Free CLF-C02 practice test: 30 questions with answers

Customers are responsible for configuring and securing their guest operating systems, applications, and data. AWS is responsible for the physical facilities, hardware, and the hypervisor infrastructure.

MFA and limiting root use to the few tasks that require it reduce the risk of takeover and misuse. Root access keys, daily root use, and shared passwords each increase exposure.

IAM policies control which identities can perform which actions on AWS resources. Route 53, Global Accelerator, and CloudFront handle DNS, network routing, and content delivery.

AWS Artifact provides on-demand access to compliance reports such as SOC reports and certifications. Macie discovers sensitive data, Shield protects against DDoS, and Athena queries data.

An IAM role supplies temporary credentials to the compute resource automatically. Keys in source code, shared root keys, and public buckets are all unsafe.

Trusted Advisor checks accounts against best practices across cost, performance, security, and fault tolerance, with prioritized recommendations. Polly, Snowball, and Lightsail are not assessment services.

GuardDuty analyzes account and network activity for threats using managed analysis. Lightsail, Snowball, and Polly do not detect threats.

Default server-side encryption ensures newly stored objects are encrypted at rest. A public policy exposes data, a password in a name is not encryption, and versioning does not encrypt objects.

Availability Zones are isolated locations within a Region, and spreading resources across them improves resilience. A single zone, manual cross-region copies, and one on-premises server do not provide the same automatic resilience.

AWS Lambda runs code in response to events without server management. EC2 requires managing instances, RDS is a managed database service, and Snow devices are for data transfer in the field.

Amazon S3 stores objects durably and provides URLs for retrieval, which suits uploaded images. EBS is block storage attached to an instance, archive tiers are slow to retrieve for active use, and instance temporary disks are lost when the instance stops.

CloudFront is a content delivery network that caches content at edge locations near users. A single-Region EC2 deployment, Direct Connect, and Snowball do not provide global edge caching.

Amazon RDS manages relational engines, including MySQL-compatible ones, with backups and patching handled by the service. DynamoDB is a NoSQL service, self-managed EC2 MySQL requires more work, and S3 files are not a relational database.

Managed platforms such as Elastic Beanstalk handle much of the underlying infrastructure, letting the team focus on application code. Bare-metal, manual hardware, and desktops require the team to manage the infrastructure itself.

Direct Connect provides a dedicated private network connection to AWS with more consistent performance than internet-based connections. CloudFront is a content delivery service, Route 53 is DNS, and Lambda runs code.

Fargate runs containers without the team managing servers or hosts. Self-managed hosts, desktops, and tape archives do not meet the requirement.

Cloud services let customers pay for consumption instead of purchasing hardware in advance, which converts capital spending into variable operating spending. Fixed hardware costs, owned buildings, and fixed capacity contracts describe the traditional model.

Migrating to the cloud moves workloads so that the provider manages the underlying hardware. On-premises and colocation keep ownership of equipment, and mainframe outsourcing is a different model.

Elasticity and pay-as-you-go pricing let capacity and cost follow demand. Fixed capacity, purchase-based peaks, and months-long manual provisioning are the opposite of the cloud benefit.

Designing for failure and decoupling components limits the blast radius of a fault. A single large server, no redundancy, and a single data store all create single points of failure.

A Region is a geographic area with multiple isolated Availability Zones, and each zone contains data centers. The other statements reverse or oversimplify that hierarchy.

Operational excellence and reliability are among the Well-Architected pillars. Unlimited capacity, manual provisioning, and single-Region design are not pillars and run against the framework's guidance.

Consumption-based pricing charges for what is used, which aligns cost with actual demand. Perpetual licenses, hardware investment, and capacity reservations are the opposite model.

The AWS Pricing Calculator estimates the cost of planned architectures. Trusted Advisor reviews existing accounts, CloudWatch monitors metrics, and Config evaluates resource configuration.

Savings Plans and Reserved Instances offer lower prices for committed usage over one or three years. On-Demand has no commitment discount, Spot is interruptible, and Dedicated Hosts are not billed by megabyte.

Consolidated billing through AWS Organizations combines charges from member accounts into one bill. Separate cards, email spreadsheets, and deleting accounts do not consolidate billing.

AWS Budgets sends alerts when spending exceeds thresholds, and Cost Explorer visualizes spending patterns. Macie, Shield, and Artifact serve other purposes.

Cost Explorer visualizes spending over time by service, account, and other dimensions. Artifact provides compliance reports, Config evaluates resource settings, and Macie finds sensitive data.

Enterprise support includes a technical account manager who helps with planning and guidance. Basic and developer plans do not include that level of named technical engagement, and self-service does not mean no support.

Trusted Advisor checks accounts for unused resources, open ports, and other best-practice deviations. Polly, Lightsail, and Snowcone do not provide best-practice checks.