Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 351:

  A company has an environment that includes Amazon EC2 instances, Amazon Lightsail, and on-premises servers. The company wants to automate the security updates for its operating systems and applications.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Use AWS Shield to identify and manage security events.
  B. Connect to each server by using a remote desktop connection. Run an update script.
  C. Use the AWS Systems Manager Patch Manager capability.
  D. Schedule Amazon GuardDuty to run on a nightly basis.
  C. Use the AWS Systems Manager Patch Manager capability.

  ---

  Explanation

  AWS Systems Manager Patch Manager is a capability that allows users to automate the security updates for their operating systems and applications. It enables users to scan their instances for missing patches, define patch baselines, schedule patching windows, and monitor patch compliance. It supports Amazon EC2 instances, Amazon Lightsail instances, and on-premises servers. AWS Shield is a service that provides protection against Distributed Denial of Service (DDoS) attacks for AWS resources and services. It does not automate the security updates for operating systems and applications. Connecting to each server by using a remote desktop connection and running an update script is a manual and time-consuming solution that requires a lot of operational effort. It is not a recommended best practice for automating the security updates for operating systems and applications. Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for AWS accounts and resources. It does not automate the security updates for operating systems and applications.

• Question 352:

  Which option is a customer responsibility under the AWS shared responsibility model?

  A. Maintenance of underlying hardware of Amazon EC2 instances
  B. Application data security
  C. Physical security of data centers
  D. Maintenance of VPC components
  B. Application data security

  ---

  Explanation

  The option that is a customer responsibility under the AWS shared responsibility model is

  B. Application data security.

  According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS manages the security of the underlying infrastructure,

  such as the hardware, software, networking, and facilities that run the AWS services, while the customer manages the security of their applications, data, and resources that they use on top of AWS. Application data security is one of the

  customer responsibilities under the AWS shared responsibility model. This means that the customer is responsible for protecting their application data from unauthorized access, modification, deletion, or leakage. The customer can use

  various AWS services and features to help with application data security, such as encryption, key management, access control, logging, and auditing. Maintenance of underlying hardware of Amazon EC2 instances is not a customer

  responsibility under the AWS shared responsibility model. This is part of the AWS responsibility to secure the cloud. AWS manages the physical servers that host the Amazon EC2 instances and ensures that they are updated, patched, and

  replaced as needed.

  Physical security of data centers is not a customer responsibility under the AWS shared responsibility model. This is also part of the AWS responsibility to secure the cloud. AWS operates and controls the facilities where the AWS services are

  hosted and ensures that they are protected from unauthorized access, environmental hazards, fire, and theft. Maintenance of VPC components is not a customer responsibility under the AWS shared responsibility model. This is a shared

  responsibility between AWS and the customer. AWS provides the VPC service and ensures that it is secure and reliable, while the customer configures and manages their own VPCs and related components, such as subnets, route tables,

  security groups, network ACLs, gateways, and endpoints.

  References:

  1: Shared Responsibility Model - Amazon Web Services (AWS)

  2: AWS Cloud Computing - W3Schools

  3: [Amazon EC2 FAQs - Amazon Web Services]

  4: [AWS Security - Amazon Web Services]

  5: [Amazon Virtual Private Cloud (VPC) - Amazon Web Services]

• Question 353:

  A company is using the AWS Free Tier for several AWS services for an application.

  What will happen if the Free Tier usage period expires or if the application use exceeds the Free Tier usage limits?

  A. The company will be charged the standard pay-as-you-go service rates for the usage that exceeds the Free Tier usage.
  B. AWS Support will contact the company to set up standard service charges.
  C. The company will be charged for the services it consumed during the Free Tier period, plus additional charges for service consumption after the Free Tier period.
  D. The company's AWS account will be frozen and can be restarted after a payment plan is established.
  A. The company will be charged the standard pay-as-you-go service rates for the usage that exceeds the Free Tier usage.

  ---

  Explanation

• Question 354:

  Which responsibility belongs to AWS when a company hosts its databases on Amazon EC2 instances?

  A. Database backups
  B. Database software patches
  C. Operating system patches
  D. Operating system installations
  D. Operating system installations

  ---

  Explanation

  In the AWS shared responsibility model, when a company hosts its databases on Amazon EC2 instances, the customer is responsible for managing everything inside the instance, including database backups and software patches. AWS, however, is responsible for the underlying infrastructure, which includes patching the host operating system and hypervisor that support the EC2 service.

  But when it comes to the operating system running inside the EC2 instance, AWS provides tools and options, but the customer is responsible for applying OS-level patches and managing configurations.

  However, if the question is referring to who provides the OS patches, then AWS is responsible for making patches available, while the customer is responsible for applying them on their EC2 instances.

  Since the question asks which responsibility belongs to AWS, the correct interpretation here is:

  None of the listed answers are fully AWS responsibilities when using EC2, but the closest correct answer in context is:

  Operating system installations

  Because AWS installs the base OS image (AMI) when you launch the EC2 instance.

• Question 355:

  To reduce costs, a company is planning to migrate a NoSQL database to AWS.

  Which AWS service is fully managed and can automatically scale throughput capacity to meet database workload demands?

  A. Amazon Redshift
  B. Amazon Aurora
  C. Amazon DynamoDB
  D. Amazon RDS
  C. Amazon DynamoDB

  ---

  Explanation

  Amazon DynamoDB: DynamoDB is a fully managed NoSQL database service provided by AWS. It is designed to provide low-latency, high-throughput performance for applications. DynamoDB can automatically scale throughput capacity based on the application's demand, making it a suitable choice for workloads with varying traffic patterns.

  Amazon Redshift: Amazon Redshift is a fully managed data warehouse service, but it is not a NoSQL database, and its scaling behavior is optimized for analytical queries rather than transactional workloads.

  Amazon Aurora: Amazon Aurora is a fully managed relational database service. While it offers automatic scaling, it may not be the optimal choice for a NoSQL database.

  Amazon RDS: Amazon RDS (Relational Database Service) is a managed relational database service that supports various database engines. It may not be the best fit for a NoSQL database with automatic scaling requirements.

• Question 356:

  A company suspects that its AWS resources are being used for illegal activities.

  Which AWS group or team should the company notify?

  A. AWS Abuse team
  B. AWS Support team
  C. AWS technical account managers
  D. AWS Professional Services team
  A. AWS Abuse team

  ---

  Explanation

  AWS Abuse team is the AWS group or team that the company should notify if it suspects that its AWS resources are being used for illegal activities. AWS Abuse team is a dedicated team that handles reports of abuse, such as spam, phishing, malware, denial-of-service attacks, and unauthorized access, involving AWS resources. The company can contact the AWS Abuse team by filling out the [Report Abuse of AWS Resources form] or sending an email to [email protected]. The company should provide as much information as possible, such as the source and destination IP addresses, timestamps, log files, and screenshots, to help the AWS Abuse team investigate and take appropriate actions. For more information, see [Reporting Abuse] and [AWS Acceptable Use Policy].

• Question 357:

  A company wants to launch multiple workloads on AWS. Each workload is related to a different business unit. The company wants to separate and track costs for each business unit.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Use AWS Organizations and create one account for each business unit.
  B. Use a spreadsheet to control the owners and cost of each resource.
  C. Use an Amazon DynamoDB table to record costs for each business unit.
  D. Use the AWS Billing console to assign owners to resources and track costs.
  A. Use AWS Organizations and create one account for each business unit.

  ---

  Explanation

  AWS Organizations is a service that helps you centrally manage and govern your AWS environment. You can use AWS Organizations to create multiple accounts for different business units, and group them into organizational units (OUs)

  that reflect your organizational structure1. By doing so, you can separate and track costs for each business unit using the account ID as a cost allocation tag2. You can also use AWS Organizations to apply policies and controls to your

  accounts, such as service control policies (SCPs) and tag policies1. The other options are not suitable for meeting the requirements with the least operational overhead. Using a spreadsheet or a DynamoDB table to control and record costs for each business unit would require manual data entry and

  maintenance, which is prone to errors and inconsistencies. Using the AWS Billing console to assign owners to resources and track costs would also require manual tagging of each resource, which is time-consuming and inefficient.

  References:

  1: What Is AWS Organizations? - AWS Organizations

  2: Cost Tagging and Reporting with AWS Organizations | AWS Cloud Financial Management

• Question 358:

  Why are AWS CloudFormation templates used?

  A. To reduce provisioning time by using automation.
  B. To transfer existing infrastructure to another company.
  C. To reuse on-premises infrastructure in the AWS Cloud.
  D. To deploy large infrastructure with no cost implications.
  A. To reduce provisioning time by using automation.

  ---

  Explanation

• Question 359:

  A company wants to generate a list of IAM users. The company also wants to view the status of various credentials that are associated with the users, such as password, access keys, and multi-factor authentication (MFA) devices. Which AWS service or feature will meet these requirements?

  A. IAM credential report
  B. AWS IAM Identity Center (AWS Single Sign-On)
  C. AWS Identity and Access Management Access Analyzer
  D. AWS Cost and Usage Report
  A. IAM credential report

  ---

  Explanation

  An IAM credential report is a feature of AWS Identity and Access Management (IAM) that allows you to view and download a report that lists all IAM users in your account and the status of their various credentials, such as passwords, access keys, and MFA devices. You can use this report to audit the security status of your IAM users and ensure that they follow the best practices for credential management.

• Question 360:

  Which AWS service or feature enables users to block the incoming or outgoing traffic associated with specific IP addresses flowing through a VPC?

  A. Network ACLs
  B. Security groups
  C. AWS Identity and Access Management (IAM)
  D. AWS WAF
  A. Network ACLs

  ---

  Explanation

  To allow or block specific IP addresses for your EC2 instances, use a network Access Control List (ACL) or security group rules in your VPC. Network ACLs and security group rules act as firewalls allowing or blocking IP addresses from accessing your resources.