Free Practice Questions for Amazon Web Services CLF-C02 Exam

AWS serverless computing is a way of building and running applications without thinking about servers. AWS manages the infrastructure for you, so you don’t have to provision, scale, patch, or monitor servers. You only pay for the compute time you consume, and you can focus on your application logic instead of managing servers12. References: Serverless Computing – Amazon Web Services, AWS Serverless Computing, Benefits, Architecture and Use-cases - XenonStack

All Upfront Reserved Instances offer the most cost-effective solution for a workload that will run continuously for one year without interruption. By paying upfront, the user receives the maximum discount over the On-Demand pricing model. Partial Upfront Reserved Instances and Dedicated Instances are more expensive than All Upfront Reserved Instances. On-Demand Instances are not cost-effective for continuous long-term workloads due to their higher hourly rates.

AWS Lambdais a serverless compute service that allows users to run code in response to events without provisioning or managing servers. It automatically scales the application by running code only when needed, and users are charged only for the compute time consumed. This service is ideal for applications that require event-driven compute functions.

B. AWS CloudFormation: Incorrect, as it is an infrastructure-as-code service that helps users automate the deployment of AWS resources, not a serverless compute service.

C. AWS Elastic Beanstalk: Incorrect, as it is a Platform-as-a-Service (PaaS) that still involves managing servers, even though it abstracts much of the infrastructure management.

D. Elastic Load Balancing: Incorrect, as it is a service for distributing incoming application or network traffic across multiple targets, not a serverless compute service.

AWS Cloud References:

AWS Lambda

AWS Transit Gatewayis a network transit hub that customers can use to connect their Amazon VPCs and on-premises networks to a central hub. This service simplifies network management and reduces operational overhead by enabling a single gateway for managing multiple network connections. It facilitates seamless integration and routing between VPCs and on-premises networks.

A. Virtual private gateway: Incorrect, as it is used to connect a single VPC to an on-premises network through a VPN connection.

C. Internet gateway: Incorrect, as it provides internet access for instances in a VPC but does not connect multiple networks.

D. Customer gateway: Incorrect, as it represents the on-premises device or software application that connects to AWS, but it does not provide a central hub.

AWS Cloud References:

AWS Transit Gateway

 Amazon Neptune is a fully managed graph database service on AWS. A graph database is a type of database that stores and queries data as a network of nodes and edges, representing entities and relationships. Graph databases are useful for applications that deal with highly connected data, such as social networks, recommendation engines, fraud detection, and knowledge graphs45. Amazon Neptune is a fast, reliable, and scalable graph database service that supports two popular graph models: property graphs and RDF. Amazon Neptune also supports two open standards for querying graphs: Apache TinkerPop Gremlin and SPARQL. Amazon Neptune handles the heavy lifting of managing the database, such as provisioning, patching, backup, recovery, encryption, and replication456. References: 4: Managed Graph Database - Amazon Neptune - AWS, 5: Amazon Neptune – A Fully Managed Graph Database Service, 6: Working with AWS Neptune. Neptune is a fully-managed graph … - Medium

The AWS Cloud Adoption Framework (AWS CAF) security perspective helps users achieve the confidentiality, integrity, and availability of their data and cloud workloads. It comprises nine capabilities that are grouped into three categories: preventive, detective, and responsive. Incident response and infrastructure protection are two of the capabilities in the responsive and preventive categories, respectively. Incident response helps users prepare for and respond to security incidents in a timely and effective manner, using tools and processes that leverage AWS features and services. Infrastructure protection helps users implement security controls and mechanisms to protect their cloud resources, such as network, compute, storage, and database, from unauthorized access or malicious attacks. References: Security perspective: compliance and assurance, AWS Cloud Adoption Framework

Spot Instances are a type of EC2 instance that let you bid on unused compute capacity, which AWS offers at a discount of up to 90% compared to On-Demand prices1. Spot Instances are suitable for fault-tolerant, stateless, or flexible applications that can handle interruptions2. Spot Instances can be interrupted with a two-minute warning when EC2 needs the capacity back3. The other options are not pricing models that will interrupt a running EC2 instance if capacity becomes temporarily unavailable

Amazon CloudFront and AWS Global Accelerator are two AWS services that make use of global edge locations. Edge locations are AWS sites that are deployed worldwide in major cities and places with a high population. Edge locations are used to cache data and reduce latency for end-user access1.

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. Amazon CloudFront uses a global network of over 200 edge locations and 13 regional edge caches to cache your content closer to your viewers, improving performance and reducing costs23.

AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint based on health, performance, and policies. AWS Global Accelerator uses over 100 edge locations to bring your application endpoints closer to your users, reducing networkhops and improving user experience45. References: 1: AWS for the Edge - Amazon Web Services (AWS), 2: Content Delivery Network (CDN) - Amazon CloudFront - AWS, 3: Amazon CloudFront Documentation, 4: AWS Global Accelerator - Amazon Web Services, 5: AWS Global Accelerator Documentation

TheAWS Developer Supportplan is the lowest-cost AWS Support plan that provides basic guidance and technical support for running production workloads. It offers 24/7 access to AWS customer service, documentation, whitepapers, and access to a limited set of Trusted Advisor checks. This plan is ideal for non-critical workloads or early development phases but provides lower levels of support compared to the Business, Enterprise On-Ramp, and Enterprise plans.

B. Enterprise On-Ramp: Incorrect, as it is a higher-cost support plan designed for production workloads needing more guidance and technical support.

C. Enterprise: Incorrect, as it is the most expensive support plan, providing a Technical Account Manager and other premium support features.

D. Business: Incorrect, as it provides comprehensive support for production workloads but is more expensive than the Developer plan.

AWS Cloud References:

AWS Support Plans

Amazon Lexis a service for building conversational interfaces into any application using voice and text. It provides the tools necessary to create, test, and publish intelligent chatbots that can be integrated with web applications to provide a conversational experience.

A. Amazon Textract: Incorrect, as it is a service for extracting text and data from documents, not for creating chatbots.

C. AWS Glue: Incorrect, as it is a data integration service used for preparing and transforming data.

D. Amazon Rekognition: Incorrect, as it is an image and video analysis service.

AWS Cloud References:

Amazon Lex

On-Demand Instances are the most flexible and cost-effective pricing model for short-term, experimental, or unpredictable workloads on AWS. On-Demand Instances let you pay only for the resources you use, without any long-term commitments or upfront fees. You can easily start and stop instances as needed, and scale up or down depending on your demand.

Savings Plans, Reserved Instances, and Dedicated Hosts are all pricing models that require a commitment for a certain amount of usage or capacity for a one- or three-year term. These pricing models offer lower prices than On-Demand Instances, but they are not suitable for workloads that only run for 3 to 6 months or have variable usage patterns. Savings Plans and Reserved Instances also offer flexibility to change instance types, sizes, or regions within the same family or pool, while Dedicated Hosts are physical servers that can only run specific instance types.

Amazon EC2 Spot Instancesoffer spare AWS compute capacity at a significantly reduced cost compared to On-Demand Instances. Spot Instances are ideal for fault-tolerant and flexibleworkloads that can tolerate interruptions, such as batch jobs, data processing, or large-scale computations. These instances may be interrupted by AWS if there is a demand for capacity, but they provide the best cost optimization for workloads that can handle such interruptions.

Why other options are not suitable:

A. Amazon Macie: A data security and privacy service, not relevant to running batch jobs.

B. Amazon Neptune: A graph database service, not relevant to compute optimization.

D. Amazon EC2 On-Demand Instances: Provide flexible compute capacity but at a higher cost than Spot Instances, which are more suitable for cost optimization.

 IAM roles are a secure way to grant permissions to applications running on an Amazon EC2 instance to make calls to other AWS services. IAM roles are entities that have specific permissions policies attached to them. You can create an IAM role and associate it with an EC2 instance when you launch it or later. The applications on the instance can then use the temporary credentials provided by the role to access AWS resources that the role allows. This way, you do not have tostore any long-term credentials or access keys on the instance, which reduces the risk of compromise or misuse12.

The other options are not correct, because:

Security groups are virtual firewalls that control the inbound and outbound traffic for your EC2 instances. Security groups do not grant permissions to access other AWS services, but rather filter the network traffic based on rules that you define3.

AWS Firewall Manager is a service that helps you centrally configure and manage firewall rules across your accounts and resources. AWS Firewall Manager works with AWS WAF, AWS Shield Advanced, and Amazon VPC security groups. AWS Firewall Manager does not grant permissions to access other AWS services, but rather helps you enforce consistent security policies across your AWS infrastructure4.

IAM user SSH keys are credentials that allow you to connect to your EC2 instance using SSH. SSH keys do not grant permissions to access other AWS services, but rather authenticate your identity when you log in to your instance5.

Using an IAM role to grant permissions to applications running on Amazon EC2 instances - AWS Identity and Access Management

IAM roles for Amazon EC2 - Amazon Elastic Compute Cloud

Security groups for your VPC - Amazon Virtual Private Cloud

What is AWS Firewall Manager? - AWS Firewall Manager

Connecting to your Linux instance using SSH - Amazon Elastic Compute Cloud

AWS SDKs are a set of tools that allow users to connect with AWS and deploy resources programmatically. AWS SDKs provide libraries, code samples, documentation, and other resources to help users write code that interacts with AWS APIs. AWS SDKs support various programming languages, such as Java, Python, Ruby, .NET, Node.js, Go, and more. AWS SDKs make it easier for users to access AWS services, such as Amazon S3, Amazon EC2, Amazon DynamoDB, AWS Lambda, and more, from their applications. AWS SDKs also handle tasks such as authentication, error handling, retries, and data serialization, so users can focus on their application logic .

The other options are not AWS services or tools that give users the ability to connect with AWS and deploy resources programmatically. Amazon QuickSight is a business intelligence service that lets users create and share interactive dashboards and visualizations1. AWS PrivateLink is a service that enables users to securely access services hosted on AWS in a scalable and cost-effective manner2. AWS Direct Connect is a service that establishes a dedicated network connection between a user’s premises and AWS3.

When a company moves from on-premises IT architecture to the AWS Cloud, it gains several benefits:

A. Reduced or eliminated tasks for hardware troubleshooting, capacity planning, and procurement: In an on-premises environment, companies must maintain their own hardware, which involves procuring servers, configuring them, managing capacity, and troubleshooting hardware failures. Moving to the AWS Cloud eliminates or greatly reduces these tasks since AWS is responsible for the underlying infrastructure.

E. Faster deployment of new features and applications: AWS provides scalable resources and automation tools that allow companies to deploy applications faster. Services like AWS Elastic Beanstalk, AWS CloudFormation, and AWS Lambda help streamline the deployment process, enabling quicker time-to-market for new features and applications.

Why other options are not suitable:

B. Elimination of the need for trained IT staff: While the cloud reduces certain operational burdens, it does not eliminate the need for skilled IT professionals to manage cloud services, ensure proper configurations, handle security, and manage applications.

C. Automatic security configuration of all applications that are migrated to the cloud: AWS provides security tools and services, but security configurations and management still require input from the customer to tailor them to specific application requirements.

D. Elimination of the need for disaster recovery planning: While AWS offers robust disaster recovery options, companies must still plan and implement disaster recovery strategies, such as backups and multi-region deployments.

Under the AWS shared responsibility model, AWS is responsible for the security " of " the cloud, which includes the physical infrastructure, networking, and hypervisor layer. The customer, however, is responsible for security " in " the cloud, which includes managing the security of their data, patching and maintaining their guest operating system and applications, and managing identity and access. The responsibilities of shredding disk drives, preventing packet capture at the hypervisor level, and physical monitoring are handled by AWS as part of its responsibility for security " of " the cloud.

According to theAWS Shared Responsibility Model, the customer is responsible for managing the guest operating system (including patches and updates) and any applications that they run on their Amazon EC2 instances.

Why other options are not suitable:

B. Control physical access to an AWS data center: AWS is responsible for the physical security of its data centers.

C. Control access to AWS underlying hardware: AWS manages the hardware infrastructure.

D. Patch a host operating system that is deployed on Amazon S3: Amazon S3 is a managed storage service, and AWS manages the underlying infrastructure, including the operating system.

AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of an AWS account. It logs, continuously monitors, and retains account activity related to actions across an AWS infrastructure.

For auditing purposes:

CloudTrail records AWS API calls made in the account, including details about who made the request, the services used, the actions performed, and the response elements returned by AWS.

This information is critical for understanding user activity, detecting anomalous behavior, and performing security analysis and compliance auditing.

Why other options are not suitable:

A. AWS Config: AWS Config provides a detailed view of the configuration of AWS resources, including how resources are related and their compliance with internal policies, but it does not provide a comprehensive audit trail of user actions.

B. Amazon Rekognition: A service for image and video analysis, not relevant to auditing AWS account activity.

D. Amazon SNS: A notification service for sending alerts and messages, not used for auditing purposes.

Loose coupling is a design principle that involves reducing dependencies between application components so that they can operate independently. This approach ensures that the failure of one component does not affect the availability of the others, thereby improving the application ' s fault tolerance and resilience. Disposable resources, automation, and rightsizing are valuable principles in cloud architecture, but they do not directly address the requirement of remaining available despite the failure of an individual component like loose coupling does.