Amazon CLF-C02 Online Practice Questions and Exam Preparation

Amazon CLF-C02 Online Questions & Answers

• Question 851:

  A company must archive Amazon S3 data that the company's business units no longer need to access.

  Which S3 storage class will meet this requirement MOST cost-effectively?

  A. S3 Glacier Instant Retrieval
  B. S3 Glacier Flexible Retrieval
  C. S3 Glacier Deep Archive
  D. S3 One Zone-Infrequent Access (S3 One Zone-IA)
  C. S3 Glacier Deep Archive

  ---

  Explanation

  S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice in a year. It is designed for customers -- particularly those in highly-regulated industries, such as the Financial Services, Healthcare, and Public Sectors -- that retain data sets for 7-10 years or longer to meet regulatory compliance requirements. Customers can store large amounts of data at a very low cost, and reliably access it with a wait time of 12 hours.

• Question 852:

  A company needs an AWS service that will continuously monitor the company's AWS account for suspicious activity. The service must have the ability to initiate automated actions against threats that are identified in the security findings. Which service will meet these requirements?

  A. AWS Trusted Advisor
  B. Amazon Detective
  C. Amazon Inspector
  D. Amazon GuardDuty
  D. Amazon GuardDuty

  ---

  Explanation

  Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. https://aws.amazon.com/guardduty/

• Question 853:

  What should a user do if the user loses an IAM secret access key?

  A. Retrieve the secret access key by using the IAM console.
  B. Create a new user with a new access key and a new secret access key.
  C. Rotate the secret access key.
  D. Request a new secret access key from AWS Support.
  A. Retrieve the secret access key by using the IAM console.

  ---

  Explanation

• Question 854:

  A company wants to run a simulation for 3 years without interruptions.

  Which Amazon EC2 instance purchasing option will meet these requirements MOST cost-effectively?

  A. Spot Instances
  B. Reserved Instances
  C. Dedicated Hosts
  D. On-Demand Instances
  B. Reserved Instances

  ---

  Explanation

• Question 855:

  A company needs to continuously monitor its environment to analyze network and account activity and identify potential security threats.

  Which AWS service should the company use to meet these requirements?

  A. AWS Artifact
  B. Amazon Macie
  C. AWS Identity and Access Management (IAM)
  D. Amazon GuardDuty
  D. Amazon GuardDuty

  ---

  Explanation

  Amazon GuardDuty is a service that provides intelligent threat detection and continuous monitoring for the AWS environment. It analyzes network and account activity using machine learning and threat intelligence to identify potential security threats, such as unauthorized access, compromised credentials, malicious hosts, and reconnaissance activities. It also generates detailed and actionable findings that can be viewed on the AWS Management Console or sent to other AWS services, such as Amazon CloudWatch Events and AWS Lambda, for further analysis or remediation. Amazon GuardDuty OverviewAWS Certified Cloud Practitioner - aws.amazon.com

• Question 856:

  A company's system administrator discovers that someone logged in to the company's AWS account during the weekend and terminated an Amazon EC2 instance.

  Which AWS service should the system administrator use to identify who made this change?

  A. Amazon Inspector
  B. Amazon Pinpoint
  C. AWS CloudTrail
  D. AWS Trusted Advisor
  C. AWS CloudTrail

  ---

  Explanation

• Question 857:

  A company needs to set up user authentication for a new application. Users must be able to sign in directly with a user name and password, or through a third-party provider.

  Which AWS service should the company use to meet these requirements?

  A. AWS IAM Identity Center (AWS Single Sign-On)
  B. AWS Signer
  C. Amazon Cognito
  D. AWS Directory Service
  C. Amazon Cognito

  ---

  Explanation

  Amazon Cognito is a service that provides user authentication and authorization for web and mobile applications. You can use Amazon Cognito to enable users to sign in directly with a user name and password, or through a third-party provider, such as Facebook, Google, or Amazon. You can also use Amazon Cognito to manage user profiles, preferences, and security settings

• Question 858:

  A company acquired another corporation. The company now has two AWS accounts.

  Which AWS service or tool can the company use to consolidate the billing for these two accounts?

  A. AWS Systems Manager
  B. AWS Organizations
  C. AWS License Manager
  D. Cost Explorer
  B. AWS Organizations

  ---

  Explanation

• Question 859:

  Which AWS services and features are provided to all customers at no charge? (Select TWO.)

  A. Amazon Aurora
  B. VPC
  C. Amazon SageMaker
  D. AWS Identity and Access Management (IAM)
  E. Amazon Polly
  B. VPC
  D. AWS Identity and Access Management (IAM)

  ---

  Explanation

  The AWS services and features that are provided to all customers at no charge are VPC and AWS Identity and Access Management (IAM). VPC is a service that allows you to launch AWS resources in a logically isolated virtual network that you define. You can create and use a VPC at no additional charge, and you only pay for the resources that you launch in the VPC, such as EC2 instances or EBS volumes. IAM is a service that allows you to manage access and permissions to AWS resources. You can create and use IAM users, groups, roles, and policies at no additional charge, and you only pay for the AWS resources that the IAM entities access. Amazon Aurora, Amazon SageMaker, and Amazon Polly are not free services, and they charge based on the usage and features that you choose5

• Question 860:

  A company wants to ensure that two Amazon EC2 instances are in separate data centers with minimal communication latency between the data centers.

  How can the company meet this requirement?

  A. Place the EC2 instances in two separate AWS Regions connected with a VPC peering connection.
  B. Place the EC2 instances in two separate Availability Zones within the same AWS Region.
  C. Place one EC2 instance on premises and the other in an AWS Region. Then connect them by using an AWS VPN connection.
  D. Place both EC2 instances in a placement group for dedicated bandwidth.
  B. Place the EC2 instances in two separate Availability Zones within the same AWS Region.

  ---

  Explanation

  The correct answer is B because placing the EC2 instances in two separate Availability Zones within the same AWS Region is the best way to meet the requirement. Availability Zones are isolated locations within an AWS Region that have independent power, cooling, and networking. Users can launch their resources, such as Amazon EC2 instances, in multiple Availability Zones to increase the fault tolerance and resilience of their applications. Availability Zones within the same AWS Region are connected with low- latency, high-throughput, and highly redundant networking. The other options are incorrect because they are not the best ways to meet the requirement. Placing the EC2 instances in two separate AWS Regions connected with a VPC peering connection is not the best way to meet the requirement because AWS Regions are geographically dispersed and may have higher communication latency between them than Availability Zones within the same AWS Region. VPC peering connection is a networking connection between two VPCs that enables users to route traffic between them using private IP addresses. Placing one EC2 instance on premises and the other in an AWS Region, and then connecting them by using an AWS VPN connection is not the best way to meet the requirement because on-premises and AWS Region are geographically dispersed and may have higher communication latency between them than Availability Zones within the same AWS Region. AWS VPN connection is a secure and encrypted connection between a user's network and their VPC. Placing both EC2 instances in a placement group for dedicated bandwidth is not the best way to meet the requirement because a placement group is a logical grouping of instances within a single Availability Zone that enables users to launch instances with specific performance characteristics. A placement group does not ensure that the instances are in separate data centers, and it does not provide low-latency communication between instances in different Availability Zones.

  [Regions, Availability Zones, and Local Zones], [VPC Peering], [AWS VPN], [Placement Groups]