Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 111:

  What are the benefits of consolidated billing for AWS Cloud services? (Choose two.)

  A. Volume discounts
  B. A minimal additional fee for use
  C. One bill for multiple accounts
  D. Installment payment options
  E. Custom cost and usage budget creation
  A. Volume discounts
  C. One bill for multiple accounts

  ---

  Explanation

  https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

• Question 112:

  Which security service automatically recognizes and classifies sensitive data or intellectual property on AWS?

  A. Amazon GuardDuty
  B. Amazon Macie
  C. Amazon Inspector
  D. AWS Shield
  B. Amazon Macie

  ---

  Explanation

• Question 113:

  Which AWS service can create a private network connection from on premises to the AWS Cloud?

  A. AWS Config
  B. Virtual Private Cloud (Amazon VPC)
  C. AWS Direct Connect
  D. Amazon Route 53
  C. AWS Direct Connect

  ---

  Explanation

  AWS Direct Connect provides a dedicated private network connection from on-premises data centers directly to the AWS Cloud, bypassing the public internet. This setup is ideal for reducing network costs, increasing bandwidth throughput, and providing a more consistent network experience compared to standard internet connections. Other services, such as Amazon VPC, relate to networking but do not establish a private network connection from on-premises to AWS.

• Question 114:

  Which cloud computing advantage is a company applying when it uses AWS Regions to increase application availability to users in different countries?

  A. Pay-as-you-go pricing
  B. Capacity forecasting
  C. Economies of scale
  D. Global reach
  D. Global reach

  ---

  Explanation

  Global reach is a cloud computing advantage that a company can apply when it uses AWS Regions to increase application availability to users in different countries. Global reach refers to the ability to deploy applications and services in multiple geographic locations around the world, and to serve customers with low latency and high performance. AWS has the largest and most reliable global infrastructure of any cloud provider, with 25 Regions and 81 Availability Zones across the Americas, Europe, Asia Pacific, Africa, and the Middle East. By using AWS Regions, a company can choose the best location for its application based on customer proximity, compliance requirements, and disaster recovery strategies.

  References:

  1: AWS Global Infrastructure - Amazon Web Services (AWS),

  2: Regions and Availability Zones - Amazon Elastic Compute Cloud,

  3: AWS Infrastructure: Regions and Availability Zones Explained

• Question 115:

  A company wants to test a new application.

  Which AWS principle will help the company test the application?

  A. Make long-term commitments in exchange for a cost discount.
  B. Scale up and down when needed without any long-term commitments.
  C. Have total control over the application infrastructure.
  D. Manage all of the maintenance tasks associated with the cloud.
  B. Scale up and down when needed without any long-term commitments.

  ---

  Explanation

  AWS provides the flexibility to scale resources up or down on demand, enabling companies to test new applications without making long-term commitments. This principle allows for cost efficiency and agility during testing and development. The other options do not specifically highlight the benefits of flexible, on-demand resource scaling.

• Question 116:

  A company wants to run its workloads in the AWS Cloud effectively, reduce management overhead, and improve processes.

  Which AWS Well-Architected Framework pillar represents these requirements?

  A. Reliability
  B. Operational excellence
  C. Performance efficiency
  D. Cost optimization
  B. Operational excellence

  ---

  Explanation

• Question 117:

  Which of the following are pillars of the AWS Well-Architected Framework? (Choose two.)

  A. Resource scalability
  B. Performance efficiency
  C. System elasticity
  D. Agile development
  E. Operational excellence
  C. System elasticity
  E. Operational excellence

  ---

  Explanation

• Question 118:

  Which tasks are the responsibility of the customer, according to the AWS shared responsibility model? (Select TWO.)

  A. Patch the Amazon RDS operating system.
  B. Upgrade the firmware of the network infrastructure.
  C. Manage data encryption.
  D. Maintain physical access control in an AWS Region.
  E. Grant least privilege access to IAM users.
  C. Manage data encryption.
  E. Grant least privilege access to IAM users.

  ---

  Explanation

  According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of managing data encryption and granting least privilege access to IAM users. Data encryption is the process of transforming data into an unreadable format that can only be accessed with a key or a password. The customer must decide whether to encrypt their data at rest (when it is stored on AWS) or in transit (when it is moving between AWS and the customer or between AWS services). The customer must also choose the encryption method, algorithm, and key management solution that best suit their needs. AWS provides various services and features that support data encryption, such as AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM), and AWS Encryption SDK5 IAM users are entities that represent the people or applications that interact with AWS resources and services. The customer must grant the IAM users the minimum permissions that they need to perform their tasks, and avoid giving them unnecessary or excessive access. This is known as the principle of least privilege, and it helps reduce the risk of unauthorized or malicious actions. The customer can use IAM policies, roles, groups, and permissions boundaries to manage the access of IAM users.

• Question 119:

  Which AWS services are connectivity services for a VPC? (Select TWO.)

  A. AWS Site-to-Site VPN
  B. AWS Direct Connect
  C. Amazon Connect
  D. AWS Key Management Service (AWS KMS)
  E. AWS Identity and Access Management (IAM)
  A. AWS Site-to-Site VPN
  B. AWS Direct Connect

  ---

  Explanation

  AWS Site-to-Site VPN and AWS Direct Connect are AWS services that are connectivity services for a VPC. AWS Site-to-Site VPN is a service that enables you to securely connect your on-premises network or branch office site to your Amazon Virtual Private Cloud (Amazon VPC). You can establish VPN connections over the internet or over AWS Direct Connect1. AWS Direct Connect is a service that lets you establish a dedicated network connection between your network and one of the AWS Direct Connect locations. Using AWS Direct Connect, you can create a private connection between AWS and your datacenter, office, or colocation environment, which can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections2. Amazon Connect is a service that lets you set up and manage a contact center in the cloud, but it does not provide network connectivity between the VPC and your on-premises network. AWS Key Management Service (AWS KMS) is a service that makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications, but it does not provide network connectivity between the VPC and your on-premises network. AWS Identity and Access Management (IAM) is a service that enables you to manage access to AWS services and resources securely, but it does not provide network connectivity between the VPC and your on-premises network.

• Question 120:

  Which AWS service keeps track of SSL/TLS certificates, creates new certificates, and processes renewals?

  A. AWS Identity and Access Management (IAM)
  B. AWS Certificate Manager (ACM)
  C. AWS Config
  D. AWS Trusted Advisor
  B. AWS Certificate Manager (ACM)

  ---

  Explanation

  AWS Certificate Manager helps manage the challenges of maintaining SSL/TLS certificates, including certificate renewals so you don't have to worry about expiring certificates. Learn more about provisioning, managing, and deploying public and private SSL/TLS certificates.