Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 1961:

  Which of the following is an AWS Well-Architected Framework design principle related to reliability?

  A. Deployment to a single Availability Zone

  B. Ability to recover from failure

  C. Design for cost optimization

  D. Perform operations as code

  Correct Answer: B

  Reference: https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

• Question 1962:

  Which type of AWS storage is ephemeral and is deleted when an instance is stopped or terminated?

  A. Amazon EBS

  B. Amazon EC2 instance store

  C. Amazon EFS

  D. Amazon S3

  Correct Answer: B

  When you stop or terminate an instance, every block of storage in the instance store is reset. Therefore, your data cannot be accessed through the instance store of another instance. Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

• Question 1963:

  What can users access from AWS Artifact?

  A. AWS security and compliance documents

  B. A download of configuration management details for all AWS resources

  C. Training materials for AWS services

  D. A security assessment of the applications deployed in the AWS Cloud

  Correct Answer: A

  You can use AWS Artifact Reports to download AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports. Reference: https://aws.amazon.com/artifact/faq/

• Question 1964:

  What AWS service would be used to centrally manage AWS access across multiple accounts?

  A. AWS Service Catalog

  B. AWS Config

  C. AWS Trusted Advisor

  D. AWS Organizations

  Correct Answer: D

  To improve control over your AWS environment, you can use AWS Organizations to create groups of accounts, and then attach policies to a group to ensure the correct policies are applied across the accounts without requiring custom scripts and manual processes.

  Reference: https://aws.amazon.com/organizations/

• Question 1965:

  Which AWS service can a customer use to set up an alert notification when the account is approaching a particular dollar amount?

  A. AWS Cost and Usage reports

  B. AWS Budgets

  C. AWS Cost Explorer

  D. AWS Trusted Advisor

  Correct Answer: B

  Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html

• Question 1966:

  How can a customer increase security to AWS account logons? (Choose two.)

  A. Configure AWS Certificate Manager

  B. Enable Multi-Factor Authentication (MFA)

  C. Use Amazon Cognito to manage access

  D. Configure a strong password policy

  E. Enable AWS Organizations

  Correct Answer: BC

  Your root account should always be protected by Multi-Factor Authentication (MFA). This additional layer of security helps protect against unauthorized logins to your account by requiring two factors: something you know (a password) and

  something you have (for example, an MFA device). AWS supports virtual and hardware MFA devices and U2F security keys.

  Cognito can be used as an Identity Provider (IdP), where it stores and maintains users and credentials securely for your applications, or it can be integrated with OpenID Connect, SAML, and other popular web identity providers like

  Amazon.com.

  Using Amazon Cognito, you can generate temporary access credentials for your clients to access AWS services, eliminating the need to store long-term credentials in client applications. Reference: https://aws.amazon.com/blogs/security/guidelines-for-protecting-your-aws-account-while-using-programmatic-access/

• Question 1967:

  A company's web application currently has tight dependencies on underlying components, so when one component fails the entire web application fails. Applying which AWS Cloud design principle will address the current design issue?

  A. Implementing elasticity, enabling the application to scale up or scale down as demand changes.

  B. Enabling several EC2 instances to run in parallel to achieve better performance.

  C. Focusing on decoupling components by isolating them and ensuring individual components can function when other components fail.

  D. Doubling EC2 computing resources to increase system fault tolerance.

  Correct Answer: C

• Question 1968:

  A director has been tasked with investigating hybrid cloud architecture. The company currently accesses AWS over the public internet. Which service will facilitate private hybrid connectivity?

  A. Amazon Virtual Private Cloud (Amazon VPC) NAT Gateway

  B. AWS Direct Connect

  C. Amazon Simple Storage Service (Amazon S3) Transfer Acceleration

  D. AWS Web Application Firewall (AWS WAF)

  Correct Answer: B

  Amazon VPC provides multiple network connectivity options for you to leverage depending on your current network designs and requirements. These connectivity options include leveraging either the internet or an AWS Direct Connect connection as the network backbone and terminating the connection into either AWS or user-managed network endpoints. Additionally, with AWS, you can choose how network routing is delivered between Amazon VPC and your networks, leveraging either AWS or user-managed network equipment and routes.

  Reference: https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/introduction.html

• Question 1969:

  What is a benefit of loose coupling as a principle of cloud architecture design?

  A. It facilitates low-latency request handling.

  B. It allows applications to have dependent workflows.

  C. It prevents cascading failures between different components.

  D. It allows companies to focus on their physical data center operations.

  Correct Answer: C

  IT systems should ideally be designed in a way that reduces inter-dependencies. Your components need to be loosely coupled to avoid changes or failure in one of the components from affecting others.

  Your infrastructure also needs to have well defined interfaces that allow the various components to interact with each other only through specific, technology-agnostic interfaces. Modifying any underlying operations without affecting other

  components should be made possible.

  Reference: https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

• Question 1970:

  What does it mean to grant least privilege to AWS IAM users?

  A. It is granting permissions to a single user only.

  B. It is granting permissions using AWS IAM policies only.

  C. It is granting AdministratorAccess policy permissions to trustworthy users.

  D. It is granting only the permissions required to perform a given task.

  Correct Answer: D

  When you create IAM policies, follow the standard security advice of granting least privilege, or granting only the permissions required to perform a task. Determine what users (and roles) need to do and then craft policies that allow them to perform only those tasks.

  Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege