Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 531:

  Which AWS service or tool helps to centrally manage billing and allow controlled access to resources across AWS accounts?

  A. AWS Identity and Access Management (IAM)

  B. AWS Organizations

  C. AWS Cost Explorer

  D. AWS Budgets

  Correct Answer: B

  AWS Organizations helps to centrally manage billing and allow controlled access to resources across AWS accounts. AWS Organizations is a service that enables the user to consolidate multiple AWS accounts into an organization that can be managed as a single unit. AWS Organizations allows the user to create groups of accounts and apply policies to them, such as service control policies (SCPs) that specify the services and actions that users and roles can access in the accounts. AWS Organizations also enables the user to use consolidated billing, which combines the usage and charges from all the accounts in the organization into a single bill.

• Question 532:

  A user wants to identify any security group that is allowing unrestricted incoming SSH traffic.

  Which AWS service can be used to accomplish this goal?

  A. Amazon Cognito

  B. AWS Shield

  C. Amazon Macie

  D. AWS Trusted Advisor

  Correct Answer: D

  The correct answer to the question is D because AWS Trusted Advisor is an AWS service that can be used to accomplish the goal of identifying any security group that is allowing unrestricted incoming SSH traffic. AWS Trusted Advisor is a service that provides customers with recommendations that help them follow AWS best practices. Trusted Advisor evaluates the customer's AWS environment and identifies ways to optimize their AWS infrastructure, improve security and performance, reduce costs, and monitor service quotas. One of the checks that Trusted Advisor performs is the Security Groups - Specific Ports Unrestricted check, which flags security groups that allow unrestricted access to specific ports, such as port 22 for SSH. Customers can use this check to review and modify their security group rules to restrict SSH access to only authorized sources. Reference: Security Groups - Specific Ports Unrestricted

• Question 533:

  Which AWS services and features are provided to all customers at no charge? (Select TWO.)

  A. Amazon Aurora

  B. VPC

  C. Amazon SageMaker

  D. AWS Identity and Access Management (IAM)

  E. Amazon Polly

  Correct Answer: BD

  The AWS services and features that are provided to all customers at no charge are VPC and AWS Identity and Access Management (IAM). VPC is a service that allows you to launch AWS resources in a logically isolated virtual network that you define. You can create and use a VPC at no additional charge, and you only pay for the resources that you launch in the VPC, such as EC2 instances or EBS volumes. IAM is a service that allows you to manage access and permissions to AWS resources. You can create and use IAM users, groups, roles, and policies at no additional charge, and you only pay for the AWS resources that the IAM entities access. Amazon Aurora, Amazon SageMaker, and Amazon Polly are not free services, and they charge based on the usage and features that you choose5

• Question 534:

  A company deploys its application to multiple AWS Regions and configures automatic failover between those Regions.

  Which cloud concept does this architecture represent?

  A. Security

  B. Reliability

  C. Scalability

  D. Cost optimization

  Correct Answer: B

  Reliability is the cloud concept that this architecture represents. Reliability is the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. Deploying an application to multiple AWS Regions and configuring automatic failover between those Regions enhances the reliability of the application by reducing the impact of regional failures and increasing the availability of the application4

• Question 535:

  A company needs to use dashboards and charts to analyze insights from business data.

  Which AWS service will provide the dashboards and charts for these insights?

  A. Amazon Macie

  B. Amazon Aurora

  C. Amazon QuickSight

  D. AWS CloudTrail

  Correct Answer: C

  The correct answer is C because Amazon QuickSight is an AWS service that will provide the dashboards and charts for the insights from business data. Amazon QuickSight is a fully managed, scalable, and serverless business intelligence service that enables users to create and share interactive dashboards and charts. Amazon QuickSight can connect to various data sources, such as Amazon S3, Amazon RDS, Amazon Redshift, and more. Amazon QuickSight also provides users with machine learning insights, such as anomaly detection, forecasting, and natural language narratives. The other options are incorrect because they are not AWS services that will provide the dashboards and charts for the insights from business data. Amazon Macie is an AWS service that helps users discover, classify, and protect sensitive data stored in Amazon S3. Amazon Aurora is an AWS service that provides a relational database that is compatible with MySQL and PostgreSQL. AWS CloudTrail is an AWS service that enables users to track user activity and API usage across their AWS account. Reference: Amazon QuickSight FAQs

• Question 536:

  A company uses Amazon Aurora as its database service. The company wants to encrypt its databases and database backups.

  Which party manages the encryption of the database clusters and database snapshots, according to the AWS shared responsibility model?

  A. AWS

  B. The company

  C. AWS Marketplace partners

  D. Third-party partners

  Correct Answer: A

  AWS manages the encryption of the database clusters and database snapshots for Amazon Aurora, as well as the encryption keys. This is part of the AWS shared responsibility model, where AWS is responsible for the security of the cloud, and the customer is responsible for the security in the cloud. Encryption is one of the security features that AWS provides to protect the data at rest and in transit. For more information, see Amazon Aurora FAQs and AWS Shared Responsibility Model.

• Question 537:

  A company needs to use standard SQL to query and combine exabytes of structured and semi-structured data across a data warehouse, operational database, and data lake.

  Which AWS service meets these requirements?

  A. Amazon DynamoDB

  B. Amazon Aurora

  C. Amazon Athena

  D. Amazon Redshift

  Correct Answer: D

  Amazon Redshift is the service that meets the requirements of using standard SQL to query and combine exabytes of structured and semi-structured data across a data warehouse, operational database, and data lake. Amazon Redshift is a fully managed, petabyte-scale data warehouse service that allows you to run complex analytic queries using standard SQL and your existing business intelligence tools. Amazon Redshift also supports Redshift Spectrum, a feature that allows you to directly query and join data stored in Amazon S3 using the same SQL syntax. Amazon Redshift can scale up or down to handle any volume of data and deliver fast query performance5

• Question 538:

  What are some advantages of using Amazon EC2 instances lo host applications in the AWS Cloud instead of on premises? (Select TWO.)

  A. EC2 includes operating system patch management

  B. EC2 integrates with Amazon VPC. AWS CloudTrail, and AWS Identity and Access Management (IAM)

  C. EC2 has a 100% service level agreement (SLA).

  D. EC2 has a flexible, pay-as-you-go pricing model.

  E. EC2 has automatic storage cost optimization.

  Correct Answer: BD

  Some of the advantages of using Amazon EC2 instances to host applications in the AWS Cloud instead of on premises are:

  EC2 integrates with Amazon VPC, AWS CloudTrail, and AWS Identity and Access Management (IAM). Amazon VPC lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network

  that you define. AWS CloudTrail enables governance, compliance, operational auditing, and risk auditing of your AWS account. AWS IAM enables you to manage access to AWS services and resources securely. Therefore, the correct

  answer is B. You can learn more about Amazon EC2 and its integration with other AWS services from this page.

  EC2 has a flexible, pay-as-you-go pricing model. You only pay for the compute capacity you use, and you can scale up and down as needed. You can also choose from different pricing options, such as On-Demand, Savings Plans, Reserved

  Instances, and Spot Instances, to optimize your costs. Therefore, the correct answer is D. You can learn more about Amazon EC2 pricing from this page.

  The other options are incorrect because:

  EC2 does not include operating system patch management. You are responsible for managing and maintaining your own operating systems on EC2 instances. You can use AWS Systems Manager to automate common maintenance tasks,

  such as applying patches, or use Amazon EC2 Image Builder to create and maintain secure images. Therefore, the incorrect answer is A. EC2 does not have a 100% service level agreement (SLA). The EC2 SLA guarantees 99.99%

  availability for each EC2 Region, not for each individual instance. Therefore, the incorrect answer is C.

  EC2 does not have automatic storage cost optimization. You are responsible for choosing the right storage option for your EC2 instances, such as Amazon Elastic Block Store (EBS) or Amazon Elastic File System (EFS), and monitoring and

  optimizing your storage costs. You can use AWS Cost Explorer or AWS Trusted Advisor to analyze and reduce your storage spending. Therefore, the incorrect answer is E.

• Question 539:

  A company wants to use the AWS Cloud as an offsite backup location for its on-premises infrastructure.

  Which AWS service will meet this requirement MOST cost-effectively?

  A. Amazon S3

  B. Amazon Elastic File System (Amazon EFS)

  C. Amazon FSx

  D. Amazon Elastic Block Store (Amazon EBS)

  Correct Answer: A

  Amazon S3 is the most cost-effective service for storing offsite backups of on-premises infrastructure. Amazon S3 offers low-cost, durable, and scalable storage that can be accessed from anywhere over the internet. Amazon S3 also supports lifecycle policies, versioning, encryption, and cross-region replication to optimize the backup and recovery process. Amazon EFS, Amazon FSx, and Amazon EBS are more suitable for storing data that requires high performance, low latency, and frequent access12

• Question 540:

  A company needs to run code in response to an event notification that occurs when objects are uploaded to an Amazon S3 bucket.

  Which AWS service will integrate directly with the event notification?

  A. AWS Lambda

  B. Amazon EC2

  C. Amazon Elastic Container Registry (Amazon ECR)

  D. AWS Elastic Beanstalk

  Correct Answer: A

  AWS Lambda is a service that lets you run code without provisioning or managing servers. You can use Lambda to process event notifications from Amazon S3 when objects are uploaded or deleted. Lambda integrates directly with the event notification and invokes your code automatically. Therefore, the correct answer is A.