Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 471:

  A company is running workloads for multiple departments within a single VPC. The company needs to be able to bill each department for its resource usage.

  Which action should the company take to accomplish this goal with the LEAST operational overhead?

  A. Add a department tag to each resource and configure cost allocation tags.

  B. Move each department resource to its own VPC.

  C. Move each department resource to its own AWS account.

  D. Use AWS Organizations to get a billing report for each department.

  Correct Answer: A

  Adding a department tag to each resource and configuring cost allocation tags is an action that can help you accomplish the goal of billing each department for its resource usage with the least operational overhead. Tags are simple labels consisting of a key and an optional value that you can assign to AWS resources. You can use tags to organize your resources and track your AWS costs on a detailed level. Cost allocation tags enable you to track your AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs2. Moving each department resource to its own VPC or its own AWS account is an action that can help you isolate and control the resources for each department, but it would incur more operational overhead than using tags. Using AWS Organizations to get a billing report for each department is an action that can help you consolidate billing and payment across multiple AWS accounts, but it would not help you bill each department for its resource usage within a single VPC.

• Question 472:

  A developer needs to maintain a development environment infrastructure and a production environment infrastructure in a repeatable fashion.

  Which AWS service should the developer use to meet these requirements?

  A. AWS Ground Station

  B. AWS Shield

  C. AWS loT Device Defender

  D. AWS CloudFormation

  Correct Answer: D

  AWS CloudFormation is a service that allows you to model and provision your AWS and third-party application resources in a repeatable and predictable way. You can use AWS CloudFormation to create, update, and delete a collection of resources as a single unit, called a stack. You can also use AWS CloudFormation to manage your development and production environments in a consistent and efficient manner4.

• Question 473:

  A company has developed a distributed application that recovers gracefully from interruptions. The application periodically processes large volumes of data by using multiple Amazon EC2 instances. The application is sometimes idle for months.

  Which EC2 instance purchasing option is MOST cost-effective for this use case?

  A. Reserved Instances

  B. Spot Instances

  C. Dedicated Instances

  D. On-Demand Instances

  Correct Answer: B

  Spot Instances are instances that use spare EC2 capacity that is available for up to 90% off the On-Demand price. Because Spot Instances can be interrupted by EC2 with two minutes of notification when EC2 needs the capacity back, you can use them for applications that have flexible start and end times, or that can withstand interruptions5. This option is most cost-effective for the use case described in the question. Reserved Instances are instances that you purchase for a one-year or three-year term, and pay a lower hourly rate compared to On-Demand Instances. This option is suitable for applications that have steady state or predictable usage. Dedicated Instances are instances that run on hardware that's dedicated to a single customer within an Amazon VPC. This option is suitable for applications that have stringent regulatory or compliance requirements. On-Demand Instances are instances that you pay for by the second, with no long-term commitments or upfront payments. This option is suitable for applications that have unpredictable or intermittent workloads.

• Question 474:

  A company is hosting a web application on Amazon EC2 instances. The company wants to implement custom conditions to filter and control inbound web traffic.

  Which AWS service will meet these requirements?

  A. Amazon GuardDuty

  B. AWS WAF

  C. Amazon Macie

  D. AWS Shield

  Correct Answer: B

  The AWS service that will meet the requirements of the company that is hosting a web application on Amazon EC2 instances and wants to implement custom conditions to filter and control inbound web traffic is AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect availability, compromise security, or consume excessive resources. The company can use AWS WAF to create custom rules that block malicious requests that match certain patterns, such as SQL injection or cross-site scripting. AWS WAF can be applied to web applications that are behind an Application Load Balancer, Amazon CloudFront, or Amazon API Gateway. Amazon GuardDuty, Amazon Macie, and AWS Shield are not the best services to use for this purpose. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior across the AWS accounts and resources. Amazon Macie is a data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3. AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards web applications running on AWS. These services are more useful for detecting and preventing different types of threats and attacks, rather than filtering and controlling inbound web traffic based on custom conditions.

• Question 475:

  Which actions are examples of a company's effort to right size its AWS resources to control cloud costs? (Select TWO.)

  A. Switch from Amazon RDS to Amazon DynamoDB to accommodate NoSQL datasets.

  B. Base the selection of Amazon EC2 instance types on past utilization patterns.

  C. Use Amazon S3 Lifecycle policies to move objects that users access infrequently to lower-cost storage tiers.

  D. Use Multi-AZ deployments for Amazon RDS.

  E. Replace existing Amazon EC2 instances with AWS Elastic Beanstalk.

  Correct Answer: BC

  Basing the selection of Amazon EC2 instance types on past utilization patterns is a way to right size the AWS resources and optimize the performance and cost. Using Amazon S3 Lifecycle policies to move objects that users access infrequently to lower-cost storage tiers is another way to reduce the storage costs and align them with the business value of the data. These two actions are recommended by the AWS Cost Optimization Pillar1. Switching from Amazon RDS to Amazon DynamoDB is not necessarily a cost-saving action, as it depends on the use case and the data model. Using Multi-AZ deployments for Amazon RDS is a way to improve the availability and durability of the database, but it also increases the cost. Replacing existing Amazon EC2 instances with AWS Elastic Beanstalk is a way to simplify the deployment and management of the application, but it does not affect the cost of the underlying EC2 instances.

• Question 476:

  A user discovered that an Amazon EC2 instance is missing an Amazon Elastic Block Store (Amazon EBS) data volume. The user wants to determine when the EBS volume was removed.

  Which AWS service will provide this information?

  A. AWS Config

  B. AWS Trusted Advisor

  C. Amazon Timestream

  D. Amazon QuickSight

  Correct Answer: A

  AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. AWS Config can help you determine when an EBS volume was removed from an EC2 instance by providing a timeline of configuration changes and compliance status. AWS Trusted Advisor, Amazon Timestream, and Amazon QuickSight do not provide the same level of configuration tracking and auditing as AWS Config. Source: AWS Config

• Question 477:

  A company wants to migrate its on-premises application to the AWS Cloud. The company is legally obligated to retain certain data in its onpremises data center.

  Which AWS service or feature will support this requirement?

  A. AWS Wavelength

  B. AWS Local Zones

  C. VMware Cloud on AWS

  D. AWS Outposts

  Correct Answer: D

  AWS Outposts is a fully managed service that extends AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on- premises facility for a truly consistent hybrid experience. AWS Outposts enables you to run AWS services in your on-premises data center, which can support the requirement of retaining certain data on-premises due to legal obligations5.

• Question 478:

  A company is collecting user behavior patterns to identify how to meet goals for sustainability impact.

  Which guidelines are best practices for the company to implement to meet these goals? (Select TWO.)

  A. Scale infrastructure with user load.

  B. Maximize the geographic distance between workloads and user locations.

  C. Eliminate creation and maintenance of unused assets.

  D. Scale resources with excess capacity and remove auto scaling.

  E. Scale infrastructure based on the number of users.

  Correct Answer: AC

  To meet the goals for sustainability impact, the company should follow the best practices of scaling infrastructure with user load and eliminating creation and maintenance of unused assets. Scaling infrastructure with user load means adjusting the capacity of the infrastructure to match the demand of the users, which can reduce the energy consumption and carbon footprint of the system. Eliminating creation and maintenance of unused assets means avoiding the waste of resources and money on assets that are not needed or used, which can also improve the environmental and economic efficiency of the system3.

• Question 479:

  Which of the following is entirely the responsibility of AWS, according to the AWS shared responsibility model?

  A. Security awareness and training

  B. Development of an IAM password policy

  C. Patching of the guest operating system

  D. Physical and environmental controls

  Correct Answer: D

  Physical and environmental controls are entirely the responsibility of AWS, according to the AWS shared responsibility model. The AWS shared responsibility model defines the division of responsibilities between AWS and the customer for security and compliance. AWS is responsible for the security of the cloud, which includes the physical and environmental controls of the AWS global infrastructure, such as power, cooling, fire suppression, and physical access. The customer is responsible for the security in the cloud, which includes the configuration and management of the AWS resources and applications. For more information, see [AWS Shared Responsibility Model] and [AWS Cloud Security].

• Question 480:

  A company needs a repository that stores source code. The company needs a way to update the running software when the code changes.

  Which combination of AWS services will meet these requirements? (Select TWO.)

  A. AWS CodeCommit

  B. AWS CodeDeploy

  C. Amazon DynamoDB

  D. Amazon S3

  E. Amazon Elastic Container Service (Amazon ECS)

  Correct Answer: AB

  A and B are correct because AWS CodeCommit is the AWS service that provides a fully managed source control service that hosts secure Git-based repositories1, and AWS CodeDeploy is the AWS service that automates code deployments to any instance, including Amazon EC2 instances and servers running on-premises2. These two services can be used together to store source code and update the running software when the code changes. C is incorrect because Amazon DynamoDB is the AWS service that provides a fully managed NoSQL database service that supports key-value and document data models3. It is not related to storing source code or updating software. D is incorrect because Amazon S3 is the AWS service that provides object storage through a web service interface4. It can be used to store source code, but it does not provide source control features or update software. E is incorrect because Amazon Elastic Container Service (Amazon ECS) is the AWS service that allows users to run, scale, and secure Docker container applications. It can be used to deploy containerized software, but it does not store source code or update software.