CLF-C02 practice questions: Cloud Technology and Services

Answer: D. Task Statement 3.3 states that candidates should recognize that auto scaling provides elasticity. The Amazon EC2 Auto Scaling user guide states that 'You can specify the minimum number of instances in each Auto Scaling group,' 'the maximum number,' and that 'If you specify scaling policies, then Amazon EC2 Auto Scaling can launch or terminate instances as demand on your application increases or decreases.' It adds that 'Using auto scaling allows you to maintain application availability and reduce costs by adding capacity to handle peak loads and removing capacity when demand is lower.' Source: AWS CLF-C02 Exam Guide - Domain 3: Cloud Technology and Services

Answer: B. Task Statement 3.1 covers the various ways of provisioning and operating in the AWS Cloud. The AWS Elastic Beanstalk developer guide states that 'With Elastic Beanstalk you can deploy web applications into the AWS Cloud on a variety of supported platforms. You build and deploy your applications. Elastic Beanstalk provisions Amazon EC2 instances or EKS clusters, configures load balancing, sets up health monitoring, and dynamically scales your environment.' It states that Elastic Beanstalk 'supports applications developed in Go, Java, .NET, Node.js, PHP, Python, and Ruby', and on pricing that 'There is no additional charge for Elastic Beanstalk. You pay only for the underlying AWS resources that your application consumes.' Elastic Beanstalk appears under Compute in the CLF-C02 in-scope services list. Source: AWS CLF-C02 Exam Guide - Domain 3: Cloud Technology and Services

Answer: A. Task Statement 3.2 covers the benefits of edge locations, and the CLF-C02 in-scope services list names AWS Global Accelerator under Networking and Content Delivery. Its developer guide states that 'By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator. The static IP addresses are anycast from the AWS edge network,' that for standard accelerators 'Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health, client location, and policies that you configure,' that endpoints can be Network Load Balancers in one or several Regions, and that the service 'reacts instantly to changes in health or configuration.' Source: AWS CLF-C02 Exam Guide - Domain 3: Cloud Technology and Services

Answer: B. Task Statement 3.5 covers security in a VPC. The Amazon VPC user guide page 'Security group rules' lists 'The ID of a security group' among the sources a rule can take, and states under 'Security group referencing' that 'When you specify a security group as the source or destination for a rule, the rule affects all instances that are associated with the security groups. The instances can communicate in the specified direction, using the private IP addresses of the instances, over the specified protocol and port.' The same page's worked example places each reference: 'Add rules to the security group for the web servers to allow HTTP and HTTPS traffic only from the load balancer. The source is the security group for the load balancer' and 'Add rules to the security group for the database servers to allow database requests from the web servers. The source is the security group for the web servers.' It also notes that 'A rule that references another security group counts as one rule, no matter the size of the referenced security group.' Elsewhere the guide defines a managed prefix list as 'a set of one or more CIDR blocks', and the default security group's inbound rule as one that 'Allows inbound traffic from all resources that are assigned to this security group'. Source: AWS CLF-C02 Exam Guide - Domain 3: Cloud Technology and Services

Answer: B. Task Statement 3.5 covers security in a VPC, including security groups and network ACLs. The Amazon VPC user guide page on security groups states: 'Security groups are stateful. For example, if you send a request from an instance, the response traffic for that request is allowed to reach the instance regardless of the inbound security group rules. Responses to allowed inbound traffic are allowed to leave the instance, regardless of the outbound rules.' The same page describes 'the default outbound rule, which allows all traffic.' The page 'Default network ACL for a VPC' states that 'A default network ACL is configured to allow all traffic to flow in and out of the subnets with which it is associated.' With an empty inbound rule set, the instance can still start connections and receive the replies to them. Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html