Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 401:

  A company wants guidance to optimize the cost and performance of its current AWS environment.

  Which AWS service or tool should the company use to identify areas for optimization?

  A. Amazon QuickSight

  B. AWS Trusted Advisor

  C. AWS Organizations

  D. AWS Budgets

  Correct Answer: B

  AWS Trusted Advisor is the AWS service or tool that the company should use to identify areas for optimization. According to the AWS Trusted Advisor User Guide, "AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices. AWS Trusted Advisor checks help optimize your AWS infrastructure, increase security and performance, reduce your overall costs, and monitor service limits." Amazon QuickSight, AWS Organizations, and AWS Budgets are not designed to provide optimization recommendations for the current AWS environment.

• Question 402:

  A company is running an application on AWS. The company wants to identify and prevent the accidental

  Which AWS service or feature will meet these requirements?

  A. Amazon GuardDuty

  B. Network ACL

  C. AWS WAF

  D. AWS Network Firewall

  Correct Answer: A

  Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you can automate anomaly detection and get actionable findings to help you protect your AWS resources4.

• Question 403:

  A company wants to develop a shopping application that records customer orders. The application needs to use an AWS managed database service to store data.

  Which AWS service should the company use to meet these requirements?

  A. Amazon RDS

  B. Amazon Redshift

  C. Amazon ElastiCache

  D. Amazon Neptune

  Correct Answer: A

  A is correct because Amazon RDS is the AWS service that provides a managed relational database service that supports various database engines, such as MySQL, PostgreSQL, Oracle, and SQL Server. B is incorrect because Amazon Redshift is the AWS service that provides a managed data warehouse service that is optimized for analytical queries. C is incorrect because Amazon ElastiCache is the AWS service that provides a managed in-memory data store service that supports Redis and Memcached. D is incorrect because Amazon Neptune is the AWS service that provides a managed graph database service that supports property graph and RDF models.

• Question 404:

  A company wants to create multiple isolated networks in the same AWS account.

  Which AWS service or component will provide this functionality?

  A. AWS Transit Gateway

  B. Internet gateway

  C. Amazon VPC

  D. Amazon EC2

  Correct Answer: C

  Amazon Virtual Private Cloud (Amazon VPC) is the AWS service that allows customers to create multiple isolated networks in the same AWS account. A VPC is a logically isolated section of the AWS Cloud where customers can launch AWS resources in a virtual network that they define. Customers can create multiple VPCs within an AWS account, each with its own IP address range, subnets, route tables, security groups, network access control lists, gateways, and other components. AWS Transit Gateway, Internet gateway, and Amazon EC2 are not services or components that provide the functionality of creating multiple isolated networks in the same AWS account. AWS Transit Gateway is a service that enables customers to connect their Amazon VPCs and their on- premises networks to a single gateway. An Internet gateway is a component that enables communication between instances in a VPC and the Internet. Amazon EC2 is a service that provides scalable compute capacity in the cloud34

• Question 405:

  A company suspects that its AWS resources are being used for illegal activities.

  Which AWS group or team should the company notify?

  A. AWS Abuse team

  B. AWS Support team

  C. AWS technical account managers

  D. AWS Professional Services team

  Correct Answer: A

  AWS Abuse team is the AWS group or team that the company should notify if it suspects that its AWS resources are being used for illegal activities. AWS Abuse team is a dedicated team that handles reports of abuse, such as spam, phishing, malware, denial-of-service attacks, and unauthorized access, involving AWS resources. The company can contact the AWS Abuse team by filling out the [Report Abuse of AWS Resources form] or sending an email to [email protected]. The company should provide as much information as possible, such as the source and destination IP addresses, timestamps, log files, and screenshots, to help the AWS Abuse team investigate and take appropriate actions. For more information, see [Reporting Abuse] and [AWS Acceptable Use Policy].

• Question 406:

  Which task can a company perform by using security groups in the AWS Cloud?

  A. Allow access to an Amazon EC2 instance through only a specific port.

  B. Deny access to malicious IP addresses at a subnet level.

  C. Protect data that is cached by Amazon CloudFront.

  D. Apply a stateless firewall to an Amazon EC2 instance.

  Correct Answer: A

  Security groups are virtual firewalls that control the inbound and outbound traffic for Amazon EC2 instances. They can be used to allow access to an Amazon EC2 instance through only a specific port, such as port 22 for SSH or port 80 for HTTP. Security groups cannot deny access to malicious IP addresses at a subnet level, as they only allow or deny traffic based on the rules defined by the customer. To block malicious IP addresses, customers can use network ACLs, which are stateless firewalls that can be applied to subnets. Security groups cannot protect data that is cached by Amazon CloudFront, as they only apply to EC2 instances. To protect data that is cached by Amazon CloudFront, customers can use encryption, signed URLs, or signed cookies. Security groups are not stateless firewalls, as they track the state of the traffic and automatically allow the response traffic to flow back to the source. Stateless firewalls do not track the state of the traffic and require rules for both inbound and outbound traffic.

• Question 407:

  A company wants to migrate to the AWS Cloud. The company needs the ability to acquire resources when the resources are necessary.

  The company also needs the ability to release those resources when the resources are no longer necessary.

  Which architecture concept of the AWS Cloud meets these requirements?

  A. Elasticity

  B. Availability

  C. Reliability

  D. Durability

  Correct Answer: A

  The architecture concept of the AWS Cloud that meets the requirements of the company that wants to migrate to the AWS Cloud and needs the ability to acquire and release resources as needed is elasticity. Elasticity means that AWS customers can quickly and easily provision and scale up or down AWS resources as their demand changes, without any upfront costs or long-term commitments. AWS provides various tools and services that enable customers to achieve elasticity, such as Amazon EC2 Auto Scaling, Amazon CloudWatch, and AWS CloudFormation. Elasticity helps customers optimize their performance, availability, and cost efficiency. Availability, reliability, and durability are other architecture concepts of the AWS Cloud, but they are not directly related to the ability to acquire and release resources as needed. Availability means that AWS customers can access their AWS resources and applications whenever and wherever they need them. Reliability means that AWS customers can depend on their AWS resources and applications to function correctly and consistently. Durability means that AWS customers can preserve their data and objects for long periods of time without loss or corruption12

• Question 408:

  Which AWS service is always available free of charge to users?

  A. Amazon Athena

  B. AWS Identity and Access Management (IAM)

  C. AWS Secrets Manager

  D. Amazon ElastiCache

  Correct Answer: B

  AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources for your users. You use IAM to control who can use your AWS resources (authentication) and what resources they can use and in what ways (authorization). IAM is always available free of charge to users4.

• Question 409:

  Which AWS services can a company use to host and run a MySQL database? (Select TWO.)

  A. Amazon RDS

  B. Amazon DynamoDB

  C. Amazon S3

  D. Amazon EC2

  E. Amazon MQ

  Correct Answer: AD

  Amazon RDS and Amazon EC2 are two AWS services that you can use to host and run a MySQL database. Amazon RDS is a service that makes it easy to set up, operate, and scale a relational database in the cloud. You can use Amazon RDS to launch a MySQL database instance and let Amazon RDS manage common database tasks such as backups, patching, scaling, and replication6. Amazon EC2 is a service that provides secure, resizable compute capacity in the cloud.

  You can use Amazon EC2 to launch a virtual server and install MySQL software on it. You have complete control over your database configuration, but you are responsible for managing and maintaining the database software and the underlying infrastructure7. Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. Amazon S3 is an object storage service that offers industry-leading scalability, data availability, security, and performance. Amazon MQ is a managed message broker service for Apache ActiveMQ. None of these services can help you host and run a MySQL database.

• Question 410:

  A manufacturing company has a critical application that runs at a remote site that has a slow internet connection. The company wants to migrate the workload to AWS. The application is sensitive to latency and interruptions in connectivity. The company wants a solution that can host this application with minimum latency.

  Which AWS service or feature should the company use to meet these requirements?

  A. Availability Zones

  B. AWS Local Zones

  C. AWS Wavelength

  D. AWS Outposts

  Correct Answer: D

  AWS Outposts is a service that offers fully managed and configurable compute and storage racks built with AWS-designed hardware that allow you to run your workloads on premises and seamlessly connect to AWS services in the cloud. AWS Outposts is ideal for workloads that require low latency, local data processing, or local data storage. With AWS Outposts, you can use the same AWS APIs, tools, and infrastructure across on premises and the cloud to deliver a truly consistent hybrid experience5. Availability Zones are isolated locations within each AWS Region that are engineered to be fault-tolerant and provide high availability. AWS Local Zones are extensions of AWS Regions that are placed closer to large population, industry, and IT centers where no AWS Region exists today. AWS Wavelength is a service that enables developers to build applications that deliver ultra-low latency to mobile devices and users by deploying AWS compute and storage at the edge of the 5G network. None of these services or features can help you host a critical application with minimum latency at a remote site that has a slow internet connection.