Amazon CLF-C01 Online Practice Questions and Exam Preparation

Amazon CLF-C01 Online Questions & Answers

• Question 1621:

  A company needs an AWS service that can monitor the company's AWS account If the service identifies misconfigurations; the company's operations team must receive an alert Additionally, the service must remediate the issues by invoking AWS Lambda functions.

  Which service will meet these requirements?

  A. Amazon Macie
  B. Amazon GuardDuty
  C. AWS Config
  D. AWS Trusted Advisor
  D. AWS Trusted Advisor

• Question 1622:

  A company plans to store sensitive data in an Amazon S3 bucket.

  Which task is the responsibility of AWS?

  A. Activate encryption at rest for the data.
  B. Provide security for the physical infrastructure.
  C. Train the company's employees about cloud security.
  D. Remove personally identifiable information (PII) from the data.
  A. Activate encryption at rest for the data.

  ---

  Explanation/Reference:

  Amazon S3 can often house sensitive and confidential information. To help secure your data within Amazon S3, you should be using AWS Key Management Service (AWS KMS) with server-side encryption at rest for Amazon S3. It is also important that you secure the S3 buckets so that you only allow access to the developers and users who require that access.

  Reference: https://aws.amazon.com/blogs/security/strengthen-the-security-of-sensitive-data-stored-in-amazon-s3-by-using-additional-aws-services/

• Question 1623:

  Which AWS service or tool provides information about the utilization of Reserved Instances?

  A. AWS Systems Manager
  B. Cost Explorer
  C. AWS Config2
  D. Amazon CloudWatch
  D. Amazon CloudWatch

• Question 1624:

  A company must store critical business data in Amazon S3 with a backup to another AWS Region.

  How can this be achieved?

  A. Use an Amazon CloudFront Content Delivery Network (CDN) to cache data globally
  B. Set up Amazon S3 cross-region replication to another AWS Region
  C. Configure the AWS Backup service to back up the data to another AWS Region
  D. Take Amazon S3 bucket snapshots and copy that data to another AWS Region
  B. Set up Amazon S3 cross-region replication to another AWS Region

• Question 1625:

  Which AWS service facilitates transporting 50 GB of data from an on-premises data center to an Amazon S3 bucket without using a network connection?

  A. AWS Snowball
  B. AWS CodeDeploy
  C. AWS Backup
  D. AWS Direct Connect
  B. AWS CodeDeploy

• Question 1626:

  Which of the following is an AWS Cloud architecture design principle?

  A. Implement single points of failure.
  B. Implement loose coupling.
  C. Implement monolithic design.
  D. Implement vertical scaling.
  B. Implement loose coupling.

  ---

  Explanation/Reference:

  Loose coupling between services can also be done through asynchronous integration. It involves one component that generates events and another that consumes them. The two components do not integrate through direct point-to-point interaction, but usually through an intermediate durable storage layer. This approach decouples the two components and introduces additional resiliency. So, for example, if a process that is reading messages from the queue fails, messages can still be added to the queue to be processed when the system recovers.

  Reference: https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

• Question 1627:

  Which AWS Cloud benefit is shown by an architecture's ability to withstand failures with minimal downtime?

  A. Agility
  B. Elasticity
  C. Scalability
  D. High availability
  D. High availability

• Question 1628:

  A company wants to route its traffic directly and privately to a VPC without going over the public internet. Which connectivity option provides this capability?

  A. AWS VPN
  B. AWS Direct Connect
  C. VPC NAT gateway
  D. VPC internet gateway
  D. VPC internet gateway

  ---

  Explanation/Reference:

  Reference: https://aws.amazon.com/vpc/faqs/

• Question 1629:

  Which action will provide documentation to help a company evaluate whether its use of the AWS Cloud is compliant with local regulatory standards?

  A. Running Amazon GuardDuty
  B. Using AWS Artifact
  C. Creating an AWS Support ticket
  D. Evaluating AWS CloudTrail logs
  B. Using AWS Artifact

• Question 1630:

  Which AWS service would identify if unrestricted access to a resource has been allowed by a security group?

  A. AWS Trusted Advisor
  B. Amazon CloudWatch
  C. VPC Flow Logs
  D. AWS CloudTrail
  A. AWS Trusted Advisor

  ---

  Explanation/Reference:

  Reference: https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/