Practice Free CLF-C02 Exam Online Questions
Question #161
Which complimentary AWS service or tool creates data-driven business cases for cloud planning?
- A . Migration Evaluator
- B . AWS Billing Conductor
- C . AWS Billing Console
- D . Amazon Forecast
Correct Answer: A
A
Explanation:
Migration Evaluator is a cloud-based service that provides organizations with a comprehensive assessment of their current IT environment and estimates the cost savings and performance improvements that can be achieved by migrating to AWS. Migration Evaluator helps users build a data-driven business case for AWS by discovering over-provisioned on-premises instances, providing recommendations for cost-effective AWS alternatives, and analyzing existing licenses and cost comparisons of Bring Your Own License (BYOL) and License Included (LI) options
A
Explanation:
Migration Evaluator is a cloud-based service that provides organizations with a comprehensive assessment of their current IT environment and estimates the cost savings and performance improvements that can be achieved by migrating to AWS. Migration Evaluator helps users build a data-driven business case for AWS by discovering over-provisioned on-premises instances, providing recommendations for cost-effective AWS alternatives, and analyzing existing licenses and cost comparisons of Bring Your Own License (BYOL) and License Included (LI) options
57 1. Which option is a customer responsibility when using Amazon DynamoDB under the AWS Shared Responsibility Model?
Question #162
Which of the following is entirely the responsibility of AWS, according to the AWS shared responsibility model?
- A . Security awareness and training
- B . Development of an IAM password policy
- C . Patching of the guest operating system
- D . Physical and environmental controls
Correct Answer: D
D
Explanation:
Physical and environmental controls are entirely the responsibility of AWS, according to the AWS shared responsibility model. The AWS shared responsibility model defines the division of responsibilities between AWS and the customer for security and compliance. AWS is responsible for the security of the cloud, which includes the physical and environmental controls of the AWS global infrastructure, such as power, cooling, fire suppression, and physical access. The customer is responsible for the security in the cloud, which includes the configuration and management of the AWS resources and applications. For more information, see [AWS Shared Responsibility Model] and [AWS Cloud Security].
D
Explanation:
Physical and environmental controls are entirely the responsibility of AWS, according to the AWS shared responsibility model. The AWS shared responsibility model defines the division of responsibilities between AWS and the customer for security and compliance. AWS is responsible for the security of the cloud, which includes the physical and environmental controls of the AWS global infrastructure, such as power, cooling, fire suppression, and physical access. The customer is responsible for the security in the cloud, which includes the configuration and management of the AWS resources and applications. For more information, see [AWS Shared Responsibility Model] and [AWS Cloud Security].
Question #163
Which feature of the AWS Cloud gives users the ability to pay based on current needs rather than forecasted needs?
- A . AWS Budgets
- B . Pay-as-you-go pricing
- C . Volume discounts
- D . Savings Plans
Correct Answer: B
B
Explanation:
Pay-as-you-go pricing is the feature of the AWS Cloud that gives users the ability to pay based on current needs rather than forecasted needs. Pay-as-you-go pricing means that users only pay for the AWS services and resources they use, without any upfront or long-term commitments. This allows users to scale up or down their usage depending on their changing business requirements, and avoid paying for idle or unused capacity. Pay-as-you-go pricing also enables users to benefit from the economies of scale and lower costs of AWS as they grow their business5
B
Explanation:
Pay-as-you-go pricing is the feature of the AWS Cloud that gives users the ability to pay based on current needs rather than forecasted needs. Pay-as-you-go pricing means that users only pay for the AWS services and resources they use, without any upfront or long-term commitments. This allows users to scale up or down their usage depending on their changing business requirements, and avoid paying for idle or unused capacity. Pay-as-you-go pricing also enables users to benefit from the economies of scale and lower costs of AWS as they grow their business5
Question #164
Which AWS service or tool can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet?
- A . Security group
- B . AWS WAF
- C . AWS Firewall Manager
- D . Network ACL
Correct Answer: D
D
Explanation:
A network ACL (NACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You can create a network ACL and associate it with a subnet to apply rules that allow or deny traffic to or from the subnet. Network ACLs are stateless, meaning that they evaluate the source and destination IP addresses for both inbound and outbound traffic. You can also use network ACLs to block IP address ranges that are known to be malicious12.
The other options are not AWS services or tools that can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet. Security groups are another layer of security for your VPC that act as a firewall for your EC2 instances. Security groups are stateful, meaning that they automatically allow return traffic for allowed inbound traffic. Security groups can only filter traffic based on protocols, ports, and source or destination IP addresses, not on IP ranges3. AWS WAF is a web application firewall that helps protect your web applications from common web exploits. AWS WAF can filter web requests based on rules that you define, such as IP addresses, HTTP headers, HTTP body, or URI strings. AWS WAF does not apply to non-web traffic or to traffic within a VPC4. AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources in AWS Organizations. You can use Firewall Manager to apply AWS WAF rules, AWS Network Firewall policies, and Amazon VPC security groups across your AWS accounts. AWS Firewall Manager does not provide a firewall service itself, but rather helps you manage other firewall services
D
Explanation:
A network ACL (NACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You can create a network ACL and associate it with a subnet to apply rules that allow or deny traffic to or from the subnet. Network ACLs are stateless, meaning that they evaluate the source and destination IP addresses for both inbound and outbound traffic. You can also use network ACLs to block IP address ranges that are known to be malicious12.
The other options are not AWS services or tools that can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet. Security groups are another layer of security for your VPC that act as a firewall for your EC2 instances. Security groups are stateful, meaning that they automatically allow return traffic for allowed inbound traffic. Security groups can only filter traffic based on protocols, ports, and source or destination IP addresses, not on IP ranges3. AWS WAF is a web application firewall that helps protect your web applications from common web exploits. AWS WAF can filter web requests based on rules that you define, such as IP addresses, HTTP headers, HTTP body, or URI strings. AWS WAF does not apply to non-web traffic or to traffic within a VPC4. AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources in AWS Organizations. You can use Firewall Manager to apply AWS WAF rules, AWS Network Firewall policies, and Amazon VPC security groups across your AWS accounts. AWS Firewall Manager does not provide a firewall service itself, but rather helps you manage other firewall services
Question #165
A company deploys its application to multiple AWS Regions and configures automatic failover between those Regions.
Which cloud concept does this architecture represent?
- A . Security
- B . Reliability
- C . Scalability
- D . Cost optimization
Correct Answer: B
B
Explanation:
Reliability is the cloud concept that this architecture represents. Reliability is the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. Deploying an application to multiple AWS Regions and configuring automatic failover between those Regions enhances the reliability of the application by reducing the impact of regional failures and increasing the availability of the application4
B
Explanation:
Reliability is the cloud concept that this architecture represents. Reliability is the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. Deploying an application to multiple AWS Regions and configuring automatic failover between those Regions enhances the reliability of the application by reducing the impact of regional failures and increasing the availability of the application4
Question #166
Which AWS service or feature identifies whether an Amazon S3 bucket or an IAM role has been shared with an external entity?
- A . AWS Service Catalog
- B . AWS Systems Manager
- C . AWS IAM Access Analyzer
- D . AWS Organizations
Correct Answer: C
C
Explanation:
AWS IAM Access Analyzer is a service that helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, IAM Access Analyzer generates a finding. Findings include information about the access and the external principal granted to it345.
References: 3: Using AWS Identity and Access Management Access Analyzer, 4: IAM Access Analyzer – Amazon Web Services (AWS), 5: Welcome – IAM Access Analyzer
C
Explanation:
AWS IAM Access Analyzer is a service that helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, IAM Access Analyzer generates a finding. Findings include information about the access and the external principal granted to it345.
References: 3: Using AWS Identity and Access Management Access Analyzer, 4: IAM Access Analyzer – Amazon Web Services (AWS), 5: Welcome – IAM Access Analyzer
Question #167
Which AWS service gives users the ability to deploy highly repeatable infrastructure configurations?
- A . AWS CloudFormation
- B . AWS CodeDeploy
- C . AWS CodeBuild
- D . AWS Systems Manager
Correct Answer: A
A
Explanation:
AWS CloudFormation allows users to define and deploy infrastructure as code, creating highly repeatable and consistent configurations across environments. It uses templates to automate the provisioning and management of resources. CodeDeploy focuses on application deployment, and Systems Manager offers operational management, but neither provides templated infrastructure deployment at the same level as CloudFormation.
A
Explanation:
AWS CloudFormation allows users to define and deploy infrastructure as code, creating highly repeatable and consistent configurations across environments. It uses templates to automate the provisioning and management of resources. CodeDeploy focuses on application deployment, and Systems Manager offers operational management, but neither provides templated infrastructure deployment at the same level as CloudFormation.
Question #168
A company is configuring its AWS Cloud environment. The company’s administrators need to group users together and apply permissions to the group.
Which AWS service or feature can the company use to meet these requirements?
- A . AWS Organizations
- B . Resource groups
- C . Resource tagging
- D . AWS Identity and Access Management (IAM)
Correct Answer: D
D
Explanation:
The AWS service or feature that the company can use to group users together and apply permissions to the group is AWS Identity and Access Management (IAM). AWS IAM is a service that enables users to create and manage users, groups, roles, and permissions for AWS services and resources. Users can use IAM groups to organize multiple users that have similar access requirements, and attach policies to the groups that define the permissions for the users in the group. This simplifies the management and administration of user access
D
Explanation:
The AWS service or feature that the company can use to group users together and apply permissions to the group is AWS Identity and Access Management (IAM). AWS IAM is a service that enables users to create and manage users, groups, roles, and permissions for AWS services and resources. Users can use IAM groups to organize multiple users that have similar access requirements, and attach policies to the groups that define the permissions for the users in the group. This simplifies the management and administration of user access
Question #169
A company is releasing a business-critical application. Before the release, the company needs strategic planning assistance from AWS. During the release, the company needs AWS infrastructure event management and real-time support.
What should the company do to meet these requirement?
- A . Access AWS Trusted Advisor.
- B . Contact the AWS Partner Network (APN).
- C . Sign up for AWS Enterprise Support.
- D . Contact AWS Professional Services.
Correct Answer: C
C
Explanation:
AWS Enterprise Support provides strategic planning assistance, infrastructure event management, and real-time support, which are necessary for business-critical applications. Trusted Advisor and APN do not offer direct strategic support, and while AWS Professional Services can assist with complex solutions, Enterprise Support specifically includes ongoing operational support and event management.
C
Explanation:
AWS Enterprise Support provides strategic planning assistance, infrastructure event management, and real-time support, which are necessary for business-critical applications. Trusted Advisor and APN do not offer direct strategic support, and while AWS Professional Services can assist with complex solutions, Enterprise Support specifically includes ongoing operational support and event management.
Question #170
An ecommerce company has migrated its IT infrastructure from an on-premises data center to the AWS Cloud.
Which AWS service is used to track, record, and audit configuration changes made to AWS resources?
- A . AWS Shield
- B . AWS Config
- C . AWS IAM
- D . Amazon Inspector
Correct Answer: B
B
Explanation:
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With AWS Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines3.
B
Explanation:
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With AWS Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines3.