Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
A company wants to establish a private network C. AWS Direct Connect.
connection between AWS and its corporate Here's why:
network.Which AWS service or feature will meet this AWS Direct Connect is a service that allows you to establish a dedicated
requirement? network connection from your premises (such as your corporate data center)
A. Amazon Connect to AWS. This connection bypasses the public internet and provides a more
B. Amazon Route 53 consistent network experience, lower latency, and potentially higher
C. AWS Direct Connect throughput compared to internet-based connections.
D. VPC peering Key features of AWS Direct Connect include:
Private Connectivity: It enables you to establish private connectivity between
AWS and your data center, office, or colocation environment.
Dedicated Connection: You can provision a dedicated network connection
between AWS and your network, which can be used to access AWS services
within a specific AWS region.
Reduced Network Costs: By using AWS Direct Connect, you can reduce
network costs, increase bandwidth throughput, and provide a more consistent
network experience compared to internet-based connections.
In contrast, the other options:
Amazon Connect (A): This is a cloud-based contact center service and not
related to establishing private network connections.
Amazon Route 53 (B): This is a scalable Domain Name System (DNS) web
service and does not provide direct private network connectivity.
VPC peering (D): This allows you to connect Virtual Private Clouds (VPCs)
within the same AWS region securely using private IP addresses. It does not
extend connectivity to an external corporate network; it only connects AWS
VPCs.
A company plans to use an Amazon Snowball Edge C. The transfer of data from the Snowball Edge appliance into Amazon S3
device to transfer files to the AWS Cloud.Which When you use a Snowball Edge device to transfer data into Amazon S3, there's
activities related to a Snowball Edge device are no additional cost associated with that data transfer. However, there are
available to the company at no cost? charges for importing data into the Snowball Edge device and for the device
A. Use of the Snowball Edge appliance for a 10-day itself, but transferring data from the Snowball Edge appliance into Amazon S3
period is typically free of charge.
B. The transfer of data out of Amazon S3 and to the
Snowball Edge appliance
C. The transfer of data from the Snowball Edge
appliance into Amazon S3
D. Daily use of the Snowball Edge appliance after 10
days
,Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
A company has deployed applications on Amazon EC2 B. Amazon Inspector
instances. The company needs to assess application Amazon Inspector is the AWS service designed specifically to assess the
vulnerabilities and must identify infrastructure security and compliance of applications deployed on Amazon EC2 instances. It
deployments that do not meet best practices. Which helps identify vulnerabilities and deviations from best practices. It analyzes the
AWS service can the company use to meet these network, file system, and process activities of your EC2 instances to identify
requirements? potential security issues. Therefore, it's the most suitable option for the scenario
A. AWS Trusted Advisor described.
B. Amazon Inspector ===========================================================
C. AWS Config A. AWS Trusted Advisor: is a service that provides real-time guidance to help
D. Amazon GuardDuty you provision your resources following AWS best practices. It analyzes your
AWS environment and provides recommendations in areas such as cost
optimization, security, performance, and fault tolerance. Trusted Advisor
checks can help you improve security by identifying security vulnerabilities,
such as exposed access keys or security groups with overly permissive rules.
C. AWS Config: is a service that provides a detailed inventory of your AWS
resources and captures configuration changes over time. It continuously
monitors resource configurations and relationships, allowing you to assess the
impact of changes, troubleshoot configuration issues, and maintain compliance
with organizational policies. AWS Config can help improve security by
providing visibility into resource configurations and detecting unauthorized
changes.
D. Amazon GuardDuty: is a threat detection service that continuously monitors
your AWS environment for malicious activity and unauthorized behavior. It
analyzes logs from AWS CloudTrail, VPC Flow Logs, and DNS logs to detect
threats such as compromised EC2 instances, unauthorized access attempts,
and unusual network activity. GuardDuty helps improve security by providing
real-time threat detection and automated response capabilities.
A company has a centralized group of users with large B. Configure and deploy an AWS Storage Gateway file gateway. Connect each
file storage requirements that have exceeded the space user's workstation to the file gateway.
available on premises. The company wants to extend its By using an AWS Storage Gateway file gateway, the company can extend its file
file storage capabilities for this group while retaining storage capabilities while retaining the performance benefits of sharing
the performance benefit of sharing content locally. content locally. The file gateway provides on-premises applications with file-
What is the MOST operationally efficient AWS solution based, cached access to virtually unlimited cloud storage. Users can continue
for this scenario? to access files as if they were stored locally while the data is seamlessly
A. Create an Amazon S3 bucket for each user. Mount transferred to and from Amazon S3. This solution eliminates the need for
each bucket by using an S3 file system mounting utility. managing individual S3 buckets per user (option A) or deploying and managing
B. Configure and deploy an AWS Storage Gateway file additional infrastructure like EC2 instances (option D). Options C doesn't
gateway. Connect each user's workstation to the file address the need for large file storage requirements directly.
gateway.
C. Move each user's working environment to Amazon
WorkSpaces. Set up an Amazon WorkDocs account for
each user.
D. Deploy an Amazon EC2 instance and attach an
Amazon Elastic Block Store (Amazon EBS) Provisioned
IOPS volume. Share the EBS volume directly with the
users.
,Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
According to security best practices, how should an C. Have the EC2 instance assume a role to obtain the privileges to upload the
Amazon EC2 instance be given access to an Amazon file.
S3 bucket? Using IAM roles is the recommended approach for granting permissions to
A. Hard code an IAM user's secret key and access key AWS resources like EC2 instances to access other AWS services like S3
directly in the application, and upload the file. securely. By assigning an IAM role to the EC2 instance with the necessary
B. Store the IAM user's secret key and access key in a permissions to access the S3 bucket, you can avoid hard coding access keys or
text file on the EC2 instance, read the keys, then upload storing them in files on the instance, which could lead to security
the file. vulnerabilities. This method follows the principle of least privilege and helps
C. Have the EC2 instance assume a role to obtain the maintain better security posture.
privileges to upload the file.
D. Modify the S3 bucket policy so that any service can
upload to it at any time.
Which option is a customer responsibility when using C. Access to DynamoDB tables
Amazon DynamoDB under the AWS Shared Under the AWS Shared Responsibility Model, Amazon DynamoDB is a fully
Responsibility Model? managed service. This means that AWS is responsible for the security of the
A. Physical security of DynamoDB cloud infrastructure that runs DynamoDB, including the physical security of the
B. Patching of DynamoDB servers, patching the underlying infrastructure, and ensuring encryption of data
C. Access to DynamoDB tables at rest.
D. Encryption of data at rest in DynamoDB However, customers are responsible for managing access to their DynamoDB
tables. This includes setting up appropriate IAM policies, controlling who can
access the tables, and managing permissions for users and applications.
Which option is a perspective that includes C. Governance
foundational capabilities of the AWS Cloud Adoption The AWS Cloud Adoption Framework (AWS CAF) provides guidance for
Framework (AWS CAF)? organizations to structure their cloud adoption journey. It includes several
A. Sustainability perspectives or areas of focus, one of which is governance. Governance
B. Performance efficiency encompasses establishing policies, roles, and responsibilities to ensure that
C. Governance cloud resources are used efficiently, securely, and in compliance with
D. Reliability organizational requirements and standards.
==========================================================
A. Sustainability: This term refers to the environmental impact of cloud
computing. Cloud providers like AWS are increasingly investing in sustainable
practices to minimize energy consumption, reduce carbon emissions, and
promote renewable energy usage in their data centers.
B. Performance efficiency: Performance efficiency in cloud computing refers to
the ability of a system to provide adequate performance while optimizing
resource utilization. It involves designing systems to scale efficiently, handle
variable workloads, and minimize latency to deliver a high level of
performance to users.
D. Reliability: Reliability in cloud computing refers to the ability of a system to
consistently perform its intended functions without failure or downtime. It
involves designing systems with fault tolerance, redundancy, and automated
recovery mechanisms to ensure high availability and minimize service
disruptions for users.
, Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
A company is running and managing its own Docker C. AWS Fargate.
environment on Amazon EC2 instances. The company AWS Fargate is a compute engine for Amazon ECS (Elastic Container Service)
wants an alternative to help manage cluster size, that allows you to run containers without having to manage the underlying
scheduling, and environment maintenance. Which AWS infrastructure. It abstracts away the management of EC2 instances, thus
service meets these requirements? handling tasks like cluster size, scheduling, and environment maintenance
A. AWS Lambda automatically. This can help simplify container management, making it an ideal
B. Amazon RDS solution for companies looking to offload the operational overhead associated
C. AWS Fargate with managing Docker environments on EC2 instances.
D. Amazon Athena ==========================================================
A. AWS Lambda: AWS Lambda is a serverless compute service provided by
Amazon Web Services. It allows you to run code without provisioning or
managing servers. With Lambda, you can upload your code and AWS Lambda
takes care of automatically scaling and managing the underlying infrastructure
to run your code in response to events, such as changes to data in an Amazon
S3 bucket or updates to an Amazon DynamoDB table.
B. Amazon RDS: Amazon RDS (Relational Database Service) is a managed
relational database service provided by Amazon Web Services. It allows you to
set up, operate, and scale relational databases in the cloud. With Amazon RDS,
you can choose from several popular database engines, such as MySQL,
PostgreSQL, MariaDB, Oracle, and SQL Server, and AWS handles routine
database administration tasks such as backups, patching, and monitoring.
D. Amazon Athena: Amazon Athena is an interactive query service provided by
Amazon Web Services that allows you to analyze data stored in Amazon S3
using standard SQL. With Amazon Athena, you can run ad-hoc SQL queries on
data in S3 without having to set up or manage any infrastructure. It is
particularly useful for analyzing large datasets stored in S3 using a serverless
and pay-per-query model.
A company wants to run a NoSQL database on Amazon C. Patch the physical infrastructure that hosts the EC2 instances.
EC2 instances. Which task is the responsibility of AWS in AWS manages the physical infrastructure, including performing maintenance
this scenario? tasks such as patching the underlying hardware to ensure security and
A. Update the guest operating system of the EC2 reliability. This allows the company to focus on managing their NoSQL database
instances. and application logic without worrying about the physical infrastructure's
B. Maintain high availability at the database layer. maintenance.
C. Patch the physical infrastructure that hosts the EC2
instances.
D. Configure the security group firewall.
A company wants to establish a private network C. AWS Direct Connect.
connection between AWS and its corporate Here's why:
network.Which AWS service or feature will meet this AWS Direct Connect is a service that allows you to establish a dedicated
requirement? network connection from your premises (such as your corporate data center)
A. Amazon Connect to AWS. This connection bypasses the public internet and provides a more
B. Amazon Route 53 consistent network experience, lower latency, and potentially higher
C. AWS Direct Connect throughput compared to internet-based connections.
D. VPC peering Key features of AWS Direct Connect include:
Private Connectivity: It enables you to establish private connectivity between
AWS and your data center, office, or colocation environment.
Dedicated Connection: You can provision a dedicated network connection
between AWS and your network, which can be used to access AWS services
within a specific AWS region.
Reduced Network Costs: By using AWS Direct Connect, you can reduce
network costs, increase bandwidth throughput, and provide a more consistent
network experience compared to internet-based connections.
In contrast, the other options:
Amazon Connect (A): This is a cloud-based contact center service and not
related to establishing private network connections.
Amazon Route 53 (B): This is a scalable Domain Name System (DNS) web
service and does not provide direct private network connectivity.
VPC peering (D): This allows you to connect Virtual Private Clouds (VPCs)
within the same AWS region securely using private IP addresses. It does not
extend connectivity to an external corporate network; it only connects AWS
VPCs.
A company plans to use an Amazon Snowball Edge C. The transfer of data from the Snowball Edge appliance into Amazon S3
device to transfer files to the AWS Cloud.Which When you use a Snowball Edge device to transfer data into Amazon S3, there's
activities related to a Snowball Edge device are no additional cost associated with that data transfer. However, there are
available to the company at no cost? charges for importing data into the Snowball Edge device and for the device
A. Use of the Snowball Edge appliance for a 10-day itself, but transferring data from the Snowball Edge appliance into Amazon S3
period is typically free of charge.
B. The transfer of data out of Amazon S3 and to the
Snowball Edge appliance
C. The transfer of data from the Snowball Edge
appliance into Amazon S3
D. Daily use of the Snowball Edge appliance after 10
days
,Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
A company has deployed applications on Amazon EC2 B. Amazon Inspector
instances. The company needs to assess application Amazon Inspector is the AWS service designed specifically to assess the
vulnerabilities and must identify infrastructure security and compliance of applications deployed on Amazon EC2 instances. It
deployments that do not meet best practices. Which helps identify vulnerabilities and deviations from best practices. It analyzes the
AWS service can the company use to meet these network, file system, and process activities of your EC2 instances to identify
requirements? potential security issues. Therefore, it's the most suitable option for the scenario
A. AWS Trusted Advisor described.
B. Amazon Inspector ===========================================================
C. AWS Config A. AWS Trusted Advisor: is a service that provides real-time guidance to help
D. Amazon GuardDuty you provision your resources following AWS best practices. It analyzes your
AWS environment and provides recommendations in areas such as cost
optimization, security, performance, and fault tolerance. Trusted Advisor
checks can help you improve security by identifying security vulnerabilities,
such as exposed access keys or security groups with overly permissive rules.
C. AWS Config: is a service that provides a detailed inventory of your AWS
resources and captures configuration changes over time. It continuously
monitors resource configurations and relationships, allowing you to assess the
impact of changes, troubleshoot configuration issues, and maintain compliance
with organizational policies. AWS Config can help improve security by
providing visibility into resource configurations and detecting unauthorized
changes.
D. Amazon GuardDuty: is a threat detection service that continuously monitors
your AWS environment for malicious activity and unauthorized behavior. It
analyzes logs from AWS CloudTrail, VPC Flow Logs, and DNS logs to detect
threats such as compromised EC2 instances, unauthorized access attempts,
and unusual network activity. GuardDuty helps improve security by providing
real-time threat detection and automated response capabilities.
A company has a centralized group of users with large B. Configure and deploy an AWS Storage Gateway file gateway. Connect each
file storage requirements that have exceeded the space user's workstation to the file gateway.
available on premises. The company wants to extend its By using an AWS Storage Gateway file gateway, the company can extend its file
file storage capabilities for this group while retaining storage capabilities while retaining the performance benefits of sharing
the performance benefit of sharing content locally. content locally. The file gateway provides on-premises applications with file-
What is the MOST operationally efficient AWS solution based, cached access to virtually unlimited cloud storage. Users can continue
for this scenario? to access files as if they were stored locally while the data is seamlessly
A. Create an Amazon S3 bucket for each user. Mount transferred to and from Amazon S3. This solution eliminates the need for
each bucket by using an S3 file system mounting utility. managing individual S3 buckets per user (option A) or deploying and managing
B. Configure and deploy an AWS Storage Gateway file additional infrastructure like EC2 instances (option D). Options C doesn't
gateway. Connect each user's workstation to the file address the need for large file storage requirements directly.
gateway.
C. Move each user's working environment to Amazon
WorkSpaces. Set up an Amazon WorkDocs account for
each user.
D. Deploy an Amazon EC2 instance and attach an
Amazon Elastic Block Store (Amazon EBS) Provisioned
IOPS volume. Share the EBS volume directly with the
users.
,Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
According to security best practices, how should an C. Have the EC2 instance assume a role to obtain the privileges to upload the
Amazon EC2 instance be given access to an Amazon file.
S3 bucket? Using IAM roles is the recommended approach for granting permissions to
A. Hard code an IAM user's secret key and access key AWS resources like EC2 instances to access other AWS services like S3
directly in the application, and upload the file. securely. By assigning an IAM role to the EC2 instance with the necessary
B. Store the IAM user's secret key and access key in a permissions to access the S3 bucket, you can avoid hard coding access keys or
text file on the EC2 instance, read the keys, then upload storing them in files on the instance, which could lead to security
the file. vulnerabilities. This method follows the principle of least privilege and helps
C. Have the EC2 instance assume a role to obtain the maintain better security posture.
privileges to upload the file.
D. Modify the S3 bucket policy so that any service can
upload to it at any time.
Which option is a customer responsibility when using C. Access to DynamoDB tables
Amazon DynamoDB under the AWS Shared Under the AWS Shared Responsibility Model, Amazon DynamoDB is a fully
Responsibility Model? managed service. This means that AWS is responsible for the security of the
A. Physical security of DynamoDB cloud infrastructure that runs DynamoDB, including the physical security of the
B. Patching of DynamoDB servers, patching the underlying infrastructure, and ensuring encryption of data
C. Access to DynamoDB tables at rest.
D. Encryption of data at rest in DynamoDB However, customers are responsible for managing access to their DynamoDB
tables. This includes setting up appropriate IAM policies, controlling who can
access the tables, and managing permissions for users and applications.
Which option is a perspective that includes C. Governance
foundational capabilities of the AWS Cloud Adoption The AWS Cloud Adoption Framework (AWS CAF) provides guidance for
Framework (AWS CAF)? organizations to structure their cloud adoption journey. It includes several
A. Sustainability perspectives or areas of focus, one of which is governance. Governance
B. Performance efficiency encompasses establishing policies, roles, and responsibilities to ensure that
C. Governance cloud resources are used efficiently, securely, and in compliance with
D. Reliability organizational requirements and standards.
==========================================================
A. Sustainability: This term refers to the environmental impact of cloud
computing. Cloud providers like AWS are increasingly investing in sustainable
practices to minimize energy consumption, reduce carbon emissions, and
promote renewable energy usage in their data centers.
B. Performance efficiency: Performance efficiency in cloud computing refers to
the ability of a system to provide adequate performance while optimizing
resource utilization. It involves designing systems to scale efficiently, handle
variable workloads, and minimize latency to deliver a high level of
performance to users.
D. Reliability: Reliability in cloud computing refers to the ability of a system to
consistently perform its intended functions without failure or downtime. It
involves designing systems with fault tolerance, redundancy, and automated
recovery mechanisms to ensure high availability and minimize service
disruptions for users.
, Amazon AWS Certified Cloud Practitioner CLF-C02 Exam Practice Questions and Answers
A company is running and managing its own Docker C. AWS Fargate.
environment on Amazon EC2 instances. The company AWS Fargate is a compute engine for Amazon ECS (Elastic Container Service)
wants an alternative to help manage cluster size, that allows you to run containers without having to manage the underlying
scheduling, and environment maintenance. Which AWS infrastructure. It abstracts away the management of EC2 instances, thus
service meets these requirements? handling tasks like cluster size, scheduling, and environment maintenance
A. AWS Lambda automatically. This can help simplify container management, making it an ideal
B. Amazon RDS solution for companies looking to offload the operational overhead associated
C. AWS Fargate with managing Docker environments on EC2 instances.
D. Amazon Athena ==========================================================
A. AWS Lambda: AWS Lambda is a serverless compute service provided by
Amazon Web Services. It allows you to run code without provisioning or
managing servers. With Lambda, you can upload your code and AWS Lambda
takes care of automatically scaling and managing the underlying infrastructure
to run your code in response to events, such as changes to data in an Amazon
S3 bucket or updates to an Amazon DynamoDB table.
B. Amazon RDS: Amazon RDS (Relational Database Service) is a managed
relational database service provided by Amazon Web Services. It allows you to
set up, operate, and scale relational databases in the cloud. With Amazon RDS,
you can choose from several popular database engines, such as MySQL,
PostgreSQL, MariaDB, Oracle, and SQL Server, and AWS handles routine
database administration tasks such as backups, patching, and monitoring.
D. Amazon Athena: Amazon Athena is an interactive query service provided by
Amazon Web Services that allows you to analyze data stored in Amazon S3
using standard SQL. With Amazon Athena, you can run ad-hoc SQL queries on
data in S3 without having to set up or manage any infrastructure. It is
particularly useful for analyzing large datasets stored in S3 using a serverless
and pay-per-query model.
A company wants to run a NoSQL database on Amazon C. Patch the physical infrastructure that hosts the EC2 instances.
EC2 instances. Which task is the responsibility of AWS in AWS manages the physical infrastructure, including performing maintenance
this scenario? tasks such as patching the underlying hardware to ensure security and
A. Update the guest operating system of the EC2 reliability. This allows the company to focus on managing their NoSQL database
instances. and application logic without worrying about the physical infrastructure's
B. Maintain high availability at the database layer. maintenance.
C. Patch the physical infrastructure that hosts the EC2
instances.
D. Configure the security group firewall.
