Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 1841:

  Within the AWS shared responsibility model, who is responsible for security and compliance?

  A. The customer is responsible.

  B. AWS is responsible.

  C. AWS and the customer share responsibility.

  D. AWS shares responsibility with the relevant governing body.

  Correct Answer: C

  Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer's operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.

  Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

• Question 1842:

  A company wants to build its new application workloads in the AWS Cloud instead of using on-premises resources. What expense can be reduced using the AWS Cloud?

  A. The cost of writing custom-built Java or Node .js code

  B. Penetration testing for security

  C. hardware required to support new applications

  D. Writing specific test cases for third-party applications.

  Correct Answer: C

  Reference: https://aws.amazon.com/pricing/cost-optimization/

• Question 1843:

  What should users do if they want to install an application in geographically isolated locations?

  A. Install the application using multiple internet gateways.

  B. Deploy the application to an Amazon VPC.

  C. Deploy the application to multiple AWS Regions.

  D. Configure the application using multiple NAT gateways.

  Correct Answer: C

  Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

• Question 1844:

  What is the purpose of AWS Storage Gateway?

  A. It ensures on-premises data storage is 99.999999999% durable.

  B. It transports petabytes of data to and from AWS.

  C. It connects to multiple Amazon EC2 instances.

  D. It connects on-premises data storage to the AWS Cloud.

  Correct Answer: D

  Moving data to the cloud is not quite as simple as flipping a switch. For companies that have managed their own data centers or server rooms for decades, there are a few steps to consider-- and it's not always wise to pull the plug on an internal infrastructure quite so quickly. If a startup uses on-premise business servers and then experiences unexpected growth, abandoning those servers doesn't make sense (even if the long-term plan is to do exactly that).

  AWS Storage Gateway is a way to bridge this gap for companies of any size. It's a hybrid storage option that connects on-premise storage including age-old tape backup systems to the cloud in a way that also provides one console to access all storage configurations.

  Reference: https://www.techradar.com/news/what-is-aws-storage-gateway

• Question 1845:

  A system in the AWS Cloud is designed to withstand the failure of one or more components.

  What is this an example of?

  A. Elasticity

  B. High Availability

  C. Scalability

  D. Agility

  Correct Answer: B

  Reference: https://wa.aws.amazon.com/wat.question.REL_7.en.html

• Question 1846:

  A Cloud Practitioner needs a consistent and dedicated connection between AWS resources and an on-premises system. Which AWS service can fulfill this requirement?

  A. AWS Direct Connect

  B. AWS VPN

  C. Amazon Connect

  D. AWS Data Pipeline

  Correct Answer: A

  You can use AWS Direct Connect to establish a private virtual interface from your on-premise network directly to your Amazon VPC, providing you with a private, high bandwidth network connection between your network and your VPC. With multiple virtual interfaces, you can even establish private connectivity to multiple VPCs while maintaining network isolation.

  Reference: https://aws.amazon.com/directconnect/

• Question 1847:

  What are the immediate benefits of using the AWS Cloud? (Choose two.)

  A. Increased IT staff.

  B. Capital expenses are replaced with variable expenses.

  C. User control of infrastructure.

  D. Increased agility.

  E. AWS holds responsibility for security in the cloud.

  Correct Answer: BD

• Question 1848:

  Which security service automatically recognizes and classifies sensitive data or intellectual property on AWS?

  A. Amazon GuardDuty

  B. Amazon Macie

  C. Amazon Inspector

  D. AWS Shield

  Correct Answer: B

  Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. As organizations manage growing volumes of data, identifying and protecting their sensitive data at scale can become increasingly complex, expensive, and time-consuming. Amazon Macie automates the discovery of sensitive data at scale and lowers the cost of protecting your data. Macie automatically provides an inventory of Amazon S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with AWS accounts outside those you have defined in AWS Organizations. Then, Macie applies machine learning and pattern matching techniques to the buckets you select to identify and alert you to sensitive data, such as personally identifiable information (PII). Macie's alerts, or findings, can be searched and filtered in the AWS Management Console and sent to Amazon EventBridge, formerly called Amazon CloudWatch Events, for easy integration with existing workflow or event management systems, or to be used in combination with AWS services, such as AWS Step Functions to take automated remediation actions. This can help you meet regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and General Data Privacy Regulation (GDPR). You can get started with Amazon Macie by leveraging the 30-day free trial for bucket evaluation. The trial includes 30-days of Amazon S3 bucket inventory and bucket- level security and access control assessment at no cost. Note that sensitive data discovery is not included in the 30day free trial for bucket evaluation. Benefits Discover your sensitive data at scale Amazon Macie uses machine learning and pattern matching to cost efficiently discover sensitive data at scale. Macie automatically detects a large and growing list of sensitive data types, including personal identifiable information (PII) such as names, addresses, and credit card numbers. The service also allows you to define your own custom sensitive data types so you can discover and protect the sensitive data that may be unique to your business or use case. Visibility of your data security posture Amazon Macie gives you constant visibility of the data security and data privacy of your data stored in Amazon S3. Macie automatically and continually evaluates all of your S3 buckets and alerts you to any unencrypted buckets, publicly accessible buckets, or buckets shared with AWS accounts outside those you have defined in the AWS Organizations. Macie provides native multi-account support so you can view your data security posture across your entire S3 environment from a single Macie administrator account. Easy to setup and manage Getting started with Amazon Macie is fast and easy with one-click in the AWS Management Console or a single API call. Macie provides multi-account support using AWS Organizations, so you can enable Macie across all of your accounts with a few clicks. Macie maintains a fully-managed set of sensitive data types, so there is no custom configuration required.

  Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property. It provides you with dashboards and alerts that give visibility into how this data is being accessed or moved.

  Reference: https://docs.aws.amazon.com/macie/latest/userguide/what-is-macie.html

• Question 1849:

  Where can users find a catalog of AWS-recognized providers of third-party security solutions?

  A. AWS Service Catalog

  B. AWS Marketplace

  C. AWS Quick Start

  D. AWS CodeDeploy

  Correct Answer: A

  AWS Service Catalog Delivery Partners are APN Consulting Partners who help create catalogs of IT services that are approved by the customer's organization for use on AWS. With AWS Service Catalog, customers and partners can centrally manage commonly deployed IT services to help achieve consistent governance and meet compliance requirements while enabling users to self-provision approved services.

  Reference: https://aws.amazon.com/servicecatalog/partners/

• Question 1850:

  A Cloud Practitioner needs to store data for 7 years to meet regulatory requirements.

  Which AWS service will meet this requirement at the LOWEST cost?

  A. Amazon S3

  B. AWS Snowball

  C. Amazon Redshift

  D. Amazon S3 Glacier

  Correct Answer: D

  S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once or twice in a year. It is designed for customers-- particularly those in highly-regulated industries, such as the Financial Services, Healthcare, and Public Sectors-- that retain data sets for 7-10 years or longer to meet regulatory compliance requirements. S3 Glacier Deep Archive can also be used for backup and disaster recovery use cases, and is a cost-effective and easy-to-manage alternative to magnetic tape systems, whether they are on-premises libraries or off-premises services.

  Reference: https://aws.amazon.com/s3/storage-classes/