Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 311:

  Which AWS service or feature is associated with a subnet in a VPC and is used to control inbound and outbound traffic?

  A. Amazon Inspector

  B. Network ACLs

  C. AWS Shield

  D. VPC Flow Logs

  Correct Answer: B

  Network ACLs (network access control lists) are an optional layer of security for your VPC that act as a firewall for controlling traffic in and out of one or more subnets. You can use network ACLs to allow or deny traffic based on protocol, port, or source and destination IP address. Network ACLs are stateless, meaning that they do not track the traffic that flows through them. Therefore, you must create rules for both inbound and outbound traffic.

• Question 312:

  A company wants to monitor for misconfigured security groups that are allowing unrestricted access to specific ports.

  Which AWS service will meet this requirement?

  A. AWS Trusted Advisor

  B. Amazon CloudWatch

  C. Amazon GuardDuty

  D. AWS Health Dashboard

  Correct Answer: A

  AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices, including security and performance. It can help you monitor for misconfigured security groups that are allowing unrestricted access to specific ports. Amazon CloudWatch is a service that monitors your AWS resources and the applications you run on AWS. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. AWS Health Dashboard provides relevant and timely information to help you manage events in progress, and provides proactive notification to help you plan for scheduled activities.

• Question 313:

  A company is launching a mobile app. The company wants customers to be able to use the app without upgrading their mobile devices.

  Which pillar of the AWS Well-Architected Framework does this goal represent?

  A. Security

  B. Reliability

  C. Cost optimization

  D. Sustainability

  Correct Answer: C

  Cost optimization is one of the five pillars of the AWS Well-Architected Framework. It focuses on avoiding unnecessary costs, understanding and controlling where money is being spent, selecting the most appropriate and right number of resource types, analyzing spend over time, and scaling to meet business needs without overspending.

• Question 314:

  Which capabilities are in the platform perspective of the AWS Cloud Adoption Framework (AWS CAF)? (Select TWO.)

  A. Performance and capacity management

  B. Data engineering

  C. Continuous integration and continuous delivery (CI/CD)

  D. Infrastructure protection

  E. Change and release management

  Correct Answer: BC

  The platform perspective of the AWS Cloud Adoption Framework (AWS CAF) helps you build an enterprise-grade, scalable, hybrid cloud platform, modernize existing workloads, and implement new cloud-native solutions1. It comprises seven capabilities, two of which are data engineering and CI/CD1. Data engineering: This capability helps you design and evolve a fit-for-purpose data and analytics architecture that can reduce complexity, cost, and technical debt while enabling you to gain actionable insights from exponentially growing data volumes1. It involves selecting key technologies for each of your architectural layers, such as ingestion, storage, catalog, processing, and consumption. It also involves supporting real-time data processing and adopting a Lake House architecture to facilitate data movements between data lakes and purpose-built data stores1. CI/CD: This capability helps you automate the delivery of your cloud solutions using a set of practices and tools that enable faster and more reliable deployments1. It involves establishing a pipeline that can build, test, and deploy your code across multiple environments. It also involves adopting a DevOps culture that fosters collaboration, feedback, and continuous improvement among your development and operations teams1. References:

  1: Platform perspective: infrastructure and applications - An Overview of the AWS Cloud Adoption Framework

• Question 315:

  Which option is a customer responsibility under the AWS shared responsibility model?

  A. Maintenance of underlying hardware of Amazon EC2 instances

  B. Application data security

  C. Physical security of data centers

  D. Maintenance of VPC components

  Correct Answer: B

  The option that is a customer responsibility under the AWS shared responsibility model is B. Application data security.

  According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS manages the security of the underlying infrastructure,

  such as the hardware, software, networking, and facilities that run the AWS services, while the customer manages the security of their applications, data, and resources that they use on top of AWS12. Application data security is one of the

  customer responsibilities under the AWS shared responsibility model. This means that the customer is responsible for protecting their application data from unauthorized access, modification, deletion, or leakage. The customer can use

  various AWS services and features to help with application data security, such as encryption, key management, access control, logging, and auditing12. Maintenance of underlying hardware of Amazon EC2 instances is not a customer

  responsibility under the AWS shared responsibility model. This is part of the AWS responsibility to secure the cloud. AWS manages the physical servers that host the Amazon EC2 instances and ensures that they are updated, patched, and

  replaced as needed13.

  Physical security of data centers is not a customer responsibility under the AWS shared responsibility model. This is also part of the AWS responsibility to secure the cloud. AWS operates and controls the facilities where the AWS services are

  hosted and ensures that they are protected from unauthorized access, environmental hazards, fire, and theft14. Maintenance of VPC components is not a customer responsibility under the AWS shared responsibility model. This is a shared

  responsibility between AWS and the customer. AWS provides the VPC service and ensures that it is secure and reliable, while the customer configures and manages their own VPCs and related components, such as subnets, route tables,

  security groups, network ACLs, gateways, and endpoints15.

  References:

  1: Shared Responsibility Model - Amazon Web Services (AWS) 2: AWS Cloud Computing - W3Schools 3: [Amazon EC2 FAQs - Amazon Web Services] 4: [AWS Security - Amazon Web Services] 5: [Amazon Virtual Private Cloud (VPC) Amazon Web Services]

• Question 316:

  A company wants a time-series database service that makes it easier to store and analyze trillions of events each day.

  Which AWS service will meet this requirement?

  A. Amazon Neptune

  B. Amazon Timestream

  C. Amazon Forecast

  D. Amazon DocumentDB (with MongoDB compatibility)

  Correct Answer: B

  Amazon Timestream is a fast, scalable, and serverless time-series database service for IoT and other operational applications that makes it easy to store and analyze trillions of events per day up to 1,000 times faster and at as little as 1/10th the cost of relational databases1. Amazon Timestream saves you time and cost in managing the lifecycle of time series data, and its purpose-built query engine lets you access and analyze recent and historical data together with a single query1. Amazon Timestream has built-in time series analytics functions, helping you identify trends and patterns in near real time1. The other options are not suitable for storing and analyzing trillions of events per day. Amazon Neptune is a graph database service that supports highly connected data sets. Amazon Forecast is a machine learning service that generates accurate forecasts based on historical data. Amazon DocumentDB (with MongoDB compatibility) is a document database service that supports MongoDB workloads. References:

  1: Time Series Database ?Amazon Timestream ?Amazon Web Services

• Question 317:

  Which AWS service can provide a dedicated network connection with consistent low latency from on premises to the AWS Cloud?

  A. Amazon VPC

  B. Amazon Kinesis Data Streams

  C. AWS Direct Connect

  D. Amazon OpenSearch Service

  Correct Answer: C

  AWS Direct Connect is a service that provides a dedicated network connection from on premises to the AWS Cloud. It can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience than internet- based connections. It can also provide low latency for applications that require real-time data transfer4. Amazon VPC is a service that provides a logically isolated section of the AWS Cloud where users can launch AWS resources in a virtual network that they define. Amazon Kinesis Data Streams is a service that provides a scalable and durable stream of data records for real-time data processing. Amazon OpenSearch Service is a service that provides a fully managed, scalable, and secure search and analytics solution that is compatible with Elasticsearch.

• Question 318:

  A company needs to deploy applications in the AWS Cloud as quickly as possible. The company also needs to minimize the complexity that is related to the management of AWS resources.

  Which AWS service should the company use to meet these requirements?

  A. AWS config

  B. AWS Elastic Beanstalk

  C. Amazon EC2

  D. Amazon Personalize

  Correct Answer: B

  AWS Elastic Beanstalk is the AWS service that allows customers to deploy applications in the AWS Cloud as quickly as possible. AWS Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, and auto-scaling to application health monitoring. Customers can upload their code and Elastic Beanstalk will take care of the rest1. AWS Elastic Beanstalk also minimizes the complexity that is related to the management of AWS resources. Customers can retain full control of the underlying AWS resources powering their applications and adjust the settings to suit their needs1. Customers can also use the AWS Management Console, the AWS Command Line Interface (AWS CLI), or APIs to manage their applications1. AWS Config is the AWS service that enables customers to assess, audit, and evaluate the configurations of their AWS resources. AWS Config continuously monitors and records the configuration changes of the resources and evaluates them against desired configurations or best practices2. AWS Config does not help customers deploy applications in the AWS Cloud as quickly as possible or minimize the complexity that is related to the management of AWS resources. Amazon EC2 is the AWS service that provides secure, resizable compute capacity in the cloud. Customers can launch virtual servers called instances and choose from various configurations of CPU, memory, storage, and networking resources3. Amazon EC2 does not automatically handle the deployment or management of AWS resources for customers. Customers have to manually provision, configure, monitor, and scale their instances and other related resources. Amazon Personalize is the AWS service that enables customers to create personalized recommendations for their users based on their behavior and preferences. Amazon Personalize uses machine learning to analyze data and deliver real-time recommendations4. Amazon Personalize does not help customers deploy applications in the AWS Cloud as quickly as possible or minimize the complexity that is related to the management of AWS resources.

• Question 319:

  Which AWS service requires the customer to be fully responsible for applying operating system patches?

  A. Amazon DynamoDB

  B. AWS Lambda

  C. AWS Fargate

  D. Amazon EC2

  Correct Answer: D

• Question 320:

  A company wants to migrate its server-based applications to the AWS Cloud. The company wants to determine the total cost of ownership for its compute resources that will be hosted on the AWS Cloud.

  Which combination of AWS services or tools will meet these requirements?

  A. AWS Pricing Calculator

  B. Migration Evaluator

  C. AWS Support Center

  D. AWS Application Discovery Service

  E. AWS Database Migration Service (AWS DMS)

  Correct Answer: AD

  AWS Pricing Calculator and AWS Application Discovery Service are the best combination of AWS services or tools to meet the requirements of determining the total cost of ownership for compute resources that will be hosted on the AWS Cloud. AWS Pricing Calculator is a tool that enables you to estimate the cost of using AWS services based on your usage scenarios and requirements. You can use AWS Pricing Calculator to compare the costs of running your applications on-premises or on AWS, and to optimize your AWS spending. AWS Application Discovery Service is a service that helps you plan your migration to the AWS Cloud by collecting and analyzing information about your on- premises servers, applications, and dependencies. You can use AWS Application Discovery Service to identify the inventory of your on-premises infrastructure, group servers by applications, and estimate the performance and resource utilization of your applications45