Question 260
A cloud adoption review identifies two separate needs. Finding 1: An organization wants a vetted third-party implementation partner to help plan its AWS deployment and manage agreed delivery work. Finding 2: A service owner needs to learn whether an AWS service incident is affecting its resources, rather than infer outage status solely from application errors. Which two-part response addresses both findings in order?
- (1) Report the suspected abuse through the appropriate AWS Trust and Safety process with relevant evidence. (2) Review the applicable AWS Health information and account-specific event notifications where available.
- (1) Evaluate suitable AWS Partner Network providers and verify their relevant skills and contractual scope. (2) Review the applicable AWS Health information and account-specific event notifications where available.
- (1) Review the applicable AWS Health information and account-specific event notifications where available. (2) Evaluate suitable AWS Partner Network providers and verify their relevant skills and contractual scope.
- (1) Evaluate suitable AWS Partner Network providers and verify their relevant skills and contractual scope. (2) Evaluate AWS Professional Services or qualified partners and agree a specific statement of work and responsibilities.
Explanation
Correct Answer
B:For finding 1: APN partners can provide independent solutions and integration services under customer agreements. For finding 2: AWS Health provides visibility into relevant service events and their possible impact on AWS environments. Both actions are required.
Incorrect Answers
A:For finding 1: APN partners can provide independent solutions and integration services under customer agreements. That action addresses a different situation: A business identifies a suspected phishing campaign launched from AWS infrastructure and wants to send substantiated abuse evidence to AWS.
C:The actions are reversed. The correct order is (1) Evaluate suitable AWS Partner Network providers and verify their relevant skills and contractual scope. (2) Review the applicable AWS Health information and account-specific event notifications where available.
D:For finding 2: AWS Health provides visibility into relevant service events and their possible impact on AWS environments. That action addresses a different situation: An enterprise wants specialized AWS experts to help implement a migration and assumes the marketplace listing itself guarantees an AWS-delivered consulting engagement.
Question 261
A finance analyst compares cloud compute price with hardware purchase price but ignores power, cooling, physical space, and maintenance. What should the team do?
- Compare AWS variable usage charges with the capital and fixed operating costs of owned infrastructure.
- Compare elastic storage consumption with the carrying cost of unused pre-purchased capacity.
- Compare total cost of ownership using facility, operations, staffing, and depreciation costs as well as infrastructure pricing.
- Track actual utilization and configure cost controls because unused or oversized cloud resources still create charges.
Explanation
Correct Answer
C:On-premises costs extend beyond the purchase cost of computing equipment.
Incorrect Answers
A:On-premises costs extend beyond the purchase cost of computing equipment. That alternative applies to a different situation: A company spends heavily on owned servers before projects start and wants a model with more consumption-linked spending.
B:On-premises costs extend beyond the purchase cost of computing equipment. That alternative applies to a different situation: An internal platform buys enough storage for predicted five-year growth and pays for all of it before any data is stored.
D:On-premises costs extend beyond the purchase cost of computing equipment. That alternative applies to a different situation: A product team assumes that using cloud services guarantees an always lower invoice without management or governance.
Question 262
A team identifies three independent cloud planning needs. Finding 1: A company needs managed public DNS records and health-based DNS routing for its customer-facing domains. Finding 2: An office must establish private dedicated network connectivity into AWS rather than relying solely on an internet VPN connection. Finding 3: A developer uses a DNS service to host application business data and assumes creating a Route 53 record makes that data durable. Which complete response addresses all three findings in order?
- (1) Evaluate Amazon Route 53 hosted zones and suitable supported DNS routing policies. (2) Evaluate AWS Direct Connect with an authorized connectivity provider and compatible network architecture. (3) Store business records in an appropriate database or storage service and use Route 53 for name resolution.
- (1) Evaluate Amazon Route 53 hosted zones and suitable supported DNS routing policies. (2) Evaluate a supported AWS Site-to-Site VPN configuration with the required routing and authentication. (3) Store business records in an appropriate database or storage service and use Route 53 for name resolution.
- (1) Evaluate Amazon Route 53 hosted zones and suitable supported DNS routing policies. (2) Evaluate AWS Direct Connect with an authorized connectivity provider and compatible network architecture. (3) Evaluate a supported AWS Site-to-Site VPN configuration with the required routing and authentication.
- (1) Evaluate a supported AWS Site-to-Site VPN configuration with the required routing and authentication. (2) Evaluate AWS Direct Connect with an authorized connectivity provider and compatible network architecture. (3) Store business records in an appropriate database or storage service and use Route 53 for name resolution.
Explanation
Correct Answer
A:For finding 1: Route 53 provides managed DNS and routing capabilities for domain name resolution. For finding 2: Direct Connect provides dedicated connectivity into AWS through supported interconnection arrangements. For finding 3: DNS records direct clients to endpoints but do not act as general application databases. All three decisions are needed.
Incorrect Answers
B:For finding 2: Direct Connect provides dedicated connectivity into AWS through supported interconnection arrangements. That action addresses a different situation: A remote branch needs an encrypted site-to-site tunnel across the internet to access eligible VPC resources.
C:For finding 3: DNS records direct clients to endpoints but do not act as general application databases. That action addresses a different situation: A remote branch needs an encrypted site-to-site tunnel across the internet to access eligible VPC resources.
D:For finding 1: Route 53 provides managed DNS and routing capabilities for domain name resolution. That action addresses a different situation: A remote branch needs an encrypted site-to-site tunnel across the internet to access eligible VPC resources.
Question 263
An EC2 application requires read access to one S3 bucket, but developers put an administrator's access keys in the instance configuration. Which response best addresses the situation?
- Apply an IAM policy granting the minimum necessary read permissions for the analyst's actual tasks.
- Evaluate an authorized cross-account IAM role trust relationship and scoped permissions.
- Use an IAM role or instance profile appropriate to the service instead of treating user groups as workload identities.
- Assign a suitable IAM role to the EC2 workload with permissions limited to the required bucket actions.
Explanation
Correct Answer
D:Temporary role credentials avoid distributing a powerful human user's long-lived access keys.
Incorrect Answers
A:Temporary role credentials avoid distributing a powerful human user's long-lived access keys. That alternative applies to a different situation: A team grants an analyst the ability to delete any AWS resource even though the job requires only reading two CloudWatch dashboards.
B:Temporary role credentials avoid distributing a powerful human user's long-lived access keys. That alternative applies to a different situation: An organization needs controlled access from one AWS account to a resource in another without sharing permanent secret keys.
C:Temporary role credentials avoid distributing a powerful human user's long-lived access keys. That alternative applies to a different situation: A developer assumes an IAM group can be attached directly to an EC2 instance to supply temporary application credentials.
Question 264
Two cloud decisions must be made in the stated order. Finding 1: A small team encounters an unexpected AWS service issue and needs to know which available Support plan offers the required response scope. Finding 2: A company wants published architectural guidance for common migration and modernization decisions, not a service interruption ticket. Which two-part response addresses both findings in order?
- (1) Review current AWS Support plan capabilities, eligibility, and response options before choosing a plan. (2) Consult AWS Prescriptive Guidance and applicable AWS architecture materials for documented patterns.
- (1) Review current AWS Support plan capabilities, eligibility, and response options before choosing a plan. (2) Use AWS re:Post or another appropriate official community knowledge resource for peer discussion.
- (1) Consult AWS Prescriptive Guidance and applicable AWS architecture materials for documented patterns. (2) Review current AWS Support plan capabilities, eligibility, and response options before choosing a plan.
- (1) Consult current AWS service documentation and applicable service quotas or best-practice guidance. (2) Consult AWS Prescriptive Guidance and applicable AWS architecture materials for documented patterns.
Explanation
Correct Answer
A:For finding 1: AWS Support plans differ in included technical assistance and should be matched to operational need. For finding 2: Prescriptive Guidance provides reusable architecture and migration practices rather than live incident triage. Both actions are required.
Incorrect Answers
B:For finding 2: Prescriptive Guidance provides reusable architecture and migration practices rather than live incident triage. That action addresses a different situation: A developer wants to exchange AWS implementation experiences with other practitioners without opening a formal account support case.
C:The actions are reversed. The correct order is (1) Review current AWS Support plan capabilities, eligibility, and response options before choosing a plan. (2) Consult AWS Prescriptive Guidance and applicable AWS architecture materials for documented patterns.
D:For finding 1: AWS Support plans differ in included technical assistance and should be matched to operational need. That action addresses a different situation: An engineer needs an authoritative explanation of a cloud service's documented limits and cannot rely on an old forum answer.
Question 265
A company copies raw files to cloud storage but forgets to test whether applications can read the required format after migration. Which response best addresses the situation?
- Evaluate AWS Snow Family offline data transfer where appropriate to the amount of data, location, and service availability.
- Build a workload and dependency inventory before selecting migration strategies and execution waves.
- Validate data format, permissions, and dependent application behavior before declaring the migration complete.
- Plan a supported hybrid transition where business dependencies require some workloads to remain on premises.
Explanation
Correct Answer
C:Successful file transfer is only one part of proving that a business workload is ready to operate.
Incorrect Answers
A:Successful file transfer is only one part of proving that a business workload is ready to operate. That alternative applies to a different situation: A manufacturer must move hundreds of terabytes to AWS from a remote site with extremely limited network bandwidth.
B:Successful file transfer is only one part of proving that a business workload is ready to operate. That alternative applies to a different situation: An organization wants a cloud migration roadmap but has no inventory of workloads, interfaces, and licensing dependencies.
D:Successful file transfer is only one part of proving that a business workload is ready to operate. That alternative applies to a different situation: A team assumes cloud migration must be a single permanent choice and cannot include a temporary hybrid operating period.
Question 266
A cloud adoption review identifies two separate needs. Finding 1: A data science group wants a managed environment to build, train, and deploy machine learning models instead of assembling every tool on EC2. Finding 2: A legal knowledge portal needs enterprise search over approved documents and wants relevance-based retrieval rather than a simple storage bucket listing. Which two-part response addresses both findings in order?
- (1) Evaluate Amazon Lex for a supported conversational text or voice interface. (2) Evaluate Amazon Kendra for an eligible intelligent enterprise search use case.
- (1) Evaluate Amazon Kendra for an eligible intelligent enterprise search use case. (2) Evaluate Amazon SageMaker AI against the team's model-development and managed deployment needs.
- (1) Evaluate Amazon SageMaker AI against the team's model-development and managed deployment needs. (2) Apply data classification, identity access, and approved service-use controls to any AI or ML workload.
- (1) Evaluate Amazon SageMaker AI against the team's model-development and managed deployment needs. (2) Evaluate Amazon Kendra for an eligible intelligent enterprise search use case.
Explanation
Correct Answer
D:For finding 1: SageMaker AI supports managed machine learning workflows for supported projects. For finding 2: Kendra supports search across connected information sources with appropriate access configuration. Both actions are required.
Incorrect Answers
A:For finding 1: SageMaker AI supports managed machine learning workflows for supported projects. That action addresses a different situation: A call-center application needs to recognize customer intents and build a conversational interface rather than train a general-purpose model from scratch.
B:The actions are reversed. The correct order is (1) Evaluate Amazon SageMaker AI against the team's model-development and managed deployment needs. (2) Evaluate Amazon Kendra for an eligible intelligent enterprise search use case.
C:For finding 2: Kendra supports search across connected information sources with appropriate access configuration. That action addresses a different situation: An operations team assumes an AI service can use protected customer data without permissions or governance simply because it is AWS-managed.
Question 267
A team identifies three independent cloud planning needs. Finding 1: A procurement team wants to determine whether a specific AWS service is covered by a particular compliance program. Finding 2: A company receives AWS's independent audit report and assumes it proves the company's application has no data protection gaps. Finding 3: A legal team needs to review a standard AWS compliance agreement before processing protected customer information. Which complete response addresses all three findings in order?
- (1) Review the applicable AWS service scope and compliance documentation rather than assuming every service has identical certifications. (2) Obtain the applicable AWS compliance reports and agreements through AWS Artifact with appropriate account access. (3) Consult AWS Artifact Agreements and the relevant AWS compliance guidance through the authorized approval process.
- (1) Review the applicable AWS service scope and compliance documentation rather than assuming every service has identical certifications. (2) Evaluate customer-side data handling, permissions, and configuration separately from provider compliance evidence. (3) Obtain the applicable AWS compliance reports and agreements through AWS Artifact with appropriate account access.
- (1) Obtain the applicable AWS compliance reports and agreements through AWS Artifact with appropriate account access. (2) Evaluate customer-side data handling, permissions, and configuration separately from provider compliance evidence. (3) Consult AWS Artifact Agreements and the relevant AWS compliance guidance through the authorized approval process.
- (1) Review the applicable AWS service scope and compliance documentation rather than assuming every service has identical certifications. (2) Evaluate customer-side data handling, permissions, and configuration separately from provider compliance evidence. (3) Consult AWS Artifact Agreements and the relevant AWS compliance guidance through the authorized approval process.
Explanation
Correct Answer
D:For finding 1: Compliance program coverage can vary by service and must be checked against actual scope. For finding 2: Third-party cloud infrastructure assurance does not audit every customer-created application. For finding 3: AWS Artifact supports access to certain agreements as well as provider audit documentation. All three decisions are needed.
Incorrect Answers
A:For finding 2: Third-party cloud infrastructure assurance does not audit every customer-created application. That action addresses a different situation: An auditor requests AWS's current third-party compliance reports for a supported service, but the team plans to gather screenshots of the console instead.
B:For finding 3: AWS Artifact supports access to certain agreements as well as provider audit documentation. That action addresses a different situation: An auditor requests AWS's current third-party compliance reports for a supported service, but the team plans to gather screenshots of the console instead.
C:For finding 1: Compliance program coverage can vary by service and must be checked against actual scope. That action addresses a different situation: An auditor requests AWS's current third-party compliance reports for a supported service, but the team plans to gather screenshots of the console instead.
Question 268
Two cloud decisions must be made in the stated order. Finding 1: A backup team chooses the cheapest advertised S3 archival storage rate but expects thousands of immediate restores each day. Finding 2: An application communicates between two AWS Regions and the team assumes there can be no networking charges because both Regions belong to AWS. Which two-part response addresses both findings in order?
- (1) Include retrieval, minimum-duration, and access-pattern considerations when comparing eligible S3 storage classes. (2) Distinguish compute capacity reservation needs from savings commitments and evaluate their supported combinations.
- (1) Review the relevant inter-Region data transfer pricing and architecture before estimating recurring costs. (2) Include retrieval, minimum-duration, and access-pattern considerations when comparing eligible S3 storage classes.
- (1) Check the applicable outbound and cross-boundary data transfer pricing rather than assuming it matches inbound transfer. (2) Review the relevant inter-Region data transfer pricing and architecture before estimating recurring costs.
- (1) Include retrieval, minimum-duration, and access-pattern considerations when comparing eligible S3 storage classes. (2) Review the relevant inter-Region data transfer pricing and architecture before estimating recurring costs.
Explanation
Correct Answer
D:For finding 1: Total storage cost depends on access behavior as well as the per-gigabyte storage rate. For finding 2: Transfers between AWS locations can incur charges even when the endpoints are both AWS-hosted. Both actions are required.
Incorrect Answers
A:For finding 2: Transfers between AWS locations can incur charges even when the endpoints are both AWS-hosted. That action addresses a different situation: A finance analyst assumes Capacity Reservations and Savings Plans are identical products with the same capacity guarantees and discounts.
B:The actions are reversed. The correct order is (1) Include retrieval, minimum-duration, and access-pattern considerations when comparing eligible S3 storage classes. (2) Review the relevant inter-Region data transfer pricing and architecture before estimating recurring costs.
C:For finding 1: Total storage cost depends on access behavior as well as the per-gigabyte storage rate. That action addresses a different situation: A file service sends large quantities of data to customers across the internet, but its budget assumes every transferred byte costs the same as inbound upload.
Question 269
Three AWS decisions are needed in the order given. Finding 1: A team treats application uptime as guaranteed merely because it launches one large instance in an AWS Region. Finding 2: A business runs frequent manual production changes with no runbooks or measurable feedback on deployment failures. Finding 3: A website keeps a backup copy of data but has never rehearsed restoring the application to meet its recovery objective. Which complete response addresses all three findings in order?
- (1) Review the Reliability pillar and design recovery, redundancy, and failure testing appropriate to the workload. (2) Treat the Well-Architected Framework as a review of architectural trade-offs and prioritize remediation through owned changes. (3) Test end-to-end recovery against stated recovery time and recovery point requirements.
- (1) Treat the Well-Architected Framework as a review of architectural trade-offs and prioritize remediation through owned changes. (2) Apply the Operational Excellence pillar through repeatable procedures, observability, and continuous improvement. (3) Test end-to-end recovery against stated recovery time and recovery point requirements.
- (1) Review the Reliability pillar and design recovery, redundancy, and failure testing appropriate to the workload. (2) Apply the Operational Excellence pillar through repeatable procedures, observability, and continuous improvement. (3) Test end-to-end recovery against stated recovery time and recovery point requirements.
- (1) Review the Reliability pillar and design recovery, redundancy, and failure testing appropriate to the workload. (2) Apply the Operational Excellence pillar through repeatable procedures, observability, and continuous improvement. (3) Treat the Well-Architected Framework as a review of architectural trade-offs and prioritize remediation through owned changes.
Explanation
Correct Answer
C:For finding 1: Resilience depends on architecture and recovery controls, not the presence of an AWS logo or large instance. For finding 2: Operational excellence emphasizes managing operations as code and learning from operational events. For finding 3: Backups alone do not establish that a workload can restore service within an acceptable interruption. All three decisions are needed.
Incorrect Answers
A:For finding 2: Operational excellence emphasizes managing operations as code and learning from operational events. That action addresses a different situation: An infrastructure team wants to use AWS Well-Architected findings as a mandatory product that automatically repairs every discovered issue.
B:For finding 1: Resilience depends on architecture and recovery controls, not the presence of an AWS logo or large instance. That action addresses a different situation: An infrastructure team wants to use AWS Well-Architected findings as a mandatory product that automatically repairs every discovered issue.
D:For finding 3: Backups alone do not establish that a workload can restore service within an acceptable interruption. That action addresses a different situation: An infrastructure team wants to use AWS Well-Architected findings as a mandatory product that automatically repairs every discovered issue.
Question 270
A manufacturer needs to securely connect and manage sensor messages from thousands of eligible devices. Which response best addresses the situation?
- Evaluate Amazon AppStream 2.0 for supported application-streaming requirements.
- Evaluate AWS Amplify or AWS AppSync capabilities matched to the frontend and API requirements.
- Evaluate AWS IoT Core for managed device connectivity and messaging integration.
- Evaluate Amazon WorkSpaces for a suitable managed virtual desktop use case.
Explanation
Correct Answer
C:IoT Core provides supported connectivity and message routing for connected-device applications.
Incorrect Answers
A:IoT Core provides supported connectivity and message routing for connected-device applications. That alternative applies to a different situation: A design team wants to stream Windows applications to users through a browser without delivering a full managed desktop.
B:IoT Core provides supported connectivity and message routing for connected-device applications. That alternative applies to a different situation: A mobile team wants managed tooling to connect an application's frontend with supported cloud resources and APIs.
D:IoT Core provides supported connectivity and message routing for connected-device applications. That alternative applies to a different situation: An organization wants employees to access hosted virtual desktops without procuring a high-performance workstation for every remote contractor.
AWS Certified Cloud Practitioner CLF-C02 Practice Tests