Amazon Web Services CLF-C02 - AWS Certified Cloud Practitioner

Based on AWS IAM documentation,inline policiesare policies that aredirectly embedded into a single IAM user, group, or role. When a company wants to create and apply a policy specifically for one user and does not intend to reuse it, inline policies are the most appropriate option.

AWS managed policies are created and maintained by AWS and are intended for general use cases. Customer managed policies are reusable policies created by customers and can be attached to multiple users, groups, or roles. Amazon S3 bucket policies are resource-based policies and apply only to S3 buckets, not directly to IAM users.

AWS documentation explains that inline policies maintain astrict one-to-one relationshipwith the entity to which they are attached. If the user is deleted, the inline policy is also deleted automatically. This makes inline policies ideal foruser-specific, tightly scoped permissions, which matches the requirement in the question exactly.

Under the AWS shared responsibility model, AWS is responsible for managing the underlying infrastructure, including operating system-level updates on managed services like Amazon RDS. Customers are responsible for managing the database instance and configurations, but AWS handles OS updates for the infrastructure supporting RDS.

AWS IAM Identity Center provides centralized access management across multiple AWS accounts, enabling organizations to manage employee access efficiently. It is specifically designed for this purpose within AWS Organizations. AWS STS provides temporary credentials but does not manage multiple account access centrally, while IAM Access Analyzer and Secrets Manager serve different purposes related to access and secret management.

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

For an Amazon RDS Multi-AZ DB instance deployment, Amazon RDS provides the managed high-availability and failover mechanism. If a qualifying planned or unplanned outage affects the primary DB instance, RDS automatically switches to the standby replica in another Availability Zone. This automatic promotion or failover is performed by AWS as part of the managed RDS service, so option B is correct. The customer must first choose and enable a Multi-AZ deployment; AWS does not decide to enable that architecture on the customer’s behalf, which eliminates option C. The application must also be designed to recover connections after failover, normally by reconnecting through the unchanged DB endpoint after DNS updates propagate, which eliminates option A. Monitoring application behavior, business transactions, latency, and post-failover performance also remains part of the customer’s operational responsibility, even though AWS monitors the RDS service and underlying infrastructure. The exam distinction is that AWS automates the database infrastructure failover, while the customer configures the deployment and makes the application resilient to the connection interruption.

The customer is responsible for selecting and configuring the encryption options used for its Amazon RDS database. When creating an encrypted DB instance, the customer enables encryption and can select an AWS managed KMS key or an eligible customer managed KMS key. The customer must also manage permissions and policies for customer managed keys. Therefore, option A is correct. Amazon RDS is a managed database service, so AWS manages the underlying server hardware and the operating system used to run standard RDS DB instances. RDS also manages routine database software patching, including applicable minor-version maintenance according to the configured maintenance and upgrade settings. The exact division can differ for specialized products such as RDS Custom or engines enrolled in Extended Support, but the foundational-level question refers to standard Amazon RDS. AWS protects and maintains the managed infrastructure, while customers remain responsible for their data, database users, access controls, network configuration, encryption choices, application integration, and query tuning. The exam clue is that encryption is a customer security configuration decision, whereas physical hardware and underlying managed-platform patching are handled by AWS.

Refactoring involves re-architecting and modifying an application to take advantage of cloud-native features. In this case, the company wants to modernize a monolithic application by breaking it into microservices. This process aligns with the Refactor strategy, which is aimed at modernizing and re-architecting applications. Rehost, Repurchase, and Replatform do not involve the level of re-architecting needed to move from a monolithic to a microservices architecture.

Amazon Athena Overview:

Amazon Athena is a serverless query service that allows users to analyze data in S3 using standard SQL.

It is commonly used to query AWS Cost and Usage Reports stored in S3.

How It Works for Cost Reports:

Cost and Usage Reports are delivered in a structured format to an S3 bucket.

Athena can query these reports without requiring additional ETL processes.

Why Other Options Are Incorrect:

A. Amazon OpenSearch Service:Designed for search and log analytics, not querying structured data.

C. Amazon Aurora:A relational database service, unsuitable for querying S3 data directly.

D. AWS Glue:Used for ETL tasks but not directly for querying.

AWS IAM Access Analyzer can identify and report unused access granted to IAM users and roles. When an unused-access analyzer is created, it reviews access activity and generates findings for conditions such as unused roles, unused IAM user access keys, unused console passwords, and permissions for services or actions that have not been used during the configured analysis period. This allows organizations to remove unnecessary permissions and move toward least-privilege access. Therefore, option B is correct. AWS CloudTrail records account and API activity, and its data can support investigations, but it does not by itself produce the specialized unused-access findings described in the question. IAM Identity Center centrally manages workforce access to multiple AWS accounts and applications but is not the analysis service for identifying unused IAM permissions. AWS Trusted Advisor provides best-practice checks across categories such as cost, performance, resilience, security, and service quotas, but IAM Access Analyzer is the service specifically documented for unused access analysis. Access Analyzer can continuously monitor IAM users and roles and provide findings that help administrators refine or remove permissions that are no longer required.

S3 Intelligent-Tiering is cost-effective for data with unpredictable access patterns. It automatically moves data between two access tiers (frequent and infrequent) based on access patterns, which is suitable for data accessed daily or infrequently. S3 Glacier Deep Archive is for archival data accessed infrequently, and S3 One Zone-IA is for infrequent access data stored in a single availability zone, which may not be ideal for data accessed daily.