Amazon AWS Certified Cloud Practitioner CLF-C02 Practice Test 78
Question 770
A web application needs a managed relational database that supports SQL queries and transactions. Which AWS service or cloud concept is the MOST direct match for this need?
- Amazon Aurora
- Amazon RDS
- Amazon DynamoDB
- Amazon Neptune
Explanation
Correct Answer
B:Amazon RDS fits the need because rDS manages selected database infrastructure work for relational workloads, while users still control database schema and access. The relevant capability or responsibility is: Use Amazon Relational Database Service for supported relational engines.
Incorrect Answers
A:Amazon Aurora is associated with a different use case: a growing business wants a cloud-optimized managed relational engine compatible with MySQL or PostgreSQL. Aurora is an AWS-managed relational database designed for cloud operation and compatible with selected open-source SQL engines. The question instead focuses on a web application needs a managed relational database that supports SQL queries and transactions; Amazon RDS is the more direct match.
C:Amazon DynamoDB is associated with a different use case: a game needs low-latency access to large volumes of key-value player state without managing servers. DynamoDB supports key-value and document data models and is not a general-purpose relational SQL database. The question instead focuses on a web application needs a managed relational database that supports SQL queries and transactions; Amazon RDS is the more direct match.
D:Amazon Neptune is associated with a different use case: a fraud team needs to query relationships and connections among entities. Neptune supports graph data models for workloads centered on relationships among connected entities. The question instead focuses on a web application needs a managed relational database that supports SQL queries and transactions; Amazon RDS is the more direct match.
Question 771
A project manager compares Managed service operations with other AWS concepts while considering this need: an analytics team prefers a managed database rather than operating its own database host. Which pairing assigns the responsibilities or benefits correctly?
- Managed service operations: protect stored objects against underlying component failures; Storage durability: reduce routine infrastructure management by consuming a managed service
- Managed service operations: increase a system's capacity to handle a larger ongoing workload; Scalability: reduce routine infrastructure management by consuming a managed service
- Managed service operations: reduce routine infrastructure management by consuming a managed service; Storage durability: protect stored objects against underlying component failures
- Managed service operations: plan for sustained essential operations and recovery after disruptive events; Business continuity: reduce routine infrastructure management by consuming a managed service
Explanation
Correct Answer
C:The first pairing identifies Managed service operations with its actual role: reduce routine infrastructure management by consuming a managed service. Managed AWS offerings take on selected provisioning and maintenance tasks while customers remain responsible for their data and access policies. The comparison is valid because Storage durability instead addresses protect stored objects against underlying component failures.
Incorrect Answers
A:The roles are swapped. Storage durability is associated with protect stored objects against underlying component failures; Managed service operations instead has the role: Reduce routine infrastructure management by consuming a managed service. Managed AWS offerings take on selected provisioning and maintenance tasks while customers remain responsible for their data and access policies.
B:The roles are swapped. Scalability is associated with increase a system's capacity to handle a larger ongoing workload; Managed service operations instead has the role: Reduce routine infrastructure management by consuming a managed service. Managed AWS offerings take on selected provisioning and maintenance tasks while customers remain responsible for their data and access policies.
D:The roles are swapped. Business continuity is associated with plan for sustained essential operations and recovery after disruptive events; Managed service operations instead has the role: Reduce routine infrastructure management by consuming a managed service. Managed AWS offerings take on selected provisioning and maintenance tasks while customers remain responsible for their data and access policies.
Question 772
A stakeholder is considering Amazon CloudWatch because operations needs metrics and alarms for an AWS workload's performance. What is the MOST relevant capability or benefit?
- Evaluate customer controls and obligations alongside AWS's assurance documentation
- Enable applicable data-at-rest encryption on storage services
- Track configuration changes and evaluate resource compliance over time
- Monitor metrics, logs and alarm conditions for workloads
Explanation
Correct Answer
D:Monitor metrics, logs and alarm conditions with Amazon CloudWatch. CloudWatch supplies monitoring and observability signals, not an authoritative history of every API management change. The stated need is specifically operations needs metrics and alarms for an AWS workload's performance.
Incorrect Answers
A:This outcome fits AWS compliance shared model: AWS compliance programs cover AWS's side of applicable frameworks, while customers must evaluate and satisfy their own duties. The stakeholder requires the more specific capability provided by Amazon CloudWatch, not that separate benefit.
B:This outcome fits Encryption at rest: Encryption at rest protects stored data against certain exposure risks, not data traveling across the network. The stakeholder requires the more specific capability provided by Amazon CloudWatch, not that separate benefit.
C:This outcome fits AWS Config resource history: AWS Config tracks supported resource configuration history and rules rather than serving as a generic application log service. The stakeholder requires the more specific capability provided by Amazon CloudWatch, not that separate benefit.
Question 773
A stakeholder is considering Customer choice of AWS Region because a business contract requires some client records to remain in a specified geographic jurisdiction. What is the MOST relevant capability or benefit?
- The customer selects where to deploy and store its workloads to meet residency rules
- AWS maintains the physical host and underlying cloud virtualization infrastructure
- AWS performs managed database infrastructure tasks such as underlying host and OS maintenance
- The customer classifies its own data and defines appropriate access requirements
Explanation
Correct Answer
A:The customer selects where to deploy and store its workloads to meet residency rules. AWS provides available Regions, while the customer chooses deployment locations to meet its legal and organizational obligations. The stated need is specifically a business contract requires some client records to remain in a specified geographic jurisdiction.
Incorrect Answers
B:This outcome fits AWS EC2 host infrastructure: AWS is responsible for facilities, physical servers and underlying cloud infrastructure for EC2. The stakeholder requires the more specific capability provided by Customer choice of AWS Region, not that separate benefit.
C:This outcome fits AWS RDS database infrastructure: RDS reduces operational work compared with a self-managed database, but does not remove customer responsibilities for data and access. The stakeholder requires the more specific capability provided by Customer choice of AWS Region, not that separate benefit.
D:This outcome fits Customer data classification: AWS cannot determine the business sensitivity of customer content; data classification and applicable handling policies belong to the customer. The stakeholder requires the more specific capability provided by Customer choice of AWS Region, not that separate benefit.
Question 774
A learner is explaining Automation savings to colleagues facing this situation: a department repeatedly creates and deletes temporary test environments by hand. Which explanation is MOST accurate?
- Variable cost follows utilization or usage rather than remaining fixed at a pre-purchased capacity level.
- Automation can reduce manual effort and mistakes while making temporary resources easier to retire.
- Total cost of ownership considers direct and indirect costs, not only an instance hourly price.
- Idle provisioned resources may continue to generate charges; matching uptime to need reduces wasted spending.
Explanation
Correct Answer
B:Automation can reduce manual effort and mistakes while making temporary resources easier to retire. The explanation directly connects Automation savings to reduce repetitive administrative work through consistent automation for the stated requirement.
Incorrect Answers
A:This statement is true of Variable costs, which addresses a retailer wants lower cloud expenses during months with fewer transactions. It does not explain the particular role of Automation savings; Automation can reduce manual effort and mistakes while making temporary resources easier to retire.
C:This statement is true of Total cost of ownership, which addresses a finance director compares AWS migration with building another private data center. It does not explain the particular role of Automation savings; Automation can reduce manual effort and mistakes while making temporary resources easier to retire.
D:This statement is true of Idle resource spending, which addresses an internal testing account leaves unused compute instances running every weekend. It does not explain the particular role of Automation savings; Automation can reduce manual effort and mistakes while making temporary resources easier to retire.
Question 775
A stakeholder is considering AWS KMS because an application team needs centralized control of encryption key use and auditability. What is the MOST relevant capability or benefit?
- Monitor metrics, logs and alarm conditions for workloads
- Retrieve AWS compliance reports and related agreements using AWS Artifact
- Enable supported cryptographic key management
- Record account API activity and identify the calling principal
Explanation
Correct Answer
C:Use AWS Key Management Service for supported cryptographic key management. AWS KMS manages keys and enforces key-use controls for integrated services; it is not a general database service. The stated need is specifically an application team needs centralized control of encryption key use and auditability.
Incorrect Answers
A:This outcome fits Amazon CloudWatch monitoring: CloudWatch supplies monitoring and observability signals, not an authoritative history of every API management change. The stakeholder requires the more specific capability provided by AWS KMS, not that separate benefit.
B:This outcome fits AWS Artifact compliance reports: AWS Artifact gives customers on-demand access to available AWS assurance reports and selected compliance agreements. The stakeholder requires the more specific capability provided by AWS KMS, not that separate benefit.
D:This outcome fits AWS CloudTrail API auditing: CloudTrail helps audit actions performed through the console, SDK and API; it differs from performance metrics. The stakeholder requires the more specific capability provided by AWS KMS, not that separate benefit.
Question 776
Within the Security and Compliance domain, which business example MOST clearly illustrates AWS STS, rather than a different AWS concept?
- A team needs to assign the same AWS permissions to several IAM users
- An application needs controlled storage and rotation of a database password
- A company needs a document specifying allowed or denied AWS actions on selected resources
- An application needs temporary AWS credentials after assuming an authorized IAM role
Explanation
Correct Answer
D:The decisive requirement is: Obtain session credentials through AWS Security Token Service. This is the role of AWS STS. STS provides temporary credentials for permitted role or federated sessions; it does not issue physical security tokens.
Incorrect Answers
A:This describes a scenario for IAM groups: use an IAM group to manage shared user permissions. IAM groups collect IAM users for permissions management; they are not assumed identities like IAM roles. It is not the most direct example of AWS STS.
B:This describes a scenario for AWS Secrets Manager: store and manage application secrets with AWS Secrets Manager. Secrets Manager manages sensitive credentials and supports rotation workflows; IAM policies determine who may retrieve a secret. It is not the most direct example of AWS STS.
C:This describes a scenario for IAM policies: use IAM policy statements that define access permissions. An IAM policy expresses permissions; it is not itself a human identity or a network firewall. It is not the most direct example of AWS STS.
Question 777
A learner is explaining AWS Snow Family to colleagues facing this situation: an organization must transfer a very large volume of data from a remote site with insufficient network bandwidth. Which explanation is MOST accurate?
- AWS Snow devices support moving large datasets when transferring everything over a network is slow or constrained.
- Relocating retains much of the underlying virtualization model while shifting where it runs.
- Retaining is an intentional decision to defer migration when business or technical constraints make an immediate move inappropriate.
- AWS DMS can transfer data and support change data capture for applicable database migration scenarios.
Explanation
Correct Answer
A:AWS Snow devices support moving large datasets when transferring everything over a network is slow or constrained. The explanation directly connects AWS Snow Family to use physical AWS data transfer devices where online transfer is impractical for the stated requirement.
Incorrect Answers
B:This statement is true of Relocating a workload, which addresses a company can move a supported virtualized environment to AWS while maintaining its familiar virtualization stack. It does not explain the particular role of AWS Snow Family; AWS Snow devices support moving large datasets when transferring everything over a network is slow or constrained.
C:This statement is true of Retaining a workload, which addresses a business must keep a legacy production system on premises until a contractual restriction expires. It does not explain the particular role of AWS Snow Family; AWS Snow devices support moving large datasets when transferring everything over a network is slow or constrained.
D:This statement is true of AWS Database Migration Service, which addresses a company wants to transfer database content to AWS while limiting downtime. It does not explain the particular role of AWS Snow Family; AWS Snow devices support moving large datasets when transferring everything over a network is slow or constrained.
Question 778
A learner is explaining Amazon GuardDuty to colleagues facing this situation: a security team wants managed detection of suspicious activity from AWS account and workload signals. Which explanation is MOST accurate?
- AWS Config tracks supported resource configuration history and rules rather than serving as a generic application log service.
- GuardDuty analyzes signals for suspicious or malicious behavior rather than acting as a general-purpose firewall.
- Encryption in transit protects communications over networks; it differs from encryption of data stored on disks.
- CloudHSM provides customer-controlled HSM capacity for supported workloads requiring hardware-backed cryptographic operations.
Explanation
Correct Answer
B:GuardDuty analyzes signals for suspicious or malicious behavior rather than acting as a general-purpose firewall. The explanation directly connects Amazon GuardDuty to use Amazon GuardDuty to identify potential threats from supported telemetry for the stated requirement.
Incorrect Answers
A:This statement is true of AWS Config resource history, which addresses an organization must inspect how an AWS resource configuration changed over time. It does not explain the particular role of Amazon GuardDuty; GuardDuty analyzes signals for suspicious or malicious behavior rather than acting as a general-purpose firewall.
C:This statement is true of Encryption in transit, which addresses a company wants to protect data while it moves between clients and an online service. It does not explain the particular role of Amazon GuardDuty; GuardDuty analyzes signals for suspicious or malicious behavior rather than acting as a general-purpose firewall.
D:This statement is true of AWS CloudHSM hardware keys, which addresses a company needs dedicated hardware security modules for particular cryptographic key requirements. It does not explain the particular role of Amazon GuardDuty; GuardDuty analyzes signals for suspicious or malicious behavior rather than acting as a general-purpose firewall.
Question 779
A stakeholder is considering Repurchasing migration because an organization replaces its custom on-premises collaboration tool with a commercial SaaS subscription. What is the MOST relevant capability or benefit?
- Organize organizational readiness across AWS CAF perspectives
- Make significant application changes to use cloud-native capabilities
- Replace an existing application with a different product or SaaS solution
- Leave a selected workload in its existing environment for now
Explanation
Correct Answer
C:Replace an existing application with a different product or SaaS solution. Repurchasing changes the software product consumed instead of moving the same application stack. The stated need is specifically an organization replaces its custom on-premises collaboration tool with a commercial SaaS subscription.
Incorrect Answers
A:This outcome fits AWS Cloud Adoption Framework: AWS CAF helps align business and technology stakeholders throughout cloud adoption instead of treating migration as a server-copy exercise. The stakeholder requires the more specific capability provided by Repurchasing migration, not that separate benefit.
B:This outcome fits Refactoring migration: Refactoring transforms the application architecture, rather than simply moving the existing runtime to the cloud. The stakeholder requires the more specific capability provided by Repurchasing migration, not that separate benefit.
D:This outcome fits Retaining a workload: Retaining is an intentional decision to defer migration when business or technical constraints make an immediate move inappropriate. The stakeholder requires the more specific capability provided by Repurchasing migration, not that separate benefit.
Question 780
A learner is explaining AWS Trusted Advisor to colleagues facing this situation: a small team wants to find certain common AWS account configuration risks through recommendations. Which explanation is MOST accurate?
- Detective correlates supported signals for investigation; GuardDuty focuses on finding potential threats.
- Knowledge Center provides guidance and answers; it is an information resource, not an active security enforcement tool.
- AWS RAM manages sharing of eligible AWS resources with other accounts or organizational units, subject to permissions.
- Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
Explanation
Correct Answer
D:Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits. The explanation directly connects AWS Trusted Advisor to review supported security recommendations in AWS Trusted Advisor for the stated requirement.
Incorrect Answers
A:This statement is true of Amazon Detective investigations, which addresses an analyst wants to investigate relationships among security findings after suspicious activity is detected. It does not explain the particular role of AWS Trusted Advisor; Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
B:This statement is true of AWS Knowledge Center, which addresses an AWS user wants AWS-authored answers to common service troubleshooting and account questions. It does not explain the particular role of AWS Trusted Advisor; Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.
C:This statement is true of AWS Resource Access Manager, which addresses two AWS accounts in one organization need to share supported resources without duplicating them. It does not explain the particular role of AWS Trusted Advisor; Trusted Advisor provides best-practice guidance in supported categories including security, cost and service limits.