Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 211:

  Which of the following actions are controlled with AWS Identity and Access Management (IAM)? (Select TWO.)

  A. Control access to AWS service APIs and to other specific resources.

  B. Provide intelligent threat detection and continuous monitoring.

  C. Protect the AWS environment using multi-factor authentication (MFA).

  D. Grant users access to AWS data centers.

  E. Provide firewall protection for applications from common web attacks.

  Correct Answer: AC

  AWS Identity and Access Management (IAM) is a service that enables you to manage access to AWS services and resources securely. You can use IAM to perform the following actions: Control access to AWS service APIs and to other specific resources: You can create users, groups, roles, and policies that define who can access which AWS resources and how. You can also use IAM to grant temporary access to users or applications that need to perform certain tasks on your behalf3 Protect the AWS environment using multi-factor authentication (MFA): You can enable MFA for your IAM users and root user to add an extra layer of security to your AWS account. MFA requires users to provide a unique authentication code from an approved device or SMS text message, in addition to their user name and password, when they sign in to AWS4

• Question 212:

  A company needs an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities.

  Which AWS service will meet these requirements?

  A. Amazon GuardDuty

  B. Amazon Inspector

  C. AWS Security Hub

  D. AWS Shield

  Correct Answer: B

  The correct answer is B. Amazon Inspector.

  Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. Amazon Inspector automatically discovers workloads, such as

  Amazon EC2 instances, containers, and Lambda functions, and scans them for software vulnerabilities and unintended network exposure12.

  Amazon GuardDuty is a threat detection service that monitors your AWS accounts and workloads for malicious or unauthorized activity. Amazon GuardDuty does not scan for software vulnerabilities, but rather analyzes AWS CloudTrail,

  Amazon VPC Flow Logs, and DNS logs to detect threats such as compromised credentials, backdoors, or crypto mining3.

  AWS Security Hub is a security and compliance service that aggregates and prioritizes security findings from multiple AWS services and partner solutions. AWS Security Hub does not scan for software vulnerabilities, but rather provides a

  comprehensive view of your security posture across your AWS accounts4.

  AWS Shield is a managed service that protects your web applications and network resources from distributed denial-of-service (DDoS) attacks. AWS Shield does not scan for software vulnerabilities, but rather provides detection and

  mitigation of DDoS attacks at the network and application layers5.

  References:

  1: Automated Software Vulnerability Management - Amazon Inspector - AWS 3: [Amazon GuardDuty ?Intelligent Threat Detection Made Easy] 2: AWS Re-Launches Amazon Inspector with New Architecture and Features - InfoQ 4: [AWS Security Hub ?Unified Security and Compliance Center] 5: [AWS Shield ?Managed DDoS Protection]

• Question 213:

  For which AWS service is the customer responsible for maintaining the underlying operating system?

  A. Amazon DynamoDB

  B. Amazon S3

  C. Amazon EC2

  D. AWS Lambda

  Correct Answer: C

  Amazon EC2 is a service that provides resizable compute capacity in the cloud. Users can launch and manage virtual servers, known as instances, that run on the AWS infrastructure. Users are responsible for maintaining the underlying operating system of the instances, as well as any applications or software that run on them. Amazon DynamoDB is a service that provides a fully managed NoSQL database that delivers fast and consistent performance at any scale. Users do not need to manage the underlying operating system or the database software. Amazon S3 is a service that provides scalable and durable object storage in the cloud. Users do not need to manage the underlying operating system or the storage infrastructure. AWS Lambda is a service that allows users to run code without provisioning or managing servers. Users only need to upload their code and configure the triggers and parameters. AWS Lambda takes care of the underlying operating system and the execution environment.

• Question 214:

  A company wants to use the latest technologies and wants to minimize its capital investment. Instead of upgrading on-premises infrastructure, the company wants to move to the AWS Cloud.

  Which AWS Cloud benefit does this scenario describe?

  A. Increased speed to market

  B. The trade of infrastructure expenses for operating expenses

  C. Massive economies of scale

  D. The ability to go global in minutes

  Correct Answer: B

  The trade of infrastructure expenses for operating expenses is one of the benefits of the AWS Cloud. By moving to the AWS Cloud, the company can avoid the upfront costs of purchasing and maintaining on-premises infrastructure, such as servers, storage, network, and software. Instead, the company can pay only for the AWS resources and services that they use, as they use them. This reduces the risk and complexity of planning and managing IT infrastructure, and allows the company to focus on innovation and growth. Increased speed to market, massive economies of scale, and the ability to go global in minutes are also benefits of the AWS Cloud, but they are not the best ones to describe this scenario. Increased speed to market means that the company can launch new products and services faster by using AWS services and tools. Massive economies of scale means that the company can benefit from the lower costs and higher performance that AWS achieves by operating at a large scale. The ability to go global in minutes means that the company can deploy their applications and data in multiple regions and availability zones around the world to reach their customers faster and improve performance and reliability5

• Question 215:

  A company has deployed an application in the AWS Cloud. The company wants to ensure that the application is highly resilient.

  Which component of AWS infrastructure can the company use to meet this requirement?

  A. Content delivery network (CDN)

  B. Edge locations

  C. Wavelength Zones

  D. Availability Zones

  Correct Answer: D

  Availability Zones are components of AWS infrastructure that can help the company ensure that the application is highly resilient. Availability Zones are multiple, isolated locations within each AWS Region. Each Availability Zone has independent power, cooling, and physical security, and is connected to the other Availability Zones in the same Region via low-latency, high-throughput, and highly redundant networking. Availability Zones allow you to operate production applications and databases that are more highly available, fault tolerant, and scalable than would be possible from a single data center.

• Question 216:

  A company wants an AWS service to provide product recommendations based on its customer data.

  Which AWS service will meet this requirement?

  A. Amazon Polly

  B. Amazon Personalize

  C. Amazon Comprehend

  D. Amazon Rekognition

  Correct Answer: B

  Amazon Personalize is an AWS service that helps developers quickly build and deploy a custom recommendation engine with real-time personalization and user segmentation1. It uses machine learning (ML) to analyze customer data and

  provide relevant recommendations based on their preferences, behavior, and context. Amazon Personalize can be used for various use cases such as optimizing recommendations, targeting customers more accurately, maximizing the value

  of unstructured text, and promoting items using business rules1.

  The other options are not suitable for providing product recommendations based on customer data. Amazon Polly is a service that converts text into lifelike speech. Amazon Comprehend is a service that uses natural language processing

  (NLP) to extract insights from text and documents. Amazon Rekognition is a service that uses computer vision (CV) to analyze images and videos for faces, objects, scenes, and activities.

  References:

  1: Cloud Products - Amazon Web Services (AWS)

  2: Recommender System ?Amazon Personalize ?Amazon Web Services

  3: Top 25 AWS Services List 2023 - GeeksforGeeks

  4: AWS to Azure services comparison - Azure Architecture Center

  5: The 25+ Best AWS Cost Optimization Tools (Updated 2023) - CloudZero

  6: Amazon Polly ?Text-to-Speech Service - AWS

  7: Natural Language Processing - Amazon Comprehend - AWS

  8: Image and Video Analysis - Amazon Rekognition - AWS

• Question 217:

  A company is migrating to the AWS Cloud to meet storage needs. The company wants to optimize costs based on the amount of storage that the company uses.

  Which AWS offering or benefit will meet these requirements MOST cost-effectively?

  A. Pay-as-you-go pricing

  B. Savings Plans

  C. AWS Free Tier

  D. Volume-based discounts

  Correct Answer: D

  Volume-based discounts are an AWS offering or benefit that can help the company optimize costs based on the amount of storage that the company uses. Volume- based discounts are discounts that AWS provides for some storage services, such as Amazon S3 and Amazon EBS, when the company stores a large amount of data. The more data the company stores, the lower the price per GB. For example, Amazon S3 offers six storage classes, each with a different price per GB. The price per GB decreases as the amount of data stored in each storage class increases

• Question 218:

  A company needs to set a maximum spending limit on AWS services each month. The company also needs to set up alerts for when the company reaches its spending limit.

  Which AWS service or tool should the company use to meet these requirements?

  A. Cost Explorer

  B. AWS Trusted Advisor

  C. Service Quotas

  D. AWS Budgets

  Correct Answer: D

  AWS Budgets is a service that helps you plan your service usage, service costs, and instance reservations, and track how close your plan is to your budgeted amount. You can set custom budgets that alert you when you exceed (or are forecasted to exceed) your budgeted thresholds. You can also use AWS Budgets to set a maximum spending limit on AWS services each month and set up alerts for when you reach your spending limit. Cost Explorer is a service that enables you to visualize, understand, and manage your AWS costs and usage over time. You can use Cost Explorer to view charts and graphs that show how your costs are trending, identify areas that need further inquiry, and see the impact of your cost management actions. However, Cost Explorer does not allow you to set a maximum spending limit or alerts for your AWS services. AWS Trusted Advisor is a service that provides you real time guidance to help you provision your resources following AWS best practices, including security and performance. It can help you monitor for cost optimization opportunities, such as unused or underutilized resources, but it does not allow you to set a maximum spending limit or alerts for your AWS services. Service Quotas is a service that enables you to view and manage your quotas, also referred to as limits, from a central location. Quotas, also referred to as limits, are the maximum number of resources that you can create in your AWS account. However, Service Quotas does not allow you to set a maximum spending limit or alerts for your AWS services.

• Question 219:

  A company has a MySQL database running on a single Amazon EC2 instance. The company now requires higher availability in the event of an outage.

  Which set of tasks would meet this requirement?

  A. Add an Application Load Balancer in front of the EC2 instance.

  B. Configure EC2 Auto Recovery to move the instance to another Availability Zone.

  C. Migrate to Amazon RDS and enable Multi-AZ.

  D. Enable termination protection for the EC2 instance to avoid outages.

  Correct Answer: C

  The set of tasks that would meet the requirement of having higher availability for a MySQL database running on a single Amazon EC2 instance is to migrate to Amazon RDS and enable Multi-AZ. Amazon RDS is a fully managed relational database service that supports MySQL and other popular database engines. By enabling Multi-AZ, users can have a primary database in one Availability Zone and a synchronous standby replica in another Availability Zone. In case of a planned or unplanned outage of the primary database, Amazon RDS automatically fails over to the standby replica with minimal disruption3. Adding an Application Load Balancer in front of the EC2 instance, configuring EC2 Auto Recovery to move the instance to another Availability Zone, or enabling termination protection for the EC2 instance would not provide higher availability for the database, as they do not address the single point of failure or data replication issues.

• Question 220:

  A company is building an application in the AWS Cloud. The company wants to use temporary credentials for the application to access other AWS resources.

  Which AWS service will meet these requirements?

  A. AWS Key Management Service (Aws KMS)

  B. AWS CloudHSM

  C. Amazon Cognito

  D. AWS Security Token Service (Aws STS)

  Correct Answer: D

  AWS Security Token Service (AWS STS) is a service that provides temporary security credentials to users or applications that need to access AWS resources. The temporary credentials have a limited lifetime and can be configured to last

  from a few minutes to several hours. The credentials are not stored with the user or application, but are generated dynamically and provided on request. The credentials work almost identically to long-term access key credentials, but have the

  advantage of not requiring distribution, rotation, or revocation1.

  AWS Key Management Service (AWS KMS) is a service that provides encryption and decryption services for data and keys. It does not provide temporary security credentials2. AWS CloudHSM is a service that provides hardware security

  modules (HSMs) for cryptographic operations and key management. It does not provide temporary security credentials3.

  Amazon Cognito is a service that provides user authentication and authorization for web and mobile applications. It can also provide temporary security credentials for authenticated users, but not for applications4.