AWS Certified Cloud Practitioner (CLF-C02) Practice Tests

Explanation

Amazon SQS retains messages in the queue until a consumer polls and explicitly deletes them after successful processing. The default message retention period is 4 days, configurable from 1 minute up to 14 days. This decoupling allows producers and consumers to operate independently at different rates without risk of message loss. Amazon SNS uses a publish-subscribe model where publishing a single message to a topic immediately pushes that message to all subscribed endpoints simultaneously — this fan-out capability allows one SNS topic to trigger multiple Lambda functions, SQS queues, HTTP endpoints, or email addresses in parallel without the publisher needing to know about each subscriber. Amazon SNS is push-based, not pull-based — it delivers messages to registered subscribers without requiring them to poll for new messages. Amazon SQS Standard queues provide at-least-once delivery with best-effort ordering, not exactly-once delivery or strict FIFO ordering; SQS FIFO queues are required for exactly-once processing and guaranteed order. Amazon SNS does not store messages for extended retry windows — it uses a push delivery model without a durable persistent message store. Amazon SQS is the service in the portfolio designed for durable message storage and queuing.

Explanation

The Sustainability pillar of the AWS Well-Architected Framework focuses on minimizing environmental impact. Selecting Regions powered by renewable energy is a core Sustainability design principle — when latency or data residency constraints are flexible, choosing a Region with a lower carbon footprint reduces the environmental cost of running the workload. Deploying across multiple Availability Zones addresses the Reliability pillar by preventing failures from affecting the full workload. Enabling CloudTrail aligns with the Security pillar's auditing and traceability principle. Configuring least-privilege IAM policies also belongs to the Security pillar under the access management design principle.

Explanation

Economies of scale explains AWS's ability to offer lower per-unit infrastructure costs than individual organizations. AWS aggregates hardware purchasing, data center operations, and energy consumption across millions of customers worldwide, enabling bulk purchasing agreements with vendors and highly optimized facility designs. These savings are continuously passed on to customers through reduced service pricing. Elasticity describes the ability of cloud resources to automatically scale capacity both upward and downward in response to actual demand. The bank can absorb a sudden transaction spike without pre-purchasing idle capacity because resources provision on-demand within minutes and scale back down when the surge subsides — incurring cost only for what is actually consumed. The reversed ordering placing elasticity first and economies of scale second is incorrect because the question specifies the cost-reduction benefit first and the automatic scaling benefit second. High availability and fault tolerance describe system resilience and uptime guarantees rather than pricing advantages or automatic resource scaling. Global infrastructure and scalability describe geographic reach and the general capacity to grow, but do not specifically address AWS's aggregate purchasing power or automatic bidirectional scaling.

Explanation

AWS Config is purpose-built for tracking the configuration compliance state of AWS resources over time. It continuously records the current configuration of resources, evaluates that state against managed or custom rules, and reports compliance status. The managed rule s3-bucket-server-side-encryption-enabled continuously checks whether S3 buckets have encryption configured and can trigger SNS notifications or invoke Lambda for remediation when a bucket becomes non-compliant. AWS CloudTrail records API activity and tells you who made a specific API call and when — for example, who removed encryption from a bucket. CloudTrail answers the question of what happened and who did it, but does not continuously evaluate whether resources are currently in a compliant state. The distinction between CloudTrail as an API audit log and AWS Config as a configuration compliance evaluator is a frequently tested concept. Amazon CloudWatch monitors operational metrics and application logs. S3 encryption compliance status is not a CloudWatch metric, so alarms cannot be created for this condition natively. AWS Security Hub aggregates findings from services such as GuardDuty, Inspector, and Macie into a centralized security dashboard, but configuration rule evaluation against specific resource properties is Config's responsibility.

Explanation

AWS Trusted Advisor provides different levels of check access based on the AWS Support plan associated with the account. Basic Support and Developer Support accounts receive only a small core set of checks covering the most critical security and service limit recommendations. Upgrading to Business Support or Enterprise Support unlocks the full catalog of Trusted Advisor checks across all five categories: Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits. Enabling AWS Config in all Regions improves configuration tracking and compliance monitoring for resource settings over time, but it has no effect on which Trusted Advisor checks are available. Config and Trusted Advisor are separate services with different purposes and independent access models. Activating AWS Security Hub and enabling security standards improves centralized aggregation of security findings from services like Amazon GuardDuty, Amazon Inspector, and Amazon Macie. Security Hub does not expand Trusted Advisor's check catalog — these are independent services that complement each other but do not control each other's features. Attaching an IAM policy controls which IAM users can view Trusted Advisor results in the console or via API, but IAM permissions have no effect on which checks the account can access. The set of available checks is determined solely by the AWS Support plan tier associated with the account, not by the permissions granted to individual IAM identities.