Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 1851:

  A user needs an automated security assessment report that will identify unintended network access to Amazon EC2 instances and vulnerabilities on those instances. Which AWS service will provide this assessment report?

  A. EC2 security groups

  B. AWS Config

  C. Amazon Macie

  D. Amazon Inspector

  Correct Answer: D

  Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed list of security findings prioritized by level of severity. These findings can be reviewed directly or as part of detailed assessment reports which are available via the Amazon Inspector console or API.

  Reference: https://aws.amazon.com/inspector/

• Question 1852:

  How can a company isolate the costs of production and non-production workloads on AWS?

  A. Create Identity and Access Management (IAM) roles for production and non-production workloads.

  B. Use different accounts for production and non-production expenses.

  C. Use Amazon EC2 for non-production workloads and other services for production workloads.

  D. Use Amazon CloudWatch to monitor the use of services.

  Correct Answer: B

  Reference: https://aws.amazon.com/answers/account-management/aws-multi-account-billing-strategy/

• Question 1853:

  Which of the following is an AWS database service?

  A. Amazon Redshift

  B. Amazon Elastic Block Store (Amazon EBS)

  C. Amazon S3 Glacier

  D. AWS Snowball

  Correct Answer: A

  Reference: https://www.sisense.com/glossary/redshift-database/

• Question 1854:

  A Cloud Practitioner must determine if any security groups in an AWS account have been provisioned to allow unrestricted access for specific ports. What is the SIMPLEST way to do this?

  A. Review the inbound rules for each security group in the Amazon EC2 management console to check for port 0.0.0.0/0.

  B. Run AWS Trusted Advisor and review the findings.

  C. Open the AWS IAM console and check the inbound rule filters for open access.

  D. In AWS Config, create a custom rule that invokes an AWS Lambda function to review rules for inbound access.

  Correct Answer: A

  Reference: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html

• Question 1855:

  What are the benefits of developing and running a new application in the AWS Cloud compared to on-premises? (Choose two.)

  A. AWS automatically distributes the data globally for higher durability.

  B. AWS will take care of operating the application.

  C. AWS makes it easy to architect for high availability.

  D. AWS can easily accommodate application demand changes.

  E. AWS takes care application security patching.

  Correct Answer: CD

• Question 1856:

  AWS CloudFormation is designed to help the user:

  A. model and provision resources.

  B. update application code.

  C. set up data lakes.

  D. create reports for billing.

  Correct Answer: A

  AWS CloudFormation provides a common language for you to model and provision AWS and third party application resources in your cloud environment. AWS CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts. This gives you a single source of truth for your AWS and third party resources.

  Reference: https://aws.amazon.com/cloudformation/

• Question 1857:

  A company requires a dedicated network connection between its on-premises servers and the AWS Cloud. Which AWS service should be used?

  A. AWS VPN

  B. AWS Direct Connect

  C. Amazon API Gateway

  D. Amazon Connect

  Correct Answer: B

  You can use AWS Direct Connect to establish a private virtual interface from your on-premise network directly to your Amazon VPC, providing you with a private, high bandwidth network connection between your network and your VPC. With multiple virtual interfaces, you can even establish private connectivity to multiple VPCs while maintaining network isolation.

  Reference: https://aws.amazon.com/directconnect/

• Question 1858:

  Which AWS service can be used to query stored datasets directly from Amazon S3 using standard SQL?

  A. AWS Glue

  B. AWS Data Pipeline

  C. Amazon CloudSearch

  D. Amazon Athena

  Correct Answer: D

  Amazon Athena is defined as "an interactive query service that makes it easy to analyse data directly in Amazon Simple Storage Service (Amazon S3) using standard SQL." So, it's another SQL query engine for large data sets stored in S3. This is very similar to other SQL query engines, such as Apache Drill. But unlike Apache Drill, Athena is limited to data only from Amazon's own S3 storage service. However, Athena is able to query a variety of file formats, including, but not limited to CSV, Parquet, JSON, etc.

• Question 1859:

  Treating infrastructure as code in the AWS Cloud allows users to:

  A. automate migration of on-premises hardware to AWS data centers.

  B. let a third party automate an audit of the AWS infrastructure.

  C. turn over application code to AWS so it can run on the AWS infrastructure.

  D. automate the infrastructure provisioning process.

  Correct Answer: D

  Reference: https://asperbrothers.com/blog/infrastructure-as-code-aws/

• Question 1860:

  A web application running on AWS has been spammed with malicious requests from a recurring set of IP addresses. Which AWS service can help secure the application and block the malicious traffic?

  A. AWS IAM

  B. Amazon GuardDuty

  C. Amazon Simple Notification Service (Amazon SNS)

  D. AWS WAF

  Correct Answer: D

  AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. You can use AWS WAF to define customizable web security rules that control which traffic accesses your web applications. If you use AWS Shield Advanced, you can use AWS WAF at no extra cost for those protected resources and can engage the DRT to create WAF rules.

  Reference: https://aws.amazon.com/answers/networking/aws-ddos-attack-mitigation/