CLF-C02 Practice Questions

Amazon ElastiCache is a fully managed in-memory data store and caching service. It directly meets the requirements by supporting two popular open-source in-memory engines: Redis and Memcached. This service is designed to improve application performance by providing fast, in-memory data access, which aligns perfectly with the need for an "in-memory data store that is compatible with open source." It is used for caching, session management, gaming leaderboards, and real-time analytics, all of which benefit from low-latency, in-memory data retrieval.

A. Amazon DynamoDB is a NoSQL database that primarily stores data on solid-state drives (SSDs), not an in-memory data store.

C. Amazon Elastic Block Store (Amazon EBS) provides persistent block-level storage volumes (like a hard drive) for EC2 instances, not an in-memory data store.

D. Amazon Redshift is a data warehousing service optimized for large-scale data analytics, storing data on disk in a columnar format.

1. AWS Documentation

"What Is Amazon ElastiCache?": "Amazon ElastiCache is a web service that makes it easy to set up

manage

and scale a distributed in-memory data store or cache environment in the cloud. [...] Amazon ElastiCache supports the most popular open-source in-memory caching engines

Redis and Memcached."

Source: Amazon ElastiCache for Redis User Guide

"What Is Amazon ElastiCache?"

Introduction.

2. AWS Documentation

"Databases on AWS": This overview page categorizes AWS database services. ElastiCache is listed under "In-memory databases

" while DynamoDB is under "Key-value databases

" Redshift is under "Data warehouse

" and EBS is a storage service

not a database.

Source: AWS Official Website

"Databases on AWS"

Service comparison section.

3. AWS Documentation

"What is Amazon DynamoDB?": "Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. [...] DynamoDB stores data on solid state drives (SSDs)."

Source: Amazon DynamoDB Developer Guide

"What is Amazon DynamoDB?"

Introduction.

4. AWS Documentation

"Amazon Elastic Block Store (Amazon EBS)": "Amazon Elastic Block Store (EBS) is an easy-to-use

high-performance block-storage service designed for use with Amazon Elastic Compute Cloud (EC2) for both throughput and transaction-intensive workloads at any scale."

Source: Amazon EBS User Guide

"Amazon Elastic Block Store (Amazon EBS)"

Introduction.

The AWS Well-Architected Framework is a guide that helps cloud architects build secure, high-performing, resilient, and efficient infrastructure for their applications. It provides a consistent approach for customers and partners to evaluate architectures and implement designs that can scale over time. The framework is based on five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization. The question's description of "reliable, secure, efficient, and cost-effective systems" directly aligns with the core purpose and pillars of the AWS Well-Architected Framework.

A. AWS Serverless Application Model (SAM) is a specific framework for developing and deploying serverless applications, not a general guide for all cloud architectural best practices.

B. AWS Business Support is a paid support tier that provides technical assistance and guidance, not a foundational framework for designing cloud architectures.

C. The principle of least privilege is a fundamental security concept and a best practice within the Security Pillar, but it is not the overarching framework itself.

1. AWS Well-Architected Framework Documentation. (n.d.). AWS Architecture Center. Retrieved from AWS. "The AWS Well-Architected Framework helps you understand the pros and cons of decisions you make while building systems on AWS. By using the Framework

you will learn architectural best practices for designing and operating reliable

secure

efficient

cost-effective

and sustainable systems in the cloud." - Section: "What is the AWS Well-Architected Framework?".

2. AWS Well-Architected Framework Whitepaper. (July 2023). AWS. "This paper is intended for those in technology roles

such as chief technology officers (CTOs)

architects

developers

and operations team members. It describes the AWS Well-Architected Framework. It provides guidance to help you apply best practices in the design

delivery

and maintenance of AWS environments." - Page 1

Introduction.

3. Security Pillar - AWS Well-Architected Framework. (July 2023). AWS Whitepaper. "SEC 3: How do you manage identities for people and machines? ... Best practices: ... Apply least privilege: Grant principals (people and machines) only the permissions required to perform their duties." - Page 10.

4. What is the AWS Serverless Application Model (AWS SAM)? (n.d.). AWS Documentation. Retrieved from AWS. "The AWS Serverless Application Model (AWS SAM) is an open-source framework that you can use to build serverless applications on AWS." - Section: "What is the AWS Serverless Application Model (AWS SAM)?".

AWS Managed Services (AMS) is designed for companies that need operational assistance with their AWS environment. AMS provides the expertise to manage AWS infrastructure, which includes helping customers with migration. It offers a full-lifecycle service, from planning and migrating workloads to ongoing operational management, security, and cost optimization. This directly addresses the scenario where a company lacks the internal expertise to migrate and manage its workloads on AWS, as AMS effectively acts as an extension of the customer's team.

A. AWS Trusted Advisor is an automated tool that provides recommendations for cost optimization, security, and performance. It does not provide the hands-on expertise required to perform a migration.

B. AWS Consulting Partners are third-party professional services firms that help customers migrate to AWS. While a valid way to get expertise, AWS Managed Services is a direct AWS service that provides this capability, making it a more specific answer in the context of AWS services.

C. AWS Artifact is a service that provides on-demand access to AWS's security and compliance reports. It is used for auditing and compliance purposes, not for migration assistance.

1. AWS Managed Services (AMS): The official AWS documentation states

"AWS Managed Services (AMS) helps you operate your AWS infrastructure more efficiently and securely... AMS helps enterprise customers with migration

and provides a full-lifecycle service to operate their environment."

Source: AWS Managed Services

"How it works

" aws.amazon.com/managed-services/.

2. AWS Consulting Partners: The AWS Partner Network documentation describes them as

"APN Consulting Partners are professional services firms that help customers of all types and sizes design

architect

build

migrate

and manage their workloads and applications on AWS." This confirms their role but distinguishes them as third-party firms

whereas AMS is a first-party AWS service.

Source: AWS Partner Network

"APN Consulting Partners

" aws.amazon.com/partners/consulting/.

3. AWS Trusted Advisor: The official service page states

"AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices." This clarifies its role as an advisory tool

not a managed service.

Source: AWS Trusted Advisor

"Features

" aws.amazon.com/premiumsupport/technology/trusted-advisor/.

4. AWS Artifact: The official service page describes its function: "AWS Artifact is your go-to

central resource for compliance-related information that matters to you." This confirms it is a compliance tool

unrelated to migration execution.

Source: AWS Artifact

"Product Details

" aws.amazon.com/artifact/.

Cost allocation tags are key-value pairs that you can apply to AWS resources. When activated in the AWS Billing and Cost Management console, these tags are used to organize and track costs on a detailed level. By assigning tags such as department:finance or project:alpha to resources, a company can categorize its spending and generate cost allocation reports that break down AWS costs by these specific business dimensions, directly fulfilling the requirement.

A. Consolidated billing: This feature of AWS Organizations aggregates costs from multiple accounts into a single bill but does not, by itself, provide granular cost tracking by project or department.

C. AWS Marketplace: This is a digital catalog for finding, buying, and deploying third-party software and services. It is not a tool for tracking internal AWS resource costs.

D. AWS Budgets: This service is used to set spending limits and receive alerts when costs exceed a threshold. While budgets can be filtered by tags, the tags themselves are the feature used to implement the tracking.

1. AWS Billing and Cost Management User Guide: "You can use tags to organize your resources

and cost allocation tags to track your AWS costs on a detailed level. After you activate cost allocation tags

AWS uses the cost allocation tags to organize your resource costs on your cost allocation report. This makes it easier for you to categorize and track your AWS costs."

Source: AWS Documentation

Billing and Cost Management User Guide

"Using cost allocation tags".

2. AWS Billing and Cost Management User Guide: "You can use the consolidated billing feature in AWS Organizations to consolidate billing and payment for multiple AWS accounts... Consolidated billing doesn't change anything about the services that are offered to each account."

Source: AWS Documentation

Billing and Cost Management User Guide

"Consolidated billing for AWS Organizations".

3. AWS Budgets User Guide: "AWS Budgets allows you to set custom budgets to track your cost and usage... You can create budgets at the monthly

quarterly

or yearly level

and customize the start and end dates. Budget alerts can be sent through Amazon SNS

email

or both."

Source: AWS Documentation

AWS Budgets User Guide

"Managing your costs with AWS Budgets".

Resource elasticity is a core value proposition of AWS and cloud computing. It refers to the ability to acquire resources as you need them and release resources when you no longer need them. This allows you to automatically scale your infrastructure up (scale-out) to meet increasing demand and scale it down (scale-in) during quieter periods. This eliminates the need for guessing capacity upfront, ensuring you only pay for the resources you actually consume, thereby optimizing both performance and cost.

A. Speed of innovation: This value proposition relates to the agility and reduced time-to-market for developing and deploying new applications, not the scaling of infrastructure capacity.

C. Decoupled architecture: This is a system design principle where components are loosely coupled. While it facilitates scalability, it is an architectural pattern, not the value proposition of scaling itself.

D. Global deployment: This refers to the ability to easily deploy applications in multiple geographic regions around the world, which is about reach and latency reduction, not scaling based on demand.

---

1. AWS Whitepaper

"Overview of Amazon Web Services" (August 2023): In the section "The Benefits of AWS

" the document states

"Instead of waiting weeks or months for hardware

you can instantly deploy new applications

instantly scale up as your workload grows

and instantly scale down based on demand." This directly describes elasticity. (p. 4)

2. AWS Documentation

"What is Cloud Computing?": Under the section "Six Advantages of Cloud Computing

" the principle "Stop guessing capacity" is explained: "With cloud computing

you can access as much or as little capacity as you need

and scale up and down as required with only a few minutes’ notice." This is the definition of elasticity.

3. AWS Whitepaper

"AWS Cloud Adoption Framework: An Actionable Guide to Cloud Transformation" (July 2021): The "Platform Perspective" of the CAF focuses on principles for implementing new solutions and migrating workloads. It emphasizes the capability to "scale IT resources up and down based on business or workload demands

" which is a direct reference to resource elasticity. (p. 13)

The practice of simulating workflows, often referred to as "game days" or "drills," is a core component of the AWS Well-Architected Framework's design principle to "Refine operation procedures frequently." This principle emphasizes the continuous improvement of processes. By regularly testing procedures through simulations, a company can validate their effectiveness, identify areas for improvement, and ensure that staff are well-practiced and familiar with their roles during operational events. This proactive approach helps to evolve procedures in line with the changing workload and business requirements, directly aligning with the described activity.

A. Perform operations as code. This principle focuses on automating infrastructure and operational tasks using code (e.g., AWS CloudFormation), which is different from the manual or simulated review and validation of processes by staff.

C. Make frequent, small, reversible changes. This principle relates to deployment and change management strategies that minimize the impact of failures. It does not directly address the practice of testing and validating entire operational workflows.

D. Structure the company to support business outcomes. This is a perspective of the AWS Cloud Adoption Framework (CAF), not a design principle of the AWS Well-Architected Framework, which the question specifically asks about.

1. AWS Well-Architected Framework Whitepaper (July 2023):

Page 29

"Operational Excellence Pillar

" Section "Design Principles

" Sub-section "Refine operations procedures frequently": "As you evolve your workload

your procedures must evolve as well. ... Use game days to regularly exercise your procedures and check their effectiveness and that teams are familiar with them." This directly supports the correct answer by linking the practice of simulating/exercising procedures (game days) to this specific design principle.

Page 29

"Operational Excellence Pillar

" Section "Design Principles

" Sub-section "Perform operations as code": "In the cloud

you can apply the same engineering discipline that you use for application code to your entire environment. You can define your entire workload (applications

infrastructure

etc.) as code and update it with code." This clarifies why option A is incorrect.

2. AWS Documentation

"Operational Excellence Pillar - AWS Well-Architected Framework":

Section "Design Principles

" Sub-section "OPS 3: Refine operations procedures frequently": "Establish a process for reviewing and validating your procedures. Use game days to regularly exercise your procedures and check their effectiveness and that teams are familiar with them." This source reiterates the connection between game days (simulations) and refining procedures.

Amazon Inspector is an AWS-native automated vulnerability management service designed to continually scan AWS workloads, including Amazon EC2 instances, for software vulnerabilities and unintended network exposure. It provides a detailed list of findings prioritized by severity, helping users improve the security and compliance of their applications. Using an AWS-managed service like Inspector is an inherently approved method for conducting security assessments on the specified resources.

A. Flooding a target with requests describes a Denial of Service (DoS) attack, which is a prohibited activity under the AWS Acceptable Use Policy and is not a security assessment.

C. While AWS permits penetration testing, it is subject to specific policies and may require coordination. Amazon Inspector is the specific AWS service designed for automated, continuous vulnerability assessment.

D. The AWS Service Health Dashboard provides information on the operational status of AWS services, not security assessments of a customer's individual resources.

---

1. Amazon Inspector Documentation: "Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. Amazon Inspector automatically discovers and scans running Amazon EC2 instances..."

Source: AWS Documentation

"What is Amazon Inspector?"

Section: "Amazon Inspector overview".

2. AWS Penetration Testing Policy: "The following activities are prohibited: ... Denial of Service (DoS)

Distributed Denial of Service (DDoS)

Simulated DoS

Simulated DDoS". This confirms that flooding a target (Option A) is not an approved testing method.

Source: AWS Customer Support

"Penetration Testing"

Section: "Permitted services".

3. AWS Health Dashboard Documentation: "AWS Health provides ongoing visibility into your resource performance and the availability of your AWS services and accounts. The AWS Health Dashboard provides a personalized view of the health of the AWS services that power your applications." This clarifies that its purpose is service health monitoring

not security assessment (Option D).

Source: AWS Documentation

"What is AWS Health?"

Section: "AWS Health Dashboard".

An AWS Region is a physical, geographic area. Within each Region, there are multiple, isolated locations known as Availability Zones (AZs). Each AZ consists of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities. By deploying Amazon EC2 instances across multiple AZs within the same AWS Region, the company ensures the instances are in the same geographic area while being protected from failures affecting a single location, such as a power outage. This design is a fundamental best practice for achieving high availability.

B. Amazon CloudFront is a Content Delivery Network (CDN) used to cache content closer to users; it is not a database and does not host primary EC2 instances for this purpose.

C. Placing instances in the same Availability Zone would make them share the same underlying power infrastructure, creating a single point of failure and violating the redundancy requirement.

D. Using different AWS Regions would place the instances in separate, distant geographic areas, which contradicts the requirement for them to share the same geographic location.

1. AWS Documentation

"Regions and Availability Zones": "An Availability Zone (AZ) is one or more discrete data centers with redundant power

networking

and connectivity in an AWS Region. AZs give customers the ability to operate production applications and databases that are more highly available

fault tolerant

and scalable than would be possible from a single data center." This source directly supports the concept of using multiple AZs for redundancy.

Source: AWS User Guide

Amazon EC2 User Guide for Linux Instances

Section: "Regions and Availability Zones".

2. AWS Well-Architected Framework

Reliability Pillar Whitepaper: "The best practice is to deploy your workload across multiple Availability Zones (AZs). This architecture is known as a multi-AZ architecture. If one AZ becomes unavailable

the instances in the other AZs can continue to serve traffic."

Source: AWS Whitepaper

AWS Well-Architected Framework

Reliability Pillar

Section: "Withstand component failures"

Sub-section: "Deploy the workload to multiple locations".

3. AWS Documentation

"What Is Amazon CloudFront?": "Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content... CloudFront delivers your content through a worldwide network of data centers called edge locations." This clarifies that CloudFront's purpose is content delivery

not EC2 hosting for high availability.

Source: AWS Developer Guide

Amazon CloudFront Developer Guide

Section: "What Is Amazon CloudFront?".

The question requires a "dedicated connection" between an on-premises network and an AWS VPC. AWS Direct Connect is the service specifically designed to provide a dedicated, private network link. This connection bypasses the public internet, offering a more consistent network experience, lower latency, and higher bandwidth compared to internet-based connections. It establishes a private physical connection between the customer's data center, office, or colocation environment and AWS, directly meeting the requirement.

A. A VPN connection operates over the public internet. It is a secure tunnel but not a dedicated physical connection, as it relies on shared internet infrastructure.

C. An internet gateway enables communication between a VPC and the public internet, which is the opposite of a private, dedicated connection to an on-premises network.

D. Amazon Connect is a cloud-based contact center service used for customer service operations; it is not a network connectivity service.

1. AWS Direct Connect User Guide. In the section "What is AWS Direct Connect?"

the documentation states

"AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS."

Source: AWS Documentation

AWS Direct Connect User Guide

"What is AWS Direct Connect?".

2. AWS Site-to-Site VPN User Guide. The documentation explains that a Site-to-Site VPN connection securely connects an on-premises network to a VPC over the internet. This confirms it is not a dedicated connection.

Source: AWS Documentation

AWS Site-to-Site VPN User Guide

"What is AWS Site-to-Site VPN?".

3. Amazon VPC User Guide. The guide defines an internet gateway as a component that "allows communication between your VPC and the internet

" confirming it does not provide a dedicated on-premises link.

Source: AWS Documentation

Amazon VPC User Guide

"Internet gateways".

4. Amazon Connect Administrator Guide. The introduction states

"Amazon Connect is an easy-to-use omnichannel cloud contact center..." This clarifies its purpose is unrelated to network infrastructure.

Source: AWS Documentation

Amazon Connect Administrator Guide

"What is Amazon Connect?".

Amazon Relational Database Service (RDS) is a managed web service designed to simplify the setup, operation, and scaling of relational databases in the AWS Cloud. It provides support for several popular relational database engines. PostgreSQL is a powerful, open-source object-relational database system that is one of the six database engines available to use with Amazon RDS. The other options—Apache Cassandra, MongoDB, and Neo4j—are types of NoSQL databases and are therefore not compatible with the Amazon RDS service. AWS offers other purpose-built database services for these engines, such as Amazon Keyspaces for Cassandra and Amazon DocumentDB for MongoDB workloads.

A. Apache Cassandra is a NoSQL wide-column database. AWS offers the Amazon Keyspaces service for Cassandra-compatible workloads, not Amazon RDS.

B. MongoDB is a NoSQL document database. The corresponding managed AWS service is Amazon DocumentDB (with MongoDB compatibility), not Amazon RDS.

C. Neo4j is a NoSQL graph database. AWS provides Amazon Neptune as its managed service for graph databases like Neo4j, not Amazon RDS.

1. AWS Documentation

Amazon RDS User Guide

"What is Amazon RDS?": This document explicitly lists the supported database engines. It states

"Amazon RDS provides you with six familiar database engines to choose from

including Amazon Aurora

PostgreSQL

MySQL

MariaDB

Oracle Database

and SQL Server." This confirms PostgreSQL is a supported engine.

Source: AWS Documentation

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html

Section: "DB engines".

2. AWS Documentation

Amazon RDS Features Page: The official product page for Amazon RDS lists the compatible engines under the "Choice of database engines" section

which includes PostgreSQL.

Source: AWS Official Website

https://aws.amazon.com/rds/features/

Section: "Choice of database engines".

3. AWS Documentation

Amazon Keyspaces (for Apache Cassandra): This source clarifies that Cassandra workloads are handled by a different service. It describes Amazon Keyspaces as "a scalable

highly available

and managed Apache Cassandra–compatible database service."

Source: AWS Official Website

https://aws.amazon.com/keyspaces/.

4. AWS Documentation

Amazon DocumentDB (with MongoDB compatibility): This source confirms that MongoDB workloads are supported by Amazon DocumentDB

not RDS.

Source: AWS Official Website

https://aws.amazon.com/documentdb/.