AWS CLF-C02 Free Practice Questions — Page 1

Correct Answer: C. The transfer of data from the Snowball Edge appliance into Amazon S3

AWS encourages data migration into its ecosystem by offering free data transfer-in for the Snowball Edge service. While there are service fees for the device itself and shipping costs, the actual movement of data from the physical appliance into your Amazon S3 buckets does not incur a per-gigabyte data transfer charge. In contrast, Option B is incorrect because transferring data out of Amazon S3 to a Snowball device is considered data egress and is subject to per-gigabyte pricing.

Correct Answer: B. Amazon Inspector

Amazon Inspector is specifically designed to assess the security of applications deployed on Amazon EC2 instances. It identifies vulnerabilities and deviations from best practices, providing detailed findings that help improve the security posture of your applications. This makes it the most suitable service for the company's need to assess application vulnerabilities and identify infrastructure deployments that do not meet best practices.

Correct Answer: B. Configure and deploy an AWS Storage Gateway file gateway. Connect each user’s workstation to the file gateway.

To extend file storage capabilities while retaining local performance benefits, deploying an AWS Storage Gateway file gateway is the most operationally efficient solution. This enables seamless extension of on-premises file storage into the AWS Cloud, providing low-latency access to data stored in Amazon S3, and maintaining the performance benefit of local access. It also centralizes storage management and simplifies administration, eliminating the need for individual S3 buckets for each user.

Correct Answer: C. Have the EC2 instance assume a role to obtain the privileges to upload the file.

According to security best practices, the most secure way to give an Amazon EC2 instance access to an Amazon S3 bucket is by having the EC2 instance assume a role to obtain the necessary privileges. This method employs AWS Identity and Access Management (IAM) roles to grant temporary permissions to the instance. This approach is preferred because it eliminates the need to hard code or store access keys directly on the instance or in application code, thereby reducing the risk of credential exposure and adhering to the principle of least privilege. By assuming a role, the EC2 instance is granted only the permissions it needs for a limited duration, enhancing overall security.

Correct Answer: C. Access to DynamoDB tables

Under the AWS Shared Responsibility Model, AWS is responsible for the physical security, patching, and encryption of data at rest in DynamoDB. The customer is responsible for managing access to their DynamoDB tables, which includes defining permissions, roles, and policies to control who can access the tables and what actions they can perform. This involves setting up appropriate IAM policies and roles to restrict access to authorized users and applications.