Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 1121:

  Which AWS service can report how AWS resource configurations have changed over time?

  A. AWS CloudTrail
  B. Amazon CloudWatch
  C. AWS Config
  D. Amazon Inspector
  C. AWS Config

  ---

  Explanation

  AWS Config is a service that enables users to assess, audit, and evaluate the configurations of AWS resources. It continuously monitors and records the configuration changes of the resources and evaluates them against desired configurations and best practices. It also provides a detailed view of the resource configuration history and relationships, as well as compliance reports and notifications. AWS Config can help users maintain consistent and secure configurations, troubleshoot issues, and simplify compliance auditing. AWS Config OverviewAWS Certified Cloud Practitioner - aws.amazon.com

• Question 1122:

  A company wants to create multiple isolated networks in the same AWS account.

  Which AWS service or component will provide this functionality?

  A. AWS Transit Gateway
  B. Internet gateway
  C. Amazon VPC
  D. Amazon EC2
  C. Amazon VPC

  ---

  Explanation

  Amazon Virtual Private Cloud (Amazon VPC) is the AWS service that allows customers to create multiple isolated networks in the same AWS account. A VPC is a logically isolated section of the AWS Cloud where customers can launch AWS resources in a virtual network that they define. Customers can create multiple VPCs within an AWS account, each with its own IP address range, subnets, route tables, security groups, network access control lists, gateways, and other components. AWS Transit Gateway, Internet gateway, and Amazon EC2 are not services or components that provide the functionality of creating multiple isolated networks in the same AWS account. AWS Transit Gateway is a service that enables customers to connect their Amazon VPCs and their on- premises networks to a single gateway. An Internet gateway is a component that enables communication between instances in a VPC and the Internet. Amazon EC2 is a service that provides scalable compute capacity in the cloud34

• Question 1123:

  Which AWS services or features enable users to connect on-premises networks to a VPC? (Choose two.)

  A. AWS VPN
  B. Elastic Load Balancing
  C. AWS Direct Connect
  D. VPC peering
  E. Amazon CloudFront
  A. AWS VPN
  C. AWS Direct Connect

  ---

  Explanation

• Question 1124:

  A company needs to host a web server on Amazon EC2 instances for at least 1 year. The web server cannot tolerate interruption.

  Which EC2 instance purchasing option will meet these requirements MOST cost- effectively?

  A. On-Demand Instances
  B. Partial Upfront Reserved Instances
  C. Spot Instances
  D. No Upfront Reserved Instances
  B. Partial Upfront Reserved Instances

  ---

  Explanation

  The most cost-effective EC2 instance purchasing option for the company that needs to host a web server on Amazon EC2 instances for at least 1 year and cannot tolerate interruption is Partial Upfront Reserved Instances. Reserved Instances are a pricing model that offer significant discounts compared to On-Demand Instances in exchange for a commitment to use a specific amount of compute capacity for a fixed period of time (1 or 3 years). Partial Upfront Reserved Instances require customers to pay a portion of the total cost upfront, and the remaining cost in monthly installments over the term. This option offers a lower effective hourly rate than No Upfront Reserved Instances, which require no upfront payment but have higher monthly payments. On-Demand Instances and Spot Instances are not the best options for the company. On-Demand Instances are a pricing model that offer the most flexibility and no long-term commitment, but have the highest hourly rate. Spot Instances are a pricing model that offer the lowest cost, but are subject to interruption based on supply and demand34

• Question 1125:

  Which AWS service supports a company's ability to treat infrastructure as code?

  A. AWS CodeDeploy
  B. AWS Elastic Beanstalk
  C. Amazon API Gateway
  D. AWS CloudFormation
  D. AWS CloudFormation

  ---

  Explanation

• Question 1126:

  What is an AWS Region?

  A. A broad set of global, cloud-based products that include compute, storage, and databases
  B. A physical location around the world where data centers are clustered
  C. One or more discrete data centers with redundant power, networking, and connectivity
  D. A service that developers use to build applications that deliver latencies of single-digit milliseconds to users
  B. A physical location around the world where data centers are clustered

  ---

  Explanation

  AWS has the concept of a Region, which is a physical location around the world where we cluster data centers. We call each group of logical data centers an Availability Zone. Each AWS Region consists of multiple, isolated, and physically separate AZs within a geographic area.

• Question 1127:

  A company is using AWS Lambda functions to build an application.

  Which tasks are the company's responsibility, according to the AWS shared responsibility model? (Select TWO.)

  A. Patch the servers where the Lambda functions are deployed.
  B. Establish the IAM permissions that define who can run the Lambda functions.
  C. Write the code for the Lambda functions to define the application logic.
  D. Deploy Amazon EC2 instances to support the Lambda functions.
  E. Scale out the Lambda functions when the load increases.
  B. Establish the IAM permissions that define who can run the Lambda functions.
  C. Write the code for the Lambda functions to define the application logic.

  ---

  Explanation

  According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the user is responsible for the security in the cloud. This means that AWS manages the security and maintenance of the underlying infrastructure, such as the servers, networks, and operating systems, while the user manages the security and configuration of the resources and applications that run on AWS. For AWS Lambda functions, the tasks that are the user's responsibility are: Establish the IAM permissions that define who can run the Lambda functions. IAM is a service that enables users to manage access and permissions for AWS resources and users. Users can create IAM policies, roles, and users to grant or deny permissions to run Lambda functions, invoke other AWS services, or access AWS resources from Lambda functions. [AWS Lambda Permissions] AWS Certified Cloud Practitioner - aws.amazon.com Write the code for the Lambda functions to define the application logic. Lambda functions are units of code that can be written in any supported programming language, such as Python, Node.js, Java, or Go. Users can write the code for the Lambda functions using the AWS Management Console, the AWS Command Line Interface (AWS CLI), the AWS SDKs, or any code editor of their choice. Users can also use AWS Lambda Layers to share and manage common code and dependencies across multiple functions. [AWS Lambda Overview] AWS Certified Cloud Practitioner - aws.amazon.com

• Question 1128:

  An application is running on multiple Amazon EC2 instances. The company wants to make the application highly available by configuring a load balancer with requests forwarded to the EC2 instances based on URL paths.

  Which AWS load balancer will meet these requirements and take the LEAST amount of effort to deploy?

  A. Network Load Balancer
  B. Application Load Balancer
  C. AWS OpsWorks Load Balancer
  D. Custom Load Balancer on Amazon EC2
  B. Application Load Balancer

  ---

  Explanation

  The correct answer is B because Application Load Balancer is an AWS load balancer that will meet the requirements and take the least amount of effort to deploy. Application Load Balancer is a type of Elastic Load Balancing that operates at the application layer (layer 7) of the OSI model and routes requests to targets based on the content of the request. Application Load Balancer supports advanced features, such as path-based routing, host-based routing, and HTTP header-based routing. The other options are incorrect because they are not AWS load balancers that will meet the requirements and take the least amount of effort to deploy. Network Load Balancer is a type of Elastic Load Balancing that operates at the transport layer (layer 4) of the OSI model and routes requests to targets based on the destination IP address and port. Network Load Balancer does not support path-based routing. AWS OpsWorks Load Balancer is not an AWS load balancer, but rather a feature of AWS OpsWorks that enables users to attach an Elastic Load Balancing load balancer to a layer of their stack. Custom Load Balancer on Amazon EC2 is not an AWS load balancer, but rather a user-defined load balancer that runs on an Amazon EC2 instance. Custom Load Balancer on Amazon EC2 requires more effort to deploy and maintain than an AWS load balancer.

  Elastic Load Balancing

• Question 1129:

  A company has developed a distributed application that recovers gracefully from interruptions. The application periodically processes large volumes of data by using multiple Amazon EC2 instances. The application is sometimes idle for months.

  Which EC2 instance purchasing option is MOST cost-effective for this use case?

  A. Reserved Instances
  B. Spot Instances
  C. Dedicated Instances
  D. On-Demand Instances
  B. Spot Instances

  ---

  Explanation

  Spot Instances are instances that use spare EC2 capacity that is available for up to 90% off the On-Demand price. Because Spot Instances can be interrupted by EC2 with two minutes of notification when EC2 needs the capacity back, you can use them for applications that have flexible start and end times, or that can withstand interruptions5. This option is most cost-effective for the use case described in the question. Reserved Instances are instances that you purchase for a one-year or three-year term, and pay a lower hourly rate compared to On-Demand Instances. This option is suitable for applications that have steady state or predictable usage. Dedicated Instances are instances that run on hardware that's dedicated to a single customer within an Amazon VPC. This option is suitable for applications that have stringent regulatory or compliance requirements. On-Demand Instances are instances that you pay for by the second, with no long-term commitments or upfront payments. This option is suitable for applications that have unpredictable or intermittent workloads.

• Question 1130:

  Which AWS service or feature can a company use to apply security rules to specific Amazon EC2 instances?

  A. Network ACLs
  B. Security groups
  C. AWS Trusted Advisor
  D. AWS WAF
  B. Security groups

  ---

  Explanation

  Security groups are the AWS service or feature that can be used to apply security rules to specific Amazon EC2 instances. Security groups are virtual firewalls that control the inbound and outbound traffic for one or more instances. Customers can create security groups and add rules that reflect the role of the instance that is associated with the security group. For example, a web server instance needs security group rules that allow inbound HTTP and HTTPS access, while a database instance needs rules that allow access for the type of database12. Security groups are stateful, meaning that the responses to allowed inbound traffic are also allowed, regardless of the outbound rules1. Customers can assign multiple security groups to an instance, and the rules from each security group are effectively aggregated to create one set of rules1. Network ACLs are another AWS service or feature that can be used to control the traffic for a subnet. Network ACLs are stateless, meaning that they do not track the traffic that they allow. Therefore, customers must add rules for both inbound and outbound traffic3. Network ACLs are applied at the subnet level, not at the instance level. AWS Trusted Advisor is an AWS service that provides best practice recommendations for security, performance, cost optimization, and fault tolerance. AWS Trusted Advisor does not apply security rules to specific Amazon EC2 instances, but it can help customers identify security gaps and improve their security posture4. AWS WAF is an AWS service that helps protect web applications from common web exploits, such as SQL injection, cross-site scripting, and bot attacks. AWS WAF does not apply security rules to specific Amazon EC2 instances, but it can be integrated with other AWS services, such as Amazon CloudFront, Amazon API Gateway, and Application Load Balancer.