Free Amazon Web Services CLF-C02 Practice Exam with Questions & Answers | Set: 2

 Amazon Route 53 and AWS WAF are AWS services that can be configured at the Region level. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service that lets you register domain names, route traffic to resources, and check the health of your resources. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. Amazon EC2, Amazon CloudFront, and Amazon DynamoDB are AWS services that can be configured at the global level or the Availability Zone level .

According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of configuring the AWS provided security group firewall and classifying company assets in the AWS Cloud. A security group is a virtual firewall that controls the inbound and outbound traffic for one or more EC2 instances. The customer must configure the security group rules to allow or deny traffic based on protocol, port, or source and destination IP address2 Classifying company assets in the AWS Cloud means identifying the types, categories, and sensitivity levels of the data and resources that the customer stores and processes on AWS. The customer must also determine the applicable compliance requirements and regulations that apply to their assets, and implement the appropriate security controls and measures to protect them

S3 Versioning is a feature that allows you to keep multiple versions of an object in the same bucket. You can use S3 Versioning to protect your data from accidental deletion or overwriting by enabling it on a bucket or a specific object. S3 Versioning also allows you to restore previous versions of an object if needed. S3 Lifecycle rules are used to automate the transition of objects between storage classes or to expire objects after a certain period of time. S3 bucket policies are used to control access to the objects in a bucket. S3 server-side encryption is used toencrypt the data at rest in S3. References: S3 Versioning, S3 Lifecycle rules, S3 bucket policies, S3 server-side encryption

AWS Business Support is the minimum recommended tier for users who have production workloads on AWS. AWS Business Support provides 24x7 access to cloud support engineers via phone, chat, or email, as well as a guaranteed response time of less than one hour for urgent issues. AWS Business Support also includes access to AWS Trusted Advisor, a tool that provides real-time guidance to help you provision your resources following AWS best practices4.

 A and B are correct because AWS CodeCommit is the AWS service that provides a fully managed source control service that hosts secure Git-based repositories1, and AWS CodeDeploy is the AWS service that automates code deployments to any instance, including Amazon EC2 instances and servers running on-premises2. These two services can be used together to store source code and update the running software when the code changes. C is incorrect because Amazon DynamoDB is the AWS service that provides a fully managed NoSQL database service that supports key-value and document data models3. It is not related to storing source code or updating software. D is incorrect because Amazon S3 is the AWS service that provides object storage through a web service interface4. It can be used to store source code, but it does not provide source control features or update software. E is incorrect because Amazon Elastic Container Service (Amazon ECS) is the AWS service that allows users to run, scale, and secure Docker container applications. It can be used to deploy containerized software, but it does not store source code or update software.

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

AWS cost allocation tags are the feature designed to organize resources and attribute their costs at a detailed level. A tag is a key-value label applied either by the customer or by AWS. After an eligible cost allocation tag is activated in the Billing and Cost Management console, AWS can use that tag in cost-management data and reports, allowing charges to be grouped by values such as application, project, department, environment, or cost center. This makes option A the direct match for both “track” and “categorize expenditures.” Consolidated billing combines billing and usage across accounts in AWS Organizations, but it is not itself a resource-labeling mechanism. AWS Budgets compares cost or usage against thresholds and can generate alerts or actions; it does not provide the requested detailed categorization method. AWS Marketplace is a catalog and procurement channel for third-party and AWS software, data, and professional services, not a cost-allocation feature. Therefore, cost allocation tags are the specific AWS capability described in the question.

AWS Elastic Beanstalk is a service that allows you to deploy and manage applications on AWS without manually creating and configuring the required resources, such as EC2 instances, load balancers, security groups, databases, and more. AWS Elastic Beanstalk automatically handles the provisioning, scaling, load balancing, health monitoring, and updating of your application, while giving you full control over the underlying AWS resources if needed. AWS Elastic Beanstalk supports a variety of platforms and languages, such as Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker. You can use the AWS Management Console, the AWS CLI, the AWS SDKs, or the AWS Elastic Beanstalk API to create and manage your applications. You can also use AWS CodeStar, AWS CodeCommit, AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline to integrate AWS Elastic Beanstalk with your development and deployment workflows12

Using multiple Availability Zones within the same AWS Region meets the requirements for having instances in different locations with independent power and networking. Availability Zones are distinct physical locations within a region, each with separate power sources and networking. Edge locations are used for content delivery, and Amazon Connect and AWS Artifact locations are not relevant to EC2 deployment and infrastructure.

Amazon Relational Database Service reduces database administration work by managing common operational tasks. AWS documentation states that Amazon RDS manages activities including database backups, software patching, automatic failure detection, and recovery. Customers can configure settings such as backup retention periods and maintenance windows, while RDS performs the underlying managed operations. Therefore, option C is correct. Amazon RDS does not automatically guarantee better query performance than a self-managed database. Query performance depends on database design, indexing, SQL queries, instance sizing, data distribution, and workload characteristics, and customers remain responsible for query tuning. RDS also supports a defined set of database engines rather than necessarily supporting more engines than any self-managed environment. Automatic horizontal scaling for both read and write workloads is not a general feature of every RDS engine or configuration. Some engines support read replicas or specialized scaling features, but these are not equivalent to universal automatic horizontal scaling for all database operations. The primary managed-service benefit described in the question is reduced administrative effort because AWS performs routine database infrastructure maintenance, backups, and patching on the customer’s behalf.

AWS Elastic Beanstalk is a managed service that facilitates the deployment and management of applications in the AWS Cloud. It supports multiple programming languages and frameworks, allowing users to deploy web applications without managing the underlying infrastructure. Elastic Beanstalk automatically handles deployment, capacity provisioning, load balancing, and auto-scaling. The other services listed, like CodeGuru, Fargate, and CodeCommit, do not provide full application deployment and management capabilities.

Amazon RDS is a managed database service that handles most of the common database administration tasks, such as hardware provisioning, server maintenance, backup and recovery, patching, scaling, and replication. However, Amazon RDS does not optimize the application that interacts with the database. The company is stillresponsible for tuning the performance, security, and availability of the application according to its business requirements and best practices12.

AWS Artifact provides on-demand access to AWS security and compliance documents. AWS specifically lists reports and certifications related to International Organization for Standardization standards, Payment Card Industry standards, and System and Organization Controls reports among the documents available through Artifact. Customers can download applicable reports and provide them to auditors or regulators according to the document’s terms. Therefore, option A is correct. Amazon CloudWatch monitors applications and AWS resources by collecting metrics, logs, alarms, and events. AWS Config records resource configurations and evaluates them against desired compliance rules, but it does not serve as the repository for AWS ISO audit reports. AWS Audit Manager helps automate the collection and organization of evidence for customer audits based on configured frameworks. It can assist a company with assessing its own environment, but AWS Artifact is the service used to obtain AWS-issued compliance documentation and certifications. For foundational questions, distinguish AWS Artifact, which supplies AWS compliance reports and agreements, from Audit Manager, which helps customers gather evidence and manage their own audit assessments.

According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, which includes the virtualization layer down to the physical security of the facilities in which AWSservices operate1. The customer is responsible for the security in the cloud, which includes the configuration and management of the AWS resources and applications that they use1.

According to the AWS shared responsibility model, the customer is responsible for security in the cloud, which includes the tasks of managing data encryption and granting least privilege access to IAM users. Data encryption is the process of transforming data into an unreadable format that canonly be accessed with a key or a password. The customer must decide whether to encrypt their data at rest (when it is stored on AWS) or in transit (when it is moving between AWS and the customer or between AWS services). The customer must also choose the encryption method, algorithm, and key management solution that best suit their needs. AWS provides various services and features that support data encryption, such as AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM), and AWS Encryption SDK5 IAM users are entities that represent the people or applications that interact with AWS resources and services. The customer must grant the IAM users the minimum permissions that they need to perform their tasks, and avoid giving them unnecessary or excessive access. This is known as the principle of least privilege, and it helps reduce the risk of unauthorized or malicious actions. The customer can use IAM policies, roles, groups, and permissions boundaries to manage the access of IAM users.