2026年AWSCLF-C02认证考试真题题库（云从业者）

2026年AWSCLF-C02认证考试真题题库（云从业者）Question1Acompanyisdesigninganewapplicationthatwillexperienceunpredictable,spikytrafficpatterns.Theapplicationrequiresarelationaldatabase.WhichAWSserviceshouldthecompanyusetomeettheserequirementswithminimaloperationaloverhead?A.AmazonRDSwithProvisionedIOPSB.AmazonAuroraServerlessC.AmazonDynamoDBwithon-demandcapacitymodeD.AmazonRedshiftAnswer:BExplanation:AmazonAuroraServerlessisaserverless,auto-scalingconfigurationforAmazonAurora.Itautomaticallystartsup,shutsdown,andscalescapacityupordownbasedonyourapplication'sneeds.Thisisidealforunpredictable,spikyworkloadsthatrequirearelationaldatabase,asiteliminatestheneedtomanagedatabaseinstancesandcapacity.OptionArequiresmanualscalingandprovisioning.OptionCisaNoSQLdatabase,notrelational.OptionDisadatawarehousingservice,notsuitedforgeneralapplicationtransactionalworkloads.Question2WhichAWSserviceenablesyoutoruncodewithoutprovisioningormanagingserversandautomaticallyscalesfromzerotothousandsofrequestspersecond?A.AWSFargateB.AWSLambdaC.AmazonEC2AutoScalingD.AWSElasticBeanstalkAnswer:BExplanation:AWSLambdaisaserverlesscomputeservicethatletsyouruncodeforvirtuallyanytypeofapplicationorbackendservicewithoutprovisioningormanagingservers.Youpayonlyforthecomputetimeyouconsume,anditscalesautomatically.AWSFargateisserverlessforcontainers,notgenericcode.EC2AutoScalingmanagesEC2instances,whichareservers.ElasticBeanstalkisaPlatform-as-a-Servicethatstillinvolvesunderlyinginstances.Question3AccordingtotheAWSSharedResponsibilityModel,whichofthefollowingisthecustomerresponsibleforsecuring?(SelectTWO.)A.PhysicalsecurityofdatacentersB.PatchingtheguestoperatingsystemonAmazonEC2instancesC.ConfiguringsecuritygroupsandnetworkACLsD.EnvironmentalcontrolsforglobalinfrastructureE.DecommissioningphysicalstoragedevicesAnswer:B,CExplanation:TheAWSSharedResponsibilityModeldividessecurityofthecloud(AWSresponsibility)andsecurityinthecloud(customerresponsibility).AWSisresponsibleforprotectingtheinfrastructurethatrunsallAWSservices,includingphysicalsecurityofdatacenters,hardware,networking,andenvironmentalcontrols(A,D,E).Thecustomerisresponsibleforsecurityconfigurationsoftheirresources,suchaspatchingtheOSontheirEC2instances(B)andconfiguringsecuritygroupsandNACLs(C).Question4AstartupwantstodeployawebapplicationgloballywithlowlatencyforusersinNorthAmerica,Europe,andAsia.Theywantasimple,cost-effectivesolution.WhichAWSservicecombinationisMOSTsuitable?A.AmazonEC2instancesinmultipleAWSRegionswithanApplicationLoadBalancerineachregion.B.AmazonS3forhostingstaticcontent,AmazonCloudFrontforglobalcontentdelivery,andAWSLambdafordynamiccontent.C.AWSDirectConnecttoestablishprivatenetworkconnectionsfromtheiron-premisesdatacentertoallAWSRegions.D.AWSGlobalAcceleratortoroutetraffictothenearestAWSedgelocation.Answer:BExplanation:Foraglobalwebapplicationwithstaticanddynamiccontent,usingAmazonS3forstaticassets(HTML,CSS,images)combinedwithAmazonCloudFront(aContentDeliveryNetwork)cachescontentatedgelocationsworldwide,providinglowlatency.AWSLambdacanhandledynamicserverlesscompute.Thisisahighlyscalable,cost-effective,andmanagedsolution.OptionAiscomplexandexpensivetomanage.OptionCisfordedicatednetworkconnections,notprimarilyforlow-latencywebapps.OptionDimprovesperformancefornon-cacheabletrafficbutdoesn'taddressstaticcontentcachingaseffectivelyasB.Question5WhichofthefollowingisakeybenefitofusingAmazonS3Intelligent-Tieringstorageclass?A.Itprovidesthelowestcoststorageforlong-termbackups.B.Itautomaticallymovesobjectsbetweentwoaccesstiers(frequentandinfrequent)basedonchangingaccesspatterns.C.ItoffersthehighestdurabilityandavailabilityofanyAmazonS3storageclass.D.Itisdesignedfordatathatisaccessedlessthanonceaquarter.Answer:BExplanation:AmazonS3Intelligent-Tieringisdesignedtooptimizecostsbyautomaticallymovingobjectsthathavenotbeenaccessedfor30consecutivedaystotheinfrequentaccesstier.Iftheobjectisaccessedagain,it'smovedbacktothefrequentaccesstier.Thishappenswithnooperationaloverhead.OptionAdescribesS3Glacier.OptionC:AllS3storageclassesoffer99.999999999%(119's)durability.OptionDdescribesS3GlacierDeepArchive.Question6AnapplicationneedstosendanemailnotificationtouserswhenaspecificfileisuploadedtoanAmazonS3bucket.WhichAWSserviceshouldbeusedtotriggerthisworkflowwithoutrunningadedicatedserver?A.AmazonSNSB.AmazonSQSC.AWSLambdaD.AmazonEventBridgeAnswer:CExplanation:AWSLambdacanbedirectlytriggeredbyanAmazonS3event(e.g.,`ObjectCreated`).TheLambdafunctioncanthencontainthelogictosendanemail,potentiallyusingAmazonSimpleEmailService(SES).Thisisafullyserverlessarchitecture.WhileSNSorEventBridgecanbepartoftheeventrouting,Lambdaisthecorecomputeservicethatexecutesthebusinesslogicinresponsetotheevent.Question7WhatistheprimarypurposeofanAWSIdentityandAccessManagement(IAM)policy?A.TodefinepermissionsforAWSusers,groups,androles.B.ToestablishaVirtualPrivateCloud(VPC)fornetworkisolation.C.TomonitorAPIcallsandresourcechangesforsecurityanalysis.D.Tosetupmulti-factorauthentication(MFA)forrootusers.Answer:AExplanation:IAMpoliciesareJSONdocumentsthatdefinepermissions.TheyspecifywhatactionsareallowedordeniedonwhichAWSresourcesunderwhatconditions.TheyareattachedtoIAMidentities(users,groups,roles)orAWSresources.OptionBisdoneviaVPC.OptionCisthepurposeofAWSCloudTrail.OptionDisasecuritybestpracticeconfiguredwithinIAMbutnotviapolicies.Question8Acompanyismigratinganon-premisesdatabasetoAWS.TheyrequireamanageddatabaseservicethatiscompatiblewiththeirexistingPostgreSQLapplications.WhichAWSserviceshouldtheychoose?A.AmazonRDSforPostgreSQLB.AmazonDynamoDBC.AmazonAurorawithMySQLcompatibilityD.AmazonDocumentDBAnswer:AExplanation:AmazonRDSforPostgreSQLisafullymanagedrelationaldatabaseservicethatmakesiteasytosetup,operate,andscalePostgreSQLdeploymentsinthecloud.Itprovidesdirectcompatibility.OptionBisaNoSQLkey-valuestore.OptionCisMySQLcompatible,notPostgreSQL.OptionDisadocumentdatabasecompatiblewithMongoDB.Question9WhichAWScostmanagementtoolallowsyoutovisualize,understand,andmanageyourAWScostsandusageovertime,andcancreatecustombudgetsandalerts?A.AWSBudgetsB.AWSCostExplorerC.AWSTrustedAdvisorD.AWSPricingCalculatorAnswer:BExplanation:AWSCostExplorerprovidesadetailedinterfacewithgraphsandtablestovisualizeandanalyzeyourcostsandusage.Itallowsfordeepdivesintodata,forecasting,andidentifyingtrends.WhileAWSBudgets(A)isusedtosetcustomcost/spendingbudgetsandalerts,CostExploreristheprimarytoolforvisualizationandanalysis.TrustedAdvisor(C)givesrecommendationsforcostoptimization,security,etc.ThePricingCalculator(D)isforestimatingcostsbeforeusage.Question10Forcompliancereasons,acompanymustensurethatalldatastoredinAmazonS3isencryptedatrest.Whichmethodfulfillsthisrequirementwithminimalmanagementeffort?A.Client-sideencryptionusingkeysmanagedinAWSKMSbeforeuploadingdata.B.Server-SideEncryptionwithAmazonS3-ManagedKeys(SSE-S3).C.Server-SideEncryptionwithAWSKMS-ManagedKeys(SSE-KMS).D.UsingSSL/TLStoencryptdataintransittoS3.Answer:BExplanation:Server-SideEncryptionwithAmazonS3-ManagedKeys(SSE-S3)isthesimplestwaytoenableautomaticencryptionofallobjectsinanS3bucketwithminimaleffort.Youjustenablethedefaultbucketencryptionsetting.AWSmanagestheencryptionkeys.OptionAaddsclient-sidecomplexity.OptionCprovidesmorecontrolandaudittrailsbutinvolvesmanagingKMSkeys.OptionDisforencryptionintransit,notatrest.Question11WhichAWSserviceprovidesasimpleandscalablefullymanagedmessagequeuingservicetodecoupleandscalemicroservices,distributedsystems,andserverlessapplications?A.AmazonMQB.AmazonSNSC.AmazonSQSD.AmazonKinesisAnswer:CExplanation:AmazonSimpleQueueService(SQS)isafullymanagedmessagequeuingservice.Itenablesyoutodecoupleapplicationcomponentssotheycanrunandscaleindependently.Messagesarestoreduntiltheyareprocessed.AmazonSNS(B)isapub/submessagingservice.AmazonMQ(A)isamanagedmessagebrokerforprotocolslikeMQTTandAMQP.AmazonKinesis(D)isforreal-timestreamingdata.Question12Adeveloperneedstostoreapplicationconfigurationparametersthatcanbeupdatedwithoutredeployingtheapplicationcode.WhichAWSserviceisBESTsuitedforthis?A.AWSSecretsManagerB.AmazonS3C.AWSSystemsManagerParameterStoreD.AmazonRDSAnswer:CExplanation:AWSSystemsManagerParameterStoreprovidessecure,hierarchicalstorageforconfigurationdatamanagementandsecretsmanagement.Itallowsyoutostoreparameters(likedatabasestrings,licensecodes)separatelyfromyourcodeandupdatethemdynamically.SecretsManager(A)isspecificallyforstoringsecretslikepasswordsandAPIkeys.S3(B)couldbeusedbutislessefficientandsecureforthisspecificusecase.RDS(D)isadatabaseservice,notaconfigurationstore.Question13WhatistheprimaryadvantageofusingAWSCloudFormation?A.ItmonitorstheperformanceofyourAWSresources.B.Itprovidesagraphicalinterfacetodrawyourinfrastructure.C.Itenablesyoutomodel,provision,andmanageAWSresourcesusinginfrastructureascode.D.ItautomaticallyoptimizesthecostofyourAWSresources.Answer:CExplanation:AWSCloudFormationisanInfrastructureasCode(IaC)servicethatallowsyoutomodelyourentireAWSinfrastructureintextfiles(templates).Thesetemplatescanbeversion-controlled,reused,andusedtoprovisionresourcesconsistentlyandrepeatedly.OptionAistheroleofAmazonCloudWatch.OptionBdescribesAWSArchitectureCenterdiagramsorthird-partytools.OptionDisafeatureofAWSCostExplorerandTrustedAdvisor.Question14WhichofthefollowingisacharacteristicoftheAWSCloudthatallowsasystemtoacquireresourcesasneededtohandleincreaseddemand?A.HighAvailabilityB.ElasticityC.FaultToleranceD.GlobalReachAnswer:BExplanation:Elasticityistheabilitytoacquireresourcesasyouneedthemandreleaseresourceswhenyounolongerneedthem.Thisallowsasystemtoscaleouttohandleincreasedloadandscaleinwhendemanddecreases.HighAvailability(A)isaboutensuringuptime.FaultTolerance(C)isaboutoperatingwithoutinterruptiondespitefailures.GlobalReach(D)referstotheworldwideinfrastructure.Question15AcompanywantstograntanAWSservice(likeanEC2instance)permissionstoaccessotherAWSservices(likeS3).WhatistheMOSTsecurewaytodothis?A.StoreAWSaccesskeysandsecretkeysinaconfigurationfileontheinstance.B.CreateanIAMrolewiththenecessarypermissionsandattachittotheEC2instance.C.UsetherootusercredentialsoftheAWSaccount.D.CreateanIAMuser,generatekeys,andhardcodethemintheapplication.Answer:BExplanation:IAMrolesarethesecurewaytograntpermissionstoAWSservices.Youcreatearolewithapermissionpolicy,andthenyoucanattachthatroletoanEC2instance(orotherservice).Applicationsontheinstanceautomaticallyreceivetemporarysecuritycredentials,eliminatingtheneedtomanagelong-termkeys.OptionsAandDinvolvehardcodingorstoringlong-termcredentials,whichisasecurityrisk.OptionCisaseveresecurityanti-pattern.Question16WhichAWSservicehelpsyouprotectyourwebapplicationsfromcommonwebexploitsbyallowingyoutoconfigurerulesthatblock,allow,ormonitorwebrequests?A.AWSShieldB.AWSWAFC.AWSGuardDutyD.AmazonInspectorAnswer:BExplanation:AWSWAF(WebApplicationFirewall)helpsprotectwebapplicationsfromcommonwebexploitsbyallowingyoutocreaterulesthatcontrolaccesstoyourcontentbasedonconditionslikeIPaddresses,HTTPheaders,andURIstrings.AWSShield(A)isforDDoSprotection.GuardDuty(C)isathreatdetectionservice.AmazonInspector(D)isforautomatedsecurityassessmentsonEC2instances.Question17Whatdoesthe"PrincipleofLeastPrivilege"recommendwhengrantingpermissionsinAWSIAM?A.Grantallpermissionstotherootuserforsimplicity.B.Grantonlythepermissionsrequiredtoperformaspecifictask.C.GrantpermissionstoIAMgroupsinsteadofindividualusers.D.Grantpermissionsbasedonjobtitleswithintheorganization.Answer:BExplanation:ThePrincipleofLeastPrivilegeisasecuritybestpracticethatrecommendsgrantingonlytheminimumpermissionsnecessaryforauser,role,orapplicationtoperformitsintendedfunction.Thisreducestheriskofaccidentalormaliciousmisuseofpermissions.Question18Ane-commercewebsiteexperiencesatenfoldincreaseintrafficduringaholidaysale.WhichAWSfeatureallowsitsAmazonEC2-basedapplicationtohandlethissurgeautomatically?A.AWSAutoScalingB.AWSElasticLoadBalancingC.AmazonCloudWatchAlarmsD.AWSTrustedAdvisorAnswer:AExplanation:AWSAutoScaling(specificallyEC2AutoScaling)allowsyoutoautomaticallyaddorremoveEC2instancesbasedondefinedconditions(likeCPUutilizationoraschedule)tohandlechangesindemand.ElasticLoadBalancing(B)distributestrafficbutdoesnotadd/removeinstances.CloudWatch(C)providesthemetricstotriggerscaling.TrustedAdvisor(D)givesoptimizationrecommendations.Question19WhichAWSserviceprovidesafullymanaged,petabyte-scaledatawarehousethatallowsyoutoruncomplexanalyticalqueriesagainstlargedatasetsusingstandardSQL?A.AmazonRDSB.AmazonDynamoDBC.AmazonRedshiftD.AmazonAthenaAnswer:CExplanation:AmazonRedshiftisafullymanaged,petabyte-scaledatawarehouseservicedesignedforonlineanalyticalprocessing(OLAP).Itisoptimizedforcomplexqueriesonlargedatasets.AmazonRDS(A)isforOLTPworkloads.DynamoDB(B)isaNoSQLdatabase.AmazonAthena(D)isaninteractivequeryservicefordatainS3,notamanageddatawarehousecluster.Question20Acompanyneedstomigrate100TBofdatafromtheiron-premisesdatacentertoAmazonS3.Theirinternetconnectionhaslimitedbandwidth.WhichAWSserviceistheMOSTsuitableforthistransfer?A.AWSVPNB.AWSDirectConnectC.AWSSnowballEdgeD.AmazonS3TransferAccelerationAnswer:CExplanation:AWSSnowballEdgeisaphysicaldatatransportdeviceusedformovinglargeamountsofdata(terabytestopetabytes)intoandoutofAWS.Itbypassestheinternet,overcomingnetworkconstraints.DirectConnect(B)providesadedicatedprivatenetworkconnectionbutstillreliesonyournetworkspeedfortheinitiallargetransfer,whichcouldtakeweeksoverastandardconnection.S3TransferAcceleration(D)optimizestransfersovertheinternetbutisstilllimitedbybandwidth.VPN(A)isforsecureconnectivity,notlarge-scaledatamigration.Question21WhichofthefollowingisabenefitofusingAmazonCloudFront?(SelectTWO.)A.Itreduceslatencybycachingcontentatedgelocationsglobally.B.Itprovidesavirtualserverinthecloud.C.ItencryptsdataatrestinAmazonS3buckets.D.Itoffloadstheoriginserverbyservingcachedcontent.E.Itmanagesrelationaldatabasebackupsautomatically.Answer:A,DExplanation:AmazonCloudFrontisaCDN.Itsprimarybenefitsincludereducinglatency(A)byservingcontentfromlocationsclosetousersandoffloadingtrafficfromtheoriginserver(D)byservingcachedstaticanddynamiccontent.OptionBdescribesAmazonEC2.OptionCisafeatureofS3orotherstorageservices.OptionEisafeatureofAmazonRDS.Question22IntheAWSWell-ArchitectedFramework,whichpillarfocusesontheabilityofasystemtorecoverfrominfrastructureorservicedisruptions?A.SecurityB.ReliabilityC.PerformanceEfficiencyD.CostOptimizationAnswer:BExplanation:TheReliabilitypillarencompassestheabilityofasystemtorecoverfromfailuresanddynamicallyacquirecomputingresourcestomeetdemand.Itincludesprinciplesforfaulttoleranceandhighavailability.Security(A)focusesonprotectingdataandsystems.PerformanceEfficiency(C)focusesonusingcomputingresourcesefficiently.CostOptimization(D)focusesonavoidingunnecessarycosts.Question23WhichAWSserviceprovidesaunifiedviewandmanagementconsoleforallyourAWSresourcesacrossdifferentaccountsandregions?A.AWSOrganizationsB.AWSResourceGroupsC.AWSSystemsManagerD.AWSManagementConsoleAnswer:BExplanation:AWSResourceGroupsallowyoutomanageandautomatetasksongroupsofresourcesacrossdifferentAWSservicesandregionsfromasingleplace,liketheAWSManagementConsole.AWSOrganizations(A)isforaccountmanagement.AWSSystemsManager(C)isforoperationalinsightsandactionsonresources.TheAWSManagementConsole(D)isthewebinterface,butResourceGroupsorganizestheviewwithinit.Question24WhatisthepurposeofanAmazonVPC(VirtualPrivateCloud)?A.Toprovideaphysical,isolatedsectionoftheAWSCloud.B.TolaunchAWSresourcesinalogicallyisolatedvirtualnetworkthatyoudefine.C.TocreateaprivateconnectionbetweenyourdatacenterandAWS.D.Tohostpublic-facingwebsites.Answer:BExplanation:AnAmazonVPCletsyouprovisionalogicallyisolatedsectionoftheAWSCloudwhereyoucanlaunchAWSresourcesinavirtualnetworkthatyoudefine.YouhavecontroloverIPaddressranges,subnets,routetables,andgateways.OptionAdescribesaphysicalconcept,notvirtual.OptionCdescribesAWSDirectConnectorVPN.OptionDisonepossibleusecase,butnottheprimarypurpose.Question25Acompanywantstoanalyzereal-timestreamingdatafromsocialmediafeedstoidentifytrendingtopics.WhichAWSserviceisdesignedforthispurpose?A.AmazonKinesisDataStreamsB.AmazonSQSC.AmazonMQD.AmazonSNSAnswer:AExplanation:AmazonKinesisDataStreamsisaserviceforreal-timeprocessingofstreamingdataatscale.Itcaningest,buffer,andprocessdatastreams(likesocialmediafeeds,logs,IoTdata)inrealtime.SQS(B)andSNS(D)aremessagingservicesbutnotoptimizedforhigh-volume,real-timeanalyticsonstreamingdata.AmazonMQ(C)isamanagedmessagebroker.Question26WhichAWSsupportplanincludesaccesstoaTechnicalAccountManager(TAM)andarchitecturalguidancethroughAWSWell-ArchitectedReviews?A.BasicSupportB.DeveloperSupportC.BusinessSupportD.EnterpriseSupportAnswer:DExplanation:TheEnterpriseSupportplanprovidesaproactiveTechnicalAccountManager(TAM),whoprovidesguidanceandhelpsplanandreviewyourarchitecture(includingWell-ArchitectedReviews).BusinessSupportoffersaccesstoCloudSupportEngineersbutdoesnotincludeadedicatedTAM.BasicandDeveloperplansdonotincludetheseservices.Question27WhatdoestheAWSFreeTierallownewAWScustomerstodo?A.UseallAWSservicesforfreeindefinitely.B.UsealimitedamountofspecificAWSservicesforfreeeachmonthforthefirst12monthsaftersign-up,plusalwaysfreeoffers.C.GetadiscountonallAWSservicesforthefirstyear.D.UseAWSservicesforfreefordevelopmentandtestingonly.Answer:BExplanation:TheAWSFreeTieroffersthreetypesofoffers:AlwaysFree(limitedquantitiesofcertainservicesfreeindefinitely),12MonthsFree(freefor12monthsfromsign-up),andShort-TermTrials.Itisdesignedtogivenewcustomershands-onexperiencewithalimitedamountofresources.Question28WhichAWSservicecanbeusedtosetupabastionhosttosecurelyadministerAmazonEC2instancesinaprivatesubnet?A.AWSSystemsManagerSessionManagerB.AmazonRDSC.AWSDirectConnectD.AmazonRoute53Answer:AExplanation:AWSSystemsManagerSessionManagerprovidesasecureandauditablewaytomanageEC2instances,edgedevices,andon-premisesserversthroughaninteractiveone-clickbrowser-basedshellortheAWSCLI.Iteliminatestheneedforabastionhostbyprovidingasecuretunnel,butitcanalsobeusedasamoresecurealternativetoatraditionalbastionhost.Theotheroptionsareunrelated.Question29Acompanyneedsadurable,long-termstoragesolutionforregulatorycompliancearchivesthatwillbeaccessedonceevery5-7years.WhichAmazonS3storageclassisMOSTcost-effective?A.S3StandardB.S3Standard-InfrequentAccess(S3Standard-IA)C.S3GlacierFlexibleRetrievalD.S3GlacierDeepArchiveAnswer:DExplanation:S3GlacierDeepArchiveisthelowest-coststorageclassinAWS,designedforlong-termretentionofdatathatisrarelyaccessed(onceortwiceayear)andhasaretrievaltimeof12-48hours.Fordataaccessedonceevery5-7years,itisthemostcost-effectiveoption.S3GlacierFlexibleRetrieval(C)isfordataaccessed1-2timesperyear.S3Standard-IA(B)isforinfrequentlyaccesseddatawithmillisecondretrieval.S3Standard(A)isforfrequentlyaccesseddata.Question30WhichofthefollowingisabestpracticeforsecuringtheAWSrootuseraccount?A.Useitfordailyadministrativetasks.B.Enablemulti-factorauthentication(MFA)anddonotcreateaccesskeysforit.C.ShareitscredentialswiththeITteamforemergencyaccess.D.UseittocreateIAMusersandthenstorethecredentialsinanS3bucket.Answer:BExplanation:TherootuserhasunrestrictedaccesstotheAWSaccount.Thebestpracticesare:1)EnableMFAontherootaccount,2)Donotcreateaccesskeysfortherootuser,3)Usetherootuseronlyfortasksthatrequirerootpermissions(likechangingthesupportplanorclosingtheaccount).AllothertasksshouldbeperformedbyIAMusers/roles.Question31AnapplicationrequiresahighlyavailabledatabasewithareadreplicainadifferentAWSRegionfordisasterrecovery.WhichAmazonRDSfeatureenablesthis?A.Multi-AZdeploymentsB.ReadreplicasC.AutomatedbackupsD.DatabasesnapshotsAnswer:BExplanation:AmazonRDSReadReplicasprovideenhancedperformanceanddurabilityfordatabaseworkloads.YoucancreateareadreplicainadifferentAWSRegionfordisasterrecoveryortosupportgeographicallydistributedusers.Multi-AZdeployments(A)areforhighavailabilitywithinasingleregion.Automatedbackups(C)andsnapshots(D)areforbackup/restore,notforlivereadtrafficinanotherregion.Question32WhatistheprimaryusecaseforAmazonRoute53?A.ToprovideaDomainNameSystem(DNS)webservicefordomainregistrationandrouting.B.TomonitorandlogAPIcallstoAWSservices.C.Toprovideacontentdeliverynetwork(CDN).D.Tocreateandmanagevirtualprivatenetworks(VPCs).Answer:AExplanation:AmazonRoute53isascalableandhighlyavailableDomainNameSystem(DNS)webservice.Itsprimaryfunctionsaredomainregistration,DNSrouting(e.g.,routinguserstoendpointslikeEC2instances,S3buckets,orloadbalancers),andhealthchecking.OptionBisAWSCloudTrail.OptionCisAmazonCloudFront.OptionDisAmazonVPC.Question33WhichAWSservicecanbeusedtocreateadashboardtomonitortheCPUutilizationofyourAmazonEC2instances?A.AWSCloudTrailB.AWSConfigC.AmazonCloudWatchD.AWSTrustedAdvisorAnswer:CExplanation:AmazonCloudWatchisamonitoringandobservabilityservice.Itcollectsmetrics(likeCPUutilization)andlogsfromAWSresources.Youcancreatecustomdashboardstovisualizethesemetrics.CloudTrail(A)logsAPIcalls.AWSConfig(B)tracksresourceconfigurationchanges.TrustedAdvisor(D)providesoptimizationrecommendations.Question34AcompanywantstoruncontainerizedapplicationswithoutmanagingtheunderlyingEC2instances.WhichAWSserviceshouldtheyuse?A.AmazonECSonEC2B.AmazonEKSC.AWSFargateD.AmazonEC2Answer:CExplanation:AWSFargateisaserverlesscomputeengineforcontainers.ItworkswithbothAmazonECSandAmazonEKS.Itallowsyoutoruncontainerswithoutprovisioning,configuring,orscalingclustersofvirtualmachines.Youpayonlyfortheresourcesyourcontainersuse.OptionsAandBinvolvemanagingtheunderlyingEC2instances(thenodes).OptionDisrawvirtualservers.Question35AccordingtoAWS,whichpricingmodelcanresultinsignificantsavings(upto72%comparedtoOn-Demand)forsteady-stateworkloadswithflexiblestartandendtimes?A.On-DemandInstancesB.ReservedInstancesC.SpotInstancesD.DedicatedHostsAnswer:BExplanation:ReservedInstancesprovideasignificantdiscount(upto72%)comparedtoOn-Demandpricinginexchangeforacommitmenttoaconsistentamountofusage(1or3yearterm).Theyareidealforsteady-state,predictableworkloads.SpotInstances(C)offerthehighestdiscount(upto90%)butcanbeinterruptedandareforfault-tolerant,flexibleworkloads.Question36WhichAWSservicehelpsyoudiscover,filter,andanalyzeyourAWSresourceconfigurationandcompliancehistory?A.AmazonCloudWatchLogsB.AWSCloudTrailC.AWSConfigD.AWSShieldAnswer:CExplanation:AWSConfigcontinuouslymonitorsandrecordsyourAWSresourceconfigurationsandallowsyoutoassess,audit,andevaluatetheconfigurationsforcomplianceagainstinternalguidelinesorexternalregulations.Itprovidesadetailedhistoryofconfigurationchanges.CloudWatchLogs(A)isforapplicationandsystemlogs.CloudTrail(B)isforAPIcallhistory.Shield(D)isforDDoSprotection.Question37WhatistheprimarynetworkingcomponentwithinaVPCthatallowsresourcesinaprivatesubnettoinitiateoutboundconnectionstotheinternet,whilepreventinginboundconnectionsfromtheinternet?A.InternetGatewayB.NATGatewayC.VirtualPrivateGatewayD.VPCPeeringAnswer:BExplanation:ANAT(NetworkAddressTranslation)Gatewayenablesinstancesinaprivatesubnettoconnecttotheinternet(e.g.,forsoftwareupdates)orotherAWSservices,butpreventstheinternetfrominitiatingaconnectionwiththoseinstances.AnInternetGateway(A)allowsbidirectionalcommunicationforresourcesinapublicsubnet.AVirtualPrivateGateway(C)isforVPNconnections.VPCPeering(D)connectstwoV