Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 331:

  A company needs to run a workload for several batch image rendering applications. It is acceptable for the workload to experience downtime.

  Which Amazon EC2 pricing model would be MOST cost-effective in this situation?

  A. On-Demand Instances

  B. Reserved Instances

  C. Dedicated Instances

  D. Spot Instances

  Correct Answer: D

  Amazon EC2 Spot Instances are instances that use spare EC2 capacity that is available at up to a 90% discount compared to On-Demand prices. You can use Spot Instances for various stateless, fault-tolerant, or flexible applications such as big data, containerized workloads, high-performance computing (HPC), and test and development workloads. Spot Instances are ideal for workloads that can be interrupted, such as batch image rendering applications1. On-Demand Instances are instances that let you pay for compute capacity by the hour or second (minimum of 60 seconds) with no long-term commitments. This frees you from the costs and complexities of planning, purchasing, and maintaining hardware and transforms what are commonly large fixed costs into much smaller variable costs2. Reserved Instances are instances that provide you with a significant discount (up to 75%) compared to On-Demand Instance pricing. In exchange, you select a term and make an upfront payment to reserve a certain amount of compute capacity for that term3. Dedicated Instances are instances that run in a VPC on hardware that's dedicated to a single customer. Your Dedicated Instances are physically isolated at the host hardware level from instances that belong to other AWS accounts4.

• Question 332:

  A company is planning to migrate to the AWS Cloud and wants to become more responsive to customer inquiries and feedback. The company wants to focus on organizational transformation.

  A company wants to give its customers the ability to view specific data that is hosted in Amazon S3 buckets. The company wants to keep control over the full datasets that the company shares with the customers.

  Which S3 feature will meet these requirements?

  A. S3 Storage Lens

  B. S3 Cross-Region Replication (CRR)

  C. S3 Versioning

  D. S3 Access Points

  Correct Answer: D

  S3 Access Points are a feature of Amazon S3 that allows you to easily manage access to specific data that is hosted in S3 buckets. S3 Access Points are unique hostnames that customers can use to access data in S3 buckets. You can create multiple access points for a single bucket, each with its own name and permissions. You can use S3 Access Points to provide different levels of access to different groups of customers, such as read-only or write-only access. You can also use S3 Access Points to enforce encryption or logging requirements for specific data. S3 Access Points help you keep control over the full datasets that you share with your customers, while simplifying the access management and improving the performance and scalability of your applications.

• Question 333:

  A company wants high levels of detection and near-real-time (NRT) mitigation against large and sophisticated distributed denial of service (DDoS) attacks on applications running on AWS.

  Which AWS service should the company use?

  A. Amazon GuardDuty

  B. Amazon Inspector

  C. AWS Shield Advanced

  D. Amazon Macie

  Correct Answer: C

  AWS Shield Advanced is a service that provides high levels of detection and near-real-time (NRT) mitigation against large and sophisticated distributed denial of service (DDoS) attacks on applications running on AWS. AWS Shield Advanced also provides you with 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS attacks of any size or duration1. Amazon GuardDuty is a service that provides threat detection for your AWS accounts and workloads, but it does not offer DDoS protection3. Amazon Inspector is a service that helps you improve the security and compliance of your applications deployed on AWS by automatically assessing them for vulnerabilities and deviations from best practices. Amazon Macie is a service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

• Question 334:

  Which abilities are benefits of the AWS Cloud? (Select TWO.)

  A. Trade variable expenses for capital expenses.

  B. Deploy globally in minutes.

  C. Plan capacity in advance of deployments.

  D. Take advantage of economies of scale.

  E. Reduce dependencies on network connectivity.

  Correct Answer: BD

• Question 335:

  A company needs to control inbound and outbound traffic for an Amazon EC2 instance.

  Which AWS service or feature can the company associate with the EC2 instance to meet this requirement?

  A. Network ACL

  B. Security group

  C. AWS WAF

  D. VPC route tables

  Correct Answer: B

  A security group is a virtual firewall that can be associated with an Amazon EC2 instance to control the inbound and outbound traffic for the instance. You can specify which protocols, ports, and source or destination IP ranges are allowed or denied by the security group. A network ACL is a stateless filter that can be associated with a subnet to control the traffic to and from the subnet, but it is not associated with an EC2 instance4. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. VPC route tables are used to determine where network traffic is directed within a VPC or to an internet gateway, virtual private gateway, NAT device, VPC peering connection, or VPC endpoint.

• Question 336:

  Which AWS services or features can a company use to connect the network of its on- premises data center to AWS? (Select TWO.)

  A. AWS VPN

  B. AWS Directory Service

  C. AWS Data Pipeline

  D. AWS Direct Connect

  E. AWS CloudHSM

  Correct Answer: AD

  AWS VPN and AWS Direct Connect are two services that enable customers to connect their on-premises data center network to the AWS Cloud. AWS VPN establishes a secure and encrypted connection over the public internet, while AWS Direct Connect establishes a dedicated and private connection through a partner network. You can learn more about AWS VPN from [this webpage] or [this digital course]. You can learn more about AWS Direct Connect from [this webpage] or [this digital course].

• Question 337:

  An IT engineer needs to access AWS services from an on-premises application.

  Which credentials or keys does the application need for authentication?

  A. AWS account user name and password

  B. IAM access key and secret

  C. Amazon EC2 key pairs

  D. AWS Key Management Service (AWS KMS) keys

  Correct Answer: B

  IAM access keys are long-term credentials that consist of an access key ID and a secret access key. You use access keys to sign programmatic requests that you make to AWS. If you need to access AWS services from an on-premises application, you can use IAM access keys to authenticate your requests. AWS account user name and password are used to sign in to the AWS Management Console. Amazon EC2 key pairs are used to connect to your EC2 instances using SSH. AWS Key Management Service (AWS KMS) keys are used to encrypt and decrypt your data using the AWS Encryption SDK or the AWS CLI.

• Question 338:

  A company has 5 TB of data stored in Amazon S3. The company plans to occasionally run queries on the data for analysis.

  Which AWS service should the company use to run these queries in the MOST cost- effective manner?

  A. Amazon Redshift

  B. Amazon Athena

  C. Amazon Kinesis

  D. Amazon RDS

  Correct Answer: B

  Amazon Athena is a serverless, interactive analytics service that allows users to run SQL queries on data stored in Amazon S3. It is ideal for occasional queries on large datasets, as it does not require any server provisioning, configuration,

  or management. Users only pay for the queries they run, based on the amount of data scanned. Amazon Athena supports various data formats, such as CSV, JSON, Parquet, ORC, and Avro, and integrates with AWS Glue Data Catalog to

  create and manage schemas. Amazon Athena also supports querying data from other sources, such as on- premises or other cloud systems, using data connectors1. Amazon Redshift is a fully managed data warehouse service that allows

  users to run complex analytical queries on petabyte-scale data. However, it requires users to provision and maintain clusters of nodes, and pay for the storage and compute capacity they use. Amazon Redshift is more suitable for frequent

  and consistent queries on structured or semi-structured data2.

  Amazon Kinesis is a platform for streaming data on AWS, enabling users to collect, process, and analyze real-time data. It is not designed for querying data stored in Amazon S3. Amazon Kinesis consists of four services: Kinesis Data

  Streams, Kinesis Data Firehose, Kinesis Data Analytics, and Kinesis Video Streams3. Amazon RDS is a relational database service that provides six database engines: Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle Database, and

  SQL Server. It simplifies database administration tasks such as backup, patching, scaling, and replication. However, it is not optimized for querying data stored in Amazon S3. Amazon RDS is more suitable for transactional workloads that

  require high performance and availability4.

  References:

  Interactive SQL - Serverless Query Service - Amazon Athena - AWS [Amazon Redshift ?Data Warehouse Solution - AWS] [Amazon Kinesis - Streaming Data Platform - AWS]

  [Amazon Relational Database Service (RDS) ?AWS]

• Question 339:

  A company wants to verify if multi-factor authentication (MFA) is enabled for all users within its AWS accounts.

  Which AWS service or resource will meet this requirement?

  A. AWS Cost and Usage Report

  B. IAM credential reports

  C. AWS Artifact

  D. Amazon CloudFront reports

  Correct Answer: B

  The AWS service or resource that will meet the requirement of verifying if multi-factor authentication (MFA) is enabled for all users within its AWS accounts is IAM credential reports. IAM credential reports are downloadable reports that list all the users in an AWS account and the status of their various credentials, including passwords, access keys, and MFA devices. Users can use IAM credential reports to audit the security status of their AWS accounts and identify any issues or risks4. AWS Cost and Usage Report, AWS Artifact, and Amazon CloudFront reports are other AWS services or resources that provide different types of information, such as billing, compliance, and content delivery, but they do not show the MFA status of the users.

• Question 340:

  Which pillar of the AWS Well-Architected Framework includes the AWS shared responsibility model?

  A. Operational excellence

  B. Performance efficiency

  C. Reliability

  D. Security

  Correct Answer: D

  The AWS Well-Architected Framework is a set of best practices and guidelines for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud. The framework consists of five pillars: operational excellence, performance efficiency, reliability, security, and cost optimization. The security pillar covers the AWS shared responsibility model, which defines the security and compliance responsibilities of AWS and the customers. You can learn more about the AWS Well-Architected Framework from [this whitepaper] or [this digital course].