Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 391:

  A company wants its workload to perform consistently and correctly.

  Which benefit of AWS Cloud computing does this goal represent?

  A. Security

  B. Elasticity

  C. Pay-as-you-go pricing

  D. Reliability

  Correct Answer: D

  Reliability is the benefit of AWS Cloud computing that ensures the workload performs consistently and correctly. According to the AWS Cloud Practitioner Essentials course, reliability means "the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues."1 Elasticity, security, and pay-as-you-go pricing are also benefits of AWS Cloud computing, but they do not directly relate to the goal of consistent and correct performance.

• Question 392:

  A company wants to migrate its Microsoft SQL Server database management system from on premises to the AWS Cloud.

  Which AWS service should the company use to reduce management overhead for this environment?

  A. Amazon Elastic Container Service (Amazon ECS)

  B. Amazon SageMaker

  C. Amazon RDS

  D. Amazon Athena

  Correct Answer: C

  Amazon Relational Database Service (Amazon RDS) is the AWS service that the company should use to migrate its Microsoft SQL Server database management system from on premises to the AWS Cloud. Amazon RDS is a fully managed service that provides a scalable, secure, and high-performance relational database platform. Amazon RDS supports several database engines, including Microsoft SQL Server. Amazon RDS reduces the management overhead for the database environment by taking care of tasks such as provisioning, patching, backup, recovery, and monitoring. For more information, see What is Amazon Relational Database Service (Amazon RDS)? and Amazon RDS for SQL Server.

• Question 393:

  A company migrated its core application onto multiple workloads in the AWS Cloud. The company wants to improve the application's reliability.

  Which cloud design principle should the company implement to achieve this goal?

  A. Maximize utilization.

  B. Decouple the components.

  C. Rightsize the resources.

  D. Adopt a consumption model.

  Correct Answer: B

  Decoupling the components of an application means reducing the dependencies and interactions between them, which can improve the application's reliability, scalability, and performance. Decoupling can be achieved by using services such as Amazon Simple Queue Service (Amazon SQS), Amazon Simple Notification Service (Amazon SNS), and AWS Lambda1

• Question 394:

  Which service is an AWS in-memory data store service?

  A. Amazon Aurora

  B. Amazon RDS

  C. Amazon DynamoDB

  D. Amazon ElastiCache

  Correct Answer: D

  Amazon ElastiCache is a service that offers fully managed in-memory data store and cache services that deliver sub-millisecond response times to applications. You can use Amazon ElastiCache to improve the performance of your applications by retrieving data from fast, managed, in-memory data stores, instead of relying entirely on slower disk- based databases. Amazon Aurora is a relational database service that combines the performance and availability of high-end commercial databases with the simplicity and cost-effectiveness of open source databases. Amazon RDS is a service that makes it easy to set up, operate, and scale a relational database in the cloud. Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. None of these services are in-memory data store services.

• Question 395:

  Which AWS services or tools are designed to protect a workload from SQL injections, cross-site scripting, and DDoS attacks? (Select TWO.)

  A. VPC endpoint

  B. Virtual private gateway

  C. AWS Shield Standard

  D. AWS Config

  E. AWS WAF

  Correct Answer: CE

  AWS Shield Standard and AWS WAF are the AWS services or tools that are designed to protect a workload from SQL injections, cross-site scripting, and DDoS attacks. According to the AWS Shield Developer Guide, "AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection."5 According to the AWS WAF Developer Guide, "AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define." VPC endpoint, virtual private gateway, and AWS Config are not designed to protect a workload from these types of attacks.

• Question 396:

  A company is setting up AWS Identity and Access Management (IAM) on an AWS account.

  Which recommendation complies with IAM security best practices?

  A. Use the account root user access keys for administrative tasks.

  B. Grant broad permissions so that all company employees can access the resources they need.

  C. Turn on multi-factor authentication (MFA) for added security during the login process.

  D. Avoid rotating credentials to prevent issues in production applications.

  Correct Answer: C

  C is correct because turning on multi-factor authentication (MFA) for added security during the login process is one of the IAM security best practices recommended by AWS. MFA adds an extra layer of protection on top of the user name and password, making it harder for attackers to access the AWS account. A is incorrect because using the account root user access keys for administrative tasks is not a good practice, as the root user has full access to all the resources in the AWS account and can cause irreparable damage if compromised. AWS recommends creating individual IAM users with the least privilege principle and using roles for applications that run on Amazon EC2 instances. B is incorrect because granting broad permissions so that all company employees can access the resources they need is not a good practice, as it increases the risk of unauthorized or accidental actions on the AWS resources. AWS recommends granting only the permissions that are required to perform a task and using groups to assign permissions to IAM users. D is incorrect because avoiding rotating credentials to prevent issues in production applications is not a good practice, as it increases the risk of credential leakage or compromise. AWS recommends rotating credentials regularly and using temporary security credentials from AWS STS when possible.

• Question 397:

  Which AWS service is designed to help users orchestrate a workflow process for a set of AWS Lambda functions?

  A. Amazon DynamoDB

  B. AWS CodePipeline

  C. AWS Batch

  D. AWS Step Functions

  Correct Answer: D

  The AWS service that is designed to help users orchestrate a workflow process for a set of AWS Lambda functions is AWS Step Functions. AWS Step Functions is a service that helps users coordinate multiple AWS services into serverless workflows that can be triggered by events, such as messages, API calls, or schedules. AWS Step Functions allows users to create and visualize complex workflows that can include branching, parallel execution, error handling, retries, and timeouts. AWS Step Functions can integrate with AWS Lambda to orchestrate a sequence of Lambda functions that perform different tasks or logic. Amazon DynamoDB, AWS CodePipeline, and AWS Batch are not the best services to use for orchestrating a workflow process for a set of AWS Lambda functions. Amazon DynamoDB is a fully managed NoSQL database service that provides fast and consistent performance, scalability, and flexibility. AWS CodePipeline is a fully managed continuous delivery service that helps users automate the release process of their applications. AWS Batch is a fully managed service that helps users run batch computing workloads on the AWS Cloud.

• Question 398:

  A company has a compliance requirement to record and evaluate configuration changes, as well as perform remediation actions on AWS resources.

  Which AWS service should the company use?

  A. AWS Config

  B. AWS Secrets Manager

  C. AWS CloudTrail

  D. AWS Trusted Advisor

  Correct Answer: A

  AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With AWS Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This can help you simplify compliance auditing, security analysis, change management, and operational troubleshooting1.

• Question 399:

  A company has an environment that includes Amazon EC2 instances, Amazon Lightsail, and on-premises servers. The company wants to automate the security updates for its operating systems and applications.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Use AWS Shield to identify and manage security events.

  B. Connect to each server by using a remote desktop connection. Run an update script.

  C. Use the AWS Systems Manager Patch Manager capability.

  D. Schedule Amazon GuardDuty to run on a nightly basis.

  Correct Answer: C

  AWS Systems Manager Patch Manager is a capability that allows users to automate the security updates for their operating systems and applications. It enables users to scan their instances for missing patches, define patch baselines, schedule patching windows, and monitor patch compliance. It supports Amazon EC2 instances, Amazon Lightsail instances, and on-premises servers. AWS Shield is a service that provides protection against Distributed Denial of Service (DDoS) attacks for AWS resources and services. It does not automate the security updates for operating systems and applications. Connecting to each server by using a remote desktop connection and running an update script is a manual and time-consuming solution that requires a lot of operational effort. It is not a recommended best practice for automating the security updates for operating systems and applications. Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for AWS accounts and resources. It does not automate the security updates for operating systems and applications.

• Question 400:

  Which AWS service or tool provides on-demand access to AWS security and compliance reports and AWS online agreements?

  A. AWS Artifact

  B. AWS Trusted Advisor

  C. Amazon Inspector

  D. AWS Billing console

  Correct Answer: A

  AWS Artifact is the AWS service or tool that provides on-demand access to AWS security and compliance reports and AWS online agreements. AWS Trusted Advisor is a tool that provides real-time guidance to help users provision their resources following AWS best practices. Amazon Inspector is a service that helps users improve the security and compliance of their applications. AWS Billing console is a tool that helps users manage their AWS costs and usage. These concepts are explained in the AWS Cloud Practitioner Essentials course3.