Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 721:

  A company is building an application on AWS. The application needs to comply with credit card regulatory requirements. The company needs proof that the AWS services and deployment are in compliance.

  Which actions should the company take to meet these requirements? (Select TWO.)

  A. Use Amazon Inspector to submit the application for certification.
  B. Ensure that the application's underlying hardware components comply with requirements.
  C. Use AWS Artifact to access AWS documents about the compliance of the services.
  D. Get the compliance of the application certified by a company assessor.
  E. Use AWS Security Hub to certify the compliance of the application.
  C. Use AWS Artifact to access AWS documents about the compliance of the services.
  D. Get the compliance of the application certified by a company assessor.

  ---

  Explanation

  Using AWS Artifact to access AWS documents about the compliance of the services, and getting the compliance of the application certified by a company assessor are actions that the company should take to meet the requirements of complying with credit card regulatory requirements. AWS Artifact is a service that provides on-demand access to AWS security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. AWS Artifact can help you demonstrate compliance with credit card regulatory requirements by providing you with proof that the AWS services and deployment are in compliance. Getting the compliance of the application certified by a company assessor is an action that the company should take to ensure that the application meets the specific requirements of the credit card industry. A company assessor is an independent third-party entity that is qualified to assess the compliance of the application with the relevant standards and regulations. Using Amazon Inspector to submit the application for certification is not an action that the company should take, because Amazon Inspector is a service that helps you improve the security and compliance of your applications deployed on AWS by automatically assessing them for vulnerabilities and deviations from best practices, but it does not provide certification for the applications. Ensuring that the application's underlying hardware components comply with requirements is not an action that the company should take, because the application is deployed on AWS, and AWS is responsible for the security and compliance of the underlying hardware components. This is part of the shared responsibility model, where AWS is responsible for security of the cloud, and customers are responsible for security in the cloud. Using AWS Security Hub to certify the compliance of the application is not an action that the company should take, because AWS Security Hub is a service that gives you a comprehensive view of your security posture across your AWS accounts and helps you check your environment against security industry standards and best practices, but it does not provide certification for the applications.

• Question 722:

  Which of the following is an architectural design principle of the AWS Well-Architected Framework?

  A. Loosely couple components
  B. Build monolithic systems
  C. Scale vertically, not horizontally
  D. Use third-party software
  A. Loosely couple components

  ---

  Explanation

• Question 723:

  Which actions are examples of a company's effort to right size its AWS resources to control cloud costs? (Select TWO.)

  A. Switch from Amazon RDS to Amazon DynamoDB to accommodate NoSQL datasets.
  B. Base the selection of Amazon EC2 instance types on past utilization patterns.
  C. Use Amazon S3 Lifecycle policies to move objects that users access infrequently to lower-cost storage tiers.
  D. Use Multi-AZ deployments for Amazon RDS.
  E. Replace existing Amazon EC2 instances with AWS Elastic Beanstalk.
  B. Base the selection of Amazon EC2 instance types on past utilization patterns.
  C. Use Amazon S3 Lifecycle policies to move objects that users access infrequently to lower-cost storage tiers.

  ---

  Explanation

  Basing the selection of Amazon EC2 instance types on past utilization patterns is a way to right size the AWS resources and optimize the performance and cost. Using Amazon S3 Lifecycle policies to move objects that users access infrequently to lower-cost storage tiers is another way to reduce the storage costs and align them with the business value of the data. These two actions are recommended by the AWS Cost Optimization Pillar1. Switching from Amazon RDS to Amazon DynamoDB is not necessarily a cost-saving action, as it depends on the use case and the data model. Using Multi-AZ deployments for Amazon RDS is a way to improve the availability and durability of the database, but it also increases the cost. Replacing existing Amazon EC2 instances with AWS Elastic Beanstalk is a way to simplify the deployment and management of the application, but it does not affect the cost of the underlying EC2 instances.

• Question 724:

  A user wants to allow applications running on an Amazon EC2 instance to make calls to other AWS services. The access granted must be secure.

  Which AWS service or feature should be used?

  A. Security groups
  B. AWS Firewall Manager
  C. IAM roles
  D. IAM user SSH keys
  C. IAM roles

  ---

  Explanation

  IAM roles are a secure way to grant permissions to applications running on an Amazon EC2 instance to make calls to other AWS services. IAM roles are entities that have specific permissions policies attached to them. You can create an IAM role and associate it with an EC2 instance when you launch it or later. The applications on the instance can then use the temporary credentials provided by the role to access AWS resources that the role allows. This way, you do not have to store any long-term credentials or access keys on the instance, which reduces the risk of compromise or misuse. The other options are not correct, because: Security groups are virtual firewalls that control the inbound and outbound traffic for your EC2 instances. Security groups do not grant permissions to access other AWS services, but rather filter the network traffic based on rules that you define. AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources. AWS Firewall Manager works with AWS WAF, AWS Shield Advanced, and Amazon VPC security groups. AWS Firewall Manager does not grant permissions to access other AWS services, but rather helps you enforce consistent security policies across your AWS infrastructure. IAM user SSH keys are credentials that allow you to connect to your EC2 instance using SSH. SSH keys do not grant permissions to access other AWS services, but rather authenticate your identity when you log in to your instance.

  References: Using an IAM role to grant permissions to applications running on Amazon EC2 instances - AWS Identity and Access Management IAM roles for Amazon EC2 - Amazon Elastic Compute Cloud Security groups for your VPC - Amazon Virtual Private Cloud What is AWS Firewall Manager? - AWS Firewall Manager Connecting to your Linux instance using SSH - Amazon Elastic Compute Cloud

• Question 725:

  A company wants to maintain bandwidth throughput and provide a more consistent network experience than public internet-based connections.

  Which AWS service should the company choose?

  A. AWS VPN
  B. AWS Direct Connect
  C. Amazon Connect
  D. Amazon CloudFront
  B. AWS Direct Connect

  ---

  Explanation

• Question 726:

  Which statements represent the cost-effectiveness of the AWS Cloud? (Select TWO.)

  A. Users can trade fixed expenses for variable expenses.
  B. Users can deploy all over the world in minutes.
  C. AWS offers increased speed and agility.
  D. AWS is responsible for patching the infrastructure.
  E. Users benefit from economies of scale.
  A. Users can trade fixed expenses for variable expenses.
  E. Users benefit from economies of scale.

  ---

  Explanation

  The statements that represent the cost-effectiveness of the AWS Cloud are: Users can trade fixed expenses for variable expenses. By using the AWS Cloud, users can pay only for the resources they use, instead of investing in fixed and upfront costs for hardware and software. This can lower the total cost of ownership and increase the return on investment. Users benefit from economies of scale. By using the AWS Cloud, users can leverage the massive scale and efficiency of AWS to access lower prices and higher performance. AWS passes the cost savings to the users through price reductions and innovations. AWS Cloud Value Framework

• Question 727:

  A company implements an Amazon EC2 Auto Scaling policy along with an Application Load Balancer to automatically recover unhealthy applications that run on Amazon EC2 instances. Which pillar of the AWS Well-Architected Framework does this action cover?

  A. Security
  B. Performance efficiency
  C. Operational excellence
  D. Reliability
  D. Reliability

  ---

  Explanation

  The reliability pillar includes the ability of a system to recover from infrastructure or service disruptions

• Question 728:

  A company wants to create a set of custom dashboards to collect metrics to monitor its applications.

  Which AWS service will meet these requirements?

  A. Amazon CloudWatch
  B. AWS X-Ray
  C. AWS Systems Manager
  D. AWS CloudTrail
  A. Amazon CloudWatch

  ---

  Explanation

  Amazon CloudWatch is a service that provides monitoring and observability for AWS resources and applications. Users can create custom dashboards to collect and visualize metrics, logs, alarms, and events from different sources5. AWS X-Ray is a service that provides distributed tracing and analysis for applications. AWS Systems Manager is a service that provides operational management for AWS resources and applications. AWS CloudTrail is a service that provides governance, compliance, and auditing for AWS account activity.

• Question 729:

  Which AWS service supports MySQL database engines?

  A. Amazon Dynamo D
  B. Amazon RDS
  C. Amazon DocumentDB (with MongoDB compatibility)
  D. Amazon ElastiCache
  B. Amazon RDS

  ---

  Explanation

• Question 730:

  Which AWS service or feature can be used to monitor for potential disk write spikes on a system that is running on Amazon EC2?

  A. AWS CloudTrail
  B. AWS Health Dashboard
  C. AWS Trusted Advisor
  D. Amazon CloudWatch
  D. Amazon CloudWatch

  ---

  Explanation