CLF-C02 Exam Dumps - AWS Certified Cloud Practitioner

AWS provides the flexibility to scale resources up or down on demand, enabling companies to test new applications without making long-term commitments. This principle allows for cost efficiency and agility during testing and development. The other options do not specifically highlight the benefits of flexible, on-demand resource scaling.

An IAM credential report is designed for account-level auditing of IAM user credentials. AWS states that the report lists all IAM users in an AWS account and shows the status of their credentials, including passwords, access keys, and multi-factor authentication devices. It can also contain information such as whether a password is enabled, when credentials were created or last used, whether access keys are active, and whether an MFA device is enabled. This directly satisfies both requirements in the question: listing users and reporting specific credential details. AWS Shield protects applications against distributed denial-of-service attacks and does not produce user credential inventories. AWS Trusted Advisor evaluates an AWS environment against best-practice checks, but it is not the tool for downloading a complete per-user credential-status report. Amazon Inspector scans workloads such as Amazon EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. Therefore, the IAM credential report is the precise IAM auditing tool required. It can be generated and downloaded through the IAM console, AWS CLI, AWS SDKs, or IAM API.

AWS Transit Gateway acts as a cloud router for connecting multiple VPCs and on-premises networks, simplifying network management by creating a hub-and-spoke model for routing traffic. Direct Connect provides a private connection to AWS but does not function as a central router. Amazon Connect is unrelated, and Route 53 is for DNS services, not VPC connectivity.

AWS Direct Connect provides a dedicated private network connection from on-premises data centers directly to the AWS Cloud, bypassing the public internet. This setup is ideal for reducing network costs, increasing bandwidth throughput, and providing a more consistent network experience compared to standard internet connections. Other services, such as Amazon VPC, relate to networking but do not establish a private network connection from on-premises to AWS.

A VPC network access control list, commonly called a network ACL or NACL, provides stateless packet filtering at the subnet boundary. Because it is stateless, it does not remember previously allowed connections. Rules must explicitly allow the required inbound traffic and the corresponding outbound response traffic. Therefore, option C is correct. Security groups are stateful virtual firewalls applied to resources through their network interfaces. When a security group allows traffic in one direction, response traffic for that connection is automatically permitted, regardless of an explicit return rule. AWS PrivateLink provides private connectivity between VPCs, AWS services, and endpoint services without requiring traffic to traverse the public internet; it is not primarily a stateless filtering mechanism. AWS WAF filters web requests to protected application resources based on application-layer criteria such as IP addresses, headers, paths, and malicious-request patterns. It is not a subnet-level stateless VPC packet filter. For the exam, remember that security groups are stateful and normally control resource-level traffic, while network ACLs are stateless and apply inbound and outbound rules at the subnet level.

AWS CloudFormation allows developers to create, manage, and deploy AWS resources using templates, ensuring a standardized and repeatable infrastructure setup. It’s ideal for setting up development, test, and production environments consistently. AWS Cloud Map, CloudFront, and CloudTrail do not provide templated infrastructure management capabilities.