CLF-C02 Exam Dumps - AWS Certified Cloud Practitioner

"The Reliability pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it’s expected to. This includes the ability to operate and test the workload through its total lifecycle." https://docs.aws.amazon.com/wellarchitected/latest/framework/reliability.html

According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud, such as the global network, the hardware, the software, and the facilities. The customer is responsible for properly configuring the security of the provided service, such as the guest operating system, the application software, the data, and the network traffic. For abstracted services, such as Amazon RDS, AWS operates the infrastructure layer, the operating system, and the database software, while the customer is responsible for managing their data, classifying their assets, and using IAM tools to apply the appropriate permissions12.

Therefore, the tasks that are the customer’s responsibility are:

Perform client-side data encryption: The customer is responsible for encrypting their data before sending it to AWS, and decrypting it after receiving it from AWS. This ensures that the data is protected in transit and at rest. AWS provides various encryption options, such as AWS Key Management Service (AWS KMS), AWS CloudHSM, and AWS Certificate Manager (ACM)3.

Configure IAM credentials: The customer is responsible for creating and managing IAM users, groups, roles, and policies that control the access to AWS resources and services. IAM credentials include user names, passwords, access keys, and permissions4.

The tasks that are not the customer’s responsibility are:

Establish the global infrastructure: AWS is responsible for building and maintaining the global network of regions, availability zones, and edge locations that provide low latency, high availability, and fault tolerance for the AWS Cloud5.

Secure edge locations: AWS is responsible for protecting the physical security of the edge locations, which are sites that deliver cached content to end users with improved performance6.

Patch Amazon RDS DB instances: AWS is responsible for applying patches and updates to the operating system and the database software of the Amazon RDS DB instances, which are managed relational database service for MySQL, PostgreSQL, Oracle, SQL Server, and Amazon Aurora. References:

Shared Responsibility Model - Amazon Web Services (AWS)

Shared responsibility model - Amazon Web Services: Risk and Compliance

Encryption - Amazon Web Services (AWS)

What Is IAM? - AWS Identity and Access Management

Global Infrastructure - Amazon Web Services (AWS)

Amazon CloudFront Features - Content Delivery Network (CDN)

[What Is Amazon Relational Database Service (Amazon RDS)? - Amazon Relational Database Service]

Understanding IAM Roles: IAM (Identity and Access Management) roles in AWS are designed to delegate access permissions without sharing long-term security credentials. This means applications and services can use temporary security credentials, which enhances security.

Why IAM Roles are Best Practice:

Least Privilege Principle: By using IAM roles, you can ensure that applications only have the minimum permissions they need to function, reducing the risk of unauthorized access.

Temporary Credentials: Roles provide temporary security credentials, which reduce the risk if they are compromised compared to long-term access keys.

Automated Rotation: Temporary credentials automatically expire and are rotated, which means you don’t have to manage the rotation manually.

How to Implement IAM Roles:

Create an IAM Role: In the AWS Management Console, navigate to IAM, and create a new role. Choose the type of trusted entity (e.g., EC2, Lambda).

Attach Policies: Attach the necessary policies to the role that define the permissions for accessing the S3 bucket.

Assign Role to Service: Attach the IAM role to your EC2 instances, Lambda functions, or other AWS services that need to access the S3 bucket.

Use AWS SDKs: When accessing S3 from your application, use the AWS SDKs to automatically assume the IAM role and obtain temporary credentials.

AWS Identity and Access Management (IAM)

IAM Roles

The ability to scale resources up and down based on application load is tied to the advantage of "Stop guessing capacity." This feature allows users to scale resources automatically to match the demand, thereby avoiding over-provisioning or under-provisioning of resources. "Go global in minutes," "Benefit from massive economies of scale," and "Trade fixed expense for variable expense" are other advantages of cloud computing, but they do not specifically address scaling resources up and down based on load.

According to theAWS Shared Responsibility Model, customers are responsible for managing their data, classifying their assets, and using AWS's identity and access management tools to apply the appropriate permissions. Implementingmulti-factor authentication (MFA) for IAM user accountsis a customer responsibility to enhance the security of their accounts and protect against unauthorized access.

A. Apply security patches for Amazon S3 infrastructure devices: Incorrect, as AWS is responsible for managing and patching the underlying infrastructure, including storage devices.

B. Provide physical security for AWS data centers: Incorrect, as AWS is responsible for the physical security of its data centers.

C. Install operating system updates on Lambda@Edge: Incorrect, as AWS manages the underlying infrastructure for Lambda@Edge, including operating system updates.

AWS Cloud References:

AWS Shared Responsibility Model

AWS Outposts is a fully managed service that extends AWS infrastructure, services, APIs, and tools to customer premises. By providing local access to AWS managed infrastructure, AWS Outposts enables customers to build and run applications on premises using the same programming interfaces as in AWS Regions, while using local compute and storage resources for lower latency and local data processing needs. An Outpost is a pool of AWS compute and storage capacity deployed at a customer site. AWS operates, monitors, and manages this capacity as part of an AWS Region. You can create subnets on your Outpost and specify them when you create AWS resources such as EC2 instances, EBS volumes, ECS clusters, and RDS instances. Instances in Outpost subnets communicate with other instances in the AWS Region using private IP addresses, all within the same VPC. Outposts solutions allow you to extend and run native AWS services on premises, and isavailable in a variety of form factors, from 1U and 2U Outposts servers to 42U Outposts racks, and multiple rack deployments. With AWS Outposts, you can run some AWS services locally and connect to a broad range of services available in the local AWS Region2. AWS Outposts is a hybrid cloud deployment model that uses AWS Outposts as part of the application deployment infrastructure. Hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and public cloud services with orchestration between the platforms. Hybrid cloud provides businesses with greater flexibility, more deployment options, and optimized costs. By using AWS Outposts, customers can benefit from the fully managed infrastructure, services, APIs, and tools of AWS on premises, while still having access to the full range of AWS services available in the Region for a truly consistent hybrid experience3. References: On-Premises Private Cloud - AWS Outposts Family - AWS, What is AWS Outposts? - AWS Outposts

AWS CloudFormation is a service that allows developers to model and provision their AWS infrastructure in a repeatable and declarative way, using code and templates. AWS CloudFormation enables developers to define the resources they need for their development and production environments, such as compute, storage, network, and application services, and automate their creation and configuration. AWS CloudFormation also provides features such as change sets, nested stacks, and rollback triggers to help developers manage and update their infrastructure safely and efficiently12. References:

AWS CloudFormation

What is AWS CloudFormation?

Understanding S3 Intelligent-Tiering: S3 Intelligent-Tiering is designed to optimize costs by automatically moving data to the most cost-effective access tier based on changing access patterns. It is ideal for data with unknown or unpredictable access patterns.

Why S3 Intelligent-Tiering is Cost-Effective:

Automatic Tiering: Moves data between two access tiers (frequent and infrequent access) based on changing access patterns, optimizing storage costs without performance impact.

No Retrieval Fees: Unlike other storage classes, there are no retrieval fees in Intelligent-Tiering, making it cost-effective for data with unpredictable access patterns.

Monitoring and Automation: Automatically monitors access patterns and transitions data, reducing the need for manual intervention.

When to Use S3 Intelligent-Tiering:

Unpredictable Access Patterns: Ideal for datasets where the access frequency cannot be determined or changes frequently.

Cost Optimization: For organizations looking to minimize storage costs without sacrificing performance or requiring manual intervention to move data between tiers.

Amazon S3 Intelligent-Tiering

Amazon S3 Storage Classes