Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 1181:

  A cloud practitioner is analyzing Amazon EC2 instance performance and usage to provide recommendations for potential cost savings.

  Which cloud concept does this analysis demonstrate?

  A. Auto scaling
  B. Rightsizing
  C. Load balancing
  D. High availability
  B. Rightsizing

  ---

  Explanation

  Rightsizing is the cloud concept that this analysis demonstrates. Rightsizing is the process of optimizing the performance and cost of your AWS resources by selecting the most appropriate type, size, and configuration based on your workload requirements and usage patterns. Rightsizing can help you achieve potential cost savings by reducing the over-provisioning or under-utilization of your resources. You can use various AWS tools and services, such as AWS Cost Explorer, AWS Compute Optimizer, and AWS Trusted Advisor, to analyze your resource utilization and performance metrics, and receive recommendations for rightsizing.

• Question 1182:

  According to the AWS shared responsibility model, the customer is responsible for applying the latest security updates and patches for which of the following?

  A. Amazon DynamoDB
  B. Amazon EC2 instances
  C. Amazon RDS instances
  D. Amazon S3
  B. Amazon EC2 instances

  ---

  Explanation

• Question 1183:

  Which design principle should be considered when architecting in the AWS Cloud?

  A. Think of servers as non-disposable resources.
  B. Use synchronous integration of services.
  C. Design loosely coupled components.
  D. Implement the least permissive rules for security groups.
  C. Design loosely coupled components.

  ---

  Explanation

  Designing loosely coupled components is a design principle that should be considered when architecting in the AWS Cloud. Loose coupling is a way of designing systems to reduce interdependencies and minimize the impact of changes. Loose coupling allows components to interact with each other through well-defined interfaces, rather than direct references. This reduces the risk of failures and errors propagating across the system, and enables greater scalability, availability, and maintainability5.

• Question 1184:

  Which task requires a user to sign in as the AWS account root user?

  A. The deletion of IAM users
  B. The deletion of an AWS account
  C. The creation of an organization in AWS Organizations
  D. The deletion of Amazon EC2 instances
  B. The deletion of an AWS account

  ---

  Explanation

  Tasks that require root user credentials https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html

• Question 1185:

  A company wants to run its application on Amazon EC2 instances. The company needs to keep the application on-premises to meet a compliance requirement.

  Which AWS offering will meet these requirements?

  A. Dedicated Instances
  B. Amazon CloudFront
  C. AWS Fargate
  D. AWS Outposts
  D. AWS Outposts

  ---

  Explanation

  AWS Outposts is an AWS offering that brings AWS infrastructure and services to a customer's on-premises location. It allows companies to run AWS services locally while meeting regulatory or compliance requirements that mandate keeping data or applications on-premises.

  Dedicated Instances are EC2 instances that run on hardware dedicated to a single customer but remain within AWS data centers.

  Amazon CloudFront is a content delivery network (CDN) service, and AWS Fargate is a serverless compute engine for containers. Neither service meets the requirement for running an application on-premises.

• Question 1186:

  A company wants durable storage for static content and infinitely scalable data storage infrastructure at the lowest cost.

  Which AWS service should the company choose?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. Amazon S3
  C. AWS Storage Gateway
  D. Amazon Elastic File System (Amazon EFS)
  B. Amazon S3

  ---

  Explanation

  Amazon S3 is a service that provides durable storage for static content and infinitely scalable data storage infrastructure at the lowest cost. Amazon S3 is an object storage service that allows you to store and retrieve any amount of data from

  anywhere on the internet. Amazon S3 offers industry-leading scalability, availability, and performance, as well as 99.999999999% (11 9s) of durability and multi-AZ resilience. Amazon S3 also provides various storage classes that offer

  different levels of performance and cost optimization, such as S3 Standard, S3 Intelligent-Tiering, S3 Standard-Infrequent Access (S3 Standard-IA), S3 One Zone-Infrequent Access (S3 One Zone-IA), and S3 Glacier456. Amazon S3 is ideal

  for storing static content, such as images, videos, documents, and web pages, as well as building data lakes, backup and archive solutions, big data analytics, and machine learning applications.

  References:

  Cloud Storage on AWS,

  Object Storage - Amazon Simple Storage Service (S3) - AWS,

  Amazon S3 Documentation

• Question 1187:

  An ecommerce comply is using Amazon EC2 Auto Scaling groups to manage a fleet of web servers running on Amazon EC2. This architecture follows which AWS Well/architected Framework best practice?

  A. Secure the workload
  B. Decouple infrastructure components
  C. Design for failure
  D. Think parallel
  C. Design for failure

  ---

  Explanation

• Question 1188:

  A company plans to onboard new employees that will be working remotely. The company needs to set up Windows virtual desktops to create a working environment for the new employees. The employees must be able access the working environment from anywhere and by using their computer or a web browser.

  Which AWS service or feature will meet these requirements?

  A. Dedicated Hosts
  B. AWS Global Accelerator
  C. Amazon Workspaces
  D. Amazon CloudFront
  C. Amazon Workspaces

  ---

  Explanation

• Question 1189:

  A security engineer wants a single-tenant AWS solution to create, control, and manage their own cryptographic keys to meet regulatory compliance requirements for data security.

  Which AWS service should the engineer use?

  A. AWS Key Management Service (AWS KMS)
  B. AWS Certificate Manager (ACM)
  C. AWS CloudHSM
  D. AWS Systems Manager
  C. AWS CloudHSM

  ---

  Explanation

  The correct answer is C because AWS CloudHSM is an AWS service that enables the security engineer to meet the requirements. AWS CloudHSM is a service that provides customers with dedicated hardware security modules (HSMs) to create, control, and manage their own cryptographic keys in the AWS Cloud. AWS CloudHSM allows customers to meet strict regulatory compliance requirements for data security, such as FIPS 140-2 Level 3, PCI-DSS, and HIPAA. The other options are incorrect because they are not AWS services that enable the security engineer to meet the requirements. AWS Key Management Service (AWS KMS) is a service that provides customers with a fully managed, scalable, and integrated key management system to create and control encryption keys for AWS services and applications. AWS KMS does not provide customers with single-tenant or dedicated HSMs. AWS Certificate Manager (ACM) is a service that provides customers with a simple and secure way to provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and internal connected resources. ACM does not provide customers with HSMs or cryptographic keys. AWS Systems Manager is a service that provides customers with a unified user interface to view operational data from multiple AWS services and automate operational tasks across their AWS resources. AWS Systems Manager does not provide customers with HSMs or cryptographic keys.

  AWS CloudHSM FAQs

• Question 1190:

  Which AWS service aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services?

  A. Amazon Detective
  B. Amazon Inspector
  C. Amazon Macie
  D. AWS Security Hub
  D. AWS Security Hub

  ---

  Explanation

  The correct answer is D because AWS Security Hub is a service that aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Firewall Manager, and AWS IAM Access Analyzer. The other options are incorrect because they are not services that aggregate security alerts and findings from multiple AWS services. Amazon Detective is a service that helps users analyze and visualize security data to investigate and remediate potential issues. Amazon Inspector is a service that helps users find security vulnerabilities and deviations from best practices in their Amazon EC2 instances. Amazon Macie is a service that helps users discover, classify, and protect sensitive data stored in Amazon S3.

  AWS Security Hub FAQs