Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 271:

  Which task must a user perform by using the AWS account root user credentials?

  A. Make changes to AWS production resources.

  B. Change AWS Support plans.

  C. Access AWS Cost and Usage Reports.

  D. Grant auditors' access to an AWS account for a compliance audit.

  Correct Answer: B

  The AWS account root user is the email address that you used to sign up for AWS. The root user has complete access to all AWS services and resources in the account. You should use the root user only to perform a few account and service management tasks. One of these tasks is changing AWS Support plans, which requires root user credentials. For other tasks, you should create an IAM user or role with the appropriate permissions and use that instead of the root user.

• Question 272:

  A company wants to create a set of custom dashboards to collect metrics to monitor its applications.

  Which AWS service will meet these requirements?

  A. Amazon CloudWatch

  B. AWS X-Ray

  C. AWS Systems Manager

  D. AWS CloudTrail

  Correct Answer: A

  Amazon CloudWatch is a service that provides monitoring and observability for AWS resources and applications. Users can create custom dashboards to collect and visualize metrics, logs, alarms, and events from different sources5. AWS X-Ray is a service that provides distributed tracing and analysis for applications. AWS Systems Manager is a service that provides operational management for AWS resources and applications. AWS CloudTrail is a service that provides governance, compliance, and auditing for AWS account activity.

• Question 273:

  A company wants an automated process to continuously scan its Amazon EC2 instances for software vulnerabilities.

  Which AWS service will meet these requirements?

  A. Amazon GuardDuty

  B. Amazon Inspector

  C. Amazon Detective

  D. Amazon Cognito

  Correct Answer: B

  Amazon Inspector is the AWS service that can be used to perform vulnerability scans on AWS EC2 instances for software vulnerabilities automatically in a periodic fashion. Amazon Inspector automatically discovers EC2 instances and scans them for software vulnerabilities and unintended network exposure. Amazon Inspector uses AWS Systems Manager (SSM) and the SSM Agent to collect information about the software application inventory of the EC2 instances. This data is then scanned by Amazon Inspector for software vulnerabilities12. Amazon Inspector also integrates with other AWS services, such as Amazon EventBridge and AWS Security Hub, to automate discovery, expedite vulnerability routing, and shorten mean time to remediate (MTTR) vulnerabilities2.

• Question 274:

  Which tasks are the responsibility of the customer, according to the AWS shared responsibility model? (Select TWO.)

  A. Patch the Amazon RDS operating system.

  B. Upgrade the firmware of the network infrastructure.

  C. Manage data encryption.

  D. Maintain physical access control in an AWS Region.

  E. Grant least privilege access to IAM users.

  Correct Answer: CE

  According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of managing data encryption and granting least privilege access to IAM users. Data encryption is the process of transforming data into an unreadable format that can only be accessed with a key or a password. The customer must decide whether to encrypt their data at rest (when it is stored on AWS) or in transit (when it is moving between AWS and the customer or between AWS services). The customer must also choose the encryption method, algorithm, and key management solution that best suit their needs. AWS provides various services and features that support data encryption, such as AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM), and AWS Encryption SDK5 IAM users are entities that represent the people or applications that interact with AWS resources and services. The customer must grant the IAM users the minimum permissions that they need to perform their tasks, and avoid giving them unnecessary or excessive access. This is known as the principle of least privilege, and it helps reduce the risk of unauthorized or malicious actions. The customer can use IAM policies, roles, groups, and permissions boundaries to manage the access of IAM users.

• Question 275:

  Which options are AWS Cloud Adoption Framework (AWS CAF) people perspective capabilities? (Select TWO.)

  A. Organizational alignment

  B. Portfolio management

  C. Organization design

  D. Risk management

  E. Modern application development

  Correct Answer: AC

  The AWS Cloud Adoption Framework (AWS CAF) people perspective capabilities are the organizational skills and processes that enable effective cloud adoption. According to the AWS CAF people perspective whitepaper1, there are seven

  capabilities in this perspective, two of which are:

  Organizational alignment: This capability helps you align your organizational structure, roles, and responsibilities to support your cloud transformation goals and objectives. It involves assessing your current and desired state of alignment,

  identifying gaps and misalignments, and designing and implementing changes to optimize your cloud performance1.

  Organization design: This capability helps you design and evolve your organization to enable agility, innovation, and collaboration in the cloud. It involves defining your cloud operating model, identifying the skills and competencies needed for

  cloud roles, and creating career paths and development plans for your cloud workforce1. The other options are not capabilities in the AWS CAF people perspective. Portfolio management, risk management, and modern application

  development are capabilities in the AWS CAF business perspective, governance perspective, and platform perspective respectively2.

  References:

  1: AWS Cloud Adoption Framework: People Perspective - AWS Cloud Adoption Framework: People Perspective

  2: AWS Cloud Adoption Framework - AWS Cloud Adoption Framework

• Question 276:

  A company wants to design a reliable web application that is hosted on Amazon EC2.

  Which approach will achieve this goal?

  A. Launch large EC2 instances in the same Availability Zone.

  B. Spread EC2 instances across more than one security group.

  C. Spread EC2 instances across more than one Availability Zone.

  D. Use an Amazon Machine Image (AMI) from AWS Marketplace.

  Correct Answer: C

  The approach that will achieve the goal of designing a reliable web application that is hosted on Amazon EC2 is to spread EC2 instances across more than one Availability Zone. An Availability Zone is a physically isolated location within an AWS Region that has its own power, cooling, and network connectivity. By spreading EC2 instances across multiple Availability Zones, users can increase the fault tolerance and availability of their web applications, as well as reduce latency for end users2. Launching large EC2 instances in the same Availability Zone, spreading EC2 instances across more than one security group, or using an Amazon Machine Image (AMI) from AWS Marketplace are not sufficient to ensure reliability, as they do not provide redundancy or resilience in case of an outage in one Availability Zone.

• Question 277:

  Which options are AWS Cloud Adoption Framework (AWS CAF) cloud transformation journey recommendations? (Select TWO.)

  A. Envision phase

  B. Align phase

  C. Assess phase

  D. Mobilize phase

  E. Migrate and modernize phase

  Correct Answer: AB

  The AWS Cloud Adoption Framework (AWS CAF) cloud transformation journey is a four-phase process that helps customers plan and execute their cloud migration and digital transformation. The four phases are:

  Envision phase: This phase focuses on demonstrating how cloud will help accelerate the business outcomes of the customer. It involves identifying and prioritizing transformation opportunities across four domains: business, people,

  governance, and platform. It also involves associating the transformation initiatives with key stakeholders and measurable business outcomes1. Align phase: This phase focuses on identifying capability gaps across six perspectives: business,

  people, governance, platform, security, and operations. It also involves identifying cross-organizational dependencies and surfacing stakeholder concerns and challenges. The goal of this phase is to create strategies for improving the cloud

  readiness, ensure stakeholder alignment, and facilitate relevant organizational change management activities1. Launch phase: This phase focuses on delivering pilot initiatives in production and demonstrating incremental business value.

  Pilots should be highly impactful and influence future direction. The customer should learn from the pilots and adjust their approach before scaling to full production1. Scale phase: This phase focuses on expanding production pilots and

  business value to the desired scale and ensuring that the business benefits associated with the cloud investments are realized and sustained1.

• Question 278:

  A company is building a mobile app to provide shopping recommendations to its customers. The company wants to use a graph database as part of the shopping recommendation engine.

  Which AWS database service should the company choose?

  A. Amazon DynamoDB

  B. Amazon Aurora

  C. Amazon Neptune

  D. Amazon DocumentDB (with MongoDB compatibility)

  Correct Answer: C

  Amazon Neptune is a service that provides a fully managed graph database that supports property graphs and RDF graphs. It can be used to build applications that work with highly connected datasets, such as shopping recommendations, social networks, fraud detection, and knowledge graphs2. Amazon DynamoDB is a service that provides a fully managed NoSQL database that delivers fast and consistent performance at any scale. Amazon Aurora is a service that provides a fully managed relational database that is compatible with MySQL and PostgreSQL. Amazon DocumentDB (with MongoDB compatibility) is a service that provides a fully managed document database that is compatible with MongoDB.

• Question 279:

  Which tasks are customer responsibilities, according to the AWS shared responsibility model? (Select TWO.)

  A. Configure the AWS provided security group firewall.

  B. Classify company assets in the AWS Cloud.

  C. Determine which Availability Zones to use for Amazon S3 buckets.

  D. Patch or upgrade Amazon DynamoDB.

  E. Select Amazon EC2 instances to run AWS Lambda on.

  F. AWS Config

  Correct Answer: AB

  According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of configuring the AWS provided security group firewall and classifying company assets in the AWS Cloud. A security group is a virtual firewall that controls the inbound and outbound traffic for one or more EC2 instances. The customer must configure the security group rules to allow or deny traffic based on protocol, port, or source and destination IP address2 Classifying company assets in the AWS Cloud means identifying the types, categories, and sensitivity levels of the data and resources that the customer stores and processes on AWS. The customer must also determine the applicable compliance requirements and regulations that apply to their assets, and implement the appropriate security controls and measures to protect them

• Question 280:

  Which of the following is a benefit of using an AWS managed service?

  A. Reduced operational overhead for a company's IT staff

  B. Increased fixed costs that can be predicted by a finance team

  C. Removal of the need to have a backup strategy

  D. Removal of the need to follow compliance standards

  Correct Answer: A

  This is a benefit of using an AWS managed service, such as Amazon S3, Amazon DynamoDB, or AWS Lambda. AWS managed services are fully managed by AWS, which means that AWS handles the provisioning, scaling, patching, backup, and recovery of the underlying infrastructure and software. This reduces the operational overhead for the company's IT staff, who can focus on their core business logic and innovation. You can learn more about the AWS managed services from this webpage or this digital course.