Amazon AWS Certified Cloud Practitioner CLF-C02 Practice Test 24
Question 230
A project manager compares AWS Trusted Advisor with other AWS concepts while considering this need: a small team wants to find certain common AWS account configuration risks through recommendations. Which pairing assigns the responsibilities or benefits correctly?
- AWS Trusted Advisor: assist security investigations; Amazon Detective: meet this requirement: a small team wants to find certain common AWS account configuration risks through recommendations
- AWS Trusted Advisor: meet this requirement: a small team wants to find certain common AWS account configuration risks through recommendations; Amazon Detective: assist security investigations
- AWS Trusted Advisor: enable supported cross-account resource sharing; AWS Resource Access Manager: meet this requirement: a small team wants to find certain common AWS account configuration risks through recommendations
- AWS Trusted Advisor: support documented guidance; AWS Knowledge Center: meet this requirement: a small team wants to find certain common AWS account configuration risks through recommendations
Explanation
Correct Answer
B:The first pairing identifies AWS Trusted Advisor with its actual role: review supported security recommendations in AWS Trusted Advisor. Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits. The comparison is valid because Amazon Detective investigations instead addresses use Amazon Detective to assist security investigations.
Incorrect Answers
A:The roles are swapped. Amazon Detective is associated with use Amazon Detective to assist security investigations; AWS Trusted Advisor instead has the role: Review supported security recommendations in AWS Trusted Advisor. Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
C:The roles are swapped. AWS Resource Access Manager is associated with use AWS Resource Access Manager for supported cross-account resource sharing; AWS Trusted Advisor instead has the role: Review supported security recommendations in AWS Trusted Advisor. Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
D:The roles are swapped. AWS Knowledge Center is associated with use AWS Knowledge Center articles for documented guidance; AWS Trusted Advisor instead has the role: Review supported security recommendations in AWS Trusted Advisor. Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
Question 231
A learner is explaining Refactoring migration to colleagues facing this situation: a business is willing to redesign a tightly coupled application into cloud-native components. Which explanation is MOST accurate?
- Rehosting, often called lift and shift, relocates a workload without significant application redesign.
- Retiring eliminates redundant or unused workloads so migration effort is not spent on systems with no continuing value.
- Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud.
- Retaining is an intentional decision to defer migration when business or technical constraints make an immediate move inappropriate.
Explanation
Correct Answer
C:Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud. The explanation directly connects Refactoring migration to make significant application changes to use cloud-native capabilities for the stated requirement.
Incorrect Answers
A:This statement is true of Rehosting migration, which addresses a company wants to move an existing server-based application to AWS with minimal application changes. It does not explain the particular role of Refactoring migration; Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud.
B:This statement is true of Retiring an application, which addresses an inventory review discovers a legacy reporting system with no users or business dependency. It does not explain the particular role of Refactoring migration; Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud.
D:This statement is true of Retaining a workload, which addresses a business must keep a legacy production system on premises until a contractual restriction expires. It does not explain the particular role of Refactoring migration; Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud.
Question 232
A project manager compares Shared responsibility varies by service with other AWS concepts while considering this need: a technology leader compares the management obligations of EC2, RDS and Lambda. Which pairing assigns the responsibilities or benefits correctly?
- Shared responsibility varies by service: the customer configures identity permissions for access to its own data; Customer IAM permissions: customer operational responsibilities generally decrease as more service layers become AWS-managed
- Shared responsibility varies by service: aWS performs managed database infrastructure tasks such as underlying host and OS maintenance; AWS RDS database infrastructure: customer operational responsibilities generally decrease as more service layers become AWS-managed
- Shared responsibility varies by service: the customer classifies its own data and defines appropriate access requirements; Customer data classification: customer operational responsibilities generally decrease as more service layers become AWS-managed
- Shared responsibility varies by service: customer operational responsibilities generally decrease as more service layers become AWS-managed; Customer IAM permissions: the customer configures identity permissions for access to its own data
Explanation
Correct Answer
D:The first pairing identifies Shared responsibility varies by service with its actual role: customer operational responsibilities generally decrease as more service layers become AWS-managed. Responsibility depends on the service model: managing an EC2 guest OS differs from managing application code on Lambda. The comparison is valid because Customer IAM permissions instead addresses the customer configures identity permissions for access to its own data.
Incorrect Answers
A:The roles are swapped. Customer IAM permissions is associated with the customer configures identity permissions for access to its own data; Shared responsibility varies by service instead has the role: Customer operational responsibilities generally decrease as more service layers become AWS-managed. Responsibility depends on the service model: managing an EC2 guest OS differs from managing application code on Lambda.
B:The roles are swapped. AWS RDS database infrastructure is associated with aWS performs managed database infrastructure tasks such as underlying host and OS maintenance; Shared responsibility varies by service instead has the role: Customer operational responsibilities generally decrease as more service layers become AWS-managed. Responsibility depends on the service model: managing an EC2 guest OS differs from managing application code on Lambda.
C:The roles are swapped. Customer data classification is associated with the customer classifies its own data and defines appropriate access requirements; Shared responsibility varies by service instead has the role: Customer operational responsibilities generally decrease as more service layers become AWS-managed. Responsibility depends on the service model: managing an EC2 guest OS differs from managing application code on Lambda.
Question 233
A learner is explaining Multiple AWS Regions to colleagues facing this situation: a business needs a disaster recovery location outside the primary Region. Which explanation is MOST accurate?
- Deploying across Regions can address geographic disruptions, customer latency and residency objectives at higher complexity.
- Multi-AZ deployments can avoid a single-AZ failure taking down the whole application.
- AWS edge locations support services such as CloudFront and reduce delivery distance for content or requests.
- Global Accelerator provides static anycast IP addresses and routes traffic over the AWS global network to healthy endpoints.
Explanation
Correct Answer
A:Deploying across Regions can address geographic disruptions, customer latency and residency objectives at higher complexity. The explanation directly connects Multiple AWS Regions to use a separate AWS Region as part of a multi-Region continuity plan for the stated requirement.
Incorrect Answers
B:This statement is true of Multiple Availability Zones, which addresses an application must remain available if one Availability Zone experiences an outage. It does not explain the particular role of Multiple AWS Regions; Deploying across Regions can address geographic disruptions, customer latency and residency objectives at higher complexity.
C:This statement is true of AWS edge location, which addresses a global website wants cached content served closer to its end users. It does not explain the particular role of Multiple AWS Regions; Deploying across Regions can address geographic disruptions, customer latency and residency objectives at higher complexity.
D:This statement is true of AWS Global Accelerator, which addresses an internet-facing app has regional endpoints and needs stable global entry points for traffic routing. It does not explain the particular role of Multiple AWS Regions; Deploying across Regions can address geographic disruptions, customer latency and residency objectives at higher complexity.
Question 234
Which AWS service or cloud principle is the BEST fit for this outcome or responsibility: support managed machine learning development workflows?
- Amazon Athena
- Amazon SageMaker AI
- Amazon Quick
- Amazon Lex
Explanation
Correct Answer
B:Amazon SageMaker AI directly addresses this outcome. SageMaker AI supports building, training and deploying ML models rather than simply translating text. A common relevant example is: a machine learning team needs tools to build and deploy custom ML models.
Incorrect Answers
A:Amazon Athena instead focuses on a different requirement, such as an analyst needs to query data already stored in S3 using SQL without provisioning a database server. Athena is a serverless interactive query service for supported data sources such as S3. It is not the primary match for the requirement described here: support managed machine learning development workflows.
C:Amazon Quick instead focuses on a different requirement, such as a business wants dashboards and business intelligence over curated organizational data. Amazon Quick is the current AWS branding for business intelligence capabilities previously associated with QuickSight. It is not the primary match for the requirement described here: support managed machine learning development workflows.
D:Amazon Lex instead focuses on a different requirement, such as a company wants a conversational bot that interprets user requests in a customer service channel. Lex provides conversational AI for chatbots and voice-enabled applications. It is not the primary match for the requirement described here: support managed machine learning development workflows.
Question 235
A learner is explaining Compute commitment flexibility to colleagues facing this situation: finance wants to compare flexible compute consumption with paying less under a usage commitment. Which explanation is MOST accurate?
- S3 storage classes have distinct storage, retrieval and minimum-duration attributes that influence total cost.
- On-Demand pricing gives flexible capacity for irregular or new workloads, generally without the discounts of eligible commitments.
- Commitment options can lower qualifying compute costs, but suitability depends on sustained predictable usage and terms.
- EC2 Spot Instances offer discounted unused capacity but can be reclaimed with interruption notices.
Explanation
Correct Answer
C:Commitment options can lower qualifying compute costs, but suitability depends on sustained predictable usage and terms. The explanation directly connects Compute commitment flexibility to trade some flexibility for eligible discounted capacity or spending commitments for the stated requirement.
Incorrect Answers
A:This statement is true of S3 storage-class pricing, which addresses an archive team needs to compare object storage costs between frequently accessed and rarely retrieved data. It does not explain the particular role of Compute commitment flexibility; Commitment options can lower qualifying compute costs, but suitability depends on sustained predictable usage and terms.
B:This statement is true of On-Demand EC2 pricing, which addresses a company needs compute capacity for a short unpredictable project and does not want a long commitment. It does not explain the particular role of Compute commitment flexibility; Commitment options can lower qualifying compute costs, but suitability depends on sustained predictable usage and terms.
D:This statement is true of Spot Instances, which addresses a research team runs flexible batch processing jobs that can tolerate interruption. It does not explain the particular role of Compute commitment flexibility; Commitment options can lower qualifying compute costs, but suitability depends on sustained predictable usage and terms.
Question 236
An enterprise needs help migrating data from a supported existing database to another endpoint. Which AWS service or cloud concept is the MOST direct match for this need?
- Amazon ElastiCache
- Amazon Aurora
- Amazon DocumentDB
- AWS Database Migration Service
Explanation
Correct Answer
D:AWS Database Migration Service fits the need because database Migration Service helps migrate or replicate supported databases; it is not itself an application database engine. The relevant capability or responsibility is: Use AWS DMS for database transfer and applicable ongoing replication.
Incorrect Answers
A:Amazon ElastiCache is associated with a different use case: a shopping service needs fast in-memory access to frequently requested session information. ElastiCache reduces repeated backend reads by keeping appropriate data in memory for fast access. The question instead focuses on an enterprise needs help migrating data from a supported existing database to another endpoint; AWS Database Migration Service is the more direct match.
B:Amazon Aurora is associated with a different use case: a growing business wants a cloud-optimized managed relational engine compatible with MySQL or PostgreSQL. Aurora is an AWS-managed relational database designed for cloud operation and compatible with selected open-source SQL engines. The question instead focuses on an enterprise needs help migrating data from a supported existing database to another endpoint; AWS Database Migration Service is the more direct match.
C:Amazon DocumentDB is associated with a different use case: an application uses a MongoDB-compatible document data model and wants a managed database. DocumentDB is a managed document database, distinct from relational engines and caching services. The question instead focuses on an enterprise needs help migrating data from a supported existing database to another endpoint; AWS Database Migration Service is the more direct match.
Question 237
A stakeholder is considering AWS IAM Identity Center because employees need centralized workforce access to multiple AWS accounts using corporate identities. What is the MOST relevant capability or benefit?
- Support centralized workforce sign-in and account access
- Require MFA for eligible AWS sign-in identities
- Grant only the permissions necessary to perform approved duties
- Meet this requirement: an application needs temporary AWS credentials after assuming an authorized IAM role
Explanation
Correct Answer
A:Use IAM Identity Center for centralized workforce sign-in and account access. IAM Identity Center connects workforce identities and assigns access across AWS accounts and compatible applications. The stated need is specifically employees need centralized workforce access to multiple AWS accounts using corporate identities.
Incorrect Answers
B:This outcome fits Multi-factor authentication: MFA requires another authentication factor beyond a password and reduces risks from compromised passwords. The stakeholder requires the more specific capability provided by AWS IAM Identity Center, not that separate benefit.
C:This outcome fits Principle of least privilege: Least privilege restricts permissions to required actions and resources rather than granting broad administrator access. The stakeholder requires the more specific capability provided by AWS IAM Identity Center, not that separate benefit.
D:This outcome fits AWS STS role assumption: STS provides temporary credentials for permitted role or federated sessions; it does not issue physical security tokens. The stakeholder requires the more specific capability provided by AWS IAM Identity Center, not that separate benefit.
Question 238
Security engineers want AWS-authored technical articles discussing security practices. Which AWS service or cloud concept is the MOST direct match for this need?
- Official AWS security documentation
- AWS Security Blog guidance
- AWS Shield
- AWS Marketplace
Explanation
Correct Answer
B:AWS Security Blog guidance fits the need because aWS's official security blog explains security topics, unlike a service that enforces network traffic filtering. The relevant capability or responsibility is: Consult the AWS Security Blog for guidance and updates.
Incorrect Answers
A:AWS Certified security documentation is associated with a different use case: a governance team asks where to review public AWS security documentation and service compliance information. AWS official security and compliance pages provide reference material; the customer's own compliance assessment remains necessary. The question instead focuses on security engineers want AWS-authored technical articles discussing security practices; AWS Security Blog guidance is the more direct match.
C:AWS Shield DDoS protection is associated with a different use case: a public application is concerned about distributed denial-of-service traffic. Shield provides managed DDoS protection rather than classifying sensitive objects or managing IAM identities. The question instead focuses on security engineers want AWS-authored technical articles discussing security practices; AWS Security Blog guidance is the more direct match.
D:AWS Marketplace security software is associated with a different use case: a company wants to evaluate a third-party security product compatible with AWS workloads. Marketplace lets customers discover and procure partner solutions; it is not the same as an AWS native security monitoring service. The question instead focuses on security engineers want AWS-authored technical articles discussing security practices; AWS Security Blog guidance is the more direct match.
Question 239
A project manager compares Customer data classification with other AWS concepts while considering this need: a regulated company must identify which of its uploaded records contain sensitive personal information. Which pairing assigns the responsibilities or benefits correctly?
- Customer data classification: customer operational responsibilities generally decrease as more service layers become AWS-managed; Shared responsibility varies by service: the customer classifies its own data and defines appropriate access requirements
- Customer data classification: aWS operates and maintains the managed S3 storage infrastructure; AWS S3 infrastructure durability: the customer classifies its own data and defines appropriate access requirements
- Customer data classification: the customer classifies its own data and defines appropriate access requirements; AWS physical data center security: aWS secures the physical facilities that host its cloud infrastructure
- Customer data classification: aWS secures the physical facilities that host its cloud infrastructure; AWS physical data center security: the customer classifies its own data and defines appropriate access requirements
Explanation
Correct Answer
C:The first pairing identifies Customer data classification with its actual role: the customer classifies its own data and defines appropriate access requirements. AWS cannot determine the business sensitivity of customer content; data classification and applicable handling policies belong to the customer. The comparison is valid because AWS physical data center security instead addresses aWS secures the physical facilities that host its cloud infrastructure.
Incorrect Answers
A:The roles are swapped. Shared responsibility varies by service is associated with customer operational responsibilities generally decrease as more service layers become AWS-managed; Customer data classification instead has the role: The customer classifies its own data and defines appropriate access requirements. AWS cannot determine the business sensitivity of customer content; data classification and applicable handling policies belong to the customer.
B:The roles are swapped. AWS S3 infrastructure durability is associated with aWS operates and maintains the managed S3 storage infrastructure; Customer data classification instead has the role: The customer classifies its own data and defines appropriate access requirements. AWS cannot determine the business sensitivity of customer content; data classification and applicable handling policies belong to the customer.
D:The roles are swapped. AWS physical data center security is associated with aWS secures the physical facilities that host its cloud infrastructure; Customer data classification instead has the role: The customer classifies its own data and defines appropriate access requirements. AWS cannot determine the business sensitivity of customer content; data classification and applicable handling policies belong to the customer.
Question 240
A system needs a programmatic interface to request and manage AWS resources. Which AWS service or cloud concept is the MOST direct match for this need?
- Hybrid cloud deployment
- AWS CLI
- AWS CloudFormation
- AWS service APIs
Explanation
Correct Answer
D:AWS service APIs fits the need because aWS APIs enable programmatic service access; management consoles and SDKs are other ways to use such capabilities. The relevant capability or responsibility is: Interact with AWS services through supported API operations.
Incorrect Answers
A:Hybrid cloud deployment is associated with a different use case: a bank must keep some applications on its own premises while using AWS for other services. A hybrid deployment model uses both on-premises environments and cloud infrastructure rather than moving every workload immediately. The question instead focuses on a system needs a programmatic interface to request and manage AWS resources; AWS service APIs is the more direct match.
B:AWS CLI is associated with a different use case: an operations engineer wants to run repeatable AWS service commands from a terminal script. The AWS CLI exposes AWS service operations through command-line commands suitable for controlled automation. The question instead focuses on a system needs a programmatic interface to request and manage AWS resources; AWS service APIs is the more direct match.
C:AWS CloudFormation is associated with a different use case: a cloud team must define a repeatable infrastructure configuration under version control. CloudFormation uses templates and stacks to create and manage supported AWS resources consistently. The question instead focuses on a system needs a programmatic interface to request and manage AWS resources; AWS service APIs is the more direct match.