Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 351:

  Which AWS services are connectivity services for a VPC? (Select TWO.)

  A. AWS Site-to-Site VPN

  B. AWS Direct Connect

  C. Amazon Connect

  D. AWS Key Management Service (AWS KMS)

  E. AWS Identity and Access Management (IAM)

  Correct Answer: A

  AWS Site-to-Site VPN and AWS Direct Connect are AWS services that are connectivity services for a VPC. AWS Site-to-Site VPN is a service that enables you to securely connect your on-premises network or branch office site to your Amazon Virtual Private Cloud (Amazon VPC). You can establish VPN connections over the internet or over AWS Direct Connect1. AWS Direct Connect is a service that lets you establish a dedicated network connection between your network and one of the AWS Direct Connect locations. Using AWS Direct Connect, you can create a private connection between AWS and your datacenter, office, or colocation environment, which can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections2. Amazon Connect is a service that lets you set up and manage a contact center in the cloud, but it does not provide network connectivity between the VPC and your on-premises network. AWS Key Management Service (AWS KMS) is a service that makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications, but it does not provide network connectivity between the VPC and your on-premises network. AWS Identity and Access Management (IAM) is a service that enables you to manage access to AWS services and resources securely, but it does not provide network connectivity between the VPC and your on-premises network.

• Question 352:

  A company plans to migrate to the AWS Cloud. The company wants to use the AWS Cloud Adoption Framework (AWS CAF) to define and track business outcomes as part of its cloud transformation journey.

  Which AWS CAF governance perspective capability will meet these requirements?

  A. Benefits management

  B. Risk management

  C. Application portfolio management

  D. Cloud financial management

  Correct Answer: A

  The correct answer is A. Benefits management. Benefits management is the AWS CAF governance perspective capability that helps you define and track business outcomes as part of your cloud transformation journey. Benefits management

  helps you align your cloud initiatives with your business objectives, measure the value and impact of your cloud investments, and communicate the benefits of cloud adoption to your stakeholders12.

  Risk management is the AWS CAF governance perspective capability that helps you identify and mitigate the potential risks associated with cloud adoption, such as security, compliance, legal, and operational risks12.

  Application portfolio management is the AWS CAF governance perspective capability that helps you assess and optimize your existing application portfolio for cloud migration or modernization. Application portfolio management helps you

  categorize your applications based on their business value and technical fit, prioritize them for cloud adoption, and select the best migration or modernization strategy for each application12. Cloud financial management is the AWS CAF

  governance perspective capability that helps you manage and optimize the costs and value of your cloud resources. Cloud financial management helps you plan and budget for cloud adoption, track and allocate cloud costs, implement cost

  optimization strategies, and report on cloud financial performance12.

  References:

  1: AWS Cloud Adoption Framework: Governance Perspective 2: All you need to know about AWS Cloud Adoption Framework -- Governance Perspective

• Question 353:

  A company wants to migrate its high-performance computing (HPC) application to Amazon EC2 instances. The application has multiple components. The application must have fault tolerance and must have the ability to fail over automatically.

  Which AWS infrastructure solution will meet these requirements with the LEAST latency between components?

  A. Multiple AWS Regions

  B. Multiple edge locations

  C. Multiple Availability Zones

  D. Regional edge caches

  Correct Answer: C

  Using EC2 instances in multiple Availability Zones is an AWS infrastructure solution that meets the requirements of migrating a high performance computing (HPC) application to AWS with fault tolerance and failover capabilities, and with the least latency between components. An Availability Zone is a physically isolated location within an AWS Region that has its own power, cooling, and network connectivity. EC2 instances within the same Region can communicate with each other using low-latency private IP addresses. By using EC2 instances in multiple Availability Zones, the company can achieve fault tolerance and failover for their HPC application, because they can distribute the workload and data across different locations that are independent of each other. If one Availability Zone becomes unavailable or impaired, the company can redirect the traffic and data to another Availability Zone without affecting the performance and availability of the application5

• Question 354:

  A company deployed an Amazon EC2 instance last week. A developer realizes that the EC2 instance is no longer running. The developer reviews a list of provisioned EC2 instances, and the EC2 instance is no longer on the list.

  What can the developer do to generate a recent history of the EC2 instance?

  A. Run Cost Explorer to identify the start time and end time of the EC2 instance.

  B. Use Amazon Inspector to find out when the EC2 instance was stopped.

  C. Perform a search in AWS CloudTrail to find all EC2 instance-related events.

  D. Use AWS Secrets Manager to display hidden termination logs of the EC2 instance.

  Correct Answer: C

  AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of a customer's AWS account. AWS CloudTrail allows customers to track user activity and API usage across their AWS infrastructure. AWS CloudTrail can also provide a history of EC2 instance events, such as launch, stop, terminate, and reboot. Cost Explorer is a tool that enables customers to visualize, understand, and manage their AWS costs and usage over time.

  Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. AWS Secrets Manager helps customers protect secrets needed to access their applications, services, and IT resources.

• Question 355:

  Which capabilities are in the platform perspective of the AWS Cloud Adoption Framework (AWS CAF)? (Select TWO.)

  A. Performance and capacity management

  B. Data engineering

  C. Continuous integration and continuous delivery (CI/CD)

  D. Infrastructure protection

  E. Change and release management

  Correct Answer: BC

  These are two of the seven capabilities that are in the platform perspective of the AWS Cloud Adoption Framework (AWS CAF). The platform perspective helps you build an enterprise-grade, scalable, hybrid cloud platform, modernize existing

  workloads, and implement new cloud-native solutions1. The other five capabilities are:

  Platform architecture ?Establish and maintain guidelines, principles, patterns, and guardrails for your cloud environment.

  Platform engineering ?Build a compliant multi-account cloud environment with enhanced security features, and packaged, reusable cloud products. Platform operations ?Manage and optimize your cloud environment with automation,

  monitoring, and incident response.

  Application development ?Develop and deploy cloud-native applications using modern architectures and best practices.

  Application migration ?Migrate your existing applications to the cloud using proven methodologies and tools.

  Performance and capacity management, infrastructure protection, and change and release management are not capabilities of the platform perspective. They are part of the operations perspective, which helps you achieve operational

  excellence in the cloud2. The operations perspective comprises six capabilities:

  Performance and capacity management ?Monitor and optimize the performance and capacity of your cloud workloads.

  Infrastructure protection ?Protect your cloud infrastructure from unauthorized access, malicious attacks, and data breaches.

  Change and release management ?Manage changes and releases to your cloud workloads using automation and governance.

  Configuration management ?Manage the configuration of your cloud resources and applications using automation and version control. Incident management ?Respond to incidents affecting your cloud workloads using best practices and

  tools.

  Service continuity management ?Ensure the availability and resilience of your cloud workloads using backup, recovery, and disaster recovery strategies.

• Question 356:

  A company wants to use the AWS Cloud to deploy an application globally.

  Which architecture deployment model should the company use to meet this requirement?

  A. Multi-Region

  B. Single-Region

  C. Multi-AZ

  D. Single-AZ

  Correct Answer: A

  The architecture deployment model that the company should use to meet this requirement is A. Multi-Region.

  A multi-region deployment model is a cloud computing architecture that distributes an application and its data across multiple geographic regions. A multi-region deployment model enables a company to achieve global reach, high availability,

  disaster recovery, and performance optimization. By deploying an application in multiple regions, a company can serve customers from the nearest region, reduce latency, increase redundancy, and comply with data sovereignty

  regulations12.

  A single-region deployment model is a cloud computing architecture that runs an application and its data within a single geographic region. A single-region deployment model is simpler and cheaper than a multi-region deployment model, but it

  has limited scalability, availability, and performance. A single-region deployment model may not be suitable for a company that wants to deploy an application globally, as it may face challenges such as network latency, regional outages, or

  regulatory compliance12. A multi-AZ (Availability Zone) deployment model is a cloud computing architecture that distributes an application and its data across multiple isolated locations within a single region. An Availability Zone is a physically

  separate location within an AWS Region that has independent power, cooling, and networking. A multi-AZ deployment model enhances the availability and durability of an application by providing redundancy and fault tolerance within a

  region34.

  A single-AZ deployment model is a cloud computing architecture that runs an application and its data within a single Availability Zone. A single-AZ deployment model is the simplest and most cost-effective option, but it has no redundancy or

  fault tolerance. A single-AZ deployment model may not be suitable for a company that wants to deploy an application globally, as it may face challenges such as network latency, regional outages, or regulatory compliance34.

  References:

  1: AWS Cloud Computing - W3Schools 2: Understand the Different Cloud Computing Deployment Models Unit - Trailhead 3: Regions and Availability Zones - Amazon Elastic Compute Cloud 4: AWS Reference Architecture Diagrams

• Question 357:

  How does the AWS Enterprise Support Concierge team help users?

  A. Supporting application development

  B. Providing architecture guidance

  C. Answering billing and account inquiries

  D. Answering questions regarding technical support cases

  Correct Answer: C

  The AWS Enterprise Support Concierge team is a group of billing and account experts who specialize in working with enterprise customers. They can help customers with questions about billing, account management, cost optimization, and

  other non-technical issues. They can also assist customers with navigating and optimizing their AWS environment, such as setting up consolidated billing, applying for service limit increases, or requesting refunds.

  References:

  AWS Support Plan Comparison

  AWS Enterprise Support Plan

  Answer Explained: Which AWS Support plan provides access to AWS Concierge Support team for account assistance?

• Question 358:

  A company must archive Amazon S3 data that the company's business units no longer need to access.

  Which S3 storage class will meet this requirement MOST cost-effectively?

  A. S3 Glacier Instant Retrieval

  B. S3 Glacier Flexible Retrieval

  C. S3 Glacier Deep Archive

  D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

  Correct Answer: C

  S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice in a year. It is designed for customers -- particularly those in highly-regulated industries, such as the Financial Services, Healthcare, and Public Sectors -- that retain data sets for 7-10 years or longer to meet regulatory compliance requirements. Customers can store large amounts of data at a very low cost, and reliably access it with a wait time of 12 hours3.

• Question 359:

  A company needs to search for text in documents that are stored in Amazon S3.

  Which AWS service will meet these requirements?

  A. Amazon Kendra

  B. Amazon Rekognition

  C. Amazon Polly

  D. Amazon Lex

  Correct Answer: A

  Amazon Kendra is a highly accurate and easy to use intelligent search service powered by machine learning. It enables users to easily find the content they are looking for, even when it is scattered across multiple locations and content repositories within their organization. Amazon Kendra supports natural language queries, and can search for text in documents stored in Amazon S3, as well as other sources such as SharePoint, OneDrive, Salesforce, ServiceNow, and more1. Amazon Rekognition is a computer vision service that makes it easy to add image and video analysis to applications. It can detect objects, faces, text, scenes, activities, and emotions in images and videos. However, it is not designed for searching for text in documents stored in Amazon S32. Amazon Polly is a text-to-speech service that turns text into lifelike speech. It can create audio versions of books, articles, podcasts, and more. However, it is not designed for searching for text in documents stored in Amazon S33. Amazon Lex is a service for building conversational interfaces using voice and text. It can create chatbots that can interact with users using natural language. However, it is not designed for searching for text in documents stored in Amazon S34.

• Question 360:

  A company needs to apply security rules to specific Amazon EC2 instances.

  Which AWS service or feature provides this functionality?

  A. AWS Shield

  B. Network ACLs

  C. Security groups

  D. AWS Firewall Manager

  Correct Answer: C

  Security groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. You can use security groups to set rules that allow or deny traffic to or from your instances. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances that are associated with the security group.