Amazon CLF-C01 Online Practice Questions and Exam Preparation

Amazon CLF-C01 Online Questions & Answers

• Question 2031:

  In which of the following AWS services should database credentials be stored for maximum security?

  A. AWS Identity and Access Management (IAM)
  B. AWS Secrets Manager
  C. Amazon S3
  D. AWS Key Management Service (AWS KMS)
  B. AWS Secrets Manager

  ---

  Explanation/Reference:

  AWS Secrets Manager is a fully managed service that helps you protect access to applications, services, and IT resources. It enables you to store and manage credentials, secrets, and other sensitive information such as database passwords, API keys, and SSH keys. You can also rotate secrets automatically and use fine-grained access control to ensure that only authorized users and applications can access them. AWS Key Management Service (AWS KMS) is a managed service that makes it easy to create and control the encryption keys used to encrypt your data. While AWS KMS can be used to protect sensitive data, it is not specifically designed to store and manage database credentials.

• Question 2032:

  A company is using AWS Organizations to configure AWS accounts.

  Which design principle is a best practice for the company to implement?

  A. Organize accounts based on security and operational needs.
  B. Assign multiple sets of related workloads to each production account.
  C. Deploy workloads to the organization's management account.
  D. Combine production workloads and non-production workloads.
  C. Deploy workloads to the organization's management account.

• Question 2033:

  An application running on Amazon EC2 opens connections to an Amazon RDS SQL Server database The developer does not want to store the user name and password for the database in the code. The developer would also like to automatically rotate the credentials. What is the MOST secure way to store and access the database credentials?

  A. Create an IAM role that has permissions to access the database Attach the role to the EC2 instance
  B. Use AWS Secrets Manager to store the credentials Retrieve the credentials from Secrets Manager as needed
  C. Store the credentials in an encrypted text file in an Amazon S3 bucket Configure the EC2 instance's user data to download the credentials from Amazon S3 as the instance boots.
  D. Store the user name and password credentials directly in the source code No further action is needed because the source code is stored in a private repository
  B. Use AWS Secrets Manager to store the credentials Retrieve the credentials from Secrets Manager as needed

• Question 2034:

  Which AWS service uses machine learning to help discover, monitor, and protect sensitive data that is stored in Amazon S3 buckets?

  A. AWS Shield
  B. Amazon Macie
  C. AWS Network Firewall
  D. Amazon Cognito
  B. Amazon Macie

  ---

  Explanation/Reference:

  https://aws.amazon.com/macie/

  Amazon Macie is a data security and data privacy service that uses machine learning (ML) and pattern matching to discover and protect your sensitive data.

• Question 2035:

  A company needs to reserve a certain amount of Amazon EC2 compute resources in a specific Availability Zone within an AWS Region. Which purchasing option should the company use to meet this requirement?

  A. EC2 Instance Savings Plans
  B. Compute Savings Plans
  C. Regional Reserved Instances
  D. Zonal Reserved Instances
  D. Zonal Reserved Instances

  ---

  Explanation/Reference:

  When you purchase a Reserved Instance, you determine the scope of the Reserved Instance. The scope is either regional or zonal.

  Regional: When you purchase a Reserved Instance for a Region, it's referred to as a regional Reserved Instance.

  Zonal: When you purchase a Reserved Instance for a specific Availability Zone, it's referred to as a zonal Reserved Instance.

• Question 2036:

  Which benefits are included with the AWS Business Support plan? (Select TWO )

  A. 24/7 assistance by way of live chat or a telephone call
  B. Support from a dedicated AWS Technical Account Manager
  C. An unlimited number of cases and contacts
  D. 15-minute response time for production system interruption cases
  E. Annual operational reviews with AWS Solutions Architects
  A. 24/7 assistance by way of live chat or a telephone call
  C. An unlimited number of cases and contacts

• Question 2037:

  A developer created a Lambda function for a web application backend When testing the Lambda function from the AWS Lambda console, the developer can see that the function is being run, but there is no log data being generated in Amazon CloudWatch Logs, even after several minutes.

  What could cause this situation?

  A. The Lambda function does not have any explicit log statements for the log data to send it to CloudWatch Logs
  B. The Lambda function is missing CloudWatch Logs as a source trigger to send log data
  C. The execution role for the Lambda function is missing permissions to write log data to the CloudWatch Logs
  D. The Lambda function is missing a target CloudWatch Log group
  C. The execution role for the Lambda function is missing permissions to write log data to the CloudWatch Logs

• Question 2038:

  A company created an application to consume and process data. The application uses Amazon Simple Queue Service (Amazon SQS) and AWS Lambda functions. The application is currently working as expected, but it occasionally receives

  several messages that it cannot process properly The company needs to clear these messages to prevent the queue from becoming blocked.

  A developer must implement a solution that makes queue processing always operational. The solution must give the company the ability to defer the messages with errors and save these messages for further analysis.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Configure Amazon CloudWatch Logs to save the error messages to a separate log stream
  B. Create a new SQS queue. Set the new queue as a dead-letter queue for the application queue Configure the Maximum Receives setting.
  C. Change the SQS queue to a FIFO queue Configure the message retention penod to 0 seconds
  D. Configure an Amazon CloudWatch alarm for Lambda function errors Publish messages to an Amazon Simple Notification Service (Amazon SNS) topic to notify administrator users
  B. Create a new SQS queue. Set the new queue as a dead-letter queue for the application queue Configure the Maximum Receives setting.

• Question 2039:

  A company runs business applications in an on-premises data center and in the AWS Cloud. The company needs a shared file system that can be available to both environments. Which AWS service meets these requirements?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. Amazon S3
  C. Amazon ElastiCache
  D. Amazon Elastic File System (Amazon EFS)
  D. Amazon Elastic File System (Amazon EFS)

  ---

  Explanation/Reference:

  The correct answer is D, Amazon Elastic File System (Amazon EFS) provides a simple, scalable, and fully managed shared file system that can be accessed from multiple instances across different availability zones, regions, and VPCs. This makes it ideal for hybrid cloud environments where resources are located in both on-premises data centers and the AWS Cloud.

• Question 2040:

  Which actions represent best practices for using AWS IAM? (Choose two.)

  A. Configure a strong password policy
  B. Share the security credentials among users of AWS accounts who are in the same Region
  C. Use access keys to log in to the AWS Management Console
  D. Rotate access keys on a regular basis
  E. Avoid using IAM roles to delegate permissions
  A. Configure a strong password policy
  D. Rotate access keys on a regular basis

  ---

  Explanation/Reference:

  Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html