Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 261:

  A company needs to store data across multiple Availability Zones in an AWS Region. The data will not be accessed regularly but must be immediately retrievable.

  Which Amazon Elastic File System (Amazon EFS) storage class meets these requirements MOST cost effectively?

  A. EFS Standard
  B. EFS Standard-Infrequent Access(EFS Standard-IA)
  C. EFS One Zone
  D. EFS One Zone-Infrequent Access (EFS One Zone-IA)
  B. EFS Standard-Infrequent Access(EFS Standard-IA)

  ---

  Explanation

  EFS Standard-Infrequent Access (EFS Standard-IA) is the storage class that meets the requirements of storing data across multiple Availability Zones in an AWS Region, that will not be accessed regularly but must be immediately retrievable, most cost- effectively. EFS Standard-IA is designed for files that are accessed less frequently, but still require the same high performance, low latency, and high availability as EFS Standard. EFS Standard-IA has a lower storage cost than EFS Standard, but charges a small additional fee for each access. EFS One Zone and EFS One Zone-IA store data in a single Availability Zone, which reduces the availability and durability compared to EFS Standard and EFS Standard-IA.

• Question 262:

  A company wants to manage access and permissions for its third-party software as a service (SaaS) applications. The company wants to use a portal where end users can access assigned AWS accounts and AWS Cloud applications.

  Which AWS service should the company use to meet these requirements?

  A. Amazon Cognito
  B. AWS IAM Identity Center (AWS Single Sign-On)
  C. AWS Identity and Access Management (IAM)
  D. AWS Directory Service for Microsoft Active Directory
  B. AWS IAM Identity Center (AWS Single Sign-On)

  ---

  Explanation

  AWS IAM Identity Center (AWS Single Sign-On) is the AWS service that the company should use to meet the requirements of managing access and permissions for its third-party SaaS applications. AWS Single Sign-On is a cloud-based service that makes it easy to centrally manage single sign-on (SSO) access to multiple AWS accounts and business applications. You can use AWS Single Sign-On to enable your users to sign in to a user portal with their existing corporate credentials and access all of their assigned accounts and applications from one place4.

• Question 263:

  Which AWS services or tools are designed to protect a workload from SQL injections, cross-site scripting, and DDoS attacks? (Select TWO.)

  A. VPC endpoint
  B. Virtual private gateway
  C. AWS Shield Standard
  D. AWS Config
  E. AWS WAF
  C. AWS Shield Standard
  E. AWS WAF

  ---

  Explanation

  AWS Shield Standard and AWS WAF are the AWS services or tools that are designed to protect a workload from SQL injections, cross-site scripting, and DDoS attacks. According to the AWS Shield Developer Guide, "AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection."5 According to the AWS WAF Developer Guide, "AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define." VPC endpoint, virtual private gateway, and AWS Config are not designed to protect a workload from these types of attacks.

• Question 264:

  A global company wants to migrate its third-party applications to the AWS Cloud. The company wants help from a global team of experts to complete the migration faster and more reliably in accordance with AWS internal best practices. Which AWS service or resource will meet these requirements?

  A. AWS Support
  B. AWS Professional Services
  C. AWS Launch Wizard
  D. AWS Managed Services (AMS)
  B. AWS Professional Services

  ---

  Explanation

  The AWS Professional Services organization is a global team of experts that can help you realize your desired business outcomes when using the AWS Cloud. We work together with your team and your chosen member of the AWS Partner

  Network (APN) to execute your enterprise cloud computing initiatives.

  https://aws.amazon.com/professional-services/

• Question 265:

  Which option is an AWS Cloud Adoption Framework (AWS CAF) foundational capability for the operations perspective?

  A. Performance and capacity management
  B. Application portfolio management
  C. Identity and access management
  D. Product management
  C. Identity and access management

  ---

  Explanation

  Identity and access management is one of the foundational capabilities for the operations perspective of the AWS Cloud Adoption Framework (AWS CAF). It involves managing the identities, roles, permissions, and credentials of users and systems that interact with AWS resources. Performance and capacity management is a capability for the platform perspective. Application portfolio management is a capability for the business perspective. Product management is a capability for the governance perspective.

• Question 266:

  Which AWS service uses AWS Compute Optimizer to provide sizing recommendations based on workload metrics?

  A. Amazon EC2
  B. Amazon RDS
  C. Amazon Lightsail
  D. AWS Step Functions
  A. Amazon EC2

  ---

  Explanation

  Amazon EC2 is a web service that provides secure, resizable compute capacity in the cloud. It allows you to launch virtual servers, called instances, with different configurations of CPU, memory, storage, and networking resources. AWS

  Compute Optimizer analyzes the specifications and utilization metrics of your Amazon EC2 instances and generates recommendations for optimal instance types that can reduce costs and improve performance. You can view the

  recommendations on the AWS Compute Optimizer console or the Amazon EC2 console12. Amazon RDS, Amazon Lightsail, and AWS Step Functions are not supported by AWS Compute Optimizer. Amazon RDS is a managed relational database service that lets you set up, operate, and scale a relational database in the cloud.

  Amazon Lightsail is an easy- to-use cloud platform that offers everything you need to build an application or website, plus a cost-effective, monthly plan. AWS Step Functions lets you coordinate multiple AWS services into serverless

  workflows so you can build and update apps quickly3 .

• Question 267:

  Which AWS service can be used to encrypt data at rest?

  A. Amazon GuardDuty
  B. AWS Shield
  C. AWS Security Hub
  D. AWS Key Management Service (AWS KMS)
  D. AWS Key Management Service (AWS KMS)

• Question 268:

  Which AWS service or tool gives users the ability to connect with AWS and deploy resources programmatically?

  A. Amazon QuickSight
  B. AWS PrivateLink
  C. AWS Direct Connect
  D. AWS SDKs
  D. AWS SDKs

  ---

  Explanation

  AWS SDKs are a set of tools that allow users to connect with AWS and deploy resources programmatically. AWS SDKs provide libraries, code samples, documentation, and other resources to help users write code that interacts with AWS APIs. AWS SDKs support various programming languages, such as Java, Python, Ruby, .NET, Node.js, Go, and more. AWS SDKs make it easier for users to access AWS services, such as Amazon S3, Amazon EC2, Amazon DynamoDB, AWS Lambda, and more, from their applications. AWS SDKs also handle tasks such as authentication, error handling, retries, and data serialization, so users can focus on their application logic . The other options are not AWS services or tools that give users the ability to connect with AWS and deploy resources programmatically. Amazon QuickSight is a business intelligence service that lets users create and share interactive dashboards and visualizations. AWS PrivateLink is a service that enables users to securely access services hosted on AWS in a scalable and cost-effective manner. AWS Direct Connect is a service that establishes a dedicated network connection between a user's premises and AWS.

• Question 269:

  Which AWS service enables users to check for vulnerabilities on Amazon EC2 instances by using predefined assessment templates?

  A. AWS WAF
  B. AWS Trusted Advisor
  C. Amazon Inspector
  D. AWS Shield
  C. Amazon Inspector

  ---

  Explanation

• Question 270:

  A systems administrator created a new IAM user for a developer and assigned the user an access key instead of a user name and password. What is the access key used for?

  A. To access the AWS account as the AWS account root user
  B. To access the AWS account through the AWS Management Console
  C. To access the AWS account through a CLI
  D. To access all of a company's AWS accounts
  C. To access the AWS account through a CLI

  ---

  Explanation