CLF-C02 Practice Exam — CLF-C02：Cloud Practitioner

Option Analysis: A. Option A is incorrect because the 10-day free use period only applies to standard Amazon Snowball (not Snowball Edge) devices, and Snowball Edge does not include 10 days of free appliance use. B. Option B is incorrect because data transfer out from Amazon S3 to a Snowball Edge device is billed at standard AWS data transfer rates, so this activity is not free. C. Option C is correct because AWS does not charge for data transfer in from a Snowball Edge device into Amazon S3, so this activity is available at no cost. D. Option D is incorrect because daily use of a Snowball Edge appliance after the initial period (and for all days of Snowball Edge use generally) incurs usage fees, so this is not free. Key Concept: AWS Snowball Edge pricing follows a model where inbound data transfer into AWS from the device is free, while device usage and outbound data transfer from AWS to the device incur standard charges. References: AWS Snowball Pricing, https://aws.amazon.com/snowball/pricing/ What is AWS Snowball Edge?, https://docs.aws.amazon.com/snowball/latest/developer-guide/what-is-snowball-edge.html

Option Analysis: A. Option A is incorrect because AWS Trusted Advisor provides cost optimization, performance, security, and fault tolerance best practice checks for AWS accounts and infrastructure, but it does not perform application vulnerability assessment on EC2 instances. B. Option B is correct because Amazon Inspector is a vulnerability assessment service that automatically scans EC2 instances and container workloads for application vulnerabilities and deviations from infrastructure best practices. C. Option C is incorrect because AWS Config is used to track, audit, and evaluate configuration changes to AWS resources, it does not assess application vulnerabilities. D. Option D is incorrect because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior on AWS accounts and resources, it does not scan for application vulnerabilities. Key Concept: Amazon Inspector is AWS' dedicated vulnerability management service used to assess EC2 workloads for software vulnerabilities and non-compliant infrastructure configurations. References: Amazon Inspector Documentation, https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html What is Amazon Inspector?, https://aws.amazon.com/inspector/

Option Analysis: A. Option A is incorrect because mounting S3 buckets with third-party utilities is not operationally efficient, does not natively provide consistent local file sharing performance, and requires manual management of individual buckets per user. B. Option B is correct because AWS Storage Gateway file gateway enables on-premises users to mount and access AWS cloud storage as a local file share, extending on-premises storage capacity while retaining local shared file performance, and is operationally efficient for this use case. C. Option C is incorrect because moving all users to Amazon WorkSpaces and WorkDocs is not operationally efficient, as it requires migrating entire working environments rather than just extending existing on-premises file storage. D. Option D is incorrect because an Amazon EBS volume cannot be directly shared simultaneously to multiple on-premises users, and managing shared storage via an EC2 instance is far more operationally intensive than a managed AWS service purpose-built for this use case. Key Concept: AWS Storage Gateway is a hybrid cloud storage service that enables on-premises applications to seamlessly access AWS cloud storage, extending on-premises storage capacity while retaining local file share access and performance. References: What is AWS Storage Gateway?, https://docs.aws.amazon.com/storagegateway/latest/userguide/what-is-storage-gateway.html File Gateway Concepts, https://docs.aws.amazon.com/storagegateway/latest/userguide/file-gateway-concepts.html

Option Analysis: A. This option is incorrect because hardcoding IAM user access keys in application code is a critical security risk that exposes credentials to unauthorized access. B. This option is incorrect because storing IAM access keys in a text file on an EC2 instance is insecure and violates AWS security best practices for credential management. C. This option is correct because using an IAM role assigned to an EC2 instance provides temporary, least-privilege access to S3 without requiring long-term stored credentials, which aligns with AWS security best practices. D. This option is incorrect because allowing any service to upload to the S3 bucket at any time opens the bucket to unauthorized access and data compromise, violating basic security best practices. Key Concept: AWS security best practices for granting EC2 instances access to S3 recommend using IAM roles instead of long-term access credentials to eliminate credential exposure risks. References: IAM roles for Amazon EC2, https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html Security best practices in IAM, https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

Option Analysis: A. Option A is incorrect because physical security of all AWS managed services, including DynamoDB, is an AWS responsibility under the Shared Responsibility Model. B. Option B is incorrect because infrastructure and service patching for managed DynamoDB is handled by AWS, not the customer. C. Option C is correct because managing user access permissions to your own DynamoDB tables is a clear customer responsibility under the AWS Shared Responsibility Model. D. Option D is incorrect because AWS handles encryption of data at rest in DynamoDB by default (AWS owned KMS keys), so this is not a required customer responsibility. Key Concept: Under the AWS Shared Responsibility Model, AWS is responsible for security *of* the cloud, while customers are responsible for security *in* the cloud, including managing access to their own resources. References: AWS Shared Responsibility Model, https://aws.amazon.com/compliance/shared-responsibility-model/ Amazon DynamoDB Security, https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Security.html