CLF-C02 practice questions with answers

Answer: A) Operational Excellence

• AOperational Excellence covers performing operations as code, making frequent small reversible changes, refining procedures, anticipating failure, and learning from operational events.
• BPerformance Efficiency is about using resources efficiently as demand and technologies change, not operations processes.
• CCost Optimization focuses on avoiding unnecessary spend.
• DSecurity is about protecting data and systems, not operational process improvement.

Answer: A) Use Amazon CloudFront to cache and serve content from edge locations near users

• AA content delivery network serves cached content from edge locations close to users, cutting latency without redeploying the whole application.
• BA bigger instance does not shorten the physical network distance to distant users.
• CMulti-AZ improves availability within a Region; it does not reduce latency for users on other continents.
• DSupport plans affect help and response times, not application latency.

Answer: A) Stop guessing capacity, by scaling resources up and down as demand changes

Buying capacity for peak load and leaving it idle is the problem that 'Stop guessing capacity' solves. In the cloud you provision what you need now and scale up or down as demand changes.

• ACorrect. AWS describes this advantage as removing the need to guess capacity ahead of time, which leads to expensive idle resources or limited capacity. In the cloud you use as much or as little capacity as you need and scale with only a few minutes' notice.
• BIncorrect. Economies of scale lower the unit price, because AWS combines usage from many customers. They do not stop a company from buying more capacity than it uses.
• CIncorrect. This advantage is about low latency for customers worldwide, not about matching capacity to demand.
• DIncorrect. Agility is about shortening the time to get resources and to experiment. The problem in this scenario is unused capacity bought for a rarely reached peak.

Answer: A) Resources can be released as soon as the trial ends, so only the time used is billed

With on-demand provisioning and pay-as-you-go pricing, a team can start and stop resources in minutes, so an abandoned experiment costs only the short time it ran. This lowers the cost of experimenting.

• ACorrect. Resources are available in minutes and can be shut down just as quickly. With pay-as-you-go pricing, a failed experiment costs only the short time it ran. AWS describes this as greater speed and agility.
• BIncorrect. AWS does not refund or credit charges because a project was abandoned. The saving comes from paying only for the time resources actually ran.
• CIncorrect. Reserved Instance discounts require a 1-year or 3-year commitment. Short experiments are better suited to On-Demand pricing, which has no commitment.
• DIncorrect. With the cloud you don't need to buy or reserve capacity up front for an experiment, and unused reservations are not refunded.

Answer: A) AWS Artifact

• AAWS Artifact is the self-service portal for downloading AWS's compliance reports and certifications and for accepting agreements like a BAA.
• BTrusted Advisor gives best-practice checks on your account, not AWS's audit reports.
• CQuickSight is a business-intelligence/dashboarding service.
• DSecrets Manager stores and rotates application secrets.

Answer: A) AWS CloudTrail

• ACloudTrail logs management and (optionally) data-plane API calls across the account, providing an audit trail of actions taken by users, roles, and services.
• BCloudWatch collects metrics, logs, and alarms about resource performance and health, not an audit trail of API calls.
• CTrusted Advisor gives best-practice recommendations; it does not record API history.
• DX-Ray traces requests through a distributed application for debugging and performance analysis, not account auditing.

Answer: A) KMS keys never leave AWS KMS unencrypted; large data is encrypted outside KMS with data keys that KMS generates

KMS keys are created, used and kept inside AWS KMS and never leave it unencrypted. For larger data, KMS issues data keys that you use and manage outside the service (envelope encryption).

• ACorrect. KMS keys are protected by FIPS 140-3 validated HSMs and never leave AWS KMS unencrypted. For large amounts of data, KMS generates a data key (plaintext plus an encrypted copy), and you use it outside KMS. This is envelope encryption.
• BIncorrect. Symmetric KMS keys can't be downloaded. To use or manage a KMS key, you call AWS KMS. Only data keys are returned to you for use outside the service.
• CIncorrect. AWS KMS generates, encrypts and decrypts data keys, but it doesn't store, manage or track them, and it doesn't do cryptographic operations with them. You use data keys outside KMS.
• DIncorrect. You can't use AWS managed keys in cryptographic operations directly. Only the AWS service that created them uses them on your behalf. For your own applications, use customer managed keys.

Answer: A) AWS Firewall Manager

• AFirewall Manager centrally configures and manages WAF rules, AWS Shield Advanced protections, security groups, and Network Firewall policies across accounts and resources in an organization.
• BInspector scans workloads for vulnerabilities; it doesn't centrally manage firewall rules.
• CTrusted Advisor makes recommendations but doesn't deploy and enforce firewall policy fleet-wide.
• DMacie classifies sensitive data in S3.

Answer: A) Amazon QuickSight

• AQuickSight is AWS's serverless business-intelligence service for building and sharing interactive dashboards and visualizations over many AWS and external data sources.
• BKinesis ingests and processes real-time streaming data; it isn't a BI dashboard tool.
• CGlue prepares and transforms data; it doesn't provide the dashboards.
• DCloudWatch dashboards visualize operational metrics/logs, not general business data analytics.

Answer: A) AWS Control Tower

• AControl Tower automates creation of a well-architected multi-account environment using AWS Organizations, with preventive and detective guardrails and an account factory for new accounts.
• BConfig is one component used under the hood, but Control Tower is the service that orchestrates the whole landing zone.
• CCloudWatch is a monitoring service.
• DTrusted Advisor offers best-practice checks but doesn't build or govern a multi-account landing zone.

Answer: A) S3 Intelligent-Tiering

• AIntelligent-Tiering automatically moves objects between frequent, infrequent, and archive access tiers based on changing access patterns for a small monitoring fee.
• BS3 Standard keeps everything in one tier at one price regardless of how often objects are used.
• CEBS is block storage without automatic access-pattern tiering.
• DInstance store is ephemeral local disk, not durable tiered object storage.

Answer: A) AWS Transfer Family

• AAWS Transfer Family offers managed SFTP, FTPS, and FTP endpoints that read from and write to Amazon S3 or Amazon EFS, with no servers to run.
• BDataSync is for scheduled bulk transfers between storage systems, not an interactive SFTP endpoint for external partners.
• CCloudFront delivers content out to users; it isn't an SFTP ingestion service.
• DSnowball is a physical device for offline transfer.

Answer: A) A logically isolated section of the AWS Cloud where you define your own IP ranges, subnets, route tables, and gateways

• AA VPC gives you control over a private virtual network in which to launch AWS resources.
• BThat describes Amazon RDS.
• CThat describes Amazon CloudFront.
• DThat describes AWS Lambda.

Answer: A) AWS re:Post (community Q&A) and the AWS Knowledge Center

• AAWS re:Post is a free question-and-answer community, and the Knowledge Center publishes answers to common questions — both available to all customers at no cost.
• BA TAM is included only with Enterprise (and, as a pool, Enterprise On-Ramp) Support.
• CThat requires a Business or higher Support plan.
• DConcierge is an Enterprise Support benefit for billing and account questions.

Answer: A) AWS Countdown

AWS Countdown, which replaced the earlier Infrastructure Event Management offering, helps customers prepare for and run critical planned events. It is included with Enterprise Support, and Countdown Premium is available for more in-depth engagements.

• AAWS Countdown is included with Enterprise Support. It provides readiness reviews and capacity planning before critical events such as launches, migrations, and traffic peaks, plus support while the event is running.
• BThe Well-Architected Tool is a self-service tool for reviewing workloads against best practices. It doesn't give you AWS experts on hand during an event.
• CTrusted Advisor runs automated checks and makes best-practice recommendations. It doesn't provide people working with you before or during an event.
• DThe Health Dashboard shows AWS service events and scheduled changes that affect your account. It offers no event planning help or expert support.