CLF-C02 Sample Questions & Answers

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. It does this by caching content in a worldwide network of edge locations. This is the ideal service for distributing game assets to a global user base. AWS Direct Connect is for private network connections, S3 Transfer Acceleration is for fast uploads to S3, and Elastic Load Balancing distributes traffic to backend servers within a region.

The most secure and recommended method is to use an IAM role. An IAM role can be attached to an EC2 instance, which grants the applications on that instance temporary security credentials to access other AWS services. This avoids the need to store long-term credentials (like access keys) on the instance, which is a major security risk. The EC2 instance automatically rotates the temporary credentials provided by the role.

The AWS Cloud pricing model is fundamentally pay-as-you-go. This means you pay only for the individual services you need, for as long as you use them, without requiring long-term contracts or complex licensing. This allows businesses to trade capital expense (CapEx) for variable expense (OpEx).

Availability Zones (AZs) are distinct locations within an AWS Region that are engineered to be isolated from failures in other AZs. By deploying an application across multiple AZs, it can remain operational even if one of the AZs fails, thus significantly increasing its availability and fault tolerance. Reducing global latency is achieved by using multiple Regions or Amazon CloudFront. Data sovereignty is handled at the Region level.

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from an on-premises location to AWS. This provides a more consistent network experience than internet-based connections, offering private connectivity and high bandwidth, which are critical for sensitive workloads like an EHR system. A Site-to-Site VPN connects over the public internet, which may not meet the performance or security requirements. VPC Peering connects two VPCs, and a NAT Gateway provides outbound internet access from a private subnet.

AWS CloudFormation provides a common language to model and provision all the infrastructure resources in your cloud environment. It allows you to use a simple text file (in YAML or JSON format) to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts. This practice is known as Infrastructure as Code (IaC).

AWS Organizations allows you to centrally govern your environment as you grow and scale your AWS resources. One of its key features is consolidated billing, which combines the usage from all member accounts into a single bill for the management account. This allows the organization to benefit from volume pricing discounts and Reserved Instance sharing across accounts.

In the shared responsibility model, AWS is responsible for the security 'of' the cloud (infrastructure, hardware, software, networking, facilities). The customer is responsible for security 'in' the cloud. This includes managing the guest OS on EC2, configuring firewalls like security groups and network ACLs, managing their data, and configuring IAM. Physical security and hypervisor management are AWS's responsibilities.

AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures. This enables the university to provide standardized, pre-approved environments (products) that researchers can deploy on-demand, ensuring compliance and governance without granting them direct access to provision underlying services.

A primary economic benefit of the cloud is the shift from capital expenditure (CapEx) to operational expenditure (OpEx). Instead of investing heavily in data centers and servers before you know how you’re going to use them (CapEx), you can pay only when you consume computing resources, and pay only for how much you consume (OpEx).