Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 1781:

  Which actions represent best practices for using AWS IAM? (Choose two.)

  A. Configure a strong password policy

  B. Share the security credentials among users of AWS accounts who are in the same Region

  C. Use access keys to log in to the AWS Management Console

  D. Rotate access keys on a regular basis

  E. Avoid using IAM roles to delegate permissions

  Correct Answer: AD

  Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

• Question 1782:

  Which AWS feature or service can be used to capture information about incoming and outgoing traffic in an AWS VPC infrastructure?

  A. AWS Config

  B. VPC Flow Logs

  C. AWS Trusted Advisor

  D. AWS CloudTrail

  Correct Answer: B

  Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

• Question 1783:

  Under the AWS shared responsibility model, the customer manages which of the following? (Choose two.)

  A. Decommissioning of physical storage devices

  B. Security group and ACL configuration

  C. Patch management of an Amazon RDS instance operating system

  D. Controlling physical access to data centers

  E. Patch management of an Amazon EC2 instance operating system

  Correct Answer: BE

  Reference: https://www.whizlabs.com/blog/aws-security-shared-responsibility/

• Question 1784:

  What can assist in evaluating an application for migration to the cloud? (Choose two.)

  A. AWS Trusted Advisor

  B. AWS Professional Services

  C. AWS Systems Manager

  D. AWS Partner Network (APN)

  E. AWS Secrets Manager

  Correct Answer: AD

• Question 1785:

  Which AWS service helps users meet contractual and regulatory compliance requirements for data security by using dedicated hardware appliances within the AWS Cloud?

  A. AWS Secrets Manager

  B. AWS CloudHSM

  C. AWS Key Management Service (AWS KMS)

  D. AWS Directory Service

  Correct Answer: B

  The AWS CloudHSM service helps you meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are designed and validated to government standards for secure key management. CloudHSM allows you to securely generate, store, and manage cryptographic keys used for data encryption in a way that keys are accessible only by you.

  Reference: https://aws.amazon.com/cloudhsm/faqs/

• Question 1786:

  Which AWS service will provide a way to generate encryption keys that can be used to encrypt data? (Choose two.)

  A. Amazon Macie

  B. AWS Certificate Manager

  C. AWS Key Management Service (AWS KMS)

  D. AWS Secrets Manager

  E. AWS CloudHSM

  Correct Answer: CE

  Reference: https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-service-hsm.html https://docs.aws.amazon.com/kms/latest/developerguide/overview.html

• Question 1787:

  A company is planning to migrate from on-premises to the AWS Cloud.

  Which AWS tool or service provides detailed reports on estimated cost savings after migration?

  A. AWS Total Cost of Ownership (TCO) Calculator

  B. Cost Explorer

  C. AWS Budgets

  D. AWS Migration Hub

  Correct Answer: D

  Reference: https://docs.aws.amazon.com/migrationhub/latest/ug/hub-api.pdf (26)

• Question 1788:

  A user must meet compliance and software licensing requirements that state a workload must be hosted on a physical server. Which Amazon EC2 instance pricing option will meet these requirements?

  A. Dedicated Hosts

  B. Dedicated Instances

  C. Spot Instances

  D. Reserved Instances

  Correct Answer: A

  Reference: https://aws.amazon.com/ec2/dedicated-hosts/

• Question 1789:

  A company wants to expand from one AWS Region into a second AWS Region. What does the company need to do to start supporting the new Region?

  A. Contact an AWS Account Manager to sign a new contract

  B. Move an Availability Zone to the new Region

  C. Begin deploying resources in the second Region

  D. Download the AWS Management Console for the new Region

  Correct Answer: C

  B. Move an availability zone into the Region; is suggesting that the customer purchase a building and build a new data center into it (not very cost effective for the customer- considering AWS has already done that and D; Download the AWS management console !!

• Question 1790:

  AWS Enterprise Support users have access to which service or feature that is not available to users with other AWS Support plans?

  A. AWS Trusted Advisor

  B. AWS Support case

  C. Concierge team

  D. Amazon Connect

  Correct Answer: C

  Reference: https://aws.amazon.com/premiumsupport/plans/