Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 301:

  A company wants to continuously monitor its AWS accounts and workloads for malicious activity. The company also wants to receive detailed security findings for visibility and remediation. Which AWS service should the company use to meet these requirements?

  A. Amazon GuardDuty

  B. AWS Shield

  C. AWS WAP

  D. AWS CloudTrail

  Correct Answer: A

  Secret here is the "workloads for malicious activities" if it was just users it would be CloudTrail which keeps track of AWS Admin activities. Since is workloads and users leveraging ML to guard the account.

• Question 302:

  Which AWS Support plan includes infrastructure event management at no additional cost?

  A. AWS Basic Support

  B. AWS Business Support

  C. AWS Enterprise Support

  D. AWS Developer Support

  Correct Answer: C

  C- Enterprise. Plan https://us-east-1.console.aws.amazon.com/support/plans/home?region=us-east-1#/

• Question 303:

  Which of the following are AWS Cloud design principles? (Choose two.)

  A. Pay for compute resources in advance

  B. Make data driven decisions to determine cloud architectural design

  C. Emphasize manual processes to allow for changes

  D. Test systems at production scale

  E. Refine operational procedures infrequently

  Correct Answer: BD

• Question 304:

  A company needs to receive notification when a deployed workload is using more than a certain percentage of a service quota. Which AWS service should the company use to meet this requirement?

  A. AWS config

  B. AWS CloudTrail

  C. AWS Trusted Advisor

  D. AWS Lambda

  Correct Answer: C

• Question 305:

  A company is using a third-party service to back up 10 TB of data to a tape library. The on-premises backup server is running out of space. The company wants to use AWS services for the backups without changing its existing backup work ows.

  Which AWS service should the company use to meet these requirements?

  A. Amazon Elastic Block Store (Amazon EBS)

  B. AWS Storage Gateway

  C. Amazon Elastic Container Service (Amazon ECS)

  D. AWS Lambda

  Correct Answer: B

  AWS Storage Gateway is a hybrid cloud storage service that enables on-premises applications to use cloud storage. It supports three different types of gateways: file, volume, and tape gateway.

• Question 306:

  A company recently migrated to the AWS Cloud. The company needs to determine whether its newly imported Amazon EC2 instances are the appropriate size and type. Which AWS services can provide this information to the company? (Choose two.)

  A. AWS Auto Scaling

  B. AWS Control Tower

  C. AWS Trusted Advisor

  D. AWS Compute Optimizer

  E. Amazon Forecast

  Correct Answer: CD

  Option C: AWS Trusted Advisor is a service that provides real-time guidance to help optimize AWS resources and improve security and performance. It includes recommendations for cost optimization, security, fault tolerance, and performance improvement. In this case, the company can use the EC2 Instance Size Optimization recommendation to determine whether its imported EC2 instances are the appropriate size.

  Option D: AWS Compute Optimizer is a service that analyzes resource utilization metrics and provides recommendations for the optimal size and types of EC2 instances, as well as the best purchase option (on-demand, reserved, or spot instances) for each workload. The company can use this service to identify which EC2 instances need to be resized or replaced with a different instance type.

• Question 307:

  A user is using AWS account root user credentials to try to close an AWS account that is managed by AWS Organizations. However, the attempt is unsuccessful. What could cause this attempt to be unsuccessful?

  A. No multi-factor authentication (MFA) has been configured.

  B. The root user is not specifically assigned to the administration group.

  C. The root user's password does not meet the minimum password complexity requirements.

  D. The organizational administrator has used a service control policy (SCP) to limit the root user permissions.

  Correct Answer: D

  D. The organizational administrator has used a service control policy (SCP) to limit the root user permissions.

  When an AWS account is managed by AWS Organizations, the root user of the account has limited permissions to perform actions such as closing the account. The organizational administrator can use a service control policy (SCP) to limit the permissions of the root user and prevent them from performing certain actions, including closing the account. Therefore, if the root user is trying to close an AWS account that is managed by AWS Organizations and the attempt is unsuccessful, it is likely because the organizational administrator has used an SCP to limit the root user's permissions

• Question 308:

  A user is using AWS account root user credentials to try to close an AWS account that is managed by AWS Organizations. However, the attempt is unsuccessful. What could cause this attempt to be unsuccessful?

  A. No multi-factor authentication (MFA) has been configured.

  B. The root user is not specifically assigned to the administration group.

  C. The root user's password does not meet the minimum password complexity requirements.

  D. The organizational administrator has used a service control policy (SCP) to limit the root user permissions.

  Correct Answer: D

  D. The organizational administrator has used a service control policy (SCP) to limit the root user permissions.

  When an AWS account is managed by AWS Organizations, the root user of the account has limited permissions to perform actions such as closing the account. The organizational administrator can use a service control policy (SCP) to limit the permissions of the root user and prevent them from performing certain actions, including closing the account. Therefore, if the root user is trying to close an AWS account that is managed by AWS Organizations and the attempt is unsuccessful, it is likely because the organizational administrator has used an SCP to limit the root user's permissions

• Question 309:

  A cloud engineer wants to store data in Amazon S3. The engineer will access some of the data yearly and some of the data daily. Which S3 storage class will meet those requirements MOST cost-effectively?

  A. S3 Standard

  B. S3 Glacier Deep Archive

  C. S3 One Zone-Infrequent Access (S3 One Zone-IA)

  D. S3 Intelligent-Tiering

  Correct Answer: D

  S3 Intelligent-Tiering is a storage class that automatically moves objects between two access tiers (frequent and infrequent) based on changing access patterns and changing data. This means that the data that is accessed yearly can be moved to the infrequent access tier, while the data that is accessed daily can be kept in the frequent access tier.

• Question 310:

  According to the AWS shared responsibility model, which task is the responsibility of the customer?

  A. Protect the global infrastructure that runs all of the services offered in the AWS Cloud.

  B. configure logical access controls for resources, and protect account credentials.

  C. configure the security used by managed services.

  D. Patch and back up Amazon Aurora.

  Correct Answer: B

  B. Configure logical access controls for resources, and protect account credentials.

  According to the AWS shared responsibility model, AWS is responsible for securing the underlying infrastructure that supports the cloud, while the customer is responsible for securing the resources they deploy in the cloud. This means that AWS provides a secure cloud infrastructure, but it is up to the customer to secure the services, applications, and data they use and store in the cloud.