Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 641:

  A newly created IAM user has no IAM policy attached.

  What will happen when the user logs in and attempts to view the AWS resources in the account?

  A. All AWS services will be read-only access by default.

  B. Access to all AWS resources will be denied.

  C. Access to the AWS billing services will be allowed.

  D. Access to AWS resources will be allowed through the AWS CLL

  Correct Answer: B

  Access to all AWS resources will be denied if a newly created IAM user has no IAM policy attached and logs in and attempts to view the AWS resources in the account. IAM policies are the way to grant permissions to IAM users, groups, and roles to access and manage AWS resources. By default, IAM users have no permissions, unless they are explicitly granted by an IAM policy. Therefore, a newly created IAM user without any IAM policy attached will not be able to view or perform any actions on the AWS resources in the account. Access to the AWS billing services and AWS CLI will also be denied, unless the user has the necessary permissions.

• Question 642:

  Which AWS service provides highly durable object storage?

  A. Amazon S3

  B. Amazon Elastic File System (Amazon EFS)

  C. Amazon Elastic Block Store (Amazon EBS)

  D. Amazon FSx

  Correct Answer: A

  Amazon S3 is the AWS service that provides highly durable object storage. Amazon S3 is designed to provide 99.999999999% durability of objects over a given year. This means that you can store your data with high confidence that it will not be lost. Amazon S3 also provides high availability, scalability, security, and performance for your data. You can use Amazon S3 to store and retrieve any amount of data, at any time, from anywhere on the web5.

• Question 643:

  Which AWS service can a company use to perform complex analytical queries?

  A. Amazon RDS

  B. Amazon DynamoDB

  C. Amazon Redshift

  D. Amazon ElastiCache

  Correct Answer: C

  Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud. You can start with just a few hundred gigabytes of data and scale to a petabyte or more. This enables you to use your data to acquire new insights for your business and customers. Amazon Redshift is designed for complex analytical queries that often involve aggregations and joins across very large tables. Amazon Redshift supports standard SQL and integrates with many existing business intelligence tools1.

• Question 644:

  A company is building a serverless architecture that connects application data from multiple data sources. The company needs a solution that does not require additional code.

  Which AWS service meets these requirements?

  A. AWS Lambda

  B. Amazon Simple Queue Service (Amazon SQS)

  C. Amazon CloudWatch

  D. Amazon EventBridge

  Correct Answer: D

  Amazon EventBridge is the service that meets the requirements of building a serverless architecture that connects application data from multiple data sources without requiring additional code. Amazon EventBridge is a serverless event bus service that allows you to easily connect your applications with data from AWS services, SaaS applications, and your own applications. You can use Amazon EventBridge to create rules that match events and route them to targets such as AWS Lambda functions, Amazon SNS topics, Amazon SQS queues, or other AWS services. Amazon EventBridge handles the event ingestion, delivery, security, authorization, and error handling for you34

• Question 645:

  A company hosts an application on an Amazon EC2 instance. The EC2 instance needs to access several AWS resources, including Amazon S3 and Amazon DynamoDB.

  What is the MOST operationally efficient solution to delegate permissions?

  A. Create an IAM role with the required permissions. Attach the role to the EC2 instance.

  B. Create an IAM user and use its access key and secret access key in the application.

  C. Create an IAM user and use its access key and secret access key to create a CLI profile in the EC2 instance.

  D. Create an IAM role with the required permissions. Attach the role to the administrativeIAM user.

  Correct Answer: A

  Creating an IAM role with the required permissions and attaching the role to the EC2 instance is the most operationally efficient solution to delegate permissions. An IAM role is an entity that defines a set of permissions for making AWS service requests. An IAM role can be assumed by an EC2 instance to access other AWS resources, such as Amazon S3 and Amazon DynamoDB, without having to store any credentials on the instance. This solution is more secure and scalable than using IAM users and their access keys. For more information, see [IAM Roles for Amazon EC2] and [Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances].

• Question 646:

  Which AWS service should a cloud practitioner use to receive real-time guidance for provisioning resources, based on AWS best practices related to security, cost optimization, and service limits?

  A. AWS Trusted Advisor

  B. AWS Config

  C. AWS Security Hub

  D. AWS Systems Manager

  Correct Answer: A

  AWS Trusted Advisor is the AWS service that provides real-time guidance for provisioning resources, based on AWS best practices related to security, cost optimization, and service limits. AWS Trusted Advisor inspects the user's AWS environment and provides recommendations for improving performance, security, and reliability, reducing costs, and following best practices. AWS Trusted Advisor also alerts the user when they are approaching or exceeding their service limits, and helps them request limit increases3.

• Question 647:

  Which of the following are benefits that a company receives when it moves an on-premises production workload to AWS? (Select TWO.)

  A. AWS trains the company's staff on the use of all the AWS services.

  B. AWS manages all security in the cloud.

  C. AWS offers free support from technical account managers (TAMs).

  D. AWS offers high availability.

  E. AWS provides economies of scale.

  Correct Answer: DE

  The correct answers are D and E because AWS offers high availability and AWS provides economies of scale are benefits that a company receives when it moves an on-premises production workload to AWS. High availability means that AWS has a global infrastructure that allows customers to deploy their applications and data across multiple regions and availability zones. This increases the fault tolerance and resilience of their applications and reduces the impact of failures. Economies of scale means that AWS can achieve lower variable costs than customers can get on their own. This allows customers to pay only for the resources they use and scale up or down as needed. The other options are incorrect because they are not benefits that a company receives when it moves an on- premises production workload to AWS. AWS trains the company's staff on the use of all the AWS services is not a benefit that a company receives when it moves an on-premises production workload to AWS. AWS does provide various learning resources and training courses for customers, but it does not train the company's staff on the use of all the AWS services. AWS manages all security in the cloud is not a benefit that a company receives when it moves an on-premises production workload to AWS. AWS is responsible for the security of the cloud, but the customer is responsible for the security in the cloud. AWS offers free support from technical account managers (TAMs) is not a benefit that a company receives when it moves an on-premises production workload to AWS. AWS does offer support from TAMs, but only for customers who have the AWS Enterprise Support plan, which is not free. Reference: What is Cloud Computing?, [AWS Shared Responsibility Model], [AWS Support Plans]

• Question 648:

  Which factors affect costs in the AWS Cloud? (Select TWO.)

  A. The number of unused AWS Lambda functions

  B. The number of configured Amazon S3 buckets

  C. Inbound data transfers without acceleration

  D. Outbound data transfers without acceleration

  E. Compute resources that are currently in use

  Correct Answer: DE

  Outbound data transfers without acceleration and compute resources that are currently in use are the factors that affect costs in the AWS Cloud. Outbound data transfers without acceleration refer to the amount of data that is transferred from AWS to the internet, without using any service that can optimize the speed and cost of the data transfer, such as AWS Global Accelerator or Amazon CloudFront. Outbound data transfers are charged at different rates depending on the source and destination AWS Regions, and the volume of data transferred. Compute resources that are currently in use refer to the AWS services and resources that provide computing capacity, such as Amazon EC2 instances, AWS Lambda functions, or Amazon ECS tasks. Compute resources are charged based on the type, size, and configuration of the resources, and the duration and frequency of their usage.

• Question 649:

  A company is designing a web application that will run on Amazon EC2 instances.

  Which AWS services and features will improve availability and reduce the impact of failures for this application? (Select TWO.)

  A. Amazon EC2 Auto Scaling for the EC2 instances

  B. VPC subnet ACLs to check the health of a service

  C. Resources that are distributed across multiple Availability Zones

  D. Configuration of AWS Server Migration Service (AWS SMS) to move the EC2 instances to a different AWS Region

  E. Resources that are distributed across multiple AWS points of presence

  Correct Answer: AC

  The correct answers are A and C because Amazon EC2 Auto Scaling and resources that are distributed across multiple Availability Zones are AWS services and features that will improve availability and reduce the impact of failures for the web application. Amazon EC2 Auto Scaling is a service that enables users to automatically adjust the number of Amazon EC2 instances in response to changes in demand or performance. Amazon EC2 Auto Scaling helps users to maintain optimal availability and performance of their applications by adding or removing instances as needed. Resources that are distributed across multiple Availability Zones are AWS features that enable users to increase the fault tolerance and resilience of their applications. Availability Zones are isolated locations within an AWS Region that have independent power, cooling, and networking. Users can launch their resources, such as Amazon EC2 instances, in multiple Availability Zones to protect their applications from the failure of a single location. The other options are incorrect because they are not AWS services and features that will improve availability and reduce the impact of failures for the web application. VPC subnet ACLs are AWS features that enable users to control the inbound and outbound traffic to and from their subnets within a VPC. VPC subnet ACLs do not check the health of a service, but rather filter the network traffic based on rules. Configuration of AWS Server Migration Service (AWS SMS) is an AWS service that enables users to migrate their on-premises servers to AWS. Configuration of AWS SMS does not help to move the Amazon EC2 instances to a different AWS Region, but rather to migrate the servers from the source environment to AWS. Resources that are distributed across multiple AWS points of presence are AWS features that enable users to deliver content to their end users with low latency and high performance. AWS points of presence are edge locations that are part of the AWS Global Infrastructure. Users can use services such as Amazon CloudFront and AWS Global Accelerator to distribute their content across multiple AWS points of presence. Reference: Amazon EC2 Auto Scaling, [Regions, Availability Zones, and Local Zones]

• Question 650:

  Which AWS service gives users the ability to provision a dedicated and private network connection from their internal network to AWS?

  A. AWS CloudHSM

  B. AWS Direct Connect

  C. AWS VPN

  D. Amazon Connect

  Correct Answer: B

  AWS Direct Connect gives users the ability to provision a dedicated and private network connection from their internal network to AWS. AWS Direct Connect links the user's internal network to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to the user's router, the other to an AWS Direct Connect router. With this connection in place, the user can create virtual interfaces directly to the AWS cloud and Amazon Virtual Private Cloud (Amazon VPC), bypassing internet service providers in the network path2.