Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 421:

  A company has an application that runs periodically in an on-premises environment. The application runs for a few hours most days, but runs for 8 hours a day for a week at the end of each month.

  Which AWS service or feature should be used to host the application in the AWS Cloud?

  A. Amazon EC2 Standard Reserved Instances

  B. Amazon EC2 On-Demand Instances

  C. AWS Wavelength

  D. Application Load Balancer

  Correct Answer: B

  Amazon EC2 On-Demand Instances are instances that you pay for by the second, with no long-term commitments or upfront payments4. This option is suitable for applications that have unpredictable or intermittent workloads, such as the one described in the question. Amazon EC2 Standard Reserved Instances are instances that you purchase for a one-year or three-year term, and pay a lower hourly rate compared to On-Demand Instances. This option is suitable for applications that have steady state or predictable usage. AWS Wavelength is a service that enables developers to build applications that deliver ultra-low latency to mobile devices and users by deploying AWS compute and storage at the edge of the 5G network. This option is not relevant for the application described in the question. Application Load Balancer is a type of load balancer that operates at the application layer and distributes traffic based on the content of the request. This option is not a service or feature to host the application, but rather to balance the traffic among multiple instances.

• Question 422:

  Which encryption types can be used to protect objects at rest in Amazon S3? (Select TWO.)

  A. Server-side encryption with AmazonS3 managed encryption keys (SSE-S3)

  B. Server-side encryption with AWS KMSmanaged keys (SSE-KMS)

  C. TLS

  D. SSL

  E. Transparent Data Encryption (TDE)

  Correct Answer: AB

  Server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and server-side encryption with AWS KMS managed keys (SSE-KMS) are the encryption types that can be used to protect objects at rest in Amazon S3. Server-side encryption means that Amazon S3 encrypts the objects before saving them on disks and decrypts them when they are downloaded. SSE-S3 uses one master key per bucket that is managed by Amazon S3. SSE-KMS uses a customer master key (CMK) that is stored in AWS Key Management Service (AWS KMS) and provides additional benefits, such as audit trails and key rotation. For more information, see Protecting Data Using Server-Side Encryption and Protecting Data Using Encryption.

• Question 423:

  Which benefit of the AWS Cloud helps companies achieve lower usage costs because of the aggregate usage of all AWS users?

  A. No need to guess capacity

  B. Ability to go global in minutes

  C. Economies of scale

  D. Increased speed and agility

  Correct Answer: C

  The benefit of the AWS Cloud that helps companies achieve lower usage costs because of the aggregate usage of all AWS users is economies of scale. Economies of scale means that AWS can achieve lower costs and higher efficiency by operating at a massive scale and passing the savings to the customers. AWS leverages the aggregate usage of all AWS users to negotiate better prices with hardware vendors, optimize power consumption, and improve operational processes. As a result, AWS can offer lower and more flexible pricing options to the customers, such as pay-as-you-go, reserved, and spot pricing models. No need to guess capacity, ability to go global in minutes, and increased speed and agility are other benefits of the AWS Cloud, but they are not directly related to the aggregate usage of all AWS users. No need to guess capacity means that AWS customers can avoid the risk of over-provisioning or under-provisioning resources, and scale up or down as needed. Ability to go global in minutes means that AWS customers can deploy their applications and data in multiple regions around the world, and deliver them to users with high performance and availability. Increased speed and agility means that AWS customers can quickly and easily provision and access AWS resources, and accelerate their innovation and time to market.

• Question 424:

  Which AWS services allow users to monitor and retain records of account activities that include governance, compliance, and auditing? (Select TWO.)

  A. Amazon CloudWatch

  B. AWS CloudTrail

  C. Amazon GuardDuty

  D. AWS Shield

  E. AWS WAF

  Correct Answer: AB

  Amazon CloudWatch and AWS CloudTrail are the AWS services that allow users to monitor and retain records of account activities that include governance, compliance, and auditing. Amazon CloudWatch is a service that collects and tracks metrics, collects and monitors log files, and sets alarms. AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. Amazon GuardDuty, AWS Shield, and AWS WAF are AWS services that provide security and protection for AWS resources, but they do not monitor and retain records of account activities. These concepts are explained in the AWS Cloud Practitioner Essentials course3.

• Question 425:

  Which controls are the responsibility of both AWS and AWS customers, according to the AWS shared responsibility model? (Select TWO.)

  A. Physical and environmental controls

  B. Patch management

  C. Configuration management

  D. Account structures

  E. Choice of the AWS Region where data is stored

  Correct Answer: BC

  Patch management and configuration management are controls that are the responsibility of both AWS and AWS customers, according to the AWS shared responsibility model. Patch management is the process of applying updates to software and applications to fix vulnerabilities, bugs, or performance issues. Configuration management is the process of defining and maintaining the settings and parameters of systems and applications to ensure their consistency and reliability. AWS is responsible for patching and configuring the software and services that it manages, such as the AWS global infrastructure, the hypervisor, and the AWS managed services. The customer is responsible for patching and configuring the software and services that they manage, such as the guest operating system, the applications, and the AWS customer-managed services. Physical and environmental controls are the responsibility of AWS, according to the AWS shared responsibility model. Physical and environmental controls are the measures that protect the physical security and availability of the AWS global infrastructure, such as power, cooling, fire suppression, and access control. AWS is responsible for maintaining these controls and ensuring the resilience and reliability of the AWS Cloud. Account structures are the responsibility of the customer, according to the AWS shared responsibility model. Account structures are the ways that customers organize and manage their AWS accounts and resources, such as using AWS Organizations, IAM users and roles, resource tagging, and billing preferences. The customer is responsible for creating and configuring these structures and ensuring the security and governance of their AWS environment. Choice of the AWS Region where data is stored is the responsibility of the customer, according to the AWS shared responsibility model. AWS Regions are geographic areas that consist of multiple isolated Availability Zones. Customers can choose which AWS Region to store their data and run their applications, depending on their latency, compliance, and cost requirements. The customer is responsible for selecting the appropriate AWS Region and ensuring the data sovereignty and regulatory compliance of their data.

• Question 426:

  A company has a single Amazon EC2 instance. The company wants to adopt a highly available architecture.

  What can the company do to meet this requirement?

  A. Scale vertically to a larger EC2 instance size.

  B. Scale horizontally across multiple Availability Zones.

  C. Purchase an EC2 Dedicated Instance.

  D. Change the EC2 instance family to a compute optimized instance.

  Correct Answer: B

  Scaling horizontally across multiple Availability Zones is a way to adopt a highly available architecture, as it increases the fault tolerance and resilience of the application. Scaling vertically to a larger EC2 instance size is a way to improve the performance of the application, but it does not improve the availability. Purchasing an EC2 Dedicated Instance is a way to isolate the instance from other AWS customers, but it does not improve the availability. Changing the EC2 instance family to a compute optimized instance is a way to optimize the instance type for the workload, but it does not improve the availability. These concepts are explained in the AWS Well-Architected Framework2.

• Question 427:

  What is an AWS responsibility under the AWS shared responsibility model?

  A. Configure the security group rules that determine which ports are open on an Amazon EC2 Linux instance.

  B. Ensure the security of the internal network in the AWS data centers.

  C. Patch the guest operating system with the latest security patches on Amazon EC2.

  D. Turn on server-side encryption for Amazon S3 buckets. A company wants to deploy its critical application on AWS and maintain high availability.

  Correct Answer: B

  Under the AWS shared responsibility model, AWS is responsible for ensuring the security of the internal network in the AWS data centers, as well as the physical security of the hardware and facilities that run AWS services. AWS customers are responsible for configuring the security group rules that determine which ports are open on an EC2 Linux instance, patching the guest operating system with the latest security patches on EC2, and turning on server-side encryption for S3 buckets. Source: AWS Shared Responsibility Model

• Question 428:

  A company wants to implement controls (guardrails) in a newly created AWS Control Tower landing zone.

  Which AWS services or features can the company use to create and define these controls (guardrails)? (Select TWO.)

  A. AWS Config

  B. Service control policies (SCPs)

  C. Amazon GuardDuty

  D. AWS Identity and Access Management (IAM)

  E. Security groups

  Correct Answer: AB

  AWS Config and service control policies (SCPs) are AWS services or features that the company can use to create and define controls (guardrails) in a newly created AWS Control Tower landing zone. AWS Config is a service that enables users to assess, audit, and evaluate the configurations of their AWS resources. It can be used to create rules that check for compliance with the desired configurations and report any deviations. AWS Control Tower provides a set of predefined AWS Config rules that can be enabled as guardrails to enforce compliance across the landing zone1. Service control policies (SCPs) are a type of policy that can be used to manage permissions in AWS Organizations. They can be used to restrict the actions that the users and roles in the member accounts can perform on the AWS resources. AWS Control Tower provides a set of predefined SCPs that can be enabled as guardrails to prevent access to certain services or regions across the landing zone2. Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for AWS accounts and resources. It is not a feature that can be used to create and define controls (guardrails) in a landing zone. AWS Identity and Access Management (IAM) is a service that allows users to manage access to AWS resources and services. It can be used to create users, groups, roles, and policies that control who can do what in AWS. It is not a feature that can be used to create and define controls (guardrails) in a landing zone. Security groups are virtual firewalls that control the inbound and outbound traffic for Amazon EC2 instances. They can be used to allow or deny access to an EC2 instance based on the port, protocol, and source or destination. They are not a feature that can be used to create and define controls (guardrails) in a landing zone.

• Question 429:

  Which task is the responsibility of AWS when using AWS services?

  A. Management of IAM user permissions

  B. Creation of security group rules for outbound access

  C. Maintenance of physical and environmental controls

  D. Application of Amazon EC2 operating system patches

  Correct Answer: C

  AWS is responsible for maintaining the physical and environmental controls of the AWS Cloud, such as power, cooling, fire suppression, and physical security1. The customer is responsible for managing the IAM user permissions, creating security group rules for outbound access, applying Amazon EC2 operating system patches, and other aspects of security in the cloud1.

• Question 430:

  A company wants to improve its security and audit posture by limiting Amazon EC2 inbound access.

  According to the AWS shared responsibility model, which task is the responsibility of the customer?

  A. Protect the global infrastructure that runs all of the services offered in the AWS Cloud.

  B. Configure logical access controls for resources, and protect account credentials.

  C. Configure the security used by managed services.

  D. Patch and back up Amazon Aurora.

  Correct Answer: B

  According to the AWS shared responsibility model, the customer is responsible for configuring logical access controls for resources, and protecting account credentials. This includes managing IAM user permissions, security group rules, network ACLs, encryption keys, and other aspects of access management1. AWS is responsible for protecting the global infrastructure that runs all of the services offered in the AWS Cloud, such as the hardware, software, networking, and facilities. AWS is also responsible for configuring the security used by managed services, such as Amazon RDS, Amazon DynamoDB, and Amazon Aurora2.