Free Practice Questions for Amazon Web Services CLF-C02 Exam

Refactoring involves re-architecting and modifying an application to take advantage of cloud-native features. In this case, the company wants to modernize a monolithic application by breaking it into microservices. This process aligns with the Refactor strategy, which is aimed at modernizing and re-architecting applications. Rehost, Repurchase, and Replatform do not involve the level of re-architecting needed to move from a monolithic to a microservices architecture.

Amazon S3 Glacier Flexible Retrieval is optimized for storing infrequently accessed data at a very low cost, making it suitable for data archiving and long-term backups. It provides flexible retrieval options for archived data. Other services like FSx for Lustre, EBS, and EFS are more suited for frequently accessed data and higher-performance use cases, not archival storage.

Understanding Performance Efficiency: This pillar of the AWS Well-Architected Framework focuses on using computing resources efficiently to meet system requirements and maintain that efficiency as demand changes and technologies evolve.

Key Aspects of Performance Efficiency:

Selection: Choose the right resources for the job. This includes using the most appropriate instance types, storage options, and database services.

Review: Regularly review your architecture to take advantage of the latest AWS services and features, and to ensure you're using the best possible resource for your needs.

Monitoring: Continuously monitor your system performance, gather metrics, and use those metrics to make informed decisions about scaling and performance optimization.

Trade-offs: Understand the trade-offs between various performance-related aspects, such as cost, latency, and durability, and make decisions that align with your business goals.

How to Implement Performance Efficiency:

Use Auto Scaling: Implement Auto Scaling to automatically adjust the number of resources based on the demand.

Choose Appropriate Storage Options: Select the right storage solution (e.g., S3, EBS, or EFS) based on performance and access patterns.

Optimize Networking: Utilize Amazon CloudFront, AWS Global Accelerator, and VPC to optimize your network performance.

Regular Review and Testing: Regularly review your architecture, test performance under various loads, and adjust configurations as needed.

AWS Well-Architected Framework

Performance Efficiency Pillar

The correct answer is B and C. EC2 Amazon Machine Images (AMIs) and Amazon Elastic Block Store (Amazon EBS) snapshots are two AWS services that provide disaster recovery solutions for Amazon EC2 instances.

EC2 AMIs are preconfigured templates that contain the software configuration and data required to launch an EC2 instance. You can create AMIs from your running EC2 instances and use them to launch new instances in the same or different AWS Regions. This way, you can quickly recover your EC2 instances in case of a disaster that affects your primary Region or Availability Zone1.

Amazon EBS snapshots are incremental backups of your Amazon EBS volumes. You can create snapshots of your volumes and store them in Amazon S3, which is a highly durable and scalable storage service. You can use snapshots to restore your volumes to a previous point in time or to create new volumes from snapshots. Snapshots can also be copied across AWS Regions, enabling you to recover your data in another Region in case of a disaster2.

The other options are not directly related to disaster recovery for EC2 instances:

EC2 Reserved Instances are a pricing model that allows you to reserve EC2 capacity for a specific period of time and receive a discount on the hourly charge. Reserved Instances do not provide any disaster recovery benefits, as they are only a billing option3.

AWS Shield is a managed service that protects your AWS resources from distributed denial-of-service (DDoS) attacks. AWS Shield provides basic protection for all AWS customers at no additional charge, and advanced protection for customers who need higher levels of detection and mitigation. AWS Shield does not provide any disaster recovery benefits, as it is only a security service4.

Amazon GuardDuty is a threat detection service that monitors your AWS account and workloads for malicious or unauthorized activity. Amazon GuardDuty analyzes various data sources, such as AWS CloudTrail, Amazon VPC Flow Logs, and DNS logs, to identify potential threats and alert you via Amazon CloudWatch Events or AWS Lambda. Amazon GuardDuty does not provide any disaster recovery benefits, as it is only a monitoring service5.

Compute Savings Plans provide the most flexibility and help to reduce your costs by up to 66%. These plans automatically apply to EC2 instance usage regardless of instance family, size, AZ, Region, OS or tenancy, and also apply to Fargate or Lambda usage. For example, with Compute Savings Plans, you can change from C4 to M5 instances, shift a workload from EU (Ireland) to EU (London), or move a workload from EC2 to Fargate or Lambda at any time and automatically continue to pay the Savings Plans price.

https://aws.amazon.com/savingsplans/compute-pricing/

TheBusiness perspectiveof the AWS Cloud Adoption Framework (AWS CAF) focuses on ensuring that cloud investments align with business strategies and that the organization achieves business value from cloud adoption. It provides real-time insights into the organization's strategic goals, financial objectives, and metrics.

This perspective helps answer questions about strategy, ensuring that cloud adoption aligns with the organization's long-term business goals.

Why other options are not suitable:

A. Operations: Focuses on operating cloud environments effectively.

B. People: Focuses on human resources and organizational structure.

D. Platform: Focuses on infrastructure and architecture.

VPC peering and AWS Transit Gateway are two AWS services or features that give users the ability to create a network connection between two VPCs. VPC peering is a networking connection between two VPCs that enables you to route traffic between them privately. You can create a VPC peering connection between your own VPCs, with a VPC in another AWS account, or with a VPC in a different AWS Region. Traffic between peered VPCs never traverses the public internet. VPC peering does not support transitive peering relationships, which means that if VPC A is peered with VPC B, and VPC B is peered with VPC C, then VPC A and VPC C are not automatically peered789. AWS Transit Gateway is a networking service that acts as a regional router for your VPCs and on-premises networks. You can attach up to 5,000 VPCs and VPN connections to a single transit gateway and route traffic between them. AWS Transit Gateway simplifies the management and scalability of your network architecture, as you only need to create and manage a single connection from the central transit gateway to each connected network. AWS Transit Gateway supports transitive routing, which means that any network thatis attached to the transit gateway can communicate with any other network that is attached to the same transit gateway . References: 7: VPC peering - Amazon Virtual Private Cloud, 8: Connect VPCs using VPC peering - Amazon Virtual Private Cloud, 9: Amazon VPC-to-Amazon VPC connectivity options - Amazon Virtual Private Cloud, : [AWS Transit Gateway - Amazon Web Services], : [Connect VPCs using AWS Transit Gateway - Amazon Virtual Private Cloud], : [AWS Transit Gateway: Simplify Your Network Architecture]

Security groups and network ACLs are two AWS services that can be used to block network traffic to an instance. Security groups are virtual firewalls that control the inbound and outbound traffic for your instances at the instance level. You can specify which protocols, ports, and source or destination IP addresses are allowed or denied for each instance. Security groups are stateful, which means that they automatically allow return traffic for any allowed inbound or outbound traffic123. Network ACLs are virtual firewalls that control the inbound and outbound traffic for your subnets at the subnet level. You can create rules to allow or deny traffic based on protocols, ports, and source or destination IP addresses. Network ACLs are stateless, which means that you have to explicitly allow return traffic for any allowed inbound or outbound traffic456. References: 1: Security groups for your VPC - Amazon Virtual Private Cloud, 2: Security Groups for Your VPC - Amazon Elastic Compute Cloud, 3: AWS Security Groups: Everything You Need to Know, 4: Network ACLs - Amazon Virtual Private Cloud, 5: Control traffic to subnetsusing network ACLs - Amazon Virtual Private Cloud, 6: AWS Network ACLs: Everything You Need to Know

AWS Security Hub is a cloud security posture management (CSPM) service that performs security best practice checks, aggregates alerts, and enables automated remediation. Security Hub collects findings from the security services enabled across your AWS accounts, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, and sensitive data identification findings from Amazon Macie. Security Hub also collects findings from partner security products using a standardized AWS Security Finding Format, eliminating the need for time-consuming data parsing and normalization efforts. Customers can designate an administrator account that can access all findings across their accounts. References: AWS Security Hub Overview, AWS Security Hub FAQs

"The Reliability pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it’s expected to. This includes the ability to operate and test the workload through its total lifecycle." https://docs.aws.amazon.com/wellarchitected/latest/framework/reliability.html

AWS Glue is a serverless data integration service that makes it easy to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning, and application development. You can use various data integration engines, such as ETL, ELT, batch, and streaming, and manage your data in a centralized data catalog. AWS Glue is designed specifically for extract, transform, and load (ETL) data, whereas the other options are not.

TheAWS Cloud Development Kit (AWS CDK)currently supports multiple programming languages, includingPythonandTypeScript. These languages allow developers to define cloud infrastructure using familiar programming constructs. Python and TypeScript are among the first languages supported by AWS CDK, which also supports Java, C#, and JavaScript. This enables developers to use their existing programming skills and tools to define cloud infrastructure in code.

B. Swift: Incorrect, as Swift is not currently supported by AWS CDK.

D. Ruby: Incorrect, as Ruby is not currently supported by AWS CDK.

E. PHP: Incorrect, as PHP is not currently supported by AWS CDK.

AWS Cloud References:

AWS Cloud Development Kit (AWS CDK)

AWS CloudTrail is the service that can be used to meet these requirements. AWS CloudTrail is a service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, therequest parameters, and the response elements returned by the AWS service1. You can use CloudTrail to track the activity in your AWS accounts, such as who made an API call, when it was made, and what resources were affected. You can also use CloudTrail to monitor thecompliance, security, and governance of your AWS environment2. The other services are not designed to track the activity and API calls in your AWS accounts. Amazon CloudWatch is a servicethat monitors and collects metrics, logs, and events from your AWS resources and applications. You can use CloudWatch to set alarms, visualize data, and automate actions based on predefined thresholds or rules3. Amazon Inspector is a service that helps you improve the security and compliance of your applications running on AWS. Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices4. AWS IAM is a service that enables you to manage access to AWS services and resources securely. IAM allows you to create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. References: AWS CloudTrail, AWS CloudTrail – Capture AWS API Activity, Amazon CloudWatch, Amazon Inspector, [AWS IAM]