet through an API?

  1. a Amazon Elastic File System (Amazon EFS)
  2. b Amazon Simple Storage Service (Amazon S3)
  3. c Amazon FSx
  4. d Amazon Elastic Block Store (Amazon EBS)
Show answer & explanation

Answer: B

Why B is correct

Amazon S3 is object storage. Data is stored as objects inside buckets, each object is addressed by a key, and access is through a web service API. Most S3 storage classes are designed for 99.999999999 percent durability by redundantly storing objects across multiple devices in a minimum of three Availability Zones.

Why the others are wrong

  • A — Amazon EFS provides a shared file system using the NFS protocol. It presents a directory hierarchy rather than objects in buckets.
  • C — Amazon FSx provides fully managed third-party file systems such as Windows File Server and Lustre. These are file, not object, storage.
  • D — Amazon EBS provides block storage volumes attached to a single EC2 instance. It is not object storage and is not accessed through an object API.

Last verified: 2026-09-02

Question 72 clf-core-services-overview-072

Easy · Choose one

Which AWS service provides persistent block storage volumes that are attached to Amazon EC2 instances and behave like raw, unformatted disks?

  1. a Amazon EFS
  2. b Amazon S3
  3. c AWS Storage Gateway
  4. d Amazon Elastic Block Store (Amazon EBS)
Show answer & explanation

Answer: D

Why D is correct

Amazon EBS provides block-level storage volumes that attach to EC2 instances. The operating system sees them as raw block devices that can be formatted with a file system, and the data persists independently of the instance lifecycle so it survives a stop and start.

Why the others are wrong

  • A — Amazon EFS is a shared file system accessed over NFS. It provides file semantics, not block devices.
  • B — Amazon S3 is object storage accessed through an API. It cannot be mounted as a block device and formatted with a file system.
  • C — AWS Storage Gateway connects on-premises environments to AWS storage. It is a hybrid gateway, not native block storage for EC2.

Last verified: 2026-09-02

Question 73 clf-core-services-overview-073

Easy · Choose one

A company must retain compliance records for ten years. The records are almost never accessed, and when they are, a retrieval time of up to 12 hours is acceptable. Which Amazon S3 storage class provides the lowest storage cost for this requirement?

  1. a S3 One Zone-Infrequent Access
  2. b S3 Glacier Deep Archive
  3. c S3 Standard-Infrequent Access
  4. d S3 Glacier Instant Retrieval
Show answer & explanation

Answer: B

Why B is correct

S3 Glacier Deep Archive is the lowest-cost Amazon S3 storage class. It is designed for long-term retention of data accessed once or twice a year, with retrieval times measured in hours and a 180-day minimum storage duration, which fits a ten-year compliance archive that tolerates a 12-hour restore.

Why the others are wrong

  • A — S3 One Zone-IA is cheaper than Standard-IA but still an infrequent-access class, not an archive class, and it stores data in only one Availability Zone, which is a poor fit for long-term compliance records.
  • C — S3 Standard-IA is for data accessed less frequently but that requires rapid access. Its storage price is far higher than the archive classes.
  • D — S3 Glacier Instant Retrieval delivers millisecond access, which the scenario does not need, and it therefore costs significantly more per gigabyte than Deep Archive.

Last verified: 2026-09-02

Question 74 clf-core-services-overview-074

Easy · Choose one

Which AWS service provides a fully managed, elastic NFS file system that can be mounted concurrently by many Amazon EC2 Linux instances across multiple Availability Zones?

  1. a Amazon Elastic Block Store (Amazon EBS)
  2. b Amazon S3 Glacier
  3. c Amazon Elastic File System (Amazon EFS)
  4. d Amazon FSx for Windows File Server
Show answer & explanation

Answer: C

Why C is correct

Amazon EFS is a fully managed, elastic file system that uses the NFS protocol. It can be mounted simultaneously by thousands of Linux EC2 instances, containers, and Lambda functions, is accessible from multiple Availability Zones, and grows and shrinks automatically as files are added and removed.

Why the others are wrong

  • A — A standard EBS volume attaches to a single instance in a single Availability Zone and cannot be shared across Availability Zones.
  • B — S3 Glacier is an archival object storage tier. It cannot be mounted as a file system.
  • D — FSx for Windows File Server uses the SMB protocol and targets Windows workloads, not Linux NFS clients.

Last verified: 2026-09-02

Question 75 clf-core-services-overview-075

Easy · Choose one

Which Amazon S3 feature keeps multiple variants of an object in the same bucket, so that a file can be recovered after it is accidentally overwritten or deleted?

  1. a S3 Transfer Acceleration
  2. b S3 Cross-Region Replication
  3. c S3 Lifecycle configuration
  4. d S3 Versioning
Show answer & explanation

Answer: D

Why D is correct

S3 Versioning keeps every version of every object in a bucket. An overwrite creates a new version rather than replacing the old one, and a delete places a delete marker while the previous versions remain, so any earlier version can be restored. It is the standard protection against accidental overwrite and deletion.

Why the others are wrong

  • A — S3 Transfer Acceleration speeds up long-distance uploads to a bucket by routing them through edge locations. It has no effect on data recovery.
  • B — Cross-Region Replication copies objects to a bucket in another Region. It protects against a Region-level event, but it also replicates overwrites and deletions unless versioning is enabled, so it is not by itself the recovery mechanism described.
  • C — A lifecycle configuration transitions objects between storage classes and expires them on a schedule. It manages cost and retention rather than preserving prior copies for recovery.

Last verified: 2026-09-02