Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 1271:

  A company is using a third-party service to back up 10 TB of data to a tape library. The on- premises backup server is running out of space. The company wants to use AWS services for the backups without changing its existing backup workflows.

  Which AWS service should the company use to meet these requirements?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. AWS Storage Gateway
  C. Amazon Elastic Container Service (Amazon ECS)
  D. AWS Lambda
  B. AWS Storage Gateway

  ---

  Explanation

  The correct answer is B because AWS Storage Gateway is a service that should be used by the company to meet the requirements. AWS Storage Gateway is a service that connects on-premises software applications with cloud-based storage. AWS Storage Gateway supports three types of gateways: file gateway, volume gateway, and tape gateway. The tape gateway type enables users to back up and archive data to virtual tapes in AWS without changing their existing backup workflows. Users can use their existing backup applications and tape libraries to store data on virtual tapes in Amazon S3 or Amazon S3 Glacier. The other options are incorrect because they are not services that should be used by the company to meet the requirements. Amazon Elastic Block Store (Amazon EBS) is a service that provides block-level storage volumes for Amazon EC2 instances. Amazon Elastic Container Service (Amazon ECS) is a service that enables users to run, scale, and secure containerized applications on AWS. AWS Lambda is a service that enables users to run code without provisioning or managing servers.

  AWS Storage Gateway FAQs

• Question 1272:

  A company wants an automated process to continuously scan its Amazon EC2 instances for software vulnerabilities.

  Which AWS service will meet these requirements?

  A. Amazon GuardDuty
  B. Amazon Inspector
  C. Amazon Detective
  D. Amazon Cognito
  B. Amazon Inspector

  ---

  Explanation

  Amazon Inspector is the AWS service that can be used to perform vulnerability scans on AWS EC2 instances for software vulnerabilities automatically in a periodic fashion. Amazon Inspector automatically discovers EC2 instances and scans them for software vulnerabilities and unintended network exposure. Amazon Inspector uses AWS Systems Manager (SSM) and the SSM Agent to collect information about the software application inventory of the EC2 instances. This data is then scanned by Amazon Inspector for software vulnerabilities12. Amazon Inspector also integrates with other AWS services, such as Amazon EventBridge and AWS Security Hub, to automate discovery, expedite vulnerability routing, and shorten mean time to remediate (MTTR) vulnerabilities2.

• Question 1273:

  A company is undergoing a security audit. The audit includes security validation and compliance validation of the AWS infrastructure and services that the company uses. The auditor needs to locate compliance-related information and must download AWS security and compliance documents. These documents include the System and Organization Control (SOC) reports.

  Which AWS service or group can provide these documents?

  A. AWS Abuse team
  B. AWS Artifact
  C. AWS Support
  D. AWS Config
  B. AWS Artifact

  ---

  Explanation

  Portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements Artifact Reports - Allows you to download AWS security and compliance documents from third-party auditors, like AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports Artifact Agreements - Allows you to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA) for an individual account or in your organization Can be used to support internal audit or compliance

• Question 1274:

  Which AWS service or tool inspects a user's AWS environment and makes recommendations for cost savings and system performance improvements?

  A. Cost Explorer
  B. AWS Trusted Advisor
  C. Amazon Inspector
  D. AWS Budgets
  B. AWS Trusted Advisor

  ---

  Explanation

• Question 1275:

  What can a user accomplish using AWS CloudTrail?

  A. Generate an IAM user credentials report.
  B. Record API calls made to AWS services.
  C. Assess the compliance of AWS resource configurations with policies and guidelines.
  D. Ensure that Amazon EC2 instances are patched with the latest security updates. A company uses Amazon Workspaces.
  B. Record API calls made to AWS services.

  ---

  Explanation

  AWS CloudTrail is an AWS service that enables users to accomplish the task of recording API calls made to AWS services. AWS CloudTrail is a service that tracks user activity and API usage across the AWS account. AWS CloudTrail records the details of every API call made to AWS services, such as the identity of the caller, the time of the call, the source IP address of the caller, the parameters and responses of the call, and more. Users can use AWS CloudTrail to audit, monitor, and troubleshoot their AWS resources and actions. The other options are incorrect because they are not tasks that users can accomplish using AWS CloudTrail. Generating an IAM user credentials report is a task that users can accomplish using IAM, which is an AWS service that enables users to manage access and permissions to AWS resources and services. Assessing the compliance of AWS resource configurations with policies and guidelines is a task that users can accomplish using AWS Config, which is an AWS service that enables users to assess, audit, and evaluate the configurations of their AWS resources. Ensuring that Amazon EC2 instances are patched with the latest security updates is a task that users can accomplish using AWS Systems Manager, which is an AWS service that enables users to automate operational tasks, manage configuration and compliance, and monitor system health and performance.

  AWS CloudTrail FAQs

• Question 1276:

  Which AWS service or component allows inbound traffic from the internet to access a VPC?

  A. Internet gateway
  B. NAT gateway
  C. AWS WAF
  D. VPC peering
  A. Internet gateway

  ---

  Explanation

• Question 1277:

  Which type of AWS storage is ephemeral and is deleted when an Amazon EC2 instance is stopped or terminated?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. Amazon EC2 instance store
  C. Amazon Elastic File System (Amazon EFS)
  D. Amazon S3
  B. Amazon EC2 instance store

  ---

  Explanation

  Amazon EC2 instance store provides temporary block-level storage for your EC2 instance. This storage is located on disks that are physically attached to the host computer. Instance store is ideal for temporary storage of information that changes frequently, such as buffers, caches, scratch data, and other temporary content. It can also be used to store temporary data that you replicate across a fleet of instances, such as a load-balanced pool of web servers. An instance store consists of one or more instance store volumes exposed as block devices. The size of an instance store as well as the number of devices available varies by instance type and instance size. The virtual devices for instance store volumes are ephemeral[0-23]. Instance types that support one instance store volume have ephemeral0. Instance types that support two or more instance store volumes have ephemeral0, ephemeral, and so on. Instance store pricing Instance store volumes are included as part of the instance's usage cost. The data on an instance store volume persists even if the instance is rebooted. However, the data does not persist if the instance is stopped, hibernated, or terminated. When the instance is stopped, hibernated, or terminated, every block of the instance store volume is cryptographically erased. Therefore, do not rely on instance store volumes for valuable, long-term data. If you need to retain the data stored on an instance store volume beyond the lifetime of the instance, you need to manually copy that data to more persistent storage, such as an Amazon EBS volume, an Amazon S3 bucket, or an Amazon EFS file system. There are some events that can result in your data not persisting throughout the lifetime of the instance. The following table indicates whether data on instance store volumes is persisted during specific events, for both virtualized and bare metal instances.

  References: Amazon EC2 instance store - Amazon Elastic Compute Cloud

• Question 1278:

  A company wants to migrate its server-based applications to the AWS Cloud. The company wants to determine the total cost of ownership for its compute resources that will be hosted on the AWS Cloud.

  Which combination of AWS services or tools will meet these requirements?

  A. AWS Pricing Calculator
  B. Migration Evaluator
  C. AWS Support Center
  D. AWS Application Discovery Service
  E. AWS Database Migration Service (AWS DMS)
  A. AWS Pricing Calculator
  D. AWS Application Discovery Service

  ---

  Explanation

  AWS Pricing Calculator and AWS Application Discovery Service are the best combination of AWS services or tools to meet the requirements of determining the total cost of ownership for compute resources that will be hosted on the AWS Cloud. AWS Pricing Calculator is a tool that enables you to estimate the cost of using AWS services based on your usage scenarios and requirements. You can use AWS Pricing Calculator to compare the costs of running your applications on-premises or on AWS, and to optimize your AWS spending. AWS Application Discovery Service is a service that helps you plan your migration to the AWS Cloud by collecting and analyzing information about your on- premises servers, applications, and dependencies. You can use AWS Application Discovery Service to identify the inventory of your on-premises infrastructure, group servers by applications, and estimate the performance and resource utilization of your applications

• Question 1279:

  Which option is a shared control between AWS and the customer, according to the AWS shared responsibility model?

  A. Configuration management
  B. Physical and environmental controls
  C. Data integrity authentication
  D. Identity and access management
  A. Configuration management

  ---

  Explanation

  In the AWS shared responsibility model, configuration management is a shared control. AWS is responsible for the infrastructure's configuration management, including the configuration of the hardware, software, networking, and facilities that run AWS services.

  On the other hand, the customer is responsible for configuration management at the application level, including the security configuration of AWS provided services such as Amazon EC2 instances, Amazon S3 buckets, and Amazon DynamoDB tables.

• Question 1280:

  Which AWS solution provides the ability for a company to run AWS services in the company's on-premises data center?

  A. AWS Direct Connect
  B. AWS Outposts
  C. AWS Systems Manager hybrid activations
  D. AWS Storage Gateway
  B. AWS Outposts

  ---

  Explanation

  AWS Outposts is a fully managed service that extends AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on- premises facility for a truly consistent hybrid experience. AWS Outposts enables you to run AWS services in your on-premises data center1.