Amazon Web Services CLF-C02 - AWS Certified Cloud Practitioner

Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. It supports both document and key-value data models and is designed to handle large amounts of data across multiple servers. Other options, like Amazon RDS and Aurora, are managed relational database services, and Amazon Redshift is a data warehousing service.

AWS Application Discovery Service helps companies gather information about on-premises data centers to support migration planning. It collects data on system configuration, resource utilization, and network dependencies, providing essential insights for migration. AWS DataSync and Storage Gateway are used for data transfer, while AWS DMS is for database migration specifically.

Comprehensive and Detailed Explanation From AWS Cloud Documentation:

Enabling S3 Versioning is the customer action that protects Amazon S3 objects from many accidental deletions and overwrites. Versioning keeps multiple variants of an object in the same bucket. When a user deletes a versioned object without specifying a version ID, Amazon S3 normally adds a delete marker instead of permanently removing all prior versions, allowing an earlier version to be recovered. It also preserves prior versions when an object is overwritten. Because the customer chooses the bucket configuration and enables versioning, option D is correct under the shared responsibility model. AWS is responsible for operating and patching the underlying S3 service, maintaining the physical storage infrastructure, and providing the designed durability of the service, so options A, B, and C are not customer tasks. Versioning should still be combined with appropriate IAM permissions, lifecycle rules, backups or replication where required, and possibly S3 Object Lock or MFA Delete for stronger protection. The central exam point is that AWS operates S3, while the customer configures data-protection features for the customer’s buckets and objects.

Amazon AppStream 2.0 is the former exam name for the service currently documented as Amazon WorkSpaces Applications. It is a fully managed application-streaming service that allows organizations to centrally host desktop applications and stream them to users. Users can access applications through supported clients or an HTML5-capable web browser without installing the complete application locally. This provides the instant, location-independent application access described in the question, making option A correct. Amazon Lightsail is a simplified service for virtual private servers, containers, databases, networking, and web application hosting. AWS Resource Access Manager allows supported AWS resources to be shared across accounts or within AWS Organizations. AWS Client VPN provides managed remote network connectivity to AWS and connected networks, but it does not host and stream desktop applications by itself. WorkSpaces Applications can maintain centrally managed application images, allowing users to access current application versions from suitable devices. For exam recognition, remember both names: older questions use Amazon AppStream 2.0, while current AWS documentation uses Amazon WorkSpaces Applications for the managed desktop application-streaming capability.

Under the AWS shared responsibility model, AWS is responsible for securityofthe cloud. For an abstracted managed service such as Amazon S3, this responsibility includes operating and protecting the infrastructure layer, physical facilities, networking, hardware, operating systems, and service platform that run S3. Therefore, option B is correct. The customer remains responsible for securityinthe cloud, including controlling access to stored objects, configuring bucket policies and IAM permissions, classifying data, and selecting appropriate data-protection settings. Enabling S3 Versioning is also a customer configuration decision. Versioning can help protect against accidental deletion or overwriting, but AWS does not automatically decide whether a particular customer bucket should use it. Similarly, AWS provides the mechanisms for bucket policies, but customers must create policies that reflect their access requirements. Data classification is based on the sensitivity, ownership, and regulatory requirements of the customer’s information and therefore cannot be performed automatically by AWS as part of its infrastructure responsibility. The key distinction is that AWS protects the platform running S3, while customers secure and govern their use of S3.

Application Load Balancer (ALB) integrates with AWS WAF to deploy and manage WAF rules for incoming traffic. ALB can route HTTP and HTTPS traffic and apply WAF rules to protect applications from common web exploits. Network Load Balancer does not support AWS WAF, and Trusted Advisor does not deploy WAF rules.

The AWS Management Console provides a web-based graphical user interface (GUI) that allows users to manage AWS services. It is user-friendly and accessible, enabling users to control and configure resources without needing to interact with AWS through code or command-line interfaces. AWS CLI and SDKs are command-line and programming tools, respectively, and do not offer a graphical interface.

Amazon Rekognition is a machine learning service that can analyze and recognize objects, people, text, scenes, and activities in images and videos. It is specifically designed for organizing, categorizing, and searching large volumes of images based on various attributes. Amazon Transcribe is for speech-to-text, Amazon Aurora is a relational database service, and Amazon QuickSight is a business intelligence tool for data visualization.

AWS is responsible for protecting the physical network infrastructure that operates AWS Cloud services. This includes the physical data centers, networking equipment, foundational hardware, software, and global infrastructure used to provide AWS services. Consequently, option C is correct. Customers are responsible for protecting their applications and data, including choosing encryption controls appropriate for their workloads. They are also responsible for authenticating their application users and determining which users should receive access. Although AWS provides services such as IAM, Amazon Cognito, and encryption services, customers must configure and use them according to their requirements. Firewall configuration is likewise generally a customer responsibility. Customers configure security groups, network ACLs, AWS WAF rules, host firewalls, and other logical controls depending on the workload and service model. AWS maintains the physical network devices and infrastructure, but the customer controls the security configuration of the customer’s cloud environment. The shared responsibility model describes AWS duties as securityofthe cloud and customer duties as securityinthe cloud. Protecting physical network infrastructure clearly belongs to AWS’s side of this division.

Amazon Aurora (with PostgreSQL compatibility) and Amazon EC2 can both host PostgreSQL databases. Aurora is a managed database service that provides a fully compatible PostgreSQL environment with automated management. EC2 can also host PostgreSQL, but it requires more manual setup and maintenance. Amazon S3 and EFS do not host databases, and Amazon OpenSearch Service is intended for search and analytics, not relational databases.

Amazon Connect is the AWS cloud contact-center service intended for building customer service centers. It provides capabilities for voice, chat, tasks, routing, queues, agent access, contact flows, reporting, and integrations with other AWS services. A company can create a virtual contact-center instance, obtain or port telephone numbers, add agents, configure routing profiles, and define how contacts move through the customer experience. Therefore, option B is correct. Current AWS documentation may display the service within updated “Connect Customer” naming, while Amazon Connect remains the name used in this exam option. Amazon Athena is a serverless interactive query service used to analyze data with SQL, commonly against data stored in Amazon S3. AWS Direct Connect establishes dedicated network connectivity between a customer environment and AWS. AWS Enterprise Support is a support plan that provides technical guidance and support capabilities; it is not a platform for operating a customer contact center. The phrase “cloud-based customer service centers” directly maps to Amazon Connect’s fully managed contact-center functionality, which allows organizations to serve customers without deploying traditional on-premises contact-center infrastructure.

IAM roles provide delegated access through temporary security credentials. A trusted user, application, workload, federated identity, or AWS service assumes a role and receives time-limited credentials from AWS Security Token Service. The permissions attached to the role determine which actions can be performed on which resources. Because the credentials expire and do not need to be permanently embedded in applications, IAM roles are the correct answer. IAM Access Analyzer identifies external, internal, or unused access and can validate policies, but it does not grant temporary credentials. Service control policies define the maximum permissions that can be available to accounts or organizational units in AWS Organizations. SCPs do not grant access and do not issue credentials. Access control lists are resource-level permission mechanisms supported by certain services; they do not create temporary identity sessions. AWS recommends temporary credentials and roles instead of long-term access keys wherever possible because temporary credentials automatically expire and reduce the risks associated with permanent credentials. The exam association is straightforward: assuming an IAM role produces temporary credentials with permissions limited by the role’s policies.